summaryrefslogtreecommitdiffstats
path: root/editor/libeditor/crashtests
diff options
context:
space:
mode:
authorMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
committerMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
commit5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree10027f336435511475e392454359edea8e25895d /editor/libeditor/crashtests
parent49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
downloadUXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
Add m-esr52 at 52.6.0
Diffstat (limited to 'editor/libeditor/crashtests')
-rw-r--r--editor/libeditor/crashtests/1057677.html9
-rw-r--r--editor/libeditor/crashtests/1128787.html17
-rw-r--r--editor/libeditor/crashtests/1134545.html22
-rw-r--r--editor/libeditor/crashtests/1158452.html10
-rw-r--r--editor/libeditor/crashtests/1158651.html18
-rw-r--r--editor/libeditor/crashtests/1244894.xhtml21
-rw-r--r--editor/libeditor/crashtests/1272490.html20
-rw-r--r--editor/libeditor/crashtests/1317704.html36
-rw-r--r--editor/libeditor/crashtests/336081-1.xhtml52
-rw-r--r--editor/libeditor/crashtests/336104.html37
-rw-r--r--editor/libeditor/crashtests/382527-1.html58
-rw-r--r--editor/libeditor/crashtests/382778-1.html53
-rw-r--r--editor/libeditor/crashtests/402172-1.html23
-rw-r--r--editor/libeditor/crashtests/403965-1.xhtml7
-rw-r--r--editor/libeditor/crashtests/407074-1.html7
-rw-r--r--editor/libeditor/crashtests/407079-1.html15
-rw-r--r--editor/libeditor/crashtests/407256-1.html23
-rw-r--r--editor/libeditor/crashtests/407277-1.html7
-rw-r--r--editor/libeditor/crashtests/414178-1.html22
-rw-r--r--editor/libeditor/crashtests/418923-1.html19
-rw-r--r--editor/libeditor/crashtests/420439.html30
-rw-r--r--editor/libeditor/crashtests/428489-1.html8
-rw-r--r--editor/libeditor/crashtests/429586-1.html8
-rw-r--r--editor/libeditor/crashtests/430624-1.html14
-rw-r--r--editor/libeditor/crashtests/431086-1.xhtml22
-rw-r--r--editor/libeditor/crashtests/448329-1.html72
-rw-r--r--editor/libeditor/crashtests/448329-2.html21
-rw-r--r--editor/libeditor/crashtests/448329-3.html112
-rw-r--r--editor/libeditor/crashtests/456727-1.html8
-rw-r--r--editor/libeditor/crashtests/456727-2.html8
-rw-r--r--editor/libeditor/crashtests/459613-iframe.html1
-rw-r--r--editor/libeditor/crashtests/459613.html17
-rw-r--r--editor/libeditor/crashtests/467647-1.html19
-rw-r--r--editor/libeditor/crashtests/475132-1.xhtml20
-rw-r--r--editor/libeditor/crashtests/499844-1.html15
-rw-r--r--editor/libeditor/crashtests/503709-1.xhtml11
-rw-r--r--editor/libeditor/crashtests/513375-1.xhtml19
-rw-r--r--editor/libeditor/crashtests/535632-1.xhtml1
-rw-r--r--editor/libeditor/crashtests/574558-1.xhtml15
-rw-r--r--editor/libeditor/crashtests/580151-1.xhtml26
-rw-r--r--editor/libeditor/crashtests/582138-1.xhtml10
-rw-r--r--editor/libeditor/crashtests/612565-1.html17
-rw-r--r--editor/libeditor/crashtests/615015-1.html17
-rw-r--r--editor/libeditor/crashtests/615450-1.html17
-rw-r--r--editor/libeditor/crashtests/633709.xhtml36
-rw-r--r--editor/libeditor/crashtests/636074-1.html18
-rw-r--r--editor/libeditor/crashtests/639736-1.xhtml14
-rw-r--r--editor/libeditor/crashtests/643786-1.html18
-rw-r--r--editor/libeditor/crashtests/650572-1.html18
-rw-r--r--editor/libeditor/crashtests/667321-1.html15
-rw-r--r--editor/libeditor/crashtests/682650-1.html30
-rw-r--r--editor/libeditor/crashtests/713427-1.html9
-rw-r--r--editor/libeditor/crashtests/713427-2.xhtml28
-rw-r--r--editor/libeditor/crashtests/716456-1.html29
-rw-r--r--editor/libeditor/crashtests/759748.html58
-rw-r--r--editor/libeditor/crashtests/761861.html15
-rw-r--r--editor/libeditor/crashtests/762183.html6
-rw-r--r--editor/libeditor/crashtests/766305.html21
-rw-r--r--editor/libeditor/crashtests/766360.html18
-rw-r--r--editor/libeditor/crashtests/766387.html20
-rw-r--r--editor/libeditor/crashtests/766413.html42
-rw-r--r--editor/libeditor/crashtests/766795.html21
-rw-r--r--editor/libeditor/crashtests/766845.xhtml27
-rw-r--r--editor/libeditor/crashtests/767169.html23
-rw-r--r--editor/libeditor/crashtests/768748.html16
-rw-r--r--editor/libeditor/crashtests/768765.html36
-rw-r--r--editor/libeditor/crashtests/769008-1.html23
-rw-r--r--editor/libeditor/crashtests/769967.xhtml16
-rw-r--r--editor/libeditor/crashtests/771749.html21
-rw-r--r--editor/libeditor/crashtests/772282.html27
-rw-r--r--editor/libeditor/crashtests/776323.html18
-rw-r--r--editor/libeditor/crashtests/793866.html21
-rw-r--r--editor/libeditor/crashtests/crashtests.list71
73 files changed, 1699 insertions, 0 deletions
diff --git a/editor/libeditor/crashtests/1057677.html b/editor/libeditor/crashtests/1057677.html
new file mode 100644
index 000000000..d0b9497a5
--- /dev/null
+++ b/editor/libeditor/crashtests/1057677.html
@@ -0,0 +1,9 @@
+<html><body></body><script>
+document.designMode = "on";
+var hrElem = document.createElement("HR");
+var select = window.getSelection();
+document.body.appendChild(hrElem);
+select.collapse(hrElem,0);
+document.execCommand("InsertHTML", false, "<div>foo</div><div>bar</div>");
+</script>
+</html>
diff --git a/editor/libeditor/crashtests/1128787.html b/editor/libeditor/crashtests/1128787.html
new file mode 100644
index 000000000..fc6bff097
--- /dev/null
+++ b/editor/libeditor/crashtests/1128787.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Bug 1128787</title>
+</head>
+<body>
+ <input type="button"/>
+ <script>
+ window.onload = function () {
+ document.designMode = "on";
+ }
+ var input = document.getElementsByTagName("input")[0];
+ input.focus();
+ input.type = "text";
+ </script>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/1134545.html b/editor/libeditor/crashtests/1134545.html
new file mode 100644
index 000000000..4e871804f
--- /dev/null
+++ b/editor/libeditor/crashtests/1134545.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<!-- saved from url=(0065)https://bug1134545.bugzilla.mozilla.org/attachment.cgi?id=8566418 -->
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
+<script>
+
+function boom()
+{
+ textNode = document.createTextNode(" ");
+ x.appendChild(textNode);
+ x.setAttribute('contenteditable', "true");
+ textNode.remove();
+ window.getSelection().selectAllChildren(textNode);
+ document.execCommand("increasefontsize", false, null);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="x" contenteditable="true"></div>
+
+
+</body></html> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/1158452.html b/editor/libeditor/crashtests/1158452.html
new file mode 100644
index 000000000..56c74abd6
--- /dev/null
+++ b/editor/libeditor/crashtests/1158452.html
@@ -0,0 +1,10 @@
+
+<div>
+<div>
+aaaaaaa
+</script>
+<script type="text/javascript">
+document.designMode = "on"
+window.getSelection().modify("extend", "backward", "line")
+document.execCommand("increasefontsize","",null);
+</script>
diff --git a/editor/libeditor/crashtests/1158651.html b/editor/libeditor/crashtests/1158651.html
new file mode 100644
index 000000000..27278b523
--- /dev/null
+++ b/editor/libeditor/crashtests/1158651.html
@@ -0,0 +1,18 @@
+<script>
+onload = function() {
+ var testContainer = document.createElement("span");
+ testContainer.contentEditable = true;
+ document.body.appendChild(testContainer);
+
+ function queryFormatBlock(content)
+ {
+ testContainer.innerHTML = content;
+ while (testContainer.firstChild)
+ testContainer = testContainer.firstChild;
+ window.getSelection().collapse(testContainer, 0);
+ document.queryCommandValue('formatBlock');
+ }
+
+ queryFormatBlock('<ol>hello</ol>');
+};
+</script>
diff --git a/editor/libeditor/crashtests/1244894.xhtml b/editor/libeditor/crashtests/1244894.xhtml
new file mode 100644
index 000000000..89a24751e
--- /dev/null
+++ b/editor/libeditor/crashtests/1244894.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ document.designMode = 'on';
+ document.execCommand("indent", false, null);
+ document.execCommand("insertText", false, "a");
+ document.execCommand("forwardDelete", false, null);
+ document.execCommand("justifyfull", false, null);
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</head>
+
+<body> <span class="v"></span></body><body><input type="file" /></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/1272490.html b/editor/libeditor/crashtests/1272490.html
new file mode 100644
index 000000000..a3c8ecd81
--- /dev/null
+++ b/editor/libeditor/crashtests/1272490.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+window.onload = function () {
+ var childDocument = document.getElementsByTagName("iframe")[0].contentDocument;
+ childDocument.designMode = "on";
+ function onAttrModified(aEvent) {
+ childDocument.removeEventListener("DOMAttrModified", onAttrModified, false);
+ // Remove the editor from document during executing "insertOrderedList".
+ document.body.innerHTML = "";
+ }
+ childDocument.addEventListener("DOMAttrModified", onAttrModified, false);
+ childDocument.execCommand("insertOrderedList", false, "1");
+}
+</script>
+</head>
+<body><iframe></iframe></body>
+</html>
diff --git a/editor/libeditor/crashtests/1317704.html b/editor/libeditor/crashtests/1317704.html
new file mode 100644
index 000000000..64359c796
--- /dev/null
+++ b/editor/libeditor/crashtests/1317704.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script>
+addEventListener('DOMContentLoaded', function(){
+ document.documentElement.className = 'lizard';
+ setTimeout(function(){
+ document.execCommand('selectAll', false, null);
+ document.designMode = 'on';
+ document.execCommand('removeformat', false, null);
+ }, 0);
+});
+</script>
+<style>
+.lizard{
+ -webkit-user-select:all;
+}
+*{
+ position:fixed;
+ display:table-column;
+}
+</style>
+</head>
+<body>
+<span>
+<span contenteditable>
+<span class=lizard></span>
+<span class=lizard></span>
+<span />
+</span>
+</span>
+</span>
+</span>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/336081-1.xhtml b/editor/libeditor/crashtests/336081-1.xhtml
new file mode 100644
index 000000000..da653c601
--- /dev/null
+++ b/editor/libeditor/crashtests/336081-1.xhtml
@@ -0,0 +1,52 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+<![CDATA[
+
+function foop(targetWindow)
+{
+ var targetDocument = targetWindow.document;
+
+ var r1 = targetDocument.createRange();
+ r1.setStart(targetDocument.getElementById("out1"), 0);
+ r1.setEnd (targetDocument.getElementById("out2"), 0);
+ targetWindow.getSelection().addRange(r1);
+
+ var r2 = targetDocument.createRange();
+ r2.setStart(targetDocument.getElementById("in1"), 0);
+ r2.setEnd (targetDocument.getElementById("in2"), 0);
+ targetWindow.getSelection().addRange(r2);
+
+ targetDocument.execCommand('removeformat', false, null);
+ targetDocument.execCommand('outdent', false, null);
+}
+
+function init()
+{
+ setTimeout(function()
+ {
+ var fd = window.frames[0].document;
+ fd.body.appendChild(fd.importNode(document.getElementById('rootish'), true));
+ fd.designMode = 'on';
+ foop(window.frames[0]);
+ document.documentElement.removeAttribute("class");
+ }, 100);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="init()">
+
+<iframe src="data:text/html," style="width: 95%; height: 500px;"/>
+
+<div id="rootish">
+<div id="out1"/>
+<div id="in1"/>
+<div id="in2"/>
+<div id="out2"/>
+</div>
+
+</body>
+</html> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/336104.html b/editor/libeditor/crashtests/336104.html
new file mode 100644
index 000000000..32f11b745
--- /dev/null
+++ b/editor/libeditor/crashtests/336104.html
@@ -0,0 +1,37 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function init()
+{
+ var targetWindow = window.frames[0];
+ var targetDocument = targetWindow.document;
+ var rootish = document.getElementById('rootish');
+
+ targetDocument.body.appendChild(targetDocument.adoptNode(rootish));
+ targetDocument.designMode = 'on';
+
+ targetWindow.getSelection().removeAllRanges();
+
+ var r = targetDocument.createRange();
+ r.setStart(targetDocument.getElementById("start"), 0);
+ r.setEnd (targetDocument.getElementById("endparent").firstChild, 0);
+ targetWindow.getSelection().addRange(r);
+
+ targetDocument.execCommand('outdent', false, null);
+}
+</script>
+
+</head>
+
+<body onload="setTimeout(init, 300);">
+
+<iframe src="data:text/html," style="width: 95%; height: 500px;"></iframe>
+
+<div id="rootish">
+ <div id="start"></div>
+ <p>Huh</p>
+ <svg xmlns="http://www.w3.org/2000/svg" id="endparent"> </svg>
+</div>
+
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/382527-1.html b/editor/libeditor/crashtests/382527-1.html
new file mode 100644
index 000000000..2441dcd87
--- /dev/null
+++ b/editor/libeditor/crashtests/382527-1.html
@@ -0,0 +1,58 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+
+function init1()
+{
+ targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe');
+ targetIframe.src = "data:text/html,";
+ targetIframe.setAttribute("style", "width: 300px; height: 200px; border: 1px dotted green;");
+ targetIframe.addEventListener("load", init2, false);
+ document.body.appendChild(targetIframe);
+}
+
+
+function init2()
+{
+ targetWindow = targetIframe.contentWindow;
+ targetDocument = targetWindow.document;
+
+ var div = document.getElementById("div");
+ textNode = div.firstChild;
+
+ targetDocument.body.appendChild(targetDocument.adoptNode(div, true));
+
+ targetDocument.designMode = 'on';
+ setTimeout(init3, 0);
+}
+
+
+function init3()
+{
+ var rng = targetDocument.createRange();
+ rng.setStart(textNode, 1);
+ rng.setEnd(textNode, 1);
+ targetWindow.getSelection().addRange(rng);
+
+ try {
+ targetDocument.execCommand("inserthtml", false, "<p>");
+ } catch(e) {}
+
+ document.documentElement.removeAttribute("class");
+}
+
+
+</script>
+
+</head>
+
+<body onload="init1();">
+
+<div id="div"> </div>
+
+<script>
+</script>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/382778-1.html b/editor/libeditor/crashtests/382778-1.html
new file mode 100644
index 000000000..960b16630
--- /dev/null
+++ b/editor/libeditor/crashtests/382778-1.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function init1()
+{
+ // Create an html:iframe in HTML mode (so designMode can be used 320092)
+ targetIframe = document.createElementNS('http://www.w3.org/1999/xhtml', 'iframe');
+ targetIframe.src = "data:text/html,";
+ targetIframe.setAttribute("style", "width: 700px; height: 500px; border: 1px dotted green;");
+ targetIframe.addEventListener("load", init2, false);
+ document.body.appendChild(targetIframe);
+}
+
+
+function init2()
+{
+ targetWindow = targetIframe.contentWindow;
+ targetDocument = targetWindow.document;
+
+ p = document.getElementById("p");
+ pText = p.firstChild;
+
+ targetDocument.body.appendChild(targetDocument.adoptNode(p, true));
+
+ targetDocument.designMode = 'on';
+
+ setTimeout(boom, 0);
+}
+
+
+function boom()
+{
+ var rng = targetDocument.createRange();
+ rng.setStart(pText, 3);
+ rng.setEnd(pText, 3);
+
+ targetWindow.getSelection().addRange(rng);
+
+ targetDocument.execCommand("insertorderedlist", false, null);
+
+ document.documentElement.removeAttribute("class")
+}
+
+</script>
+</head>
+
+<body onload="init1();">
+<p id="p">word word</p>
+</body>
+
+</html>
diff --git a/editor/libeditor/crashtests/402172-1.html b/editor/libeditor/crashtests/402172-1.html
new file mode 100644
index 000000000..4022523fa
--- /dev/null
+++ b/editor/libeditor/crashtests/402172-1.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("div").contentEditable = "true";
+ document.getElementById("div").focus();
+ document.getElementById("div").contentEditable = "false";
+
+ document.getElementById("table").contentEditable = "true";
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<table id="table"><td></td></table><div id="div"></div>
+
+</body>
+
+</html>
diff --git a/editor/libeditor/crashtests/403965-1.xhtml b/editor/libeditor/crashtests/403965-1.xhtml
new file mode 100644
index 000000000..02993914d
--- /dev/null
+++ b/editor/libeditor/crashtests/403965-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<tbody contenteditable="true"/>
+<frameset/>
+<xul:box onbeforecopy="event.explicitOriginalTarget.parentNode.parentNode.removeChild(event.explicitOriginalTarget.parentNode)">
+<xul:box/>
+</xul:box>
+</html> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/407074-1.html b/editor/libeditor/crashtests/407074-1.html
new file mode 100644
index 000000000..22f172856
--- /dev/null
+++ b/editor/libeditor/crashtests/407074-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+
+<body onload="try { document.execCommand('inserthtml', false, '0'); } catch(e) { }"><span id="textarea" contenteditable="true">is</span></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/407079-1.html b/editor/libeditor/crashtests/407079-1.html
new file mode 100644
index 000000000..8b0e36cd6
--- /dev/null
+++ b/editor/libeditor/crashtests/407079-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.execCommand("selectAll", false, null);
+ document.execCommand("inserthtml", false, "<p>");
+}
+
+</script>
+</head>
+
+<body onload="boom();"><textarea contenteditable="true"></textarea></body>
+</html>
diff --git a/editor/libeditor/crashtests/407256-1.html b/editor/libeditor/crashtests/407256-1.html
new file mode 100644
index 000000000..824162ac5
--- /dev/null
+++ b/editor/libeditor/crashtests/407256-1.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.addEventListener("DOMNodeInserted", x, false);
+
+ function x()
+ {
+ document.removeEventListener("DOMNodeInserted", x, false);
+ document.execCommand("insertParagraph", false, "");
+ }
+
+ document.execCommand("insertorderedlist", false, "");
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom()"></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/407277-1.html b/editor/libeditor/crashtests/407277-1.html
new file mode 100644
index 000000000..41c6bf280
--- /dev/null
+++ b/editor/libeditor/crashtests/407277-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body style="margin: initial;"
+ contenteditable="true"
+ onload="document.execCommand('outdent', false, null);"></body>
+</html>
diff --git a/editor/libeditor/crashtests/414178-1.html b/editor/libeditor/crashtests/414178-1.html
new file mode 100644
index 000000000..19cc205b9
--- /dev/null
+++ b/editor/libeditor/crashtests/414178-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var table = document.createElement("table");
+ document.body.appendChild(table);
+ table.contentEditable = "true";
+ table.focus();
+ try {
+ // This will throw, since it's attempting to inject a list inside a table
+ document.execCommand("insertunorderedlist", false, null);
+ } catch (e) {}
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/418923-1.html b/editor/libeditor/crashtests/418923-1.html
new file mode 100644
index 000000000..786ea25d9
--- /dev/null
+++ b/editor/libeditor/crashtests/418923-1.html
@@ -0,0 +1,19 @@
+<html><head><script type="text/javascript">
+
+function boom()
+{
+ var dE = document.documentElement;
+ var head = document.getElementsByTagName("head")[0];
+ dE.removeChild(document.body);
+ dE.contentEditable = "true";
+ dE.focus();
+ dE.contentEditable = "false";
+ head.focus();
+ head.contentEditable = "true";
+ try {
+ document.execCommand("selectAll", false, "");
+ } catch(e) {
+ }
+}
+
+</script></head><body onload="boom();"></body></html> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/420439.html b/editor/libeditor/crashtests/420439.html
new file mode 100644
index 000000000..e1303307d
--- /dev/null
+++ b/editor/libeditor/crashtests/420439.html
@@ -0,0 +1,30 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ function x()
+ {
+ document.removeEventListener("DOMAttrModified", x, false);
+ document.execCommand("backcolor", false, "green");
+ }
+
+ document.getElementById("td").focus();
+
+ document.addEventListener("DOMAttrModified", x, false);
+ try {
+ document.execCommand("subscript", false, null);
+ } catch(e) {
+ }
+ document.removeEventListener("DOMAttrModified", x, false);
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="setTimeout(boom, 30);">
+<table><tbody contenteditable="false"><tr><td contenteditable="true" id="td"></td></tr></tbody></table>
+</body>
+
+</html>
diff --git a/editor/libeditor/crashtests/428489-1.html b/editor/libeditor/crashtests/428489-1.html
new file mode 100644
index 000000000..8eec1268b
--- /dev/null
+++ b/editor/libeditor/crashtests/428489-1.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<title>Crash [@ nsHTMLEditor::GetPositionAndDimensions] when window gets removed during click on contenteditable absolute positioned element</title>
+</head>
+<body>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%0A%3Cscript%3E%0Awindow.addEventListener%28%27DOMAttrModified%27%2C%20function%28e%29%20%7Bdump%28%27DOMAttrModified\n%27%29%3Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%3B%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/head%3E%0A%3Cbody%3E%0A%3Cdiv%20style%3D%22position%3A%20absolute%3B%22%20contenteditable%3D%22true%22%3EClicking%20on%20this%20should%20not%20crash%20Mozilla%0A%3C/body%3E%0A%3C/html%3E" style="width:1000px;height: 300px;"></iframe>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/429586-1.html b/editor/libeditor/crashtests/429586-1.html
new file mode 100644
index 000000000..a32df3b72
--- /dev/null
+++ b/editor/libeditor/crashtests/429586-1.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<title>Bug 429586 - Crash [@ nsEditor::EndUpdateViewBatch] with pasting and domattrmodified removing iframe</title>
+</head>
+<body>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%0A%3Chead%3E%0A%3C/head%3E%0A%3Cbody%20contenteditable%3D%22true%22%3E%0A%0A%3Cscript%3E%0Afunction%20dokey%28%29%7B%0Adocument.body.focus%28%29%3B%0Adocument.execCommand%28%27insertParagraph%27%2C%20false%2C%20%27%27%29%3B%0A%7D%0AsetTimeout%28dokey%2C200%29%3B%0A%0Adocument.addEventListener%28%27DOMAttrModified%27%2C%20function%28%29%20%7Bwindow.frameElement.parentNode.removeChild%28window.frameElement%29%7D%2C%20true%29%3B%0A%3C/script%3E%0A%3C/body%3E%0A%3C/html%3E"></iframe>
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/430624-1.html b/editor/libeditor/crashtests/430624-1.html
new file mode 100644
index 000000000..bfa95c662
--- /dev/null
+++ b/editor/libeditor/crashtests/430624-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script>
+function crash() {
+ window.frames[0].onload = null;
+ window.frames[0].location = 'data:text/html;charset=utf-8,2nd%20page';
+}
+</script>
+</head>
+<body onload="crash()">
+ <!-- iframe contents: <html><body onload="document.body.setAttribute('spellcheck', true);"></body></html> -->
+ <iframe src="data:text/html;charset=utf-8;base64,PGh0bWw%2BPGJvZHkgb25sb2FkPSJkb2N1bWVudC5ib2R5LnNldEF0dHJpYnV0ZSgnc3BlbGxjaGVjaycsIHRydWUpOyI%2BPC9ib2R5PjwvaHRtbD4%3D"></iframe>
+</body>
+</html> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/431086-1.xhtml b/editor/libeditor/crashtests/431086-1.xhtml
new file mode 100644
index 000000000..c6c5d8d99
--- /dev/null
+++ b/editor/libeditor/crashtests/431086-1.xhtml
@@ -0,0 +1,22 @@
+<div xmlns="http://www.w3.org/1999/xhtml">
+
+<script type="text/javascript">
+
+function boom()
+{
+ var r = document.documentElement;
+ r.style.position = "absolute";
+ r.contentEditable = "true";
+ r.focus();
+ r.contentEditable = "false";
+ r.focus();
+ r.contentEditable = "true";
+ document.execCommand("subscript", false, null);
+ r.contentEditable = "false";
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+</div>
diff --git a/editor/libeditor/crashtests/448329-1.html b/editor/libeditor/crashtests/448329-1.html
new file mode 100644
index 000000000..99d0f63b3
--- /dev/null
+++ b/editor/libeditor/crashtests/448329-1.html
@@ -0,0 +1,72 @@
+<!DOCTYPE HTML>
+<html><head>
+ <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+ <title>Testcase for bug 448329</title>
+</head>
+<body>
+
+<iframe id="frame448329"></iframe>
+
+<script>
+
+function test448329(id,cmd) {
+
+ var elm = document.getElementById(id);
+ var doc = elm.contentDocument;
+ doc.designMode = "On";
+
+ // Work around getSelection depending on a presshell but not flushing to get
+ // one.
+ doc.body.offsetWidth;
+ var s = doc.defaultView.getSelection();
+
+ // Test document node
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ var range = doc.createRange();
+ range.setStart(doc, 0);
+ range.setEnd(doc, 0);
+ s.addRange(range);
+ doc.queryCommandIndeterm(cmd);
+
+ // Test HTML node
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ range = doc.createRange();
+ range.setStart(doc.documentElement, 0);
+ range.setEnd(doc.documentElement, 0);
+ s.addRange(range);
+ doc.queryCommandIndeterm(cmd);
+
+ // Test BODY node
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ range = doc.createRange();
+ var body = doc.documentElement.childNodes[1];
+ range.setStart(body, 0);
+ range.setEnd(body, 0);
+ s.addRange(range);
+ doc.queryCommandIndeterm(cmd);
+
+ var text = doc.createTextNode("Hello Kitty");
+ body.insertBefore(text, null)
+
+ // Test TEXT node
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ range = doc.createRange();
+ range.setStart(text, 0);
+ range.setEnd(text, 1);
+ s.addRange(range);
+ doc.queryCommandIndeterm(cmd);
+
+}
+
+test448329("frame448329", "backcolor")
+test448329("frame448329", "hilitecolor")
+
+</script>
+
+
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/448329-2.html b/editor/libeditor/crashtests/448329-2.html
new file mode 100644
index 000000000..fd4707b54
--- /dev/null
+++ b/editor/libeditor/crashtests/448329-2.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+ <title>Testcase for bug 448329</title>
+<script>
+function go() {
+ test("myFrame", "backcolor");
+}
+function test(id,cmd) {
+ var doc = document.getElementById(id).contentDocument;
+ doc.designMode = "On";
+
+ var s = doc.defaultView.getSelection();
+ s.removeAllRanges();
+ s.addRange(doc.createRange());
+
+ doc.queryCommandIndeterm(cmd);
+}
+</script>
+</head>
+<body onload="go()"><iframe id="myFrame"></iframe></body>
+</html>
diff --git a/editor/libeditor/crashtests/448329-3.html b/editor/libeditor/crashtests/448329-3.html
new file mode 100644
index 000000000..0a48c1818
--- /dev/null
+++ b/editor/libeditor/crashtests/448329-3.html
@@ -0,0 +1,112 @@
+<!DOCTYPE HTML>
+<html><head>
+ <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+ <title>Testcase #3 for bug 448329</title>
+</head>
+<body>
+
+<iframe id="frame448329"></iframe>
+
+<script>
+
+function test448329(id,cmd,val) {
+
+ var elm = document.getElementById(id);
+ var doc = elm.contentDocument;
+ doc.designMode = "On";
+
+ // Work around getSelection depending on a presshell but not flushing to get
+ // one.
+ doc.body.offsetWidth;
+ var s = doc.defaultView.getSelection();
+
+ // Test document node
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ var range = doc.createRange();
+ range.setStart(doc, 0);
+ range.setEnd(doc, 0);
+ s.addRange(range);
+ doc.execCommand(cmd,false,val);
+
+ // Test HTML node
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ range = doc.createRange();
+ range.setStart(doc.documentElement, 0);
+ range.setEnd(doc.documentElement, 0);
+ s.addRange(range);
+ doc.execCommand(cmd,false,val);
+
+ // Test BODY node
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ range = doc.createRange();
+ var body = doc.documentElement.childNodes[1];
+ range.setStart(body, 0);
+ range.setEnd(body, 0);
+ s.addRange(range);
+ doc.execCommand(cmd,false,val);
+
+ var text = doc.createTextNode("Hello Kitty");
+ body.insertBefore(text, null)
+
+ // Test TEXT node
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ range = doc.createRange();
+ range.setStart(text, 0);
+ range.setEnd(text, 1);
+ s.addRange(range);
+ doc.execCommand(cmd,false,val);
+
+ // Test BODY[0,0] + TEXT node
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ range = doc.createRange();
+ range.setStart(body, 0);
+ range.setEnd(body, 0);
+ s.addRange(range);
+ range = doc.createRange();
+ range.setStart(text, 0);
+ range.setEnd(text, 1);
+ s.addRange(range);
+ doc.execCommand(cmd,false,val);
+
+ // Test BODY[0,1] + TEXT node
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ range = doc.createRange();
+ range.setStart(body, 0);
+ range.setEnd(body, 1);
+ s.addRange(range);
+ range = doc.createRange();
+ range.setStart(text, 0);
+ range.setEnd(text, 1);
+ s.addRange(range);
+ doc.execCommand(cmd,false,val);
+
+ // Test BODY[0,1] + TEXT node without a parent
+ if (s.rangeCount > 0)
+ s.removeAllRanges();
+ range = doc.createRange();
+ range.setStart(body, 0);
+ range.setEnd(body, 1);
+ s.addRange(range);
+ range = doc.createRange();
+ text = doc.createTextNode("Hello Kitty"); // not in doc
+ range.setStart(text, 0);
+ range.setEnd(text, 1);
+ s.addRange(range);
+ doc.execCommand(cmd,false,val);
+
+}
+
+test448329("frame448329", "backcolor", "green")
+test448329("frame448329", "hilitecolor", "green")
+
+</script>
+
+
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/456727-1.html b/editor/libeditor/crashtests/456727-1.html
new file mode 100644
index 000000000..d14422c93
--- /dev/null
+++ b/editor/libeditor/crashtests/456727-1.html
@@ -0,0 +1,8 @@
+<html>
+<BODY onload="
+document.designMode='on';
+document.replaceChild(document.createElement('HTML'), document.firstChild);
+document.queryCommandValue('backcolor');
+">
+</body>
+</html> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/456727-2.html b/editor/libeditor/crashtests/456727-2.html
new file mode 100644
index 000000000..1c8fe5db9
--- /dev/null
+++ b/editor/libeditor/crashtests/456727-2.html
@@ -0,0 +1,8 @@
+<html>
+<BODY onload="
+document.designMode='on';
+document.removeChild(document.firstChild);
+document.queryCommandState('BackColor');
+">
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/459613-iframe.html b/editor/libeditor/crashtests/459613-iframe.html
new file mode 100644
index 000000000..9f6e558d0
--- /dev/null
+++ b/editor/libeditor/crashtests/459613-iframe.html
@@ -0,0 +1 @@
+<html><body><textarea>notaword</textarea></body></html>
diff --git a/editor/libeditor/crashtests/459613.html b/editor/libeditor/crashtests/459613.html
new file mode 100644
index 000000000..7a335f22e
--- /dev/null
+++ b/editor/libeditor/crashtests/459613.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function finish() {
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body>
+
+<iframe src="459613-iframe.html" onload="finish();"></iframe>
+
+</body>
+</html>
diff --git a/editor/libeditor/crashtests/467647-1.html b/editor/libeditor/crashtests/467647-1.html
new file mode 100644
index 000000000..7bb4271d7
--- /dev/null
+++ b/editor/libeditor/crashtests/467647-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("s").focus();
+ try {
+ document.execCommand("insertorderedlist", false, null);
+ } catch(e) { }
+}
+
+</script>
+</head>
+
+<body onload="boom();"><span id="s" contenteditable="true">One<div></div></span><marquee></marquee></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/475132-1.xhtml b/editor/libeditor/crashtests/475132-1.xhtml
new file mode 100644
index 000000000..8b4dd688c
--- /dev/null
+++ b/editor/libeditor/crashtests/475132-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementsByTagName("td")[0].contentEditable = "true";
+ document.getElementsByTagName("td")[0].focus();
+ document.documentElement.contentEditable = "true";
+ document.documentElement.focus();
+ document.execCommand("indent", false, null);
+ document.execCommand("insertParagraph", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();" contenteditable="false"><td></td></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/499844-1.html b/editor/libeditor/crashtests/499844-1.html
new file mode 100644
index 000000000..4fa509c4a
--- /dev/null
+++ b/editor/libeditor/crashtests/499844-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.body.contentEditable = "true";
+ document.execCommand("outdent", false, null);
+}
+
+</script>
+</head>
+
+<body style="word-spacing: 3px;" onload="boom();"> &#x0301;</body>
+</html>
diff --git a/editor/libeditor/crashtests/503709-1.xhtml b/editor/libeditor/crashtests/503709-1.xhtml
new file mode 100644
index 000000000..867bebf1a
--- /dev/null
+++ b/editor/libeditor/crashtests/503709-1.xhtml
@@ -0,0 +1,11 @@
+<html contenteditable="true" xmlns="http://www.w3.org/1999/xhtml"><head><script>
+
+function boom()
+{
+ document.execCommand("selectAll", false, "");
+ try { document.execCommand("justifyfull", false, null); } catch(e) { }
+ try { document.execCommand("inserthorizontalrule", false, "false"); } catch(e) { }
+ document.execCommand("delete", false, null);
+}
+
+</script></head>x y z<body onload="boom();"><div/></body></html>
diff --git a/editor/libeditor/crashtests/513375-1.xhtml b/editor/libeditor/crashtests/513375-1.xhtml
new file mode 100644
index 000000000..25e5e1c34
--- /dev/null
+++ b/editor/libeditor/crashtests/513375-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head contenteditable="true">
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+ var r = document.createRange();
+ r.selectNode(document.body);
+ r.deleteContents();
+ try { document.execCommand("selectAll", false, null); } catch(e) { }
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();" contenteditable="true"></body>
+</html>
diff --git a/editor/libeditor/crashtests/535632-1.xhtml b/editor/libeditor/crashtests/535632-1.xhtml
new file mode 100644
index 000000000..92470b825
--- /dev/null
+++ b/editor/libeditor/crashtests/535632-1.xhtml
@@ -0,0 +1 @@
+<body xmlns="http://www.w3.org/1999/xhtml" style="margin: 200px;" contenteditable="true" onload="document.execCommand('outdent', false, null);" /> \ No newline at end of file
diff --git a/editor/libeditor/crashtests/574558-1.xhtml b/editor/libeditor/crashtests/574558-1.xhtml
new file mode 100644
index 000000000..6aac47072
--- /dev/null
+++ b/editor/libeditor/crashtests/574558-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head><script>
+<![CDATA[
+
+function boom()
+{
+ document.execCommand("selectAll", false, null);
+ document.execCommand("selectAll", false, null);
+ document.execCommand("inserthtml", false, "<span><div>");
+ var textarea = document.getElementById("textarea");
+ var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+ textarea.appendChild(span);
+}
+
+]]>
+</script></head><div contenteditable="true"></div><body onload="boom();"><textarea id="textarea">f</textarea></body></html>
diff --git a/editor/libeditor/crashtests/580151-1.xhtml b/editor/libeditor/crashtests/580151-1.xhtml
new file mode 100644
index 000000000..379941111
--- /dev/null
+++ b/editor/libeditor/crashtests/580151-1.xhtml
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+var t;
+
+function boom()
+{
+ var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ t = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+ b.appendChild(t);
+ document.removeChild(document.documentElement)
+ document.appendChild(b)
+ document.removeChild(document.documentElement)
+ var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "script");
+ var nt = document.createTextNode("t.appendChild(document.createTextNode(' '));");
+ ns.appendChild(nt);
+ b.appendChild(ns);
+ document.appendChild(b);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/582138-1.xhtml b/editor/libeditor/crashtests/582138-1.xhtml
new file mode 100644
index 000000000..afcec2eba
--- /dev/null
+++ b/editor/libeditor/crashtests/582138-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><mtr xmlns="http://www.w3.org/1998/Math/MathML"><td id="cell" xmlns="http://www.w3.org/1999/xhtml"></td></mtr><script>
+function boom()
+{
+ document.getElementById("cell").contentEditable = true;
+ document.getElementById("cell").focus();
+ document.execCommand("inserthtml", false, "x");
+}
+
+window.addEventListener("load", boom, false);
+</script></html>
diff --git a/editor/libeditor/crashtests/612565-1.html b/editor/libeditor/crashtests/612565-1.html
new file mode 100644
index 000000000..1b059aa66
--- /dev/null
+++ b/editor/libeditor/crashtests/612565-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+ <body>
+ <iframe></iframe>
+ </body>
+ <script>
+ onload = function() {
+ var i = document.querySelector("iframe");
+ var doc = i.contentDocument;
+ doc.body.appendChild(doc.createTextNode("foo"));
+ doc.designMode = "on";
+ while (doc.body.firstChild) {
+ doc.body.removeChild(doc.body.firstChild);
+ }
+ };
+ </script>
+</html>
diff --git a/editor/libeditor/crashtests/615015-1.html b/editor/libeditor/crashtests/615015-1.html
new file mode 100644
index 000000000..a383f9e75
--- /dev/null
+++ b/editor/libeditor/crashtests/615015-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("j").focus();
+ try {
+ document.execCommand("insertunorderedlist", false, null);
+ } catch(e) { }
+}
+
+</script>
+</head>
+<body onload="boom();"><span><span contenteditable id="j"></span>T</span></body>
+</html>
diff --git a/editor/libeditor/crashtests/615450-1.html b/editor/libeditor/crashtests/615450-1.html
new file mode 100644
index 000000000..fb36bddc9
--- /dev/null
+++ b/editor/libeditor/crashtests/615450-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.appendChild(document.body);
+ document.documentElement.contentEditable = "false";
+ try { document.execCommand("outdent", false, null); } catch(e) { }
+ document.body.contentEditable = "true";
+ try { document.execCommand("inserthtml", false, "x"); } catch(e) { }
+}
+
+</script>
+</head>
+<body onload="boom();"><div style="margin-left: 40px;"><span contenteditable="true">p q r s</span> T</div></body></html>
diff --git a/editor/libeditor/crashtests/633709.xhtml b/editor/libeditor/crashtests/633709.xhtml
new file mode 100644
index 000000000..139389001
--- /dev/null
+++ b/editor/libeditor/crashtests/633709.xhtml
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<body><div contenteditable="true"></div><div><input id="i"><div></div></input></div></body>
+
+<script id="s">
+<![CDATA[
+
+function boom()
+{
+ document.getElementById("i").focus();
+
+ try { document.execCommand("stylewithcss", false, "true") } catch(e) { }
+ try { document.execCommand("inserthtml", false, "<x>X</x>"); } catch(e) { }
+ try { document.execCommand("underline", false, null); } catch(e) { }
+ try { document.execCommand("justifyfull", false, null); } catch(e) { }
+ try { document.execCommand("underline", false, null); } catch(e) { }
+ try { document.execCommand("insertParagraph", false, null); } catch(e) { }
+ try { document.execCommand("delete", false, null); } catch(e) { }
+
+ try { document.execCommand("stylewithcss", false, "false") } catch(e) { }
+ try { document.execCommand("inserthtml", false, "<x>X</x>"); } catch(e) { }
+ try { document.execCommand("underline", false, null); } catch(e) { }
+ try { document.execCommand("justifyfull", false, null); } catch(e) { }
+ try { document.execCommand("underline", false, null); } catch(e) { }
+ try { document.execCommand("insertParagraph", false, null); } catch(e) { }
+ try { document.execCommand("delete", false, null); } catch(e) { }
+
+ document.documentElement.removeAttribute("class");
+}
+
+setTimeout(boom, 10);
+
+]]>
+</script>
+
+</html>
diff --git a/editor/libeditor/crashtests/636074-1.html b/editor/libeditor/crashtests/636074-1.html
new file mode 100644
index 000000000..e99c42ea6
--- /dev/null
+++ b/editor/libeditor/crashtests/636074-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("i").focus();
+ document.documentElement.contentEditable = "true";
+ document.execCommand("inserthtml", false, "<table>");
+ document.execCommand("indent", false, null);
+ document.execCommand("delete", false, null);
+}
+
+</script>
+</head>
+<body onload="boom();"><input id="i"></body>
+</html>
diff --git a/editor/libeditor/crashtests/639736-1.xhtml b/editor/libeditor/crashtests/639736-1.xhtml
new file mode 100644
index 000000000..4692daee7
--- /dev/null
+++ b/editor/libeditor/crashtests/639736-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ try { document.execCommand("removeformat", false, null); } catch(e) { }
+ document.adoptNode(document.documentElement);
+}
+
+</script>
+</head>
+<body onload="boom();"><td contenteditable="true" /></body>
+</html>
diff --git a/editor/libeditor/crashtests/643786-1.html b/editor/libeditor/crashtests/643786-1.html
new file mode 100644
index 000000000..3f0b27a54
--- /dev/null
+++ b/editor/libeditor/crashtests/643786-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var f = document.getElementById("f");
+ var fw = f.contentWindow;
+ fw.document.designMode = 'on';
+ f.style.content = "'m'";
+ fw.document.removeChild(fw.document.documentElement)
+}
+
+</script>
+</head>
+<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body>
+</html>
diff --git a/editor/libeditor/crashtests/650572-1.html b/editor/libeditor/crashtests/650572-1.html
new file mode 100644
index 000000000..a86f6e618
--- /dev/null
+++ b/editor/libeditor/crashtests/650572-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ document.getElementById("d").focus();
+ document.getElementById("b").style.display = "inline";
+ document.getElementById("c").contentEditable = "false";
+}
+
+</script>
+</head>
+<body contenteditable="true" id="b" onload="setTimeout(boom, 200);"><div id="c"><input id="d"></div></body>
+</html>
+
diff --git a/editor/libeditor/crashtests/667321-1.html b/editor/libeditor/crashtests/667321-1.html
new file mode 100644
index 000000000..275269522
--- /dev/null
+++ b/editor/libeditor/crashtests/667321-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.body.style.cssFloat = "left";
+ document.createElement("div").appendChild(document.querySelector("legend"));
+}
+
+</script>
+</head>
+<body onload="boom();"><fieldset><legend></legend><textarea></textarea></fieldset></body>
+</html>
diff --git a/editor/libeditor/crashtests/682650-1.html b/editor/libeditor/crashtests/682650-1.html
new file mode 100644
index 000000000..66ebc2f62
--- /dev/null
+++ b/editor/libeditor/crashtests/682650-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function repeatChar(s, n)
+{
+ while (s.length < n)
+ s += s;
+ return s.substr(0, n);
+}
+
+function boom()
+{
+ document.documentElement.contentEditable = "true";
+ document.execCommand("inserthtml", false, "<button><\/button>");
+ document.execCommand("inserthtml", false, repeatChar("i", 34646));
+ document.execCommand("contentReadOnly", false, null);
+ document.execCommand("removeformat", false, null);
+ document.execCommand("hilitecolor", false, "red");
+ document.execCommand("inserthtml", false, "a");
+ document.execCommand("delete", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/713427-1.html b/editor/libeditor/crashtests/713427-1.html
new file mode 100644
index 000000000..21da24693
--- /dev/null
+++ b/editor/libeditor/crashtests/713427-1.html
@@ -0,0 +1,9 @@
+<span>
+<script contenteditable="true"></script>
+<blockquote>
+<input>
+<code style="display: table-row;">
+<html contenteditable="true">
+</blockquote>
+
+
diff --git a/editor/libeditor/crashtests/713427-2.xhtml b/editor/libeditor/crashtests/713427-2.xhtml
new file mode 100644
index 000000000..b04a5d773
--- /dev/null
+++ b/editor/libeditor/crashtests/713427-2.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+ while (document.documentElement.firstChild) {
+ document.documentElement.removeChild(document.documentElement.firstChild);
+ }
+
+ var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+ td.setAttributeNS(null, "contenteditable", "true");
+ (document.documentElement).appendChild(td);
+ var head = document.createElementNS("http://www.w3.org/1999/xhtml", "head");
+ (document.documentElement).appendChild(head);
+
+ head.appendChild(td);
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/editor/libeditor/crashtests/716456-1.html b/editor/libeditor/crashtests/716456-1.html
new file mode 100644
index 000000000..a5ef5a2cc
--- /dev/null
+++ b/editor/libeditor/crashtests/716456-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var div = document.querySelector("div");
+ div.contentEditable = "true";
+ div.focus();
+
+ var r = document.documentElement;
+ document["removeChild"](r);
+ document["appendChild"](r);
+
+ setTimeout(function() {
+ getSelection().collapse(div, 0);
+ document.execCommand("inserthtml", false, "a");
+ setTimeout(function() {
+ document.documentElement.removeAttribute("class");
+ }, 0);
+ }, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div></div></body>
+</html>
diff --git a/editor/libeditor/crashtests/759748.html b/editor/libeditor/crashtests/759748.html
new file mode 100644
index 000000000..1e85a3877
--- /dev/null
+++ b/editor/libeditor/crashtests/759748.html
@@ -0,0 +1,58 @@
+<!doctype html>
+<body>
+<script>
+var cmds = {
+ bold: "",
+ italic: "",
+ underline: "",
+ strikethrough: "",
+ subscript: "",
+ superscript: "",
+ cut: "",
+ copy: "",
+ paste: "",
+ delete: "",
+ forwarddelete: "",
+ selectall: "",
+ undo: "",
+ redo: "",
+ indent: "",
+ outdent: "",
+ backcolor: "#888888",
+ forecolor: "#888888",
+ hilitecolor: "#888888",
+ fontname: "Courier",
+ fontsize: "6",
+ increasefontsize: "",
+ decreasefontsize: "",
+ inserthorizontalrule: "",
+ createlink: "foo",
+ insertimage: "foo",
+ inserthtml: "foo",
+ inserttext: "foo",
+ insertparagraph: "",
+ gethtml: "",
+ justifyleft: "",
+ justifyright: "",
+ justifycenter: "",
+ justifyfull: "",
+ removeformat: "",
+ unlink: "",
+ insertorderedlist: "",
+ insertunorderedlist: "",
+ formatblock: "h1",
+ heading: "h1",
+ stylewithcss: "true",
+ usecss: "true",
+ contentreadonly: "true",
+ readonly: "true",
+ insertbronreturn: "true",
+ enableobjectresizing: "true",
+ enableinlinetableediting: "true",
+};
+for (var k in cmds) {
+ document.body.innerHTML = "<div contenteditable>abc</div>";
+ getSelection().removeAllRanges();
+ try { document.execCommand(k, false, cmds[k]) } catch(e) {}
+}
+</script>
diff --git a/editor/libeditor/crashtests/761861.html b/editor/libeditor/crashtests/761861.html
new file mode 100644
index 000000000..0c1f3f521
--- /dev/null
+++ b/editor/libeditor/crashtests/761861.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<script>
+function boom() {
+ var r = document.documentElement;
+ while (r.firstChild) {
+ r.removeChild(r.firstChild);
+ }
+
+ document.documentElement.contentEditable = "true";
+ document.documentElement.appendChild(document.createElement("span"));
+ document.documentElement.firstChild.appendChild(document.createTextNode("_"));
+ document.execCommand("forwarddelete");
+}
+</script>
+<body onload="boom()">
diff --git a/editor/libeditor/crashtests/762183.html b/editor/libeditor/crashtests/762183.html
new file mode 100644
index 000000000..1916ac6fb
--- /dev/null
+++ b/editor/libeditor/crashtests/762183.html
@@ -0,0 +1,6 @@
+<body contenteditable=true>x y
+<script>
+document.body.firstChild.splitText(2).splitText(1).splitText(1);
+getSelection().collapse(document.body, 1);
+document.execCommand("forwardDelete", false, null);
+</script>
diff --git a/editor/libeditor/crashtests/766305.html b/editor/libeditor/crashtests/766305.html
new file mode 100644
index 000000000..a5000fe73
--- /dev/null
+++ b/editor/libeditor/crashtests/766305.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var s = "x";
+ for (var i = 0; i < 15; ++i)
+ s = s + s;
+ var t = document.createTextNode(s);
+ document.body.appendChild(t);
+ window.getSelection().collapse(t, s.length);
+ document.execCommand("insertText", false, "a");
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/766360.html b/editor/libeditor/crashtests/766360.html
new file mode 100644
index 000000000..76c30456d
--- /dev/null
+++ b/editor/libeditor/crashtests/766360.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var r = document.createRange();
+ r.setEnd(document.createTextNode("x"), 0);
+ window.getSelection().addRange(r);
+ document.execCommand("inserthtml", false, "y");
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/766387.html b/editor/libeditor/crashtests/766387.html
new file mode 100644
index 000000000..20ccc60d4
--- /dev/null
+++ b/editor/libeditor/crashtests/766387.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ window.getSelection().removeAllRanges();
+ var r = document.createRange();
+ r.setStart(document.getElementById("x"), 1);
+ r.setEnd(document.getElementById("y"), 0);
+ window.getSelection().addRange(r);
+ document.execCommand("insertorderedlist", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div id="x" contenteditable="true">a</div><div id="y" contenteditable="true"></div></body>
+</html>
diff --git a/editor/libeditor/crashtests/766413.html b/editor/libeditor/crashtests/766413.html
new file mode 100644
index 000000000..c5d9835e3
--- /dev/null
+++ b/editor/libeditor/crashtests/766413.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var root = document.documentElement;
+ while (root.firstChild) {
+ root.removeChild(root.firstChild);
+ }
+
+ var space = document.createTextNode(" ");
+ var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ root.contentEditable = "true";
+ root.focus();
+ document.execCommand("contentReadOnly", false, null);
+ root.appendChild(body);
+ root.contentEditable = "false";
+ root.appendChild(space);
+ root.removeChild(body);
+ root.contentEditable = "true";
+
+ window.getSelection().removeAllRanges();
+ var r1 = document.createRange();
+ r1.setStart(root, 0);
+ r1.setEnd(root, 0);
+ window.getSelection().addRange(r1);
+ looseText = document.createTextNode("c");
+ var r2 = document.createRange();
+ r2.setStart(looseText, 0);
+ r2.setEnd(looseText, 0);
+ window.getSelection().addRange(r2);
+
+ document.execCommand("forwardDelete", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/766795.html b/editor/libeditor/crashtests/766795.html
new file mode 100644
index 000000000..b4ade3020
--- /dev/null
+++ b/editor/libeditor/crashtests/766795.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var fragEl = document.createElement("span");
+ fragEl.setAttribute("contenteditable", "true");
+ fragEl.setAttribute("style", "position: absolute;");
+
+ var frag = document.createDocumentFragment();
+ frag.appendChild(fragEl);
+
+ window.getSelection().selectAllChildren(fragEl);
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/766845.xhtml b/editor/libeditor/crashtests/766845.xhtml
new file mode 100644
index 000000000..409e21010
--- /dev/null
+++ b/editor/libeditor/crashtests/766845.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+ window.getSelection().removeAllRanges();
+ var r1 = document.createRange();
+ r1.setStart(document.body, 0);
+ r1.setEnd (document.body, 1);
+ window.getSelection().addRange(r1);
+ var r2 = document.createRange();
+ r2.setStart(document.body, 1);
+ r2.setEnd (document.body, 2);
+ window.getSelection().addRange(r2);
+ if (document.queryCommandEnabled("inserthtml"))
+ document.execCommand("inserthtml", false, "1");
+}
+
+]]>
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"><div></div><div></div></body>
+
+</html>
diff --git a/editor/libeditor/crashtests/767169.html b/editor/libeditor/crashtests/767169.html
new file mode 100644
index 000000000..3dfad160c
--- /dev/null
+++ b/editor/libeditor/crashtests/767169.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+
+// Document must not have a doctype to trigger the bug
+
+function boom()
+{
+ var root = document.documentElement;
+ while (root.firstChild) { root.removeChild(root.firstChild); }
+ root.contentEditable = "true";
+ document.removeChild(root);
+ document.appendChild(root);
+ window.getSelection().collapse(root, 0);
+ window.getSelection().extend(document, 1);
+ document.removeChild(root);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/768748.html b/editor/libeditor/crashtests/768748.html
new file mode 100644
index 000000000..09206dce3
--- /dev/null
+++ b/editor/libeditor/crashtests/768748.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+<script>
+
+function boom()
+{
+ var looseText = document.createTextNode("x");
+ window.getSelection().collapse(looseText, 0);
+ document.queryCommandState("insertorderedlist");
+}
+
+</script>
+</head>
+<body onload="setTimeout(boom, 0)"></body>
+</html>
diff --git a/editor/libeditor/crashtests/768765.html b/editor/libeditor/crashtests/768765.html
new file mode 100644
index 000000000..060e5161b
--- /dev/null
+++ b/editor/libeditor/crashtests/768765.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var root = document.documentElement;
+
+ while (root.firstChild) { root.removeChild(root.firstChild); }
+
+ var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ root.contentEditable = "true";
+ root.appendChild(div);
+ root.removeChild(div);
+ root.insertBefore(body, root.firstChild);
+
+ window.getSelection().removeAllRanges();
+ var r0 = document.createRange();
+ r0.setStart(body, 0);
+ r0.setEnd(body, 0);
+ window.getSelection().addRange(r0);
+ var r1 = document.createRange();
+ r1.setStart(div, 0);
+ r1.setEnd(div, 0);
+ window.getSelection().addRange(r1);
+
+ document.execCommand("inserthtml", false, "1");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/769008-1.html b/editor/libeditor/crashtests/769008-1.html
new file mode 100644
index 000000000..8ea8a3601
--- /dev/null
+++ b/editor/libeditor/crashtests/769008-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var x = document.getElementById("x");
+
+ window.getSelection().removeAllRanges();
+
+ var range = document.createRange();
+ range.setStart(x, 0);
+ range.setEnd(x, 0);
+ window.getSelection().addRange(range);
+
+ document.execCommand("delete", false, "null");
+}
+
+</script>
+</head>
+<body contenteditable="true" onload="boom();"><div></div><span id="x"></span></body>
+</html>
diff --git a/editor/libeditor/crashtests/769967.xhtml b/editor/libeditor/crashtests/769967.xhtml
new file mode 100644
index 000000000..724f6b899
--- /dev/null
+++ b/editor/libeditor/crashtests/769967.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" contenteditable="true" style="-moz-user-select: all;"><sub>x</sub><script>
+function boom()
+{
+ window.getSelection().removeAllRanges();
+ var r = document.createRange();
+ r.setStart(document.documentElement, 0);
+ r.setEnd(document.documentElement, 0);
+ window.getSelection().addRange(r);
+
+ document.execCommand("subscript", false, null);
+ document.execCommand("insertText", false, "y");
+}
+
+window.addEventListener("load", boom, false);
+
+</script></html>
diff --git a/editor/libeditor/crashtests/771749.html b/editor/libeditor/crashtests/771749.html
new file mode 100644
index 000000000..9237364f2
--- /dev/null
+++ b/editor/libeditor/crashtests/771749.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var root = document.documentElement;
+ root.contentEditable = "true";
+ document.removeChild(root);
+ document.appendChild(root);
+ document.execCommand("insertunorderedlist", false, null);
+ document.execCommand("inserthtml", false, "<span></span>");
+ document.execCommand("outdent", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/772282.html b/editor/libeditor/crashtests/772282.html
new file mode 100644
index 000000000..f6259b344
--- /dev/null
+++ b/editor/libeditor/crashtests/772282.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var root = document.documentElement;
+ while(root.firstChild) { root.removeChild(root.firstChild); }
+ var body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ body.setAttributeNS(null, "contenteditable", "true");
+ var img = document.createElementNS("http://www.w3.org/1999/xhtml", "img");
+ body.appendChild(img);
+ root.appendChild(body);
+ document.removeChild(root);
+ document.appendChild(root);
+ document.execCommand("insertText", false, "5");
+ document.execCommand("selectAll", false, null);
+ document.execCommand("insertParagraph", false, null);
+ document.execCommand("increasefontsize", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/776323.html b/editor/libeditor/crashtests/776323.html
new file mode 100644
index 000000000..9fc2776c3
--- /dev/null
+++ b/editor/libeditor/crashtests/776323.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+<script>
+
+function boom()
+{
+ document.execCommand("inserthtml", false, "b");
+ var myrange = document.createRange();
+ myrange.selectNodeContents(document.getElementsByTagName("img")[0]);
+ window.getSelection().addRange(myrange);
+ document.execCommand("strikethrough", false, null);
+}
+
+</script>
+</head>
+<body onload="boom();"><img></body>
+</html>
diff --git a/editor/libeditor/crashtests/793866.html b/editor/libeditor/crashtests/793866.html
new file mode 100644
index 000000000..4984474db
--- /dev/null
+++ b/editor/libeditor/crashtests/793866.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var b = document.body;
+ b.contentEditable = "true";
+ document.execCommand("contentReadOnly", false, null);
+ b.focus();
+ b.contentEditable = "false";
+ document.documentElement.contentEditable = "true";
+ document.createDocumentFragment().appendChild(b);
+ document.documentElement.focus();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/editor/libeditor/crashtests/crashtests.list b/editor/libeditor/crashtests/crashtests.list
new file mode 100644
index 000000000..3fbc6b196
--- /dev/null
+++ b/editor/libeditor/crashtests/crashtests.list
@@ -0,0 +1,71 @@
+load 336081-1.xhtml
+load 336104.html
+load 382527-1.html
+load 382778-1.html
+load 402172-1.html
+load 403965-1.xhtml
+load 407074-1.html
+load 407079-1.html
+load 407256-1.html
+load 407277-1.html
+load 414178-1.html
+load 418923-1.html
+load 420439.html
+load 428489-1.html
+load 429586-1.html
+load 430624-1.html
+load 431086-1.xhtml
+load 448329-1.html
+load 448329-2.html
+load 448329-3.html
+load 456727-1.html
+load 456727-2.html
+load 459613.html
+needs-focus load 467647-1.html
+load 475132-1.xhtml
+load 499844-1.html
+load 503709-1.xhtml
+load 513375-1.xhtml
+load 535632-1.xhtml
+load 574558-1.xhtml
+load 580151-1.xhtml
+load 582138-1.xhtml
+load 612565-1.html
+load 615015-1.html
+load 615450-1.html
+load 633709.xhtml
+load 636074-1.html
+load 639736-1.xhtml
+load 643786-1.html
+load 650572-1.html
+load 667321-1.html
+load 682650-1.html
+load 713427-1.html
+load 713427-2.xhtml
+load 716456-1.html
+load 759748.html
+load 761861.html
+load 762183.html
+load 766305.html
+load 766360.html
+load 766387.html
+load 766413.html
+load 766795.html
+load 766845.xhtml
+load 767169.html
+load 768748.html
+load 768765.html
+load 769008-1.html
+load 769967.xhtml
+needs-focus load 771749.html
+load 772282.html
+load 776323.html
+needs-focus load 793866.html
+load 1057677.html
+needs-focus load 1128787.html
+load 1134545.html
+load 1158452.html
+load 1158651.html
+load 1244894.xhtml
+load 1272490.html
+load 1317704.html