diff options
Diffstat (limited to 'dom/html/crashtests')
88 files changed, 1282 insertions, 0 deletions
diff --git a/dom/html/crashtests/1032654.html b/dom/html/crashtests/1032654.html new file mode 100644 index 000000000..3067e1077 --- /dev/null +++ b/dom/html/crashtests/1032654.html @@ -0,0 +1 @@ +<template>
# diff --git a/dom/html/crashtests/1141260.html b/dom/html/crashtests/1141260.html new file mode 100644 index 000000000..c5ced3a44 --- /dev/null +++ b/dom/html/crashtests/1141260.html @@ -0,0 +1,4 @@ +<img src="foo" srcset="bar"> +<script> + document.querySelector("img").removeAttribute('src'); +</script> diff --git a/dom/html/crashtests/1228876.html b/dom/html/crashtests/1228876.html new file mode 100644 index 000000000..b7beb645c --- /dev/null +++ b/dom/html/crashtests/1228876.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var a = document.createElement("select"); + var f = document.createElement("optgroup"); + var g = document.createElement("optgroup"); + a.appendChild(f); + g.appendChild(document.createElement("option")); + f.appendChild(g); + a.appendChild(document.createElement("option")); + document.body.appendChild(a); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/1230110.html b/dom/html/crashtests/1230110.html new file mode 100644 index 000000000..9802dd775 --- /dev/null +++ b/dom/html/crashtests/1230110.html @@ -0,0 +1,19 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> +// This test case should not leak. +function leak() +{ + var img = document.createElement("img"); + var iframe = document.createElement("iframe"); + img.appendChild(iframe); + document.body.appendChild(img); + + document.addEventListener('Foo', function(){}, false); +} +</script> +</head> +<body onload="leak();"></body> +</html> diff --git a/dom/html/crashtests/1237633.html b/dom/html/crashtests/1237633.html new file mode 100644 index 000000000..c235f0315 --- /dev/null +++ b/dom/html/crashtests/1237633.html @@ -0,0 +1 @@ +<img srcset="data:,a 2400w" sizes="(min-width: 1px) calc(300px - 100vw)"> diff --git a/dom/html/crashtests/1281972-1.html b/dom/html/crashtests/1281972-1.html new file mode 100644 index 000000000..6fa5bb250 --- /dev/null +++ b/dom/html/crashtests/1281972-1.html @@ -0,0 +1,5 @@ +<!DOCTYPE html> +<meta charset="UTF-8"> +<body onload="window[0].document.forms[0].submit();"> +<iframe src="data:text/html;charset=UTF-8,<form accept-charset=HZ-GB-2312>"></iframe> +</body> diff --git a/dom/html/crashtests/1282894.html b/dom/html/crashtests/1282894.html new file mode 100644 index 000000000..456a4541f --- /dev/null +++ b/dom/html/crashtests/1282894.html @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<script> + +function boom() { + var table = document.createElement("table"); + var cap = document.createElement("caption"); + cap.appendChild(table) + table.caption = cap; +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/1290904.html b/dom/html/crashtests/1290904.html new file mode 100644 index 000000000..5ea23ba3b --- /dev/null +++ b/dom/html/crashtests/1290904.html @@ -0,0 +1,37 @@ +<!DOCTYPE html> +<html> + <body> + <fieldset id="outer"> + <fieldset id="inner"> + </fieldset> + </fieldset> + </body> +</html> +<script> +function appendTextareaToFieldset(fieldset) { + var textarea = document.createElement("textarea"); + textarea.setAttribute("required", ""); + fieldset.appendChild(textarea); +} + +var innerFieldset = document.getElementById('inner'); +var outerFieldset = document.getElementById('outer'); + +var fieldset = document.createElement('fieldset'); +appendTextareaToFieldset(fieldset); +appendTextareaToFieldset(fieldset); +appendTextareaToFieldset(fieldset); +appendTextareaToFieldset(fieldset); + +// Adding a fieldset to a nested fieldset. +innerFieldset.appendChild(fieldset); +appendTextareaToFieldset(fieldset); +appendTextareaToFieldset(fieldset); +// This triggers mInvalidElementsCount checks in outer fieldset. +appendTextareaToFieldset(outerFieldset); + +// Removing a fieldset from a nested fieldset. +innerFieldset.removeChild(fieldset); +// This triggers mInvalidElementsCount checks in outer fieldset. +appendTextareaToFieldset(outerFieldset); +</script> diff --git a/dom/html/crashtests/1386905.html b/dom/html/crashtests/1386905.html new file mode 100644 index 000000000..6ecc59e23 --- /dev/null +++ b/dom/html/crashtests/1386905.html @@ -0,0 +1,13 @@ +<!DOCTYPE html> +<html> +<head> +<script> +document.documentElement.getBoundingClientRect() +document.documentElement.innerHTML = "<input placeholder=e type=number readonly>" +document.designMode = "on" +document.execCommand("inserttext", false, "") +document.designMode = "off" +document.documentElement.style.display = 'none' +</script> +</head> +</html> diff --git a/dom/html/crashtests/257818-1.html b/dom/html/crashtests/257818-1.html new file mode 100644 index 000000000..162390efa --- /dev/null +++ b/dom/html/crashtests/257818-1.html @@ -0,0 +1,82 @@ +<html><head> +<script type="text/javascript"> +function cE (v) { + return document.createElement(v) +} +function cTN (v) { + return document.createTextNode(v) +} + +function OSXBarIcon(elt) { + this.element = elt; + this.labelNode = this.element.firstChild; + this.labelNodeParent = this.element; + this.labelNodeParent.removeChild(this.labelNode); + + this.contents = []; + var kids = this.element.childNodes; + for(var i=0; i<kids.length; i++) this.contents[this.contents.length] = this.element.removeChild(kids[i]); + this.popupSubmenu = new OSXBarSubmenu(this); +} + +function OSXBarSubmenu(icon) { + this.parentIcon = icon; + this.create(); + this.addContent(); +} +OSXBarSubmenu.prototype = { + create : function() { + var p = this.popupNode = document.createElement("div"); + var b = document.getElementsByTagName("body").item(0); + if(b) b.appendChild(p); + this.popupNode.style.display = "none"; + // Uncomment next line to fix the problem +// var v = document.body.offsetWidth; + } +}; +OSXBarSubmenu.prototype.addContent = function() { + + // add popup label: + var label = document.createElement("div"); + label.appendChild(document.createTextNode(this.parentIcon.label)); + this.popupNode.appendChild(label); + + // add <li> children to the popup: + var contents = this.parentIcon.contents; + for(var i=0; i<contents.length; i++) { + this.popupNode.appendChild(contents[i]); + + } +}; + +</script> + +<script type="text/javascript"> +function createControlPanel() { + var bar = document.getElementById("navigation"); + var item = cE("li"); + item.appendChild(cTN("aaa")); + var textfield = cE("input"); + textfield.value = 0; + item.appendChild(textfield); + bar.insertBefore(item, bar.firstChild); +} + +window.addEventListener("load", createControlPanel, false); +</script> + +<script type="text/javascript"> +function ssload() { + new OSXBarIcon(document.getElementById("navigation").childNodes[0]); +} +window.addEventListener("load",ssload,false); + + +</script> +</head> + +<body> +<ul id="navigation"></ul> +</body></html> + + diff --git a/dom/html/crashtests/285166-1.html b/dom/html/crashtests/285166-1.html new file mode 100644 index 000000000..8a73d7d74 --- /dev/null +++ b/dom/html/crashtests/285166-1.html @@ -0,0 +1,3 @@ +<script> +document.createElement("#text"); +</script> diff --git a/dom/html/crashtests/294235-1.html b/dom/html/crashtests/294235-1.html new file mode 100644 index 000000000..00eed38f4 --- /dev/null +++ b/dom/html/crashtests/294235-1.html @@ -0,0 +1,14 @@ +<html> + <head> + <title>bug 294235</title> + <script> + function countdown(){ + count2.innerHTML="foo"; + } + document.links.length; + </script> + </head> + <body> + <strong><div id="count2"><script>countdown();</script><noscript>bar</noscript></div></strong> + </body> +</html> diff --git a/dom/html/crashtests/307616-1.html b/dom/html/crashtests/307616-1.html new file mode 100644 index 000000000..8f28ddd6e --- /dev/null +++ b/dom/html/crashtests/307616-1.html @@ -0,0 +1,8 @@ +<html> +<head><title>Testcase for assertion</title></head> +<body> +
+<input type="image" src="./nosuch.gif" alt="Search"> + +</body> +</html>
\ No newline at end of file diff --git a/dom/html/crashtests/324918-1.xhtml b/dom/html/crashtests/324918-1.xhtml new file mode 100644 index 000000000..921714cff --- /dev/null +++ b/dom/html/crashtests/324918-1.xhtml @@ -0,0 +1,26 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + + +function init() +{ + var sel = document.getElementById("sel"); + var div = document.getElementById("div"); + var newo = document.createElementNS("http://www.w3.org/1999/xhtml", "option"); + + sel.appendChild(div); + div.appendChild(newo); + sel.removeChild(div); +} + +</script> +</head> +<body onload="init();"> + +<div id="div"><option></option></div> + +<select id="sel"></select> + +</body> +</html> diff --git a/dom/html/crashtests/338649-1.xhtml b/dom/html/crashtests/338649-1.xhtml new file mode 100644 index 000000000..b0bf3186f --- /dev/null +++ b/dom/html/crashtests/338649-1.xhtml @@ -0,0 +1,22 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<title>ASSERTION: Options collection broken</title> +</head> + +<body> + +<div> + +<select> + <option id="n29">B + <optgroup label="middle" id="n20"> + <option>N</option> + </optgroup> + </option> + <option>M</option> +</select> + +</div> + +</body> +</html>
\ No newline at end of file diff --git a/dom/html/crashtests/339501-1.xhtml b/dom/html/crashtests/339501-1.xhtml new file mode 100644 index 000000000..1a231ee64 --- /dev/null +++ b/dom/html/crashtests/339501-1.xhtml @@ -0,0 +1,33 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<script> + +function boom() +{ + document.addEventListener("DOMNodeRemoved", foo, false); + remove(document.getElementById("A")); + document.removeEventListener("DOMNodeRemoved", foo, false); + + function foo() + { + document.removeEventListener("DOMNodeRemoved", foo, false); + remove(document.getElementById("B")); + } +} + + +window.addEventListener("load", boom, false); + +function remove(q1) { q1.parentNode.removeChild(q1); } + +</script> + +</head> + +<body> + +<select><option id="A">A</option><option id="B">B</option></select> + +</body> +</html> diff --git a/dom/html/crashtests/339501-2.xhtml b/dom/html/crashtests/339501-2.xhtml new file mode 100644 index 000000000..6a1835fb7 --- /dev/null +++ b/dom/html/crashtests/339501-2.xhtml @@ -0,0 +1,33 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<script> + +function boom() +{ + document.addEventListener("DOMNodeRemoved", foo, false); + remove(document.getElementById("B")); + document.removeEventListener("DOMNodeRemoved", foo, false); + + function foo() + { + document.removeEventListener("DOMNodeRemoved", foo, false); + remove(document.getElementById("A")); + } +} + + +window.addEventListener("load", boom, false); + +function remove(q1) { q1.parentNode.removeChild(q1); } + +</script> + +</head> + +<body> + +<select><option id="A">A</option><option id="B">B</option></select> + +</body> +</html> diff --git a/dom/html/crashtests/378993-1.xhtml b/dom/html/crashtests/378993-1.xhtml new file mode 100644 index 000000000..99cbb01da --- /dev/null +++ b/dom/html/crashtests/378993-1.xhtml @@ -0,0 +1,7 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<body> +<script> +document.createElement('AREA'); +</script> +</body> +</html> diff --git a/dom/html/crashtests/382568-1-inner.xhtml b/dom/html/crashtests/382568-1-inner.xhtml new file mode 100644 index 000000000..a3685f4c6 --- /dev/null +++ b/dom/html/crashtests/382568-1-inner.xhtml @@ -0,0 +1,52 @@ +<?xml version="1.0"?> +<!DOCTYPE html +PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" +"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> +<html xmlns="http://www.w3.org/1999/xhtml"> <head> +<title>Test</title> +<script type="text/javascript"><![CDATA[ + +function onAttrModified(evt) { +// window.alert("Mutation event fired within the frame code."); +// evt.target.focus(); +// evt.target.blur(); + evt.target.style.background = 'green'; + bounce(evt.target); +// evt.target.normalize(); +// bounce(evt.target.parentNode); +} +function die(n) { + p = n.parentNode; + p.removeChild(n); +} + +function bounce(n) { + p = n.parentNode; + p.removeChild(n); + p.appendChild(n); +} + + +function test_AttrModified() { + var x = document.getElementById("x"); + x.addEventListener("DOMAttrModified", onAttrModified, false); + bounce(x); +} + +function test() { + setTimeout(test_AttrModified, 3000); +} +]]></script> +</head> + +<body onload="test()"> +<h1>TestCase for unsafe mutable events from textarea</h1> +<p>Please wait for 3 seconds after document was loaded, +if your browser is vulnerable, it may stop responding +to keyboard and mouse event +and most likely it will eventually crash (may take a +while for debug builds).</p> +<p> +<textarea id="x"></textarea> +</p> +</body> </html> diff --git a/dom/html/crashtests/382568-1.html b/dom/html/crashtests/382568-1.html new file mode 100644 index 000000000..c10c71fd1 --- /dev/null +++ b/dom/html/crashtests/382568-1.html @@ -0,0 +1,9 @@ +<html class="reftest-wait"> +<head> +<script> +setTimeout('document.documentElement.className = ""', 3500); +</script> +<body> +<iframe src="382568-1-inner.xhtml"></iframe> +</body> +</html> diff --git a/dom/html/crashtests/383137.xhtml b/dom/html/crashtests/383137.xhtml new file mode 100644 index 000000000..87d853c03 --- /dev/null +++ b/dom/html/crashtests/383137.xhtml @@ -0,0 +1,13 @@ +<html xmlns="http://www.w3.org/1999/xhtml">
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">//<![CDATA[
+function doe(){
+document.documentElement.setAttribute('style', '');
+}
+
+setTimeout(doe,100);
+//]]></script>
+
+<style style="overflow: scroll; display: block;">
+style::before {content: counter(section); }
+</style>
+</html>
\ No newline at end of file diff --git a/dom/html/crashtests/388183-1.html b/dom/html/crashtests/388183-1.html new file mode 100644 index 000000000..fcca410e9 --- /dev/null +++ b/dom/html/crashtests/388183-1.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html contenteditable="true"> +<head> +</head> +<body> +<div contenteditable="true"></div> +</body> +</html> diff --git a/dom/html/crashtests/395340-1.html b/dom/html/crashtests/395340-1.html new file mode 100644 index 000000000..ddbccfe96 --- /dev/null +++ b/dom/html/crashtests/395340-1.html @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script type="text/javascript"> + +function boom() +{ + var div1 = document.createElement("div"); + div1.style.counterIncrement = "chicken"; + div1.contentEditable = "true"; + + var div2 = document.createElement("div"); + div2.style.counterIncrement = "chicken"; + + document.body.style.content = "'A'"; + + div1.appendChild(div2); + document.body.appendChild(div1); + div1.removeChild(div2); +} + +</script> + +</head> + +<body onload="boom();"> + +</body> +</html> diff --git a/dom/html/crashtests/399694-1.html b/dom/html/crashtests/399694-1.html new file mode 100644 index 000000000..e6db2342b --- /dev/null +++ b/dom/html/crashtests/399694-1.html @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> +function boom() +{ + var legend = document.createElementNS("http://www.w3.org/1999/xhtml", "legend") + var input = document.getElementById("input"); + input.appendChild(legend); + legend.focus(); + + document.documentElement.removeAttribute("class"); +} +</script> +</head> +<body onload="setTimeout(boom, 3);" contenteditable="true"> + +<input contenteditable="false"><input id="input"><q><div></div></q> + +</body> +</html> diff --git a/dom/html/crashtests/407053.html b/dom/html/crashtests/407053.html new file mode 100644 index 000000000..b80a23172 --- /dev/null +++ b/dom/html/crashtests/407053.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body onload="document.execCommand('copy', false, '');"> +<div contenteditable="true"></div> +</body> +</html> diff --git a/dom/html/crashtests/423371-1.html b/dom/html/crashtests/423371-1.html new file mode 100644 index 000000000..0069cf95d --- /dev/null +++ b/dom/html/crashtests/423371-1.html @@ -0,0 +1,9 @@ +<!DOCTYPE HTML> +<html> +<body> +<div style="position:fixed; top:100px;" id="d">hello</div> +<script> +document.write(document.getElementById("d").offsetTop); +</script> +</body> +</html> diff --git a/dom/html/crashtests/448564.html b/dom/html/crashtests/448564.html new file mode 100644 index 000000000..f31830afa --- /dev/null +++ b/dom/html/crashtests/448564.html @@ -0,0 +1,7 @@ +<s> +<form>a</form> +<iframe></iframe> +<script src=a></script> +<form></form> +<table> +<optgroup> diff --git a/dom/html/crashtests/451123-1.html b/dom/html/crashtests/451123-1.html new file mode 100644 index 000000000..abf23c1e7 --- /dev/null +++ b/dom/html/crashtests/451123-1.html @@ -0,0 +1,7 @@ +<html> +<head> +</head> +<body> +<input type="file" type="file"> +</body> +</html> diff --git a/dom/html/crashtests/453406-1.html b/dom/html/crashtests/453406-1.html new file mode 100644 index 000000000..4017c97ca --- /dev/null +++ b/dom/html/crashtests/453406-1.html @@ -0,0 +1,34 @@ +<html> +<head> +<script type="text/javascript"> +function boom() +{ + var r = document.documentElement; + while (r.firstChild) + r.removeChild(r.firstChild); + + var b = document.createElement("BODY"); + var s = document.createElement("SCRIPT"); + var f1 = document.createElement("FORM"); + var i = document.createElement("INPUT"); + var br = document.createElement("BR"); + var f2 = document.createElement("FORM"); + var span = document.createElement("SPAN"); + f1.appendChild(i); + f1.appendChild(br); + s.appendChild(f1); + b.appendChild(s); + f2.appendChild(span); + b.appendChild(f2) + document.documentElement.appendChild(b); + b.contentEditable = "true"; + document.execCommand("indent", false, null); + b.contentEditable = "false"; + span.appendChild(i); + i.parentNode.removeChild(i); +} +</script> +</head> +<body onload="boom();"> +</body> +</html> diff --git a/dom/html/crashtests/464197-1.html b/dom/html/crashtests/464197-1.html new file mode 100644 index 000000000..785686023 --- /dev/null +++ b/dom/html/crashtests/464197-1.html @@ -0,0 +1,23 @@ +<html class="reftest-wait"> +<head> +<script type="text/javascript"> + +var i = 0; + +function boom() +{ + var s = document.createElement("span"); + s.innerHTML = "<audio src='javascript:5'><\/audio>"; + s.innerHTML = ""; + + if (++i < 10) + setTimeout(boom, 0); + else + document.documentElement.removeAttribute("class"); +} + +</script> +</head> +<body onload="boom();"> +</body> +</html> diff --git a/dom/html/crashtests/465466-1.xhtml b/dom/html/crashtests/465466-1.xhtml new file mode 100644 index 000000000..4e1258702 --- /dev/null +++ b/dom/html/crashtests/465466-1.xhtml @@ -0,0 +1,23 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<bindings xmlns="http://www.mozilla.org/xbl"><binding id="u"> +<content><foopy><children xmlns="http://www.mozilla.org/xbl"/></foopy></content> +</binding></bindings> + + +<script type="text/javascript"> + +function boom() +{ + var f = document.getElementById("f"); + var anon = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(f))[0]; + document.body.removeChild(f); + anon.appendChild(document.createElement("label")); +} + +</script> +</head> + +<body onload="boom();"><form id="f" style="-moz-binding: url(#u);"><label></label></form></body> +</html> diff --git a/dom/html/crashtests/468562-1.html b/dom/html/crashtests/468562-1.html new file mode 100644 index 000000000..81123fe2e --- /dev/null +++ b/dom/html/crashtests/468562-1.html @@ -0,0 +1,6 @@ +<html> +<head></head> +<body> +<table><script>document.write("Q");</script><link> +</body> +</html> diff --git a/dom/html/crashtests/468562-2.html b/dom/html/crashtests/468562-2.html new file mode 100644 index 000000000..e0db5cd97 --- /dev/null +++ b/dom/html/crashtests/468562-2.html @@ -0,0 +1,6 @@ +<html> +<head></head> +<body> +<table><script>document.write("Q");</script><link></table> +</body> +</html> diff --git a/dom/html/crashtests/494225.html b/dom/html/crashtests/494225.html new file mode 100644 index 000000000..a78051d2a --- /dev/null +++ b/dom/html/crashtests/494225.html @@ -0,0 +1,10 @@ +<!doctype html> +<html><head><script> + var x = "f: '" + document.fgColor + + "' b: '" + document.bgColor + + "' l: '" + document.linkColor + + "' a: '" + document.alinkColor + + "' v: '" + document.vlinkColor + "'"; +</script></head><body +onload="document.body.appendChild(document.createTextNode(x))" +></body></html> diff --git a/dom/html/crashtests/495543.svg b/dom/html/crashtests/495543.svg new file mode 100644 index 000000000..b795796ad --- /dev/null +++ b/dom/html/crashtests/495543.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<script type="text/javascript"> + +function boom() +{ + var htmlBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); + document.documentElement.appendChild(htmlBody); + htmlBody.setAttribute('vlink', "transparent"); + document.height; + document.vlinkColor; +} + +window.addEventListener("load", boom, false); +</script> + +</svg> diff --git a/dom/html/crashtests/495546-1.html b/dom/html/crashtests/495546-1.html new file mode 100644 index 000000000..0547b9867 --- /dev/null +++ b/dom/html/crashtests/495546-1.html @@ -0,0 +1,19 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script type="text/javascript"> + +function boom() +{ + var video = document.createElement("video"); + var source = document.createElement("source"); + source.setAttributeNS(null, "src", "http://127.0.0.1/"); + video.appendChild(source); + document.body.appendChild(video); + setTimeout(function() { document.body.removeChild(video); }, 20); +} + +</script> +</head> + +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/504183-1.html b/dom/html/crashtests/504183-1.html new file mode 100644 index 000000000..e44db4152 --- /dev/null +++ b/dom/html/crashtests/504183-1.html @@ -0,0 +1,12 @@ +<html class="reftest-wait"> +<input id="a" type="file"> +<script> +function doe() { +var elem = document.getElementById('a'); +elem.style.display = "none"; +elem.focus(); +document.documentElement.className = ""; +} +setTimeout(doe, 0); +</script> +</html> diff --git a/dom/html/crashtests/515829-1.html b/dom/html/crashtests/515829-1.html new file mode 100644 index 000000000..e2fc655c0 --- /dev/null +++ b/dom/html/crashtests/515829-1.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<html> +<head></head> +<body onload="document.getElementById('x').innerHTML = '<button></button>';"> +<form><div id="x"><button></button></div><button></button></form> +</body> +</html> diff --git a/dom/html/crashtests/515829-2.html b/dom/html/crashtests/515829-2.html new file mode 100644 index 000000000..6de6d5986 --- /dev/null +++ b/dom/html/crashtests/515829-2.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<html> +<head></head> +<body onload="document.getElementById('x').innerHTML = '<button></button>';"> +<form><div id="x"><button></button></div><button></button><input type="image"></form> +</body> +</html> diff --git a/dom/html/crashtests/564461.xhtml b/dom/html/crashtests/564461.xhtml new file mode 100644 index 000000000..9a7bfeb24 --- /dev/null +++ b/dom/html/crashtests/564461.xhtml @@ -0,0 +1,26 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + + +<bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="editable"><content><div contenteditable="true" xmlns="http://www.w3.org/1999/xhtml"></div></content></binding> +</bindings> + +<script type="text/javascript"> +<![CDATA[ + +function boom() +{ + while (document.documentElement.firstChild) document.documentElement.removeChild(document.documentElement.firstChild); + + document.addEventListener("DOMSubtreeModified", function(){}, false); + document.addEventListener("DOMNodeInsertedIntoDocument", function(){}, false); + document.documentElement.appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "body")); + document.body.style.MozBinding = 'url(#editable)'; +} + +]]> +</script></head> + +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/570566-1.html b/dom/html/crashtests/570566-1.html new file mode 100644 index 000000000..70ec003a6 --- /dev/null +++ b/dom/html/crashtests/570566-1.html @@ -0,0 +1,2 @@ +<body onload="document.getElementById('i').removeAttribute('type')"><input id=i type=image></body> + diff --git a/dom/html/crashtests/571428-1.html b/dom/html/crashtests/571428-1.html new file mode 100644 index 000000000..ae2b960ca --- /dev/null +++ b/dom/html/crashtests/571428-1.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<html> +<head> +<script> +function boom() +{ + var i = document.getElementById("i"); + i.setAttribute("type", "button"); + i.removeAttribute("type"); +} +</script> +</head> +<body onload="boom();"><input id="i"></body> +</html> diff --git a/dom/html/crashtests/580507-1.xhtml b/dom/html/crashtests/580507-1.xhtml new file mode 100644 index 000000000..eff3fb255 --- /dev/null +++ b/dom/html/crashtests/580507-1.xhtml @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var input = document.getElementById("i"); + input.setAttribute('type', "image"); + input.removeAttribute('type'); + input.placeholder = "Y"; +} + +</script> +</head> + +<body onload="boom();"><input id="i" /></body> +</html> diff --git a/dom/html/crashtests/590387.html b/dom/html/crashtests/590387.html new file mode 100644 index 000000000..50cd05ac9 --- /dev/null +++ b/dom/html/crashtests/590387.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html> +<head> +<script> +document.createElement("div").innerHTML = "<output form=x>"; +</script> +</head> +</html> diff --git a/dom/html/crashtests/596785-1.html b/dom/html/crashtests/596785-1.html new file mode 100644 index 000000000..5d830628b --- /dev/null +++ b/dom/html/crashtests/596785-1.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<html class="reftest-wait"> + <body onload="document.getElementById('i').type = 'image'; + document.documentElement.className = '';"> + <form> + <input id='i' required> + </form> + </body> +</html> diff --git a/dom/html/crashtests/596785-2.html b/dom/html/crashtests/596785-2.html new file mode 100644 index 000000000..18cfe2788 --- /dev/null +++ b/dom/html/crashtests/596785-2.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<html class="reftest-wait"> + <body onload="document.getElementById('i').type = 'text'; + document.documentElement.className = '';"> + <form> + <input id='i' type='image' required> + </form> + </body> +</html> diff --git a/dom/html/crashtests/601422.html b/dom/html/crashtests/601422.html new file mode 100644 index 000000000..d3468a306 --- /dev/null +++ b/dom/html/crashtests/601422.html @@ -0,0 +1,23 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var frame = document.getElementById("f"); + var frameDoc = frame.contentDocument; + document.body.removeChild(frame); + try { frameDoc.shrinkToFit(); }catch(e){} + try { frameDoc.restoreImageTo(1,1); }catch(e){} + try { frameDoc.restoreImage(); }catch(e){} + try { frameDoc.toggleImageSize(); }catch(e){} +} + +</script> +</head> + +<body onload="boom();"> +<iframe id="f" src="data:image/gif;base64,R0lGODlhAQABAID/AP///wAAACwAAAAAAQABAAACAkQBADs="></iframe> +</body> +</html> diff --git a/dom/html/crashtests/602117.html b/dom/html/crashtests/602117.html new file mode 100644 index 000000000..0d1818b2a --- /dev/null +++ b/dom/html/crashtests/602117.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<html> + <script> + var isindex = document.createElement("isindex"); + isindex.setAttribute("form", "f"); + isindex.form; + </script> +</html> diff --git a/dom/html/crashtests/604807.html b/dom/html/crashtests/604807.html new file mode 100644 index 000000000..a519a778f --- /dev/null +++ b/dom/html/crashtests/604807.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<script> +try { + var selectElem = document.createElementNS("http://www.w3.org/1999/xhtml", "select"); + selectElem.QueryInterface(Components.interfaces.nsISelectElement); + selectElem.getOptionIndex(null, 0, true); +} catch (e) { +} +</script> diff --git a/dom/html/crashtests/605264.html b/dom/html/crashtests/605264.html new file mode 100644 index 000000000..3c1db3578 --- /dev/null +++ b/dom/html/crashtests/605264.html @@ -0,0 +1,8 @@ +<!DOCTYPE html> +<script> + +var v = document.createElementNS("http://www.w3.org/1999/xhtml", "video"); +v.QueryInterface(Components.interfaces.nsIObserver); +v.observe(null, null, null); + +</script> diff --git a/dom/html/crashtests/606430-1.html b/dom/html/crashtests/606430-1.html new file mode 100644 index 000000000..c347e3c9f --- /dev/null +++ b/dom/html/crashtests/606430-1.html @@ -0,0 +1,31 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var r = document.documentElement; + var i = document.getElementById("i"); + + document.removeChild(r); + document.appendChild(r); + w("dump('A\\n')"); + document.removeChild(r); + w("dump('B\\n')"); + document.appendChild(r); + + function w(s) + { + var ns = document.createElement("script"); + var nt = document.createTextNode(s); + ns.appendChild(nt); + i.appendChild(ns); + } +} + +</script> +</head> + +<body onload="boom();"><input id="i"></body> +</html> diff --git a/dom/html/crashtests/613027.html b/dom/html/crashtests/613027.html new file mode 100644 index 000000000..a866860f1 --- /dev/null +++ b/dom/html/crashtests/613027.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var a = document.createElementNS("http://www.w3.org/1999/xhtml", "fieldset"); + var b = document.createElementNS("http://www.w3.org/1999/xhtml", "legend"); + var c = document.createElementNS("http://www.w3.org/1999/xhtml", "input"); + + a.appendChild(b); + a.appendChild(c); + a.removeChild(b); + c.expandoQ = a; +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/614279.html b/dom/html/crashtests/614279.html new file mode 100644 index 000000000..ff1c50516 --- /dev/null +++ b/dom/html/crashtests/614279.html @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var a = document.createElementNS("http://www.w3.org/1999/xhtml", "datalist"); + var b = document.createElementNS("http://www.w3.org/1999/xhtml", "option"); + + a.appendChild(b); + b.expando = a.options; +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/614988-1.html b/dom/html/crashtests/614988-1.html new file mode 100644 index 000000000..931f83ac7 --- /dev/null +++ b/dom/html/crashtests/614988-1.html @@ -0,0 +1,5 @@ +<!DOCTYPE html> +<html> +<head><script>window.addEventListener("load", function() { var t = document.getElementById("t"); t.appendChild(t.previousSibling); }, false);</script></head> +<body><fieldset><legend></legend><textarea id="t"></textarea></fieldset></body> +</html> diff --git a/dom/html/crashtests/616401.html b/dom/html/crashtests/616401.html new file mode 100644 index 000000000..eb5a0bcf4 --- /dev/null +++ b/dom/html/crashtests/616401.html @@ -0,0 +1,8 @@ +<!doctype html> +<script> +var c = document.createElement("canvas"); +c.getContext("experimental-webgl", { + get a() { throw 7; }, + get b() { throw 8; } +}); +</script> diff --git a/dom/html/crashtests/620078-1.html b/dom/html/crashtests/620078-1.html new file mode 100644 index 000000000..39462706c --- /dev/null +++ b/dom/html/crashtests/620078-1.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var frame = document.getElementById("f"); + var frameRoot = frame.contentDocument.documentElement; + document.body.removeChild(frame); + var i = document.createElementNS("http://www.w3.org/1999/xhtml", "input"); + i.setAttribute("autofocus", "true"); + frameRoot.appendChild(i); +} + +</script> +</head> + +<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body> +</html> diff --git a/dom/html/crashtests/620078-2.html b/dom/html/crashtests/620078-2.html new file mode 100644 index 000000000..1be23fa1f --- /dev/null +++ b/dom/html/crashtests/620078-2.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> + <body onload='document.cloneNode(1)'> + <button autofocus></button> + </body> +</html> diff --git a/dom/html/crashtests/631421.html b/dom/html/crashtests/631421.html new file mode 100644 index 000000000..e4a7b9192 --- /dev/null +++ b/dom/html/crashtests/631421.html @@ -0,0 +1,34 @@ +<!DOCTYPE html> +<html class="reftest-wait"> +<head> +<script> +"use strict"; + +var f2; + +function newIframe() +{ + var f = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + f.setAttributeNS(null, "src", "631421.png"); + document.body.appendChild(f); + return f; +} + +function b1() +{ + void newIframe(); + f2 = newIframe(); + setTimeout(b2, 0); +} + +function b2() +{ + document.body.removeChild(f2); + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="b1();"></body> +</html> diff --git a/dom/html/crashtests/631421.png b/dom/html/crashtests/631421.png Binary files differnew file mode 100644 index 000000000..ef350c467 --- /dev/null +++ b/dom/html/crashtests/631421.png diff --git a/dom/html/crashtests/673853.html b/dom/html/crashtests/673853.html new file mode 100644 index 000000000..1325fa9ed --- /dev/null +++ b/dom/html/crashtests/673853.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var otherDoc = document.implementation.createDocument('', '', null); + var input = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "input"); + var form = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "form"); + input.setAttributeNS(null, "form", "x"); + form.setAttributeNS(null, "id", "x"); + input.appendChild(form); + otherDoc.appendChild(input); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/dom/html/crashtests/680922-1.xul b/dom/html/crashtests/680922-1.xul new file mode 100644 index 000000000..2fd1784f6 --- /dev/null +++ b/dom/html/crashtests/680922-1.xul @@ -0,0 +1,9 @@ +<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?> +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml"> + +<box id="e"> +<box id="b" name="e" style="-moz-binding:url(680922-binding.xml#xbl);"> +</box> +</box> + +</window> diff --git a/dom/html/crashtests/680922-binding.xml b/dom/html/crashtests/680922-binding.xml new file mode 100644 index 000000000..86cb0932b --- /dev/null +++ b/dom/html/crashtests/680922-binding.xml @@ -0,0 +1,7 @@ +<bindings xmlns="http://www.mozilla.org/xbl" xmlns:html="http://www.w3.org/1999/xhtml"> +<binding id="xbl" inheritstyle="false"> +<content> +<html:form id="g" observes="b"/> +</content> +</binding> +</bindings> diff --git a/dom/html/crashtests/682058.xhtml b/dom/html/crashtests/682058.xhtml new file mode 100644 index 000000000..95e7da98f --- /dev/null +++ b/dom/html/crashtests/682058.xhtml @@ -0,0 +1,11 @@ +<?xml version="1.0"?> +<html xmlns="http://www.w3.org/1999/xhtml"> + <body onload="test()"> + <script> + function test() { + document.body.innerHTML = "Foobar"; + } + document.addEventListener("DOMNodeRemoved", function() {}); + </script> + </body> +</html> diff --git a/dom/html/crashtests/682460.html b/dom/html/crashtests/682460.html new file mode 100644 index 000000000..91306be71 --- /dev/null +++ b/dom/html/crashtests/682460.html @@ -0,0 +1,21 @@ +<html> +<head> +<script> + +function boom() +{ + var f = function() { + document.documentElement.offsetHeight; + }; + window.addEventListener("DOMSubtreeModified", f, true); + + document.getElementsByTagName("table")[0].setAttribute("cellpadding", "2"); +} + +</script> +</head> + +<body onload="boom();"> +<table><tr><td></td></tr></table> +</body> +</html> diff --git a/dom/html/crashtests/68912-1.html b/dom/html/crashtests/68912-1.html new file mode 100644 index 000000000..bdd2ab461 --- /dev/null +++ b/dom/html/crashtests/68912-1.html @@ -0,0 +1,24 @@ +<html>
+<head>
+<title>Crash TR.cells = null</title>
+<script language="javascript">
+function crashme()
+{
+ var elm = document.createElement('tr');
+
+ elm.cells = null;
+}
+
+</script>
+</head>
+<body onload="crashme()">
+
+<p>
+This test case creates a TR element then tries to assign to the cells property
+</p>
+<p>
+Crash
+</p>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/738744.xhtml b/dom/html/crashtests/738744.xhtml new file mode 100644 index 000000000..7f91d0149 --- /dev/null +++ b/dom/html/crashtests/738744.xhtml @@ -0,0 +1,4 @@ +<input xmlns="http://www.w3.org/1999/xhtml" form="f"> + <form id="f" /> + <input form="f" /> +</input> diff --git a/dom/html/crashtests/741218.json b/dom/html/crashtests/741218.json new file mode 100644 index 000000000..0967ef424 --- /dev/null +++ b/dom/html/crashtests/741218.json @@ -0,0 +1 @@ +{} diff --git a/dom/html/crashtests/741218.json^headers^ b/dom/html/crashtests/741218.json^headers^ new file mode 100644 index 000000000..7b5e82d4b --- /dev/null +++ b/dom/html/crashtests/741218.json^headers^ @@ -0,0 +1 @@ +Content-Type: application/json diff --git a/dom/html/crashtests/741250.xhtml b/dom/html/crashtests/741250.xhtml new file mode 100644 index 000000000..e18a9409f --- /dev/null +++ b/dom/html/crashtests/741250.xhtml @@ -0,0 +1,9 @@ +<input form="f" id="x" xmlns="http://www.w3.org/1999/xhtml"> +<form id="f"></form> +<script> +window.addEventListener("load", function() { + var x = document.getElementById("x"); + x.appendChild(x.cloneNode(true)); +}, false); +</script> +</input> diff --git a/dom/html/crashtests/795221-1.html b/dom/html/crashtests/795221-1.html new file mode 100644 index 000000000..70e400bed --- /dev/null +++ b/dom/html/crashtests/795221-1.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<style> + div { } +</style> +<script> + document.styleSheets[0].cssRules[0].style.foo = document; +</script> diff --git a/dom/html/crashtests/795221-2.html b/dom/html/crashtests/795221-2.html new file mode 100644 index 000000000..fc2aa7d50 --- /dev/null +++ b/dom/html/crashtests/795221-2.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<style> + @media all { + div { } + } +</style> +<script> + document.styleSheets[0].cssRules[0].cssRules[0].style.foo = document; +</script> diff --git a/dom/html/crashtests/795221-3.html b/dom/html/crashtests/795221-3.html new file mode 100644 index 000000000..93348af0b --- /dev/null +++ b/dom/html/crashtests/795221-3.html @@ -0,0 +1,14 @@ +<!DOCTYPE html> +<body> +<script> + // Create the stylesheet via script, so that the parser's preloading doesn't + // make the CSS loader hold on to the sheet we're _not_ trying to form a + // cycle through, thus accidentally avoiding the cycle + var link = document.createElement("link"); + link.setAttribute("rel", "stylesheet"); + link.setAttribute("href", "data:text/css,div { }"); + link.onload = function () { + document.styleSheets[0].cssRules[0].style.foo = document; + } + document.body.appendChild(link); +</script> diff --git a/dom/html/crashtests/795221-4.html b/dom/html/crashtests/795221-4.html new file mode 100644 index 000000000..476dd3467 --- /dev/null +++ b/dom/html/crashtests/795221-4.html @@ -0,0 +1,9 @@ +<!DOCTYPE html> +<svg> + <style> + div { } + </style> +</svg> +<script> + document.styleSheets[0].cssRules[0].style.foo = document; +</script> diff --git a/dom/html/crashtests/795221-5.xml b/dom/html/crashtests/795221-5.xml new file mode 100644 index 000000000..286dcff0d --- /dev/null +++ b/dom/html/crashtests/795221-5.xml @@ -0,0 +1,6 @@ +<?xml-stylesheet href="data:text/css,div {}"?> +<html xmlns="http://www.w3.org/1999/xhtml"> + <script> + document.styleSheets[0].cssRules[0].style.foo = document; + </script> +</html> diff --git a/dom/html/crashtests/798802-1.html b/dom/html/crashtests/798802-1.html new file mode 100644 index 000000000..92ab50fd8 --- /dev/null +++ b/dom/html/crashtests/798802-1.html @@ -0,0 +1,18 @@ +<html> + <head> + <script> + onload = function() { + var canvas2d = document.createElement('canvas') + canvas2d.setAttribute('width', 0) + document.body.appendChild(canvas2d) + var ctx2d = canvas2d.getContext('2d') + ctx2d.fillStyle = 'black' + var gl = document.createElement('canvas').getContext('experimental-webgl') + gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, canvas2d) + ctx2d.fillRect(0, 0, 1, 1) + } + </script> + </head> + <body> + </body> +</html> diff --git a/dom/html/crashtests/811226.html b/dom/html/crashtests/811226.html new file mode 100644 index 000000000..990ef9af5 --- /dev/null +++ b/dom/html/crashtests/811226.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body onload="document.getElementById('s').onerror;"> +<span id="s" onerror="0;"></span> +</body> +</html> diff --git a/dom/html/crashtests/819745.html b/dom/html/crashtests/819745.html new file mode 100644 index 000000000..389e6b8c1 --- /dev/null +++ b/dom/html/crashtests/819745.html @@ -0,0 +1,5 @@ +<!doctype="html"> +<body> +<script> + document.body.onerror = null; +</script> diff --git a/dom/html/crashtests/828180.html b/dom/html/crashtests/828180.html new file mode 100644 index 000000000..055c8a34b --- /dev/null +++ b/dom/html/crashtests/828180.html @@ -0,0 +1,5 @@ +<script> +var table = document.createElement("table"); +table.tHead = null; +table.tFoot = null; +</script> diff --git a/dom/html/crashtests/828472.html b/dom/html/crashtests/828472.html new file mode 100644 index 000000000..59ce4d280 --- /dev/null +++ b/dom/html/crashtests/828472.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body> +<input type='date' value='2013-01-01'> +</body> +</html> diff --git a/dom/html/crashtests/837033.html b/dom/html/crashtests/837033.html new file mode 100644 index 000000000..772d24014 --- /dev/null +++ b/dom/html/crashtests/837033.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<html> +<body onload="document.createElement('button').validity.x = null;"></body> +</html> diff --git a/dom/html/crashtests/838256-1.html b/dom/html/crashtests/838256-1.html new file mode 100644 index 000000000..e1cdc588e --- /dev/null +++ b/dom/html/crashtests/838256-1.html @@ -0,0 +1,20 @@ +<!DOCTYPE html> +<html lang="en"> +<head> +<meta charset="UTF-8"> +<style> + +::-moz-range-track { + display: none ! important; +} + +::-moz-range-thumb { + display: none ! important; +} + +</style> +</head> +<body> +<input type="range"> +</body> +</html> diff --git a/dom/html/crashtests/862084.html b/dom/html/crashtests/862084.html new file mode 100644 index 000000000..d6d04f74d --- /dev/null +++ b/dom/html/crashtests/862084.html @@ -0,0 +1,9 @@ +<!doctype html> +<select></select> +<script> +var select = document.getElementsByTagName("select"); +select.item(0); +select[0]; +select.namedItem("x") +select["x"] +</script> diff --git a/dom/html/crashtests/865147.html b/dom/html/crashtests/865147.html new file mode 100644 index 000000000..841cf8b6d --- /dev/null +++ b/dom/html/crashtests/865147.html @@ -0,0 +1,7 @@ +<!doctype html> +<select></select> +<script> +var select = document.getElementsByTagName("select")[0]; +var newOpt = document.createElement("option"); +select.add(newOpt, newOpt); +</script> diff --git a/dom/html/crashtests/877910.html b/dom/html/crashtests/877910.html new file mode 100644 index 000000000..d454c4478 --- /dev/null +++ b/dom/html/crashtests/877910.html @@ -0,0 +1 @@ +<select><option id="foo"><script>document.querySelector("select").namedItem("foo")</script> diff --git a/dom/html/crashtests/903106.html b/dom/html/crashtests/903106.html new file mode 100644 index 000000000..fceaf4761 --- /dev/null +++ b/dom/html/crashtests/903106.html @@ -0,0 +1,3 @@ +<script> + document.createElement("tr").sectionRowIndex; +</script> diff --git a/dom/html/crashtests/916322-1.html b/dom/html/crashtests/916322-1.html new file mode 100644 index 000000000..279a8e59f --- /dev/null +++ b/dom/html/crashtests/916322-1.html @@ -0,0 +1,10 @@ +<canvas height=16 id=gl> +<script> +// Without the fix, this would trigger an assertion in the debug build +document.addEventListener("DOMContentLoaded", DifferentSizes, false); +function DifferentSizes() { + gl.getContext("2d"); + gl.removeAttribute('height'); + gl.toBlob(function() { }, false) +} +</script> diff --git a/dom/html/crashtests/916322-2.html b/dom/html/crashtests/916322-2.html new file mode 100644 index 000000000..29e390119 --- /dev/null +++ b/dom/html/crashtests/916322-2.html @@ -0,0 +1,10 @@ +<canvas height=200 id=gl> +<script> +// Without the fix, this would trigger an assertion in the debug build +document.addEventListener("DOMContentLoaded", DifferentSizes, false); +function DifferentSizes() { + gl.getContext("2d"); + gl.removeAttribute('height'); + gl.toBlob(function() { }, false) +} +</script> diff --git a/dom/html/crashtests/crashtests.list b/dom/html/crashtests/crashtests.list new file mode 100644 index 000000000..e55a0a350 --- /dev/null +++ b/dom/html/crashtests/crashtests.list @@ -0,0 +1,81 @@ +load 68912-1.html +load 257818-1.html +load 285166-1.html +load 294235-1.html +load 307616-1.html +load 324918-1.xhtml +load 338649-1.xhtml +load 339501-1.xhtml +load 339501-2.xhtml +load 378993-1.xhtml +load 382568-1.html +load 383137.xhtml +load 388183-1.html +load 395340-1.html +load 399694-1.html +load 407053.html +load 423371-1.html +load 448564.html +load 451123-1.html +load 453406-1.html +load 464197-1.html +load 465466-1.xhtml +load 468562-1.html +load 468562-2.html +load 494225.html +load 495543.svg +load 495546-1.html +load 504183-1.html +load 515829-1.html +load 515829-2.html +load 564461.xhtml +load 570566-1.html +load 571428-1.html +load 580507-1.xhtml +load 590387.html +load 596785-1.html +load 596785-2.html +load 601422.html +load 602117.html +load 604807.html +load 605264.html +load 606430-1.html +load 613027.html +load 614279.html +load 614988-1.html +load 620078-1.html +load 620078-2.html +load 631421.html +load 673853.html +load 680922-1.xul +load 682058.xhtml +load 682460.html +load 738744.xhtml +load 741218.json +load 741250.xhtml +load 795221-1.html +load 795221-2.html +load 795221-3.html +load 795221-4.html +load 795221-5.xml +load 811226.html +load 819745.html +load 828180.html +pref(dom.experimental_forms,true) load 828472.html +load 837033.html +load 838256-1.html +load 862084.html +load 865147.html +load 877910.html +load 903106.html +load 916322-1.html +load 916322-2.html +load 1032654.html +load 1141260.html +load 1228876.html +load 1230110.html +load 1237633.html +load 1281972-1.html +load 1282894.html +load 1290904.html +load 1386905.html |
