11 files changed, 352 insertions, 0 deletions
diff --git a/dom/plugins/test/crashtests/110650-1.html b/dom/plugins/test/crashtests/110650-1.html
new file mode 100644
index 000000000..9826227b0
--- /dev/null
+++ b/dom/plugins/test/crashtests/110650-1.html
@@ -0,0 +1,11 @@
+<HTML>
+<HEAD>
+<TITLE>123246 testcase</TITLE>
+</HEAD>
+<BODY>
+<object align="right" width=100>
+</object> 
+</BODY >
+</HTML>
+
+
diff --git a/dom/plugins/test/crashtests/41276-1.html b/dom/plugins/test/crashtests/41276-1.html
new file mode 100644
index 000000000..ba35c34fa
--- /dev/null
+++ b/dom/plugins/test/crashtests/41276-1.html
@@ -0,0 +1,28 @@
+<HTML><HEAD><TITLE>Plugin Limit</TITLE></HEAD>
+<BODY>
+
+Mozilla has a hardcoded limit of 10 simultaneously embedded plugins.<br>
+If that limit is exceeded, plugin instances are prematurely destroyed (see the empty boxes below).<br>
+Leave or reload a page that has a prematurely destroyed plugin and mozilla will crash.<br>
+Sometimes, just loading this page will cause mozilla to crash.<br>
+
+
+<br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<br>
+</BODY></HTML>
diff --git a/dom/plugins/test/crashtests/48856-1.html b/dom/plugins/test/crashtests/48856-1.html
new file mode 100644
index 000000000..cd0de2ab9
--- /dev/null
+++ b/dom/plugins/test/crashtests/48856-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+			"http://www.w3.org/TR/REC-html40/loose.dtd">
+<HTML>
+    <HEAD>
+        <TITLE>Mozilla Bug 48856</TITLE>
+	</HEAD>
+    <BODY>
+        <EMBED></EMBED>
+    </BODY>
+</HTML>
diff --git a/dom/plugins/test/crashtests/539897-1.html b/dom/plugins/test/crashtests/539897-1.html
new file mode 100644
index 000000000..f280e62e6
--- /dev/null
+++ b/dom/plugins/test/crashtests/539897-1.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+function crashplugin() {
+  var plugin = document.getElementById('p');
+  plugin.reinitWidget();
+  plugin.reinitWidget();
+}
+
+function getTestCases() {
+  return [
+    { testPassed:
+      (function () {
+        var plugin = document.getElementById('p');
+        try {
+          plugin.getPaintCount();
+          return true;
+        } catch (e) {
+          return false;
+        }
+      }),
+      testDescription:
+      (function () {
+        return "plugin should not crash";
+      })
+    }
+  ];
+}
+</script>
+</head>
+<body onload="crashplugin();">
+<embed id="p" type="application/x-test" wmode="window"/>
+</body>
+</html>
diff --git a/dom/plugins/test/crashtests/540114-1.html b/dom/plugins/test/crashtests/540114-1.html
new file mode 100644
index 000000000..8243649aa
--- /dev/null
+++ b/dom/plugins/test/crashtests/540114-1.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+function crashplugin() {
+  var plugin = document.getElementById('removeme');
+  var flush_reflow = plugin.offsetHeight; // this may not be necessary
+  document.body.removeChild(plugin);
+  // Give the plugin time to crash
+  setTimeout(function() { document.documentElement.removeAttribute('class') },
+             1000);
+}
+
+function getTestCases() {
+  return [
+    { testPassed:
+      (function () {
+        // Assuming the same process is used for removeme and checkme
+        var plugin = document.getElementById('checkme');
+        try {
+          plugin.getPaintCount();
+          return true;
+        } catch (e) {
+          return false;
+        }
+      }),
+      testDescription:
+      (function () {
+        return "plugin should not crash";
+      })
+    }
+  ];
+}
+</script>
+</head>
+<body onload="crashplugin();">
+<embed id="checkme" type="application/x-test"/>
+<embed id="removeme" type="application/x-test" wmode="window" cleanupwidget="false"/>
+</body>
+</html>
diff --git a/dom/plugins/test/crashtests/570884.html b/dom/plugins/test/crashtests/570884.html
new file mode 100644
index 000000000..7af5cdba5
--- /dev/null
+++ b/dom/plugins/test/crashtests/570884.html
@@ -0,0 +1,8 @@
+<body>
+<embed type="application/x-test" width="20"></embed>
+<embed type="application/x-test" width="10"></embed>
+<embed type="application/x-test" width="0"></embed>
+<embed type="application/x-test" width="20" height="20"></embed>
+<embed type="application/x-test" width="10" height="10"></embed>
+<embed type="application/x-test" width="0" height="0"></embed>
+</body>
diff --git a/dom/plugins/test/crashtests/598862.html b/dom/plugins/test/crashtests/598862.html
new file mode 100644
index 000000000..9b1ad38d7
--- /dev/null
+++ b/dom/plugins/test/crashtests/598862.html
@@ -0,0 +1,77 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+  <head>
+    <script>
+var unusedScreenX;
+function XSync() {
+  unusedScreenX = window.screenX;
+}
+
+function finish() {
+  document.documentElement.removeAttribute("class");
+}
+
+function cleanup() {
+  try {
+    document.getElementById("plugin").crash();
+  } catch (dontcare) {
+  }
+  window.setTimeout(finish, 100);
+}
+
+function scrollOfDeath() {
+  // Add a listener for the MozAfterPaint after the scrollTo below.
+  // If we don't crash during the scroll, we'll get the
+  // MozAfterPaint.
+  window.addEventListener("MozAfterPaint", cleanup, false);
+  window.scrollTo(0, 50);
+}
+
+//
+// The sequence of events we expect is
+//
+//   load (including initial paints of plugin that are cached)
+//   destroy X resources
+//   [X server has time to observe resource destruction]
+//   scrollTo
+//   [repaint using cached plugin surface: BOOM if buggy]
+//   MozAfterPaint
+//   cleanup
+//
+// However, this test is fundamentally nondeterministic.  There are
+// two main "failure" modes
+//   (1) X server doesn't have time to observer resource destruction
+//       before paint-after-scroll
+//   (2) plugin's crash notification arrives before
+//       paint-after-scroll
+// Both result in spurious passes.
+//
+// This test is anal about cleanup because it must be pretty sure that
+// the plugin subprocess is gone before starting the next test.  We
+// double-check that the plugin is gone by the time we're done by 
+// trying to crash it again, after we expect it to have crashed already.
+//
+function runTest() {
+  // Have the plugin throw away its X resources, one of which is
+  // probably a drawable to which we hold a reference
+  document.getElementById("plugin").destroySharedGfxStuff();
+
+  // Do something that's (hopefully) equivalent to an XSync() to allow
+  // the resource destruction to propagate to the server
+  XSync();
+
+  // Set up a scroll to happen soon
+  window.setTimeout(scrollOfDeath, 100);
+}
+
+window.addEventListener("MozReftestInvalidate", runTest, false);
+    </script>
+  </head>
+
+  <body style="width: 400px; height: 10000px;">
+    <embed id="plugin" type="application/x-test"
+           style="position:absolute;
+                  top:100px; left:50px; width:200px; height:200px;">
+    </embed>
+  </body>
+</html>
diff --git a/dom/plugins/test/crashtests/626602-1.html b/dom/plugins/test/crashtests/626602-1.html
new file mode 100644
index 000000000..0a878bbd1
--- /dev/null
+++ b/dom/plugins/test/crashtests/626602-1.html
@@ -0,0 +1,109 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <style type="text/css">
+#one {
+  position:absolute;
+  left:0px; top:0px;
+  z-index:4;
+}
+#two {
+  position:absolute;
+  top:100px; left:100px;
+  background-color:rgb(0,0,0,0);
+  z-index:3;
+}
+#three {
+  position:absolute;
+  left:100px; top:100px;
+  width:200px; height:200px;
+  background-color: rgb(255,0,0);
+  opacity:0.6;
+  z-index:2;
+}
+#four {
+  position:absolute;
+  top:100px; left:100px;
+  z-index:1;
+}
+  </style>
+  <script type="text/javascript">
+var plugin, div, canvas;
+function start() {
+  plugin = document.getElementById("four");
+  div = document.getElementById("three");
+  canvas = document.getElementById("two");
+  paintCanvas();
+
+  requestAnimationFrame(moveSomething);
+}
+
+function paintCanvas() {
+  var ctx = canvas.getContext("2d");
+  ctx.fillStyle = "rgba(255,0,0, 0.6)";
+  ctx.fillRect(0,0, 200,200);
+}
+
+var i = 0, numLoops = 20;
+var pluginIn = true, divIn = true, canvasIn = true;
+function moveSomething() {
+  var didSomething = (0 === (i % 2)) ? moveSomethingOut() : moveSomethingIn();
+  if (!didSomething && ++i >= numLoops) {
+    return finish();
+  }
+
+  requestAnimationFrame(moveSomething);
+}
+
+function finish() {
+  document.documentElement.removeAttribute("class");
+}
+
+function moveSomethingOut() {
+  if (pluginIn) {
+    plugin.style.left = "400px";
+    pluginIn = false;
+  } else if (divIn) {
+    div.style.left = "400px";
+    divIn = false;
+  } else if (canvasIn) {
+    canvas.style.left = "400px";
+    canvasIn = false;
+  } else {
+    return false;
+  }
+  return true;
+}
+
+function moveSomethingIn() {
+  if (!pluginIn) {
+    plugin.style.left = "100px";
+    pluginIn = true;
+  } else if (!divIn) {
+    div.style.left = "100px";
+    divIn = true;
+  } else if (!canvasIn) {
+    canvas.style.left = "100px";
+    canvasIn = true;
+  } else {
+    return false;
+  }
+  return true;
+}
+
+function reset() {
+
+}
+  </script>
+</style>
+</head>
+<body onload="start();">
+  <embed id="four" type="application/x-test" width="200" height="200"
+         drawmode="solid" color="FFFF0000"></embed>
+  <div id="three"></div>
+  <canvas id="two" width="200" height="200"></canvas>
+  <embed id="one" type="application/x-test" width="400" height="400"
+         drawmode="solid" color="9900FF00"></embed>
+</body>
+</html>
+
diff --git a/dom/plugins/test/crashtests/752340.html b/dom/plugins/test/crashtests/752340.html
new file mode 100644
index 000000000..c4c8c464f
--- /dev/null
+++ b/dom/plugins/test/crashtests/752340.html
@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <script type="text/javascript">
+    // Failures in this file can manifest as ###!!! ASSERTION: scope has non-empty map: '0 == mWrappedNativeMap->Count()'
+    // followed by an Assertion failure: allocated() crash during the next GC.
+    // It can also manifest as a leak.
+    function breakthings() {
+      var e = document.createElement("embed");
+      var i = document.getElementById("i");
+      i.contentDocument.body.appendChild(e);
+      i.src = "about:blank";
+    }
+  </script>
+</head>
+<body onload="javascript:breakthings();">
+<iframe id="i" />
+</body>
+</html>
diff --git a/dom/plugins/test/crashtests/843086.xhtml b/dom/plugins/test/crashtests/843086.xhtml
new file mode 100644
index 000000000..a88e2193f
--- /dev/null
+++ b/dom/plugins/test/crashtests/843086.xhtml
@@ -0,0 +1 @@
+<applet xmlns="http://www.w3.org/1999/xhtml" />
diff --git a/dom/plugins/test/crashtests/crashtests.list b/dom/plugins/test/crashtests/crashtests.list
new file mode 100644
index 000000000..aec2195f2
--- /dev/null
+++ b/dom/plugins/test/crashtests/crashtests.list
@@ -0,0 +1,14 @@
+load 41276-1.html
+load 48856-1.html
+load 110650-1.html
+skip-if(!haveTestPlugin) script 539897-1.html
+asserts-if(winWidget&&browserIsRemote,0-1) skip-if(!haveTestPlugin) script 540114-1.html
+load 570884.html
+# This test relies on the reading of screenX/Y forcing a round trip to
+# the X server, which is a bad assumption for <browser remote>.
+# Plugin arch is going to change anyway with OOP content so skipping
+# this test for now is OK.
+skip-if(!haveTestPlugin||http.platform!="X11") load 598862.html
+skip-if(Android) load 626602-1.html # bug 908363
+load 752340.html
+load 843086.xhtml