summaryrefslogtreecommitdiffstats
path: root/dom/xslt/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'dom/xslt/crashtests')
-rw-r--r--dom/xslt/crashtests/1089049.html3
-rw-r--r--dom/xslt/crashtests/111994.xml5
-rw-r--r--dom/xslt/crashtests/111994.xsl13
-rw-r--r--dom/xslt/crashtests/1205163.xml6
-rw-r--r--dom/xslt/crashtests/1205163.xsl11
-rw-r--r--dom/xslt/crashtests/1243337.xml3
-rw-r--r--dom/xslt/crashtests/1243337.xsl6
-rw-r--r--dom/xslt/crashtests/182460-select.xml3
-rw-r--r--dom/xslt/crashtests/182460-selects.xsl5
-rw-r--r--dom/xslt/crashtests/182460-table.xhtml9
-rw-r--r--dom/xslt/crashtests/226425.xml4
-rw-r--r--dom/xslt/crashtests/226425.xsl10
-rw-r--r--dom/xslt/crashtests/406106-1.html18
-rw-r--r--dom/xslt/crashtests/483444.xml19
-rw-r--r--dom/xslt/crashtests/485217.xml8
-rw-r--r--dom/xslt/crashtests/485217.xsl18
-rw-r--r--dom/xslt/crashtests/485286.xml12
-rw-r--r--dom/xslt/crashtests/527558_1.xml17
-rw-r--r--dom/xslt/crashtests/528300.xml22
-rw-r--r--dom/xslt/crashtests/528488.xml19
-rw-r--r--dom/xslt/crashtests/528963.xml22
-rw-r--r--dom/xslt/crashtests/545927.html28
-rw-r--r--dom/xslt/crashtests/601543.html4
-rw-r--r--dom/xslt/crashtests/602115.html22
-rw-r--r--dom/xslt/crashtests/603844.html32
-rw-r--r--dom/xslt/crashtests/667315.xml11
-rw-r--r--dom/xslt/crashtests/91332.xml10
-rw-r--r--dom/xslt/crashtests/91332.xsl21
-rw-r--r--dom/xslt/crashtests/crashtests.list20
29 files changed, 381 insertions, 0 deletions
diff --git a/dom/xslt/crashtests/1089049.html b/dom/xslt/crashtests/1089049.html
new file mode 100644
index 000000000..84ef6494c
--- /dev/null
+++ b/dom/xslt/crashtests/1089049.html
@@ -0,0 +1,3 @@
+<script>
+var xpathResult = document.evaluate('', null, null, XPathResult.FIRST_ORDERED_NODE_TYPE, null);
+</script>
diff --git a/dom/xslt/crashtests/111994.xml b/dom/xslt/crashtests/111994.xml
new file mode 100644
index 000000000..ce7ffad2a
--- /dev/null
+++ b/dom/xslt/crashtests/111994.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="111994.xsl" ?>
+<root>
+ <item id="1001" name="name" />
+</root>
diff --git a/dom/xslt/crashtests/111994.xsl b/dom/xslt/crashtests/111994.xsl
new file mode 100644
index 000000000..4cf68179f
--- /dev/null
+++ b/dom/xslt/crashtests/111994.xsl
@@ -0,0 +1,13 @@
+<?xml version="1.0" ?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <xsl:template match="root">
+ <html><body><xsl:apply-templates select="item" /></body></html>
+ </xsl:template>
+ <xsl:template match="item">
+ <img>
+ <xsl:attribute name="src">
+ <xsl:value-of select="@name" />
+ </xsl:attribute>
+ </img>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/1205163.xml b/dom/xslt/crashtests/1205163.xml
new file mode 100644
index 000000000..2d450a1d5
--- /dev/null
+++ b/dom/xslt/crashtests/1205163.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="1205163.xsl"?>
+<result>
+ <Title>Example</Title>
+ <Error>Error</Error>
+</result>
diff --git a/dom/xslt/crashtests/1205163.xsl b/dom/xslt/crashtests/1205163.xsl
new file mode 100644
index 000000000..f0bbb5cb9
--- /dev/null
+++ b/dom/xslt/crashtests/1205163.xsl
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<xsl:stylesheet version="1.0"
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <xsl:output method="text"/>
+ <xsl:template match="node()|@*">
+ <xsl:copy>
+ <xsl:apply-templates select="node()|@*"/>
+ </xsl:copy>
+ </xsl:template>
+ <xsl:template match="Error"/>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/1243337.xml b/dom/xslt/crashtests/1243337.xml
new file mode 100644
index 000000000..40f5e3a35
--- /dev/null
+++ b/dom/xslt/crashtests/1243337.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="1243337.xsl" ?>
+<root/>
diff --git a/dom/xslt/crashtests/1243337.xsl b/dom/xslt/crashtests/1243337.xsl
new file mode 100644
index 000000000..0e659bf90
--- /dev/null
+++ b/dom/xslt/crashtests/1243337.xsl
@@ -0,0 +1,6 @@
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <xsl:template match="/">
+ <xsl:value-of select="generate-id(5)"/>
+ <html><body/></html>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/182460-select.xml b/dom/xslt/crashtests/182460-select.xml
new file mode 100644
index 000000000..bb9f79b04
--- /dev/null
+++ b/dom/xslt/crashtests/182460-select.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<?xml-stylesheet type="text/xsl" href="182460-selects.xsl"?>
+<fud/> \ No newline at end of file
diff --git a/dom/xslt/crashtests/182460-selects.xsl b/dom/xslt/crashtests/182460-selects.xsl
new file mode 100644
index 000000000..f083ea31f
--- /dev/null
+++ b/dom/xslt/crashtests/182460-selects.xsl
@@ -0,0 +1,5 @@
+<html>
+<body>
+hi
+</body>
+</html>
diff --git a/dom/xslt/crashtests/182460-table.xhtml b/dom/xslt/crashtests/182460-table.xhtml
new file mode 100644
index 000000000..1bf2a23cb
--- /dev/null
+++ b/dom/xslt/crashtests/182460-table.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>XSL Crash</title>
+</head>
+<body>
+<iframe src="182460-select.xml"></iframe>
+<script type="text/javascript" src="data:text/javascript,/*no code*/"/>
+</body>
+</html>
diff --git a/dom/xslt/crashtests/226425.xml b/dom/xslt/crashtests/226425.xml
new file mode 100644
index 000000000..c6662cfe2
--- /dev/null
+++ b/dom/xslt/crashtests/226425.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<?xml-stylesheet type="text/xsl" href="226425.xsl" ?>
+
+<text></text>
diff --git a/dom/xslt/crashtests/226425.xsl b/dom/xslt/crashtests/226425.xsl
new file mode 100644
index 000000000..ddb61ae68
--- /dev/null
+++ b/dom/xslt/crashtests/226425.xsl
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="iso-8859-1"?>
+<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+<xsl:output method="html" indent="yes"/>
+
+<xsl:template match="/">
+<html><body>
+<xsl:apply-templates select="document('dontmatter')"/>
+</body></html>
+</xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/406106-1.html b/dom/xslt/crashtests/406106-1.html
new file mode 100644
index 000000000..86ab510ff
--- /dev/null
+++ b/dom/xslt/crashtests/406106-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var p = new XSLTProcessor();
+ p.setParameter("a", "b", {e: p});
+}
+
+boom();
+
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/xslt/crashtests/483444.xml b/dom/xslt/crashtests/483444.xml
new file mode 100644
index 000000000..18fffceba
--- /dev/null
+++ b/dom/xslt/crashtests/483444.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="#stylesheet"?>
+<!DOCTYPE root [
+ <!ATTLIST xsl:stylesheet id ID #IMPLIED>
+]>
+<root>
+<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <xsl:attribute-set name="a">
+ <xsl:attribute name="b">c</xsl:attribute>
+ </xsl:attribute-set>
+ <xsl:template match="/">
+ <b>Please output something!</b>
+ </xsl:template>
+ <xsl:attribute-set name="a">
+ <xsl:attribute name="b">c</xsl:attribute>
+ </xsl:attribute-set>
+</xsl:stylesheet>
+<doc id="foo">this</doc>
+</root>
diff --git a/dom/xslt/crashtests/485217.xml b/dom/xslt/crashtests/485217.xml
new file mode 100644
index 000000000..93a20e4f7
--- /dev/null
+++ b/dom/xslt/crashtests/485217.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<?xml-stylesheet type="text/xsl" href="485217.xsl"?>
+
+
+<root xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+ <item1 id="AAAAAAA" />
+ <item2 id="AAAAAAAAA" label="AAAAAAAAAAAA"/>
+</root>
diff --git a/dom/xslt/crashtests/485217.xsl b/dom/xslt/crashtests/485217.xsl
new file mode 100644
index 000000000..2935c5a41
--- /dev/null
+++ b/dom/xslt/crashtests/485217.xsl
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<xsl:stylesheet version="2.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+
+ <xsl:key name="label" match="item2" use="undeclaredfunc()"/>
+
+ <xsl:template match="root">
+ <xsl:for-each select="//item1">
+ <xsl:call-template name="item1" />
+ </xsl:for-each>
+ </xsl:template>
+
+ <xsl:template name="item1">
+ <xsl:for-each select="key('label', 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA')">
+ </xsl:for-each>
+ </xsl:template>
+
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/485286.xml b/dom/xslt/crashtests/485286.xml
new file mode 100644
index 000000000..c87aa940e
--- /dev/null
+++ b/dom/xslt/crashtests/485286.xml
@@ -0,0 +1,12 @@
+<?xml-stylesheet type="application/xml" href="485286.xml"?>
+<transform xmlns="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <variable name="v">
+ <for-each select="/">
+ <value-of select="count(1)"/>
+ </for-each>
+ </variable>
+ <key name="k" match="/" use="$v"/>
+ <template match="/">
+ <value-of select="key('k', /..)"/>
+ </template>
+</transform>
diff --git a/dom/xslt/crashtests/527558_1.xml b/dom/xslt/crashtests/527558_1.xml
new file mode 100644
index 000000000..ebb6c3d53
--- /dev/null
+++ b/dom/xslt/crashtests/527558_1.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+ id ID #REQUIRED>
+]>
+<doc>
+<xsl:transform id="bug"
+ version="2.0"
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
+ <xsl:key name="k0" match="e1" use="key('k0', 'foobar')" />
+ <xsl:template id="t1" name="t1" match="key('k0', '1/2/2003')" />
+</xsl:transform>
+
+<e1 a1="foobar" a2="foobar"/>
+
+</doc>
diff --git a/dom/xslt/crashtests/528300.xml b/dom/xslt/crashtests/528300.xml
new file mode 100644
index 000000000..8902bb373
--- /dev/null
+++ b/dom/xslt/crashtests/528300.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+ id ID #REQUIRED>
+]>
+<doc>
+<xsl:transform
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+ version="2.0"
+ id="bug">
+ <xsl:variable name="v0">
+ <xsl:for-each select="$v0" />
+ </xsl:variable>
+ <xsl:template name="t2" match="/">
+ <xsl:copy-of select="number($v0)" />
+ </xsl:template>
+</xsl:transform>
+
+<e1 />
+
+</doc>
diff --git a/dom/xslt/crashtests/528488.xml b/dom/xslt/crashtests/528488.xml
new file mode 100644
index 000000000..904b34561
--- /dev/null
+++ b/dom/xslt/crashtests/528488.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+ id ID #REQUIRED>
+]>
+<doc>
+ <xsl:transform
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+ xmlns:exslstrings="http://exslt.org/strings"
+ version="2.0"
+ id="bug">
+ <xsl:variable name="v0" select="$v0" />
+ <xsl:template name="t2" match="/">
+ <xsl:param name="p0" select="exslstrings:tokenize('1234','foobar')" />
+ <xsl:copy-of select="round($v0)" />
+ </xsl:template>
+ </xsl:transform>
+</doc>
diff --git a/dom/xslt/crashtests/528963.xml b/dom/xslt/crashtests/528963.xml
new file mode 100644
index 000000000..d855e7563
--- /dev/null
+++ b/dom/xslt/crashtests/528963.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xml" href="#bug"?>
+<!DOCTYPE doc [
+<!ATTLIST xsl:transform
+ id ID #REQUIRED>
+]>
+<doc>
+ <xsl:transform
+ xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+ version="2.0"
+ id="bug">
+ <xsl:key name="k0" match="e2" use="name('foo')" />
+
+ <xsl:template name="t1" match="/">
+ <xsl:element name="e2" namespace="{//doc}" />
+ </xsl:template>
+ <xsl:template name="t2" match="key('k0', 'bar')" />
+ </xsl:transform>
+
+ <e2/>
+
+</doc>
diff --git a/dom/xslt/crashtests/545927.html b/dom/xslt/crashtests/545927.html
new file mode 100644
index 000000000..0a9010e21
--- /dev/null
+++ b/dom/xslt/crashtests/545927.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+<script>
+function main()
+{
+ xml=document.implementation.createDocument('', '', null);
+ xml.appendChild(doc=xml.createElement('root'));
+
+ var p = new DOMParser();
+ text = '<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">';
+ text += '<xsl:template match="/">';
+ text += '<body>';
+ text += '<xsl:number value="2147483648" format="i"/>';
+ text += '</body>';
+ text += '</xsl:template>';
+ text += '</xsl:stylesheet>';
+ xsl=p.parseFromString(text, 'text/xml');
+
+ xsltProcessor=new XSLTProcessor();
+ xsltProcessor.importStylesheet(xsl);
+ d = xsltProcessor.transformToFragment(xml, document);
+}
+</script>
+</head>
+<body onload="main()">
+</body>
+</html>
+
diff --git a/dom/xslt/crashtests/601543.html b/dom/xslt/crashtests/601543.html
new file mode 100644
index 000000000..af025b242
--- /dev/null
+++ b/dom/xslt/crashtests/601543.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+(new XSLTProcessor).setParameter('', '', [{}, null]);
+</script>
diff --git a/dom/xslt/crashtests/602115.html b/dom/xslt/crashtests/602115.html
new file mode 100644
index 000000000..ad42d76a0
--- /dev/null
+++ b/dom/xslt/crashtests/602115.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<script>
+
+try {
+ var docType = document.implementation.createDocumentType(undefined, '', '');
+ var doc = document.implementation.createDocument('', '', null);
+ var xp = new XSLTProcessor;
+ xp.importStylesheet(doc);
+ xp.transformToDocument(docType);
+}
+catch (ex) {}
+
+try {
+ docType = document.implementation.createDocumentType(undefined, '', '');
+ doc = document.implementation.createDocument('', '', null);
+ xp = new XSLTProcessor;
+ xp.importStylesheet(doc);
+ xp.transformToFragment(docType, document);
+}
+catch (ex) {}
+
+</script>
diff --git a/dom/xslt/crashtests/603844.html b/dom/xslt/crashtests/603844.html
new file mode 100644
index 000000000..f576effdb
--- /dev/null
+++ b/dom/xslt/crashtests/603844.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ frame.onload = y;
+ frame.src = "data:text/plain,0";
+ document.body.appendChild(frame);
+ frameDoc = frame.contentDocument;
+
+ function y()
+ {
+ frameDoc.removeChild(frameDoc.documentElement);
+
+ var xp = new XSLTProcessor;
+ xp.importStylesheet(frameDoc);
+ try {
+ xp.transformToDocument(frameDoc.createTextNode('x'));
+ } catch(e) { }
+
+ document.documentElement.removeAttribute("class");
+ }
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/xslt/crashtests/667315.xml b/dom/xslt/crashtests/667315.xml
new file mode 100644
index 000000000..7a560ba3b
--- /dev/null
+++ b/dom/xslt/crashtests/667315.xml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="#stylesheet"?>
+<!DOCTYPE root [
+ <!ATTLIST xsl:stylesheet id ID #IMPLIED>
+]>
+<root>
+<xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+ <xsl:variable name="var"><p>a</p></xsl:variable>
+ <xsl:template match="/"><xsl:copy-of select="$var" /></xsl:template>
+</xsl:stylesheet>
+</root>
diff --git a/dom/xslt/crashtests/91332.xml b/dom/xslt/crashtests/91332.xml
new file mode 100644
index 000000000..c5a463c8a
--- /dev/null
+++ b/dom/xslt/crashtests/91332.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="91332.xsl" ?>
+<root>
+ <category name="Rectangles">
+ <list item="square" />
+ </category>
+ <quad id="square">
+ <desc>A square is ...</desc>
+ </quad>
+</root>
diff --git a/dom/xslt/crashtests/91332.xsl b/dom/xslt/crashtests/91332.xsl
new file mode 100644
index 000000000..7d01df22b
--- /dev/null
+++ b/dom/xslt/crashtests/91332.xsl
@@ -0,0 +1,21 @@
+<?xml version="1.0" ?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+
+ <xsl:key name="polyList" match="quad" use="@id" />
+
+ <xsl:template match="root">
+ <html><body><xsl:apply-templates select="category" /></body></html>
+ </xsl:template>
+
+ <xsl:template match="category">
+ <table><xsl:apply-templates select="list" /></table>
+ </xsl:template>
+
+ <xsl:template match="list">
+ <tr><td><xsl:apply-templates select="key('polyList',@item)" /></td></tr>
+ </xsl:template>
+
+ <xsl:template match="quad">
+ <b>Please output something!</b>
+ </xsl:template>
+</xsl:stylesheet>
diff --git a/dom/xslt/crashtests/crashtests.list b/dom/xslt/crashtests/crashtests.list
new file mode 100644
index 000000000..5958655d6
--- /dev/null
+++ b/dom/xslt/crashtests/crashtests.list
@@ -0,0 +1,20 @@
+load 91332.xml
+load 111994.xml
+load 182460-table.xhtml
+load 226425.xml
+load 406106-1.html
+load 483444.xml
+load 485217.xml
+load 485286.xml
+load 527558_1.xml
+load 528300.xml
+load 528488.xml
+load 528963.xml
+load 545927.html
+load 601543.html
+load 602115.html
+load 603844.html
+load 667315.xml
+load 1089049.html
+load 1205163.xml
+load 1243337.xml