diff options
Diffstat (limited to 'layout/svg/crashtests')
201 files changed, 3035 insertions, 0 deletions
diff --git a/layout/svg/crashtests/1016145.svg b/layout/svg/crashtests/1016145.svg new file mode 100644 index 000000000..5c362a17e --- /dev/null +++ b/layout/svg/crashtests/1016145.svg @@ -0,0 +1,5 @@ +<!-- svg mime type but html root --> +<html xmlns="http://www.w3.org/1999/xhtml"> + <body style="display: table-column-group;" /> +</html> + diff --git a/layout/svg/crashtests/1028512.svg b/layout/svg/crashtests/1028512.svg new file mode 100644 index 000000000..0c9458b47 --- /dev/null +++ b/layout/svg/crashtests/1028512.svg @@ -0,0 +1,15 @@ +<!-- {lower,upper}-{roman,alpha} in svg --> +<svg xmlns="http://www.w3.org/2000/svg"> +<script> +<![CDATA[ + +function boom() +{ + document.documentElement.style.transition = "2s"; + document.documentElement.style.listStyleType = "lower-roman"; +} + +window.addEventListener("load", boom, false); + +]]> +</script></svg> diff --git a/layout/svg/crashtests/1140080-1.svg b/layout/svg/crashtests/1140080-1.svg new file mode 100644 index 000000000..d42456246 --- /dev/null +++ b/layout/svg/crashtests/1140080-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<script> + +window.addEventListener("load", function() { + var stop = document.getElementsByTagName("stop")[0]; + stop.setAttribute("offset", "0"); +}, false); + +</script> +<stop/> +</svg> diff --git a/layout/svg/crashtests/1149542-1.svg b/layout/svg/crashtests/1149542-1.svg new file mode 100644 index 000000000..7353f1277 --- /dev/null +++ b/layout/svg/crashtests/1149542-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <style> + text { white-space: pre } + text::first-letter { color: red; } + tspan { display: none } + </style> + <text textLength="64"> +<tspan>a</tspan>b</text> +</svg> diff --git a/layout/svg/crashtests/1156581-1.svg b/layout/svg/crashtests/1156581-1.svg new file mode 100644 index 000000000..97e5fb1ca --- /dev/null +++ b/layout/svg/crashtests/1156581-1.svg @@ -0,0 +1,12 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="filter: url(#a); clip: rect(0px, 4rem, 2px, 2px);"> + <script> + function boom() + { + document.getElementById("a").style.overflow = "hidden"; + document.documentElement.style.fontSize = "10px"; + } + window.addEventListener("load", boom, false); + </script> + + <set id="a"/> +</svg> diff --git a/layout/svg/crashtests/1182496-1.html b/layout/svg/crashtests/1182496-1.html new file mode 100644 index 000000000..1d95905a2 --- /dev/null +++ b/layout/svg/crashtests/1182496-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE html> +<html> +<head> + <script> + function tweak(){ + document.body.innerHTML="fuzz" + } + </script> +</head> +<body onload="tweak()"> + <svg xmlns="http://www.w3.org/2000/svg"> + <text> + <foreignObject requiredFeatures="foo"> + <svg style="position: absolute;"/> + </foreignObject> + </text> + </svg> +</body> +</html> + + diff --git a/layout/svg/crashtests/1209525-1.svg b/layout/svg/crashtests/1209525-1.svg new file mode 100644 index 000000000..21134df33 --- /dev/null +++ b/layout/svg/crashtests/1209525-1.svg @@ -0,0 +1,7 @@ +<svg xmlns="http://www.w3.org/2000/svg" + width="0" height="0"> + + <rect width="10" height="10" stroke="black" + vector-effect="non-scaling-stroke" /> + +</svg> diff --git a/layout/svg/crashtests/1223281-1.svg b/layout/svg/crashtests/1223281-1.svg new file mode 100644 index 000000000..b548a9a60 --- /dev/null +++ b/layout/svg/crashtests/1223281-1.svg @@ -0,0 +1,24 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<script> +<![CDATA[ + +function forceFrameConstruction() +{ + document.documentElement.getBoundingClientRect(); +} + +function boom() +{ + document.documentElement.style.overflow = "scroll"; + forceFrameConstruction() + document.documentElement.style.visibility = "visible"; +} + +window.addEventListener("load", boom, false); + +]]> +</script> + +<rect style="perspective: 10em;" /> +</svg> + diff --git a/layout/svg/crashtests/220165-1.svg b/layout/svg/crashtests/220165-1.svg new file mode 100644 index 000000000..0335f78d4 --- /dev/null +++ b/layout/svg/crashtests/220165-1.svg @@ -0,0 +1,21 @@ +<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:html="http://www.w3.org/1999/xhtml" height="500"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="document.documentElement.getBoundingClientRect();
+ document.getElementById('x').textContent = 'New text'">
+
+ <foreignObject x="200" y="180" width="100" height="50" >
+ <html:button id="x">Old long long long text</html:button>
+ </foreignObject>
+
+ <g transform="rotate(10) translate(-100) scale(0.8)">
+ <polygon style="fill:red; fill-opacity:0.5;"
+ points="350, 75 379,161 469,161 397,215
+ 423,301 350,250 277,301 303,215
+ 231,161 321,161" />
+
+ </g>
+
+</svg>
diff --git a/layout/svg/crashtests/267650-1.svg b/layout/svg/crashtests/267650-1.svg new file mode 100644 index 000000000..3e9c7ecc0 --- /dev/null +++ b/layout/svg/crashtests/267650-1.svg @@ -0,0 +1,4 @@ +<?xml version='1.0'?>
+<svg xmlns='http://www.w3.org/2000/svg'>
+ <text fill='none' stroke='black'>TESTCASE</text>
+</svg>
diff --git a/layout/svg/crashtests/294022-1.svg b/layout/svg/crashtests/294022-1.svg new file mode 100644 index 000000000..f30b484c8 --- /dev/null +++ b/layout/svg/crashtests/294022-1.svg @@ -0,0 +1,17 @@ +<?xml version="1.0"?> +<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" + "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + > + + <g> + <clipPath id="action_box_cp"> + <rect width="100" height="46"/> + </clipPath> + <text style="clip-path:url(#action_box_cp); " y="10" id="action_boxtext" pointer-events="none" class="TextBoxText"> + <tspan x="0" dy="0">Action</tspan> + </text> + </g> + +</svg> diff --git a/layout/svg/crashtests/307314-1.svg b/layout/svg/crashtests/307314-1.svg new file mode 100644 index 000000000..5c538df88 --- /dev/null +++ b/layout/svg/crashtests/307314-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait" onload="setTimeout(function() { var g = document.getElementById('N1'), h = document.getElementById('N2'); g.appendChild(h); document.documentElement.removeAttribute("class"); }, 20);"> + + <text id="N1"/> + <text id="N2"> + <tspan> + <textPath/> + </tspan> + </text> +</svg> diff --git a/layout/svg/crashtests/308615-1.svg b/layout/svg/crashtests/308615-1.svg new file mode 100644 index 000000000..fe5391de3 --- /dev/null +++ b/layout/svg/crashtests/308615-1.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + + <pattern id="pattern1"> + <rect style="fill:url(#pattern1);"/> + </pattern> + + <rect style="fill:url(#pattern1);" /> + +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/308917-1.svg b/layout/svg/crashtests/308917-1.svg new file mode 100644 index 000000000..7d0ae44f7 --- /dev/null +++ b/layout/svg/crashtests/308917-1.svg @@ -0,0 +1,35 @@ +<?xml version="1.0" encoding="UTF-8"?> + +<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" width="100%" height="100%" viewBox="0 0 480 360" class="reftest-wait" onload="first();"> + +<script><![CDATA[ + +function first() +{ + document.getElementById("z").appendChild(document.getElementById("pat1")); + setTimeout(second, 30); +} + +function second() +{ + document.getElementById("pat4").appendChild(document.getElementById("z")); + document.documentElement.removeAttribute("class"); +} + +]]></script> + + + <pattern patternUnits="userSpaceOnUse" id="pat1" x="10" y="10" width="20" height="20"> + <rect x="5" y="5" width="10" height="10" fill="red" /> + <rect x="10" y="10" width="10" height="10" fill="green" /> + </pattern> + <rect x="25" y="10" width="430" height="60" stroke="black" fill="url(#pat1)" /> + + <pattern patternUnits="userSpaceOnUse" id="pat4" x="0" y="0" width="20" height="10"> + <rect x="0" y="0" width="10" height="10" fill="red" /> + <rect x="10" y="0" width="10" height="10" fill="blue" /> + </pattern> + <text font-family="Arial" font-size="40" fill="none" stroke="url(#pat4)" stroke-width="2" x="25" y="275" id="z">Pattern on stroke</text> + +</svg> + diff --git a/layout/svg/crashtests/310436-1.svg b/layout/svg/crashtests/310436-1.svg new file mode 100644 index 000000000..e6dd5680c --- /dev/null +++ b/layout/svg/crashtests/310436-1.svg @@ -0,0 +1,28 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"><script><![CDATA[ + +function init() { + var docElt = document.documentElement; + var div1 = document.getElementById("div1"); + var div2 = document.getElementById("div2"); + var textNode = div2.childNodes[0]; + + function first() + { + docElt.appendChild(div2); + div2.appendChild(div1); + } + + function second() + { + div2.appendChild(div1); + div1.appendChild(textNode); + document.documentElement.removeAttribute("class"); + } + + first(); + setTimeout(second, 30); +} + +window.addEventListener("load", init, false); + +]]></script><div xmlns="http://www.w3.org/1999/xhtml" id="div1"><div id="div2">A Z</div></div></svg> diff --git a/layout/svg/crashtests/310638.svg b/layout/svg/crashtests/310638.svg new file mode 100644 index 000000000..e5ee30fb2 --- /dev/null +++ b/layout/svg/crashtests/310638.svg @@ -0,0 +1,35 @@ +<svg xmlns="http://www.w3.org/2000/svg"><div xmlns='http://www.w3.org/1999/xhtml' id="div1">
+<div id="div2">bar</div> +</div>
+<script><![CDATA[ + +function init() +{ + var div2 = document.getElementById("div2"); + var div1 = document.getElementById("div1"); + var docElt = document.documentElement; + var titleText = document.createTextNode("foo baz"); + + docElt.appendChild(div2);
div2.appendChild(titleText); + + function second () + { + div2.appendChild(div1); + removeNode(titleText); + removeNode(div2); + } + + setTimeout(second, 0); +} + + +function removeNode(q1) { q1.parentNode.removeChild(q1); } + + +setTimeout(init, 0); + + +]]></script> + + +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/313737-1.xml b/layout/svg/crashtests/313737-1.xml new file mode 100644 index 000000000..93421f607 --- /dev/null +++ b/layout/svg/crashtests/313737-1.xml @@ -0,0 +1,16 @@ +<?xml version="1.0" encoding="ISO-8859-1" standalone="no"?> +<!DOCTYPE xhtml PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd" [ +]> + +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:xlink="http://www.w3.org/1999/xlink"> + <head> + <title>bug 313737</title> + </head> + <body> + + <svg:svg style="position:fixed;"> + <input type="text" style="position:absolute;" /> + </svg:svg> + + </body> +</html> diff --git a/layout/svg/crashtests/314244-1.xul b/layout/svg/crashtests/314244-1.xul new file mode 100644 index 000000000..e801ca70e --- /dev/null +++ b/layout/svg/crashtests/314244-1.xul @@ -0,0 +1,26 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> +<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=314244 --> +<!-- Just checking for lack of crash, nothing more --> + +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + title="GMail" + width="300" height="300" + screenX="10" screenY="10"> + + <hbox> + <svg version="1.0" + xmlns="http://www.w3.org/2000/svg" + width="100px" height="100px" + id="back-button" + class="nav-button" + style="display: -moz-box;"> + <rect x="10" y="10" width="80" height="80" fill="blue" /> + </svg> + <spacer flex="1" /> + </hbox> + + <spacer flex="1" /> + +</window> + diff --git a/layout/svg/crashtests/322185-1.svg b/layout/svg/crashtests/322185-1.svg new file mode 100644 index 000000000..38958c0b4 --- /dev/null +++ b/layout/svg/crashtests/322185-1.svg @@ -0,0 +1,6 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> + <g id="g" style="display: -moz-grid-line; overflow: hidden;"> + <circle /> + </g> +</svg> diff --git a/layout/svg/crashtests/322215-1.svg b/layout/svg/crashtests/322215-1.svg new file mode 100644 index 000000000..f872fbcd8 --- /dev/null +++ b/layout/svg/crashtests/322215-1.svg @@ -0,0 +1,31 @@ +<?xml version="1.0" standalone="no"?> +<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" +"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> +<!-- This Source Code Form is subject to the terms of the Mozilla Public + - License, v. 2.0. If a copy of the MPL was not distributed with this + - file, You can obtain one at http://mozilla.org/MPL/2.0/. --> +<!-- +Copyright Georgi Guninski +--> + + +<svg width="100%" height="100%" version="1.1" +xmlns="http://www.w3.org/2000/svg"> + +<defs> +<filter id="MyFilter" filterUnits="userSpaceOnUse" +x="0" y="0" width="32769" height="32769"> + +<feGaussianBlur in="SourceAlpha" stdDeviation="4" result="blur"/> + +</filter> +</defs> + +<rect x="1" y="1" width="198" height="118" fill="#cccccc" /> + +<g filter="url(#MyFilter)"> +<text fill="#FFFFFF" stroke="black" font-size="45" +x="42" y="42">Feck b1ll</text> +</g> + +</svg> diff --git a/layout/svg/crashtests/323704-1.svg b/layout/svg/crashtests/323704-1.svg new file mode 100644 index 000000000..13b8d5224 --- /dev/null +++ b/layout/svg/crashtests/323704-1.svg @@ -0,0 +1,12 @@ +<svg xmlns='http://www.w3.org/2000/svg' +xmlns:xlink='http://www.w3.org/1999/xlink'> + + <clipPath id='clipPath_0'> + <rect x='10' y='10' width='25' height='25' rx='5' ry='5' fill='none' +clip-path='url(#clipPath_0)'/> + </clipPath> + + <rect x='5' y='5' width='35' height='35' fill='red' +clip-path='url(#clipPath_0)'/> + +</svg> diff --git a/layout/svg/crashtests/325427-1.svg b/layout/svg/crashtests/325427-1.svg new file mode 100644 index 000000000..1f1c64525 --- /dev/null +++ b/layout/svg/crashtests/325427-1.svg @@ -0,0 +1,20 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <defs>
+ <g id="module">
+ <use xlink:href="#module" />
+ <use xlink:href="#module" />
+ <use xlink:href="#module" />
+ <use xlink:href="#module" />
+ <use xlink:href="#baseModule" />
+ <use xlink:href="#baseModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ </g>
+ <use id="baseModule" xlink:href="#module" />
+ <use id="extendsModule" xlink:href="#module" />
+ </defs>
+</svg>
diff --git a/layout/svg/crashtests/326495-1.svg b/layout/svg/crashtests/326495-1.svg new file mode 100644 index 000000000..4748e3157 --- /dev/null +++ b/layout/svg/crashtests/326495-1.svg @@ -0,0 +1,16 @@ +<?xml version="1.0"?> +<svg width="10cm" height="5cm" viewBox="0 0 1000 500" + xmlns="http://www.w3.org/2000/svg" + version="1.1"> + + <script> + function init() + { + document.getElementsByTagName("rect")[0].style.display = "-moz-inline-stack"; + } + + window.addEventListener("load", init, false); + </script> + + <rect requiredFeatures="http://www.w3.org/TR/SVG11/feature#SVG-nonexistent-feature"/> +</svg> diff --git a/layout/svg/crashtests/326974-1.svg b/layout/svg/crashtests/326974-1.svg new file mode 100644 index 000000000..750165b73 --- /dev/null +++ b/layout/svg/crashtests/326974-1.svg @@ -0,0 +1,21 @@ +<?xml version="1.0" encoding="UTF-8"?>
+ +<svg xmlns="http://www.w3.org/2000/svg">
+ +<script> + +function init() {
var n2 = document.getElementById("n2"); + var n3 = document.getElementById("n3"); + + n2.appendChild(n3); +}
+ +window.addEventListener("load", init, false); + +</script> + +
+<g id="n2">
<text id="n3" /> +</g>
+ +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/327706-1.svg b/layout/svg/crashtests/327706-1.svg new file mode 100644 index 000000000..9aae90925 --- /dev/null +++ b/layout/svg/crashtests/327706-1.svg @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<svg xmlns="http://www.w3.org/2000/svg"> + +<script> + +document.documentElement.unsuspendRedraw(6) + +</script> +</svg> diff --git a/layout/svg/crashtests/327709-1.svg b/layout/svg/crashtests/327709-1.svg new file mode 100644 index 000000000..ce0711427 --- /dev/null +++ b/layout/svg/crashtests/327709-1.svg @@ -0,0 +1,17 @@ +<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=327709 --> +<!-- Just checking for absence of assertion, nothing more --> +<svg xmlns="http://www.w3.org/2000/svg"> + +<script> +function init() +{ + var apsl = document.getElementById("n126").animatedPathSegList; + apsl.appendItem(apsl.__proto__); +} +window.addEventListener("load", init, false); +</script> + +<path id="n126" d="M 270 60 L 320 60 L 320 110 Z"/> + +</svg> + diff --git a/layout/svg/crashtests/327711-1.svg b/layout/svg/crashtests/327711-1.svg new file mode 100644 index 000000000..d919b866f --- /dev/null +++ b/layout/svg/crashtests/327711-1.svg @@ -0,0 +1,19 @@ +<?xml version="1.0" encoding="UTF-8"?>
+ +<svg xmlns="http://www.w3.org/2000/svg"> + +<script>
+ +function init() +{
+ document.documentElement.unsuspendRedrawAll(); + document.getElementsByTagName("text")[0].firstChild.data = "Quux"; +}
+ +window.addEventListener("load", init, false); + +</script> + +<text x="125" y="30">Foo</text>
+ +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/328137-1.svg b/layout/svg/crashtests/328137-1.svg new file mode 100644 index 000000000..26190b1eb --- /dev/null +++ b/layout/svg/crashtests/328137-1.svg @@ -0,0 +1,24 @@ +<?xml version="1.0" encoding="UTF-8"?> + +<svg xmlns="http://www.w3.org/2000/svg"> + +<script> + + +function init() +{ + x = document.getElementsByTagName("stop"); + x[0].appendChild(x[1]); +} + + +window.addEventListener("load", init, false); + +</script> + +<radialGradient> + <stop/> + <stop/> +</radialGradient> + +</svg> diff --git a/layout/svg/crashtests/329848-1.svg b/layout/svg/crashtests/329848-1.svg new file mode 100644 index 000000000..ac4f0022e --- /dev/null +++ b/layout/svg/crashtests/329848-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg">
<polygon transform="?" points="100,100 200,100 150,200"/>
</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/337408-1.xul b/layout/svg/crashtests/337408-1.xul new file mode 100644 index 000000000..f56c06ec9 --- /dev/null +++ b/layout/svg/crashtests/337408-1.xul @@ -0,0 +1,21 @@ +<?xml version="1.0"?> +<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=337408 --> +<!-- Just checking for lack of crash, nothing more --> +<window id="svg-in-xul-stack" + xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:svg="http://www.w3.org/2000/svg" + style="background-color:white;" + screenX="20" + screenY="20" + width="600" + height="400"> + + <stack> + <box flex="1"> + <label value="foo"/> + </box> + <svg:svg> + <svg:rect width="100%" height="100%" fill="red" fill-opacity="0.5"/> + </svg:svg> + </stack> +</window> diff --git a/layout/svg/crashtests/338301-1.xhtml b/layout/svg/crashtests/338301-1.xhtml new file mode 100644 index 000000000..3367eedeb --- /dev/null +++ b/layout/svg/crashtests/338301-1.xhtml @@ -0,0 +1,13 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de"> +<body> + + <svg xmlns="http://www.w3.org/2000/svg"> + <defs> + <linearGradient> + <path/> + </linearGradient> + </defs> + </svg> + +</body> +</html> diff --git a/layout/svg/crashtests/338312-1.xhtml b/layout/svg/crashtests/338312-1.xhtml new file mode 100644 index 000000000..5a751a2ae --- /dev/null +++ b/layout/svg/crashtests/338312-1.xhtml @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> + + +function boom() +{ + document.getElementById("foo").appendChild(document.getElementById("bar")); +} + +window.addEventListener("load", boom, false); + +</script> +</head> + +<body> + + <div id="foo"></div> + + <svg xmlns="http://www.w3.org/2000/svg"> + <defs> + <linearGradient id="grad1"/> + </defs> + <rect id="bar" style="fill:url(#grad1);" /> + </svg> + +</body> +</html> diff --git a/layout/svg/crashtests/340083-1.svg b/layout/svg/crashtests/340083-1.svg new file mode 100644 index 000000000..7f015b6ef --- /dev/null +++ b/layout/svg/crashtests/340083-1.svg @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="UTF-8"?> + +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100%" height="100%"> + <defs> + <title> + <image x="30" y="0" width="190" height="190" xlink:href="../../../testing/crashtest/images/tree.gif"/> + </title> + </defs> +</svg> diff --git a/layout/svg/crashtests/340945-1.svg b/layout/svg/crashtests/340945-1.svg new file mode 100644 index 000000000..01ac66fb3 --- /dev/null +++ b/layout/svg/crashtests/340945-1.svg @@ -0,0 +1,2 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="display: table;"> +</svg> diff --git a/layout/svg/crashtests/342923-1.html b/layout/svg/crashtests/342923-1.html new file mode 100644 index 000000000..bed6e8979 --- /dev/null +++ b/layout/svg/crashtests/342923-1.html @@ -0,0 +1,23 @@ +<html> +<head> +<script> + +function boo() +{ + var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect"); + rect.setAttribute("stroke", "blue"); + + document.body.appendChild(rect); +} + +</script> +</head> + +<body class="bodytext" onload="boo();"> + +<div id="c1"></div> + +<p>In a debug trunk build from 2006-006-27, loading this page triggers an assertion. (It also triggers a CSS error in the console, but I think that's a known, separate bug.)</p> + +</body> +</html> diff --git a/layout/svg/crashtests/343221-1.xhtml b/layout/svg/crashtests/343221-1.xhtml new file mode 100644 index 000000000..890b161df --- /dev/null +++ b/layout/svg/crashtests/343221-1.xhtml @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> + +function boo() +{ + document.getElementById("c").style.overflow = "hidden"; + document.documentElement.removeAttribute("class"); +} + +</script> +</head> +<body onload="setTimeout(boo, 30);"> + +<svg xmlns="http://www.w3.org/2000/svg"> + <circle id="c" cx="50" cy="50" r="20" /> +</svg> + +</body> +</html> diff --git a/layout/svg/crashtests/344749-1.svg b/layout/svg/crashtests/344749-1.svg new file mode 100644 index 000000000..1a02d7c18 --- /dev/null +++ b/layout/svg/crashtests/344749-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + +<circle cx="6cm" cy="2cm" r="100" fill="red" transform="translate(0,50)" /> +<circle cx="6cm" cy="2cm" r="100" fill="blue" transform="translate(70,150)" /> +<circle cx="6cm" cy="2cm" r="100" fill="green" transform="translate(-70,150)" /> + +<rect id="rect1" fill="url(#pat0)"/> + +<pattern patternUnits="userSpaceOnUse" id="pat0" x="10" y="10" width="20" height="20">
<rect x="5" y="5" width="10" height="10" fill="red" />
<rect x="10" y="10" width="10" height="10" fill="green" />
</pattern>
+
</svg> diff --git a/layout/svg/crashtests/344887-1.svg b/layout/svg/crashtests/344887-1.svg new file mode 100644 index 000000000..f0bd21c59 --- /dev/null +++ b/layout/svg/crashtests/344887-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(foo, 30);" class="reftest-wait"> + +<script> + +var SVG_NS = "http://www.w3.org/2000/svg"; + +function foo() +{ + var rect = document.createElementNS(SVG_NS, 'rect'); + rect.setAttribute('opacity', ".3"); + document.documentElement.appendChild(rect); + document.documentElement.removeAttribute("class"); +} + +</script> + + +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/344892-1.svg b/layout/svg/crashtests/344892-1.svg new file mode 100644 index 000000000..a38d7eb40 --- /dev/null +++ b/layout/svg/crashtests/344892-1.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<text stroke-width="50%">foo</text> + +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/344898-1.svg b/layout/svg/crashtests/344898-1.svg new file mode 100644 index 000000000..34c3f45a4 --- /dev/null +++ b/layout/svg/crashtests/344898-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(removeText, 30);" class="reftest-wait"> + + +<script> + +function removeText() +{ + var x = document.getElementById("textPath"); + x.removeChild(x.firstChild); + document.documentElement.removeAttribute("class"); +} + +</script> + + +<text x="30" y="30"><textPath id="textPath">Foo</textPath></text> + + +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/344904-1.svg b/layout/svg/crashtests/344904-1.svg new file mode 100644 index 000000000..a2c8d0764 --- /dev/null +++ b/layout/svg/crashtests/344904-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30);" class="reftest-wait"> + +<script> + +function boom() +{ + document.getElementById("m").setAttribute("stroke-miterlimit", 1); + document.documentElement.removeAttribute("class"); +} + +</script> + + +<marker> + <path id="m" /> +</marker> + + +</svg> diff --git a/layout/svg/crashtests/345418-1.svg b/layout/svg/crashtests/345418-1.svg new file mode 100644 index 000000000..2cf8b331f --- /dev/null +++ b/layout/svg/crashtests/345418-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<tspan>arg</tspan> +
</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/348982-1.xhtml b/layout/svg/crashtests/348982-1.xhtml new file mode 100644 index 000000000..ad0340689 --- /dev/null +++ b/layout/svg/crashtests/348982-1.xhtml @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + +<head> +<style> +#div, #svg { display: table; } +#g { display: inline; } +</style> +</head> + +<body> + <div id="div"> + <svg id="svg" xmlns="http://www.w3.org/2000/svg"> + <g id="g"> + <circle cx="6.5cm" cy="2cm" r="100" style="fill: blue;" /> + </g> + </svg> + </div> +</body> + +</html> diff --git a/layout/svg/crashtests/354777-1.xhtml b/layout/svg/crashtests/354777-1.xhtml new file mode 100644 index 000000000..e82baf34c --- /dev/null +++ b/layout/svg/crashtests/354777-1.xhtml @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + +<head> +<script> + +var SVG_NS = "http://www.w3.org/2000/svg"; + +function boom() +{ + var svgElem = document.createElementNS(SVG_NS, "svg"); + var ellipse = document.createElementNS(SVG_NS, "ellipse"); + + svgElem.setAttribute("viewBox", "0 0 30 40"); + document.body.appendChild(svgElem); + document.body.appendChild(ellipse); + ellipse.appendChild(svgElem); + svgElem.removeAttribute("viewBox"); +} + +</script> +</head> + +<body onload="boom()"> + +</body> + +</html> + diff --git a/layout/svg/crashtests/359516-1.svg b/layout/svg/crashtests/359516-1.svg new file mode 100644 index 000000000..c997eb3a8 --- /dev/null +++ b/layout/svg/crashtests/359516-1.svg @@ -0,0 +1,36 @@ +<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ class="reftest-wait"
+ onload="setTimeout(doStuff, 30);">
+
+<html:script style="display: none;" type="text/javascript">
+
+function doStuff()
+{
+ var svg = document.documentElement;
+ var ellipse = document.getElementById("ellipse");
+ var filter = document.getElementById("filter");
+
+ document.addEventListener("DOMNodeRemoved", foopy, false);
+ filter.removeChild(filter.firstChild);
+ document.removeEventListener("DOMNodeRemoved", foopy, false);
+
+ function foopy()
+ {
+ document.removeEventListener("DOMNodeRemoved", foopy, false);
+ svg.appendChild(filter);
+ }
+
+ // Needed for the crash, but not for the assertion.
+ svg.appendChild(ellipse);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<ellipse id="ellipse" cx="200" cy="150" rx="70" ry="40" style="filter: url(#filter);"/>
+
+<filter id="filter"> </filter>
+
+</svg>
diff --git a/layout/svg/crashtests/361015-1.svg b/layout/svg/crashtests/361015-1.svg new file mode 100644 index 000000000..8ac4bc56f --- /dev/null +++ b/layout/svg/crashtests/361015-1.svg @@ -0,0 +1,33 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:html="http://www.w3.org/1999/xhtml" + class="reftest-wait" + onload="setTimeout(boom, 30)"> + +<html:script> +<![CDATA[ + +function boom() +{ + var grad = document.getElementById("grad"); + var g = document.getElementById("g"); + grad.appendChild(g); + g.removeAttribute("transform"); + document.documentElement.removeAttribute("class"); +} + +]]> +</html:script> + + + <g id="g" transform="translate(500,0)"> + <text x="25" y="85">Foo</text> + </g> + + + <linearGradient id="grad" gradientUnits="objectBoundingBox" x1="0" y1="0" x2="1" y2="1"> + <stop stop-color="blue" offset="0.2"/> + <stop stop-color="lime" offset="0.4"/> + </linearGradient> + + +</svg> diff --git a/layout/svg/crashtests/361587-1.svg b/layout/svg/crashtests/361587-1.svg new file mode 100644 index 000000000..52bce9eda --- /dev/null +++ b/layout/svg/crashtests/361587-1.svg @@ -0,0 +1,31 @@ +<svg xmlns="http://www.w3.org/2000/svg" + onload="setTimeout(boom, 30);" + class="reftest-wait"> + +<script style="display: none" type="text/javascript"> +<![CDATA[ + +function boom() +{ + var oldGrad = document.getElementById("grad"); + oldGrad.parentNode.removeChild(oldGrad); + + var newGrad = document.createElementNS("http://www.w3.org/2000/svg", "radialGradient"); + newGrad.setAttribute("gradientUnits", "userSpaceOnUse"); + newGrad.setAttribute("id", "grad"); + + document.documentElement.appendChild(newGrad); + + document.documentElement.removeAttribute("class"); +} + +]]> +</script> + + <radialGradient id="grad" gradientUnits="userSpaceOnUse" cx="240" cy="210" r="220" fx="240" fy="210"> + <stop stop-color="yellow" offset="0"/> + <stop stop-color="green" offset="1"/> + </radialGradient> + <rect x="20" y="150" width="440" height="80" fill="url(#grad)" stroke-width="40"/> + +</svg> diff --git a/layout/svg/crashtests/363611-1.xhtml b/layout/svg/crashtests/363611-1.xhtml new file mode 100644 index 000000000..6bc386bcd --- /dev/null +++ b/layout/svg/crashtests/363611-1.xhtml @@ -0,0 +1,21 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<script style="display: none" type="text/javascript"> + +function boom() +{ + var fo = document.createElementNS("http://www.w3.org/2000/svg", 'foreignObject'); + document.getElementById("innerSVG").appendChild(fo); +} + +</script> + +</head> + +<body onload="boom();"> + +<svg xmlns="http://www.w3.org/2000/svg" ><linearGradient><svg id="innerSVG"></svg></linearGradient></svg> + +</body> +</html> diff --git a/layout/svg/crashtests/364688-1.svg b/layout/svg/crashtests/364688-1.svg new file mode 100644 index 000000000..045061cd2 --- /dev/null +++ b/layout/svg/crashtests/364688-1.svg @@ -0,0 +1,34 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:html="http://www.w3.org/1999/xhtml" + onload="setTimeout(boom, 30);" + class="reftest-wait"> + +<script> +function boom() +{ + document.getElementById("sss").removeAttribute('value'); + + document.documentElement.removeAttribute("class"); +} +</script> + + +<foreignObject width="500" height="500" y="300"> + +<div xmlns="http://www.w3.org/1999/xhtml"> + +<table border="1"> + <tr> + <td>Foo</td> + </tr> + <tr> + <td><input type="text" value="Baz" id="sss" /></td> + </tr> +</table> + +</div> + +</foreignObject> + + +</svg> diff --git a/layout/svg/crashtests/366956-1.svg b/layout/svg/crashtests/366956-1.svg new file mode 100644 index 000000000..9836c7ea3 --- /dev/null +++ b/layout/svg/crashtests/366956-1.svg @@ -0,0 +1,61 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom1, 50);" class="reftest-wait"> + +<html:script> + +function boom1() +{ + document.getElementsByTagName("mi")[0].setAttribute('id', "ffff"); + + document.getElementById("fo").appendChild(document.createTextNode(" ")); + + setTimeout(boom2, 50); +} + +function boom2() +{ + var fodiv = document.getElementById("fodiv"); + fodiv.parentNode.removeChild(fodiv); + + document.documentElement.removeAttribute("class"); +} + +</html:script> + + + <g> + <foreignObject width="500" height="500" transform="scale(.7,.7)" id="fo" y="300"> + +<div id="fodiv" xmlns="http://www.w3.org/1999/xhtml"> + + + +<p>0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99</p> + + + +<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> +<mrow> + <mi>A</mi> +</mrow> +</math></div> + + +<svg xmlns="http://www.w3.org/2000/svg" id="svg" viewbox="0 0 250 250" width="100" height="100"> + <style type="text/css"> + circle:hover {fill-opacity:0.9;} + </style> + + <g style="fill-opacity:0.7;" transform="scale(.2)"> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black; stroke-width:0.1cm" transform="translate(0,50)" /> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:blue; stroke:black; stroke-width:0.1cm" transform="translate(70,150)" /> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:green; stroke:black; stroke-width:0.1cm" transform="translate(-70,150)"/> + </g> +</svg> + +</div> +</foreignObject> +</g> + + + +</svg> diff --git a/layout/svg/crashtests/366956-2.svg b/layout/svg/crashtests/366956-2.svg new file mode 100644 index 000000000..a2ab21ed5 --- /dev/null +++ b/layout/svg/crashtests/366956-2.svg @@ -0,0 +1,61 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom1, 30);" class="reftest-wait"> + +<html:script> + +function boom1() +{ + document.getElementsByTagName("mi")[0].setAttribute('id', "ffff"); + + document.getElementById("fo").appendChild(document.createTextNode(" ")); + + boom2(); +} + +function boom2() +{ + var fodiv = document.getElementById("fodiv"); + fodiv.parentNode.removeChild(fodiv); + + document.documentElement.removeAttribute("class"); +} + +</html:script> + + + <g> + <foreignObject width="500" height="500" transform="scale(.7,.7)" id="fo" y="300"> + +<div id="fodiv" xmlns="http://www.w3.org/1999/xhtml"> + + + +<p>0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99</p> + + + +<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block"> +<mrow> + <mi>A</mi> +</mrow> +</math></div> + + +<svg xmlns="http://www.w3.org/2000/svg" id="svg" viewbox="0 0 250 250" width="100" height="100"> + <style type="text/css"> + circle:hover {fill-opacity:0.9;} + </style> + + <g style="fill-opacity:0.7;" transform="scale(.2)"> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black; stroke-width:0.1cm" transform="translate(0,50)" /> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:blue; stroke:black; stroke-width:0.1cm" transform="translate(70,150)" /> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:green; stroke:black; stroke-width:0.1cm" transform="translate(-70,150)"/> + </g> +</svg> + +</div> +</foreignObject> +</g> + + + +</svg> diff --git a/layout/svg/crashtests/367111-1.svg b/layout/svg/crashtests/367111-1.svg new file mode 100644 index 000000000..dcf6a39bf --- /dev/null +++ b/layout/svg/crashtests/367111-1.svg @@ -0,0 +1,29 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:html="http://www.w3.org/1999/xhtml" + onload="setTimeout(boom, 30);" + class="reftest-wait"> + +<html:script> + +function boom() +{ + document.getElementById("text").appendChild(document.getElementById("fo")); + + document.documentElement.removeAttribute("class"); +} + +</html:script> + +<defs> + <marker> + <text id="text">svg:text</text> + </marker> +</defs> + +<foreignObject id="fo"> + <div xmlns="http://www.w3.org/1999/xhtml"> + <p>HTML in a foreignObject</p> + </div> +</foreignObject> + +</svg> diff --git a/layout/svg/crashtests/367368-1.xhtml b/layout/svg/crashtests/367368-1.xhtml new file mode 100644 index 000000000..b9bcd3241 --- /dev/null +++ b/layout/svg/crashtests/367368-1.xhtml @@ -0,0 +1,12 @@ +<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=367368 --> +<!-- Just checking for crash, nothing more --> + +<html xmlns="http://www.w3.org/1999/xhtml"> + <body> + + <svg xmlns="http://www.w3.org/2000/svg"> + <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black;" transform="translate(0,50)" /> + </svg> + + </body> +</html> diff --git a/layout/svg/crashtests/369233-1.svg b/layout/svg/crashtests/369233-1.svg new file mode 100644 index 000000000..22f4aacb3 --- /dev/null +++ b/layout/svg/crashtests/369233-1.svg @@ -0,0 +1,33 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:html="http://www.w3.org/1999/xhtml" + onload="setTimeout(boom, 200);" + class="reftest-wait"> + +<html:script> + +function boom() +{ + try { + document.getElementById("grad2").gradientUnits.baseVal = "y"; + } catch (e) { + } + + document.documentElement.removeAttribute("class"); +} + +</html:script> + + + +<radialGradient id="grad2" gradientUnits="userSpaceOnUse" cx="240" cy="210" r="220" fx="240" fy="210"> + <stop stop-color="black" offset="0"/> + <stop stop-color="yellow" offset="0.2"/> + <stop stop-color="red" offset="0.4"/> + <stop stop-color="blue" offset="0.6"/> + <stop stop-color="white" offset="0.8"/> + <stop stop-color="green" offset="1"/> +</radialGradient> + +<rect x="20" y="150" width="440" height="80" fill="url(#grad2)" stroke-width="40"/> + +</svg> diff --git a/layout/svg/crashtests/369438-1.svg b/layout/svg/crashtests/369438-1.svg new file mode 100644 index 000000000..78bcb6b54 --- /dev/null +++ b/layout/svg/crashtests/369438-1.svg @@ -0,0 +1,24 @@ +<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom, 30);" class="reftest-wait"><html:script src="data:text/javascript,"></html:script><html:script>
+
+function boom()
+{
+ var defs = document.getElementById("defs");
+ defs.parentNode.removeChild(defs);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<defs id="defs">
+<filter id="Gaussian_Blur">
+<feGaussianBlur in="SourceGraphic" stdDeviation="3"/>
+</filter>
+</defs>
+
+<ellipse cx="200" cy="150" rx="70" ry="40"
+style="fill:#ff0000;stroke:#000000;
+stroke-width:2;filter:url(#Gaussian_Blur)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/369438-2.svg b/layout/svg/crashtests/369438-2.svg new file mode 100644 index 000000000..92eea9ee0 --- /dev/null +++ b/layout/svg/crashtests/369438-2.svg @@ -0,0 +1,27 @@ +<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom, 30);" class="reftest-wait"><html:script>
+
+function boom()
+{
+ var defs = document.getElementById("defs");
+ var gb = document.getElementById("Gaussian_Blur");
+
+ defs.parentNode.removeChild(defs);
+ gb.removeChild(gb.firstChild); // remove a whitespace text node (!)
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<defs id="defs">
+<filter id="Gaussian_Blur">
+<feGaussianBlur in="SourceGraphic" stdDeviation="3"/>
+</filter>
+</defs>
+
+<ellipse cx="200" cy="150" rx="70" ry="40"
+style="fill:#ff0000;stroke:#000000;
+stroke-width:2;filter:url(#Gaussian_Blur)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/371463-1.xhtml b/layout/svg/crashtests/371463-1.xhtml new file mode 100644 index 000000000..461fb27ba --- /dev/null +++ b/layout/svg/crashtests/371463-1.xhtml @@ -0,0 +1,8 @@ +<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:svg="http://www.w3.org/2000/svg">
+<body>
+
+<select><svg:svg><svg:foreignObject/></svg:svg></select>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/371563-1.xhtml b/layout/svg/crashtests/371563-1.xhtml new file mode 100644 index 000000000..0ebdc9bfa --- /dev/null +++ b/layout/svg/crashtests/371563-1.xhtml @@ -0,0 +1,32 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> + +function boom() +{ + document.getElementById("sdiv").style.overflow = "scroll"; + + document.documentElement.removeAttribute("class"); +} + + +</script> +</head> + +<body onload="setTimeout(boom, 30);"> + + <div id="sdiv" style="float: left;"> + + <svg xmlns="http://www.w3.org/2000/svg" height="400px" width="400px" + y="0.0000000" x="0.0000000" version="1.0" > + <defs> + <marker id="Arrow"/> + </defs> + <path style="marker-end:url(#Arrow)" + d="M 12.500000,200.00000 L 387.50000,200.00000" /> + </svg> + + </div> + +</body> +</html> diff --git a/layout/svg/crashtests/375775-1.svg b/layout/svg/crashtests/375775-1.svg new file mode 100644 index 000000000..cd17c85a9 --- /dev/null +++ b/layout/svg/crashtests/375775-1.svg @@ -0,0 +1,23 @@ +<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30);" class="reftest-wait"> + +<script type="text/javascript"> + +function boom() +{ + document.getElementById("filter").style.display = "none"; + document.getElementById("path").style.display = "none"; + + document.documentElement.removeAttribute("class"); +} + +</script> + +<filter id="filter" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="120" /> + +<g filter="url(#filter)"> + <path id="path" + fill="black" + d="M60,80 C30,80 30,40 60,40 L140,40 C170,40 170,80 140,80 z" /> +</g> + +</svg> diff --git a/layout/svg/crashtests/378716.svg b/layout/svg/crashtests/378716.svg new file mode 100644 index 000000000..b6faa0028 --- /dev/null +++ b/layout/svg/crashtests/378716.svg @@ -0,0 +1,4 @@ +<svg width="100%" height="100%" x="0" y="0" viewBox="0 0 1 1" + xmlns="http://www.w3.org/2000/svg"> + <text id="text_1" x="0.5" y="0.5" font-size="0.05" fill="green">Okay Text</text> +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/380691-1.svg b/layout/svg/crashtests/380691-1.svg new file mode 100644 index 000000000..ed2855263 --- /dev/null +++ b/layout/svg/crashtests/380691-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <mask id="m"/> + <foreignObject mask="url(#m)"/> +</svg> diff --git a/layout/svg/crashtests/384391-1.xhtml b/layout/svg/crashtests/384391-1.xhtml new file mode 100644 index 000000000..12c657a48 --- /dev/null +++ b/layout/svg/crashtests/384391-1.xhtml @@ -0,0 +1,20 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg" > +<head> +<script> + +function boom() +{ + var circle = document.getElementById("circle"); + document.removeChild(document.documentElement); + document.appendChild(circle); +} + +</script> +</head> + +<body onload="boom()"> + +<svg:circle id="circle" /> + +</body> +</html> diff --git a/layout/svg/crashtests/384499-1.svg b/layout/svg/crashtests/384499-1.svg new file mode 100644 index 000000000..f44891000 --- /dev/null +++ b/layout/svg/crashtests/384499-1.svg @@ -0,0 +1,20 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml"> + +<html:style> + #mathy { display: table} +</html:style> + +<foreignObject width="500" height="500" y="50"> + <div xmlns="http://www.w3.org/1999/xhtml"> + <p>Foo</p> + <div> + <math xmlns="http://www.w3.org/1998/Math/MathML" id="mathy" display="block"> + <mrow> + <mi>x</mi> + </mrow> + </math> + </div> + </div> +</foreignObject> + +</svg> diff --git a/layout/svg/crashtests/384637-1.svg b/layout/svg/crashtests/384637-1.svg new file mode 100644 index 000000000..263a2d556 --- /dev/null +++ b/layout/svg/crashtests/384637-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg" baseProfile="basic" width="100%" height="100%" viewBox="0 0 480 360">
+
+ <mask id="mask1" maskUnits="userSpaceOnUse" x="60" y="50" width="100" height="60">
+ <rect x="60" y="50" width="100" height="60" fill="yellow" mask="url(#mask1)"/>
+ </mask>
+
+ <rect x="60" y="50" width="100" height="60" fill="lime" mask="url(#mask1)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/384728-1.svg b/layout/svg/crashtests/384728-1.svg new file mode 100644 index 000000000..ccafc8370 --- /dev/null +++ b/layout/svg/crashtests/384728-1.svg @@ -0,0 +1,21 @@ +<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script>
+
+function boom()
+{
+ document.getElementById("thhh").setAttributeNS("http://www.w3.org/1999/xlink", 'href', '');
+}
+
+</script>
+
+ <defs>
+ <g id="ch" style="counter-reset: c;">
+ <rect x="75" y="0" width="75" height="75" fill="lightgreen" style="counter-increment: c;"/>
+ </g>
+
+ </defs>
+
+ <use id="thhh" x="0" y="0"><use xlink:href="#ch" x="0" y="0"/></use>
+
+</svg>
diff --git a/layout/svg/crashtests/385246-1.svg b/layout/svg/crashtests/385246-1.svg new file mode 100644 index 000000000..cddad0c5e --- /dev/null +++ b/layout/svg/crashtests/385246-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<foreignObject x="100" y="100" width="-2" height="500"> + <div xmlns="http://www.w3.org/1999/xhtml"> + <p>Foo</p> + </div> +</foreignObject> + +</svg> diff --git a/layout/svg/crashtests/385246-2.svg b/layout/svg/crashtests/385246-2.svg new file mode 100644 index 000000000..c392f2fc8 --- /dev/null +++ b/layout/svg/crashtests/385246-2.svg @@ -0,0 +1,15 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + +<script type="text/javascript" xlink:href="data:text/javascript,"></script> + + +<foreignObject width="-2" height="500" id="fo" x="300"> + <div xmlns="http://www.w3.org/1999/xhtml"> + <p>Hi!!!</p> + </div> +</foreignObject> + + + + +</svg> diff --git a/layout/svg/crashtests/385552-1.svg b/layout/svg/crashtests/385552-1.svg new file mode 100644 index 000000000..019e249d7 --- /dev/null +++ b/layout/svg/crashtests/385552-1.svg @@ -0,0 +1,4 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<script> +document.createElementNS("http://www.w3.org/2000/svg", "svg").unsuspendRedrawAll(); +</script> diff --git a/layout/svg/crashtests/385552-2.svg b/layout/svg/crashtests/385552-2.svg new file mode 100644 index 000000000..9a93d657f --- /dev/null +++ b/layout/svg/crashtests/385552-2.svg @@ -0,0 +1,4 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<script> +document.createElementNS("http://www.w3.org/2000/svg", "svg").suspendRedraw(3); +</script> diff --git a/layout/svg/crashtests/385840-1.svg b/layout/svg/crashtests/385840-1.svg new file mode 100644 index 000000000..cf7ff6949 --- /dev/null +++ b/layout/svg/crashtests/385840-1.svg @@ -0,0 +1,20 @@ +<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script>
+
+function boom()
+{
+ var SVG_NS = "http://www.w3.org/2000/svg";
+
+ var svgCircle = document.createElementNS(SVG_NS, 'circle');
+ var svgText = document.createElementNS(SVG_NS, 'text');
+ svgText.appendChild(document.createTextNode("foo"));
+ svgCircle.appendChild(svgText);
+
+ document.removeChild(document.documentElement);
+ document.appendChild(svgCircle);
+}
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/385852-1.svg b/layout/svg/crashtests/385852-1.svg new file mode 100644 index 000000000..17ad99ca8 --- /dev/null +++ b/layout/svg/crashtests/385852-1.svg @@ -0,0 +1,34 @@ +<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30)" class="reftest-wait">
+
+<script>
+
+var originalRoot = document.documentElement;
+var svgCircle;
+
+function boom()
+{
+ var SVG_NS = "http://www.w3.org/2000/svg";
+
+ var svgPolyline = document.createElementNS(SVG_NS, 'polyline');
+ svgCircle = document.createElementNS(SVG_NS, 'circle');
+
+ svgCircle.appendChild(svgPolyline);
+
+ document.removeChild(originalRoot);
+ document.appendChild(svgCircle);
+
+ setTimeout(restore, 30);
+}
+
+function restore()
+{
+ // We have to put it the root element back in the document so that reftest.js
+ // sees the event for the removal of class="reftest-wait"!
+ document.removeChild(svgCircle);
+ document.appendChild(originalRoot);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/386475-1.xhtml b/layout/svg/crashtests/386475-1.xhtml new file mode 100644 index 000000000..4d1b9a280 --- /dev/null +++ b/layout/svg/crashtests/386475-1.xhtml @@ -0,0 +1,24 @@ +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:svg="http://www.w3.org/2000/svg"> +<head> +<script> +function boom() +{ + document.body.style.display = "table-header-group"; + document.getElementById("svg").setAttribute('height', 1); +} +</script> +</head> + +<body onload="boom();"> + +<svg:svg width="100%" height="100%" id="svg"> + <svg:g> + <svg:foreignObject width="8205em" height="100%"> + <span>hello</span> <span>world</span> + </svg:foreignObject> + </svg:g> +</svg:svg> + +</body> +</html> diff --git a/layout/svg/crashtests/386566-1.svg b/layout/svg/crashtests/386566-1.svg new file mode 100644 index 000000000..fd44879c4 --- /dev/null +++ b/layout/svg/crashtests/386566-1.svg @@ -0,0 +1,21 @@ +<svg xmlns="http://www.w3.org/2000/svg" height="5" onload="setTimeout(boom, 30);" class="reftest-wait"> + +<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content></content></binding></bindings> + +<script> +function boom() +{ + document.getElementById("rr").style.MozBinding = "url('#foo')"; + document.documentElement.setAttribute('height', "5px"); + setTimeout(done, 30); +} + +function done() +{ + document.documentElement.removeAttribute("class"); +} +</script> + +<rect id="rr" x="50%" width="25%" height="10em" fill="red"/> + +</svg> diff --git a/layout/svg/crashtests/386690-1.svg b/layout/svg/crashtests/386690-1.svg new file mode 100644 index 000000000..e20697813 --- /dev/null +++ b/layout/svg/crashtests/386690-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 40"> + <foreignObject width="-2" height="100" /> +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/387290-1.svg b/layout/svg/crashtests/387290-1.svg new file mode 100644 index 000000000..4ac846320 --- /dev/null +++ b/layout/svg/crashtests/387290-1.svg @@ -0,0 +1,26 @@ +<?xml version="1.0" encoding="UTF-8"?> +<!-- This Source Code Form is subject to the terms of the Mozilla Public + - License, v. 2.0. If a copy of the MPL was not distributed with this + - file, You can obtain one at http://mozilla.org/MPL/2.0/. --> +<!-- +Copyright Georgi Guninski +--> + +<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" +"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> + +<svg version="1.1" +xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" +> +<defs> +<filter id="dafilter" filterUnits="userSpaceOnUse" +x="0" y="0" width="4194305" height="17"> +<feGaussianBlur in="SourceAlpha" stdDeviation="4" result="blur"/> +</filter> +</defs> +<g> + +<rect fill="red" width="256" height="256" filter="url(#dafilter)" transform="scale(262145,9)" /> +</g> + +</svg> diff --git a/layout/svg/crashtests/402408-1.svg b/layout/svg/crashtests/402408-1.svg new file mode 100644 index 000000000..f442b2171 --- /dev/null +++ b/layout/svg/crashtests/402408-1.svg @@ -0,0 +1,32 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + onload="boom();" + class="reftest-wait"> + +<script> + +function boom() +{ + var grad1 = document.getElementById("grad1"); + var grad2 = document.getElementById("grad2"); + + grad1.appendChild(grad2); + + setTimeout(function() { + grad1.removeChild(grad2); + document.documentElement.removeAttribute("class"); + }, 30); +} + +</script> + +<linearGradient id="grad1" gradientUnits="objectBoundingBox" x1="0" y1="0" x2="1" y2="0"> + <stop id="green" stop-color="#00dd00" offset="0"/> + <stop id="blue" stop-color="#0000dd" offset="1"/> +</linearGradient> + +<linearGradient id="grad2" xlink:href="#grad1"/> + +<rect x="20" y="20" width="440" height="80" fill="url(#grad2)" /> + +</svg> diff --git a/layout/svg/crashtests/404677-1.xhtml b/layout/svg/crashtests/404677-1.xhtml new file mode 100644 index 000000000..c1df3869b --- /dev/null +++ b/layout/svg/crashtests/404677-1.xhtml @@ -0,0 +1,9 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg"> +<head> +</head> +<body> + +<svg:svg height="-2" width="5" /> + +</body> +</html> diff --git a/layout/svg/crashtests/409565-1.xhtml b/layout/svg/crashtests/409565-1.xhtml new file mode 100644 index 000000000..33ab9cefb --- /dev/null +++ b/layout/svg/crashtests/409565-1.xhtml @@ -0,0 +1,3 @@ +<html xmlns="http://www.w3.org/1999/xhtml" style="white-space: pre;"><body style="width: 24px; height: 24px; -moz-column-width: 200px;"> + + <svg xmlns="http://www.w3.org/2000/svg" style="float: left;"></svg></body></html> diff --git a/layout/svg/crashtests/409573-1.svg b/layout/svg/crashtests/409573-1.svg new file mode 100644 index 000000000..bec1469a5 --- /dev/null +++ b/layout/svg/crashtests/409573-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ onload="document.documentElement.style.MozBinding = 'url(#empty)';">
+
+ <bindings xmlns="http://www.mozilla.org/xbl"><binding id="empty"><content></content></binding></bindings>
+
+ <defs>
+
+ <filter id="filter1"/>
+
+ <filter id="filter2">
+ <use filter="url(#filter1)" />
+ </filter>
+
+ </defs>
+
+</svg>
diff --git a/layout/svg/crashtests/420697-1.svg b/layout/svg/crashtests/420697-1.svg new file mode 100644 index 000000000..d8b7f3834 --- /dev/null +++ b/layout/svg/crashtests/420697-1.svg @@ -0,0 +1,7 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text stroke="black" y="1em" + stroke-dashoffset="1%" + stroke-dasharray="1px"> + m + </text> +</svg> diff --git a/layout/svg/crashtests/420697-2.svg b/layout/svg/crashtests/420697-2.svg new file mode 100644 index 000000000..8987693e5 --- /dev/null +++ b/layout/svg/crashtests/420697-2.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text stroke="black" y="1em" + stroke-dasharray="1%"> + m + </text> +</svg> diff --git a/layout/svg/crashtests/429774-1.svg b/layout/svg/crashtests/429774-1.svg new file mode 100644 index 000000000..00b726de6 --- /dev/null +++ b/layout/svg/crashtests/429774-1.svg @@ -0,0 +1,29 @@ +<?xml version="1.0"?> + +<svg width="7.5cm" height="5cm" viewBox="0 0 200 120" + xmlns="http://www.w3.org/2000/svg"> + + <defs> + <filter id="MyFilter" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="120"> + + <feOffset in="SourceAlpha" result="offset" dx="4" dy="4" y="76"/> + + <feSpecularLighting in="offset" result="specOut" + surfaceScale="5" specularConstant=".75" specularExponent="20"> + <fePointLight x="-5000" y="-10000" z="20000"/> + </feSpecularLighting> + + <feComposite in="SourceAlpha" in2="SourceAlpha" result="litPaint" + operator="arithmetic" k1="0" k2="1" k3="1" k4="0"/> + + <feMerge> + <feMergeNode in="offset"/> + <feMergeNode in="litPaint"/> + </feMerge> + + </filter> + </defs> + + <g filter="url(#MyFilter)"/> + +</svg> diff --git a/layout/svg/crashtests/441368-1.svg b/layout/svg/crashtests/441368-1.svg new file mode 100644 index 000000000..d0fee7478 --- /dev/null +++ b/layout/svg/crashtests/441368-1.svg @@ -0,0 +1,31 @@ +<?xml version="1.0" standalone="no"?> +<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" +"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> +<!-- This Source Code Form is subject to the terms of the Mozilla Public + - License, v. 2.0. If a copy of the MPL was not distributed with this + - file, You can obtain one at http://mozilla.org/MPL/2.0/. --> +<!-- +Copyright Georgi Guninski +--> + + +<svg width="100%" height="100%" version="1.1" +xmlns="http://www.w3.org/2000/svg"> + +<defs> +<filter id="MyFilter" filterUnits="userSpaceOnUse" +x="0" y="0" width="32769" height="32769"> + +<feGaussianBlur in="SourceAlpha" stdDeviation="2147483648" result="blur"/> + +</filter> +</defs> + +<rect x="1" y="1" width="198" height="118" fill="#cccccc" /> + +<g filter="url(#MyFilter)"> +<text fill="#FFFFFF" stroke="black" font-size="45" +x="42" y="42">Feck b1ll</text> +</g> + +</svg> diff --git a/layout/svg/crashtests/453754-1.svg b/layout/svg/crashtests/453754-1.svg new file mode 100644 index 000000000..a32d81928 --- /dev/null +++ b/layout/svg/crashtests/453754-1.svg @@ -0,0 +1,7 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <filter id="f" height="-1"/> + + <rect filter="url(#f)" /> + +</svg> diff --git a/layout/svg/crashtests/455314-1.xhtml b/layout/svg/crashtests/455314-1.xhtml new file mode 100644 index 000000000..01bb33d65 --- /dev/null +++ b/layout/svg/crashtests/455314-1.xhtml @@ -0,0 +1,16 @@ +<html xmlns="http://www.w3.org/1999/xhtml"><head>
+<script>
+function doe() {
+document.getElementById('a').appendChild(document.body);
+}
+setTimeout(doe, 100);
+</script>
+</head>
+<body>
+<div style="position: absolute; -moz-appearance: button; filter: url(#b); "></div>
+<pre style="position: absolute;">
+<table id="b"></table>
+</pre>
+</body>
+<div id="a"/>
+</html>
\ No newline at end of file diff --git a/layout/svg/crashtests/458453.html b/layout/svg/crashtests/458453.html new file mode 100644 index 000000000..ab72d46de --- /dev/null +++ b/layout/svg/crashtests/458453.html @@ -0,0 +1,24 @@ +<html class="reftest-wait"> +<head> +<script type="text/javascript"> + +var i = 0; + +function bouncy() +{ + var body = document.body; + document.documentElement.removeChild(body); + document.documentElement.appendChild(body); + + if (++i < 30) + setTimeout(bouncy, 1); + else + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="bouncy();"><span id="a"></span><span style="filter: url(#a);"><span style="filter: url(#a);">B</span></span></body> + +</html> diff --git a/layout/svg/crashtests/459666-1.html b/layout/svg/crashtests/459666-1.html new file mode 100644 index 000000000..69074b602 --- /dev/null +++ b/layout/svg/crashtests/459666-1.html @@ -0,0 +1,7 @@ +<!DOCTYPE html> +<html style="filter: url(#e);"> +<head></head> +<body onload="document.documentElement.style.counterReset = 'a';"> +<div id="e"></div> +</body> +</html> diff --git a/layout/svg/crashtests/459883.xhtml b/layout/svg/crashtests/459883.xhtml new file mode 100644 index 000000000..e125e71d8 --- /dev/null +++ b/layout/svg/crashtests/459883.xhtml @@ -0,0 +1,13 @@ +<html xmlns="http://www.w3.org/1999/xhtml" style="filter: url(#r);" class="reftest-wait"><head> +<script type="text/javascript"> + +function boom() +{ + document.getElementById("s").setAttribute("style", "display: -moz-box;"); + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", function() { setTimeout(boom, 0); }, false); + +</script> +</head><body><ms xmlns="http://www.w3.org/1998/Math/MathML" id="s"><maction id="r"/></ms></body></html> diff --git a/layout/svg/crashtests/461289-1.svg b/layout/svg/crashtests/461289-1.svg new file mode 100644 index 000000000..82a57f81b --- /dev/null +++ b/layout/svg/crashtests/461289-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + +<script type="text/javascript"> + +function boom() +{ + var f = document.getElementById("filter1"); + f.appendChild(document.createElementNS("http://www.w3.org/2000/svg", "feImage")); + f.appendChild(document.getElementById("rect")); +} + +window.addEventListener("load", boom, false); + +</script> + +<filter id="filter1"/><rect id="rect" filter="url(#filter1)"/> + +</svg> diff --git a/layout/svg/crashtests/464374-1.svg b/layout/svg/crashtests/464374-1.svg new file mode 100644 index 000000000..9844e5187 --- /dev/null +++ b/layout/svg/crashtests/464374-1.svg @@ -0,0 +1,15 @@ +<svg xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("b").appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "math"));
+ document.getElementById("defs").setAttribute("filter", "url(#a)");
+}
+
+</script>
+
+<defs id="defs"><filter id="a"/><g id="b"><rect/></g></defs>
+
+</svg>
diff --git a/layout/svg/crashtests/466585-1.svg b/layout/svg/crashtests/466585-1.svg new file mode 100644 index 000000000..22ad862e1 --- /dev/null +++ b/layout/svg/crashtests/466585-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<script type="text/javascript"> + +window.addEventListener("load", boom, false); + +function boom() +{ + document.getElementById("rect").setAttribute("filter", "url(#filter)"); + document.getElementById("defs").setAttribute("fill", "red"); +} + +</script> + +<defs id="defs"><filter id="filter"/><rect id="rect"/></defs> + +</svg> diff --git a/layout/svg/crashtests/467323-1.svg b/layout/svg/crashtests/467323-1.svg new file mode 100644 index 000000000..9d757c349 --- /dev/null +++ b/layout/svg/crashtests/467323-1.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg" width="500" height="500"> + +<filter id="f1" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"> + <feFlood flood-color="#ff0000" result="flood" x="0" y="0" width="100" height="100"/> + <feDisplacementMap style="color-interpolation-filters:sRGB" + in="SourceGraphic" in2="flood" scale="100" xChannelSelector="R" yChannelSelector="G"/> +</filter> +<g filter="url(#f1)"></g> + +</svg> diff --git a/layout/svg/crashtests/467498-1.svg b/layout/svg/crashtests/467498-1.svg new file mode 100644 index 000000000..9839e6c30 --- /dev/null +++ b/layout/svg/crashtests/467498-1.svg @@ -0,0 +1,12 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + <use id="a" width="100" height="100" xlink:href="#b"/> + <use id="b" x="100" y="100" width="100" height="100" xlink:href="#a"/> + <script> + document.getElementById("a").setAttribute("width", "200"); + </script> +</svg> diff --git a/layout/svg/crashtests/470124-1.svg b/layout/svg/crashtests/470124-1.svg new file mode 100644 index 000000000..ba3b8aff4 --- /dev/null +++ b/layout/svg/crashtests/470124-1.svg @@ -0,0 +1,7 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<filter id="f7" filterUnits="userSpaceOnUse" primitiveUnits="objectBoundingBox"><feComposite/></filter> + +<g filter="url(#f7)"/> + +</svg> diff --git a/layout/svg/crashtests/472782-1.svg b/layout/svg/crashtests/472782-1.svg new file mode 100644 index 000000000..7cfeb11a6 --- /dev/null +++ b/layout/svg/crashtests/472782-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="r"> +<text><textPath xlink:href="#r">S</textPath> </text> +</svg> diff --git a/layout/svg/crashtests/474700-1.svg b/layout/svg/crashtests/474700-1.svg new file mode 100644 index 000000000..141a1b390 --- /dev/null +++ b/layout/svg/crashtests/474700-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg"><filter id="f1" height="-2"/><rect width="50" height="100" filter="url(#f1)"/></svg> diff --git a/layout/svg/crashtests/475181-1.svg b/layout/svg/crashtests/475181-1.svg new file mode 100644 index 000000000..ef5a638af --- /dev/null +++ b/layout/svg/crashtests/475181-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><filter id="filter1"><feImage y="4095"/><feTile/></filter><rect width="100%" height="100%" filter="url(#filter1)"/></svg> diff --git a/layout/svg/crashtests/475193-1.html b/layout/svg/crashtests/475193-1.html new file mode 100644 index 000000000..edc08bcee --- /dev/null +++ b/layout/svg/crashtests/475193-1.html @@ -0,0 +1,21 @@ +<!DOCTYPE HTML> +<html><head> +<meta http-equiv="content-type" content="text/html; charset=UTF-8"> + + +<style type="text/css"> + +.p { marker: url('#c'); } + +</style> +<script type="text/javascript"> + +function boom() +{ + document.getElementById("a").setAttribute("class", "p"); + document.documentElement.offsetHeight; + document.getElementById("b").setAttribute("id", "c"); +} + +</script> +</head><body onload="boom();"><div class="p" id="a">C</div><div id="c"></div></body></html>
\ No newline at end of file diff --git a/layout/svg/crashtests/475302-1.svg b/layout/svg/crashtests/475302-1.svg new file mode 100644 index 000000000..4fdaa2213 --- /dev/null +++ b/layout/svg/crashtests/475302-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<style type="text/css"> + tref { filter: url(#filter1); } +</style> + +<filter id="filter1"><feFlood/></filter> + +<tref><polyline points="350,75 379,161 469,161 397,215 423,301 350,250 277,301 303,215 231,161 321,161"/></tref> + +</svg> diff --git a/layout/svg/crashtests/477935-1.html b/layout/svg/crashtests/477935-1.html new file mode 100644 index 000000000..9c2ac5438 --- /dev/null +++ b/layout/svg/crashtests/477935-1.html @@ -0,0 +1,11 @@ +<!DOCTYPE html> +<html> +<head> +<style type="text/css"> :root { filter: url('#g'); } </style> +<style type="text/css" id="ccs"> .cc { content: 'X'; } </style> +</head> +<body onload="document.getElementById('ccs').disabled = true;"> +<div id="g"></div> +<div class="cc">5</div> +</body> +</html> diff --git a/layout/svg/crashtests/478128-1.svg b/layout/svg/crashtests/478128-1.svg new file mode 100644 index 000000000..a4100026b --- /dev/null +++ b/layout/svg/crashtests/478128-1.svg @@ -0,0 +1,15 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <script type="text/javascript"> + + function boom() + { + document.documentElement.style.MozColumnCount = '15'; + } + window.onload = function() { setTimeout(boom, 20); }; + + </script> + + <foreignObject width="50" height="50" filter="url(#f1)"/> + + <filter id="f1"/> +</svg> diff --git a/layout/svg/crashtests/478511-1.svg b/layout/svg/crashtests/478511-1.svg new file mode 100644 index 000000000..75a4aaa9b --- /dev/null +++ b/layout/svg/crashtests/478511-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg" version="1.0"> + <defs> + <pattern id="pattern" + x="0" y="0" width="200" height="200"> + <circle fill="lime" r="100" cx="100" cy="100"/> + </pattern> + </defs> + <rect width="200" height="200" fill="url(#pattern)"/> +</svg> diff --git a/layout/svg/crashtests/483439-1.svg b/layout/svg/crashtests/483439-1.svg new file mode 100644 index 000000000..c9e9ebae1 --- /dev/null +++ b/layout/svg/crashtests/483439-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + + <defs> + <path id="myTextPath" + d="M275,20 + a1,1 0 0,0 100,0 + " + /> + </defs> + + <svg y="15"> + <text x="10" y="100" style="stroke: #000000;"> + <textPath xlink:href="#myTextPath" >Text along a curved path...</textPath> + </text> + </svg> +</svg> diff --git a/layout/svg/crashtests/492186-1.svg b/layout/svg/crashtests/492186-1.svg new file mode 100644 index 000000000..7f4b6650a --- /dev/null +++ b/layout/svg/crashtests/492186-1.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<altGlyphDef/> +<script xmlns="http://www.w3.org/1999/xhtml"> +document.documentElement.getBBox(); +</script> +</svg> diff --git a/layout/svg/crashtests/508247-1.svg b/layout/svg/crashtests/508247-1.svg new file mode 100644 index 000000000..c8b36b905 --- /dev/null +++ b/layout/svg/crashtests/508247-1.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<definition-src> +<path id="a"/> +</definition-src> + +<script id="script" xmlns="http://www.w3.org/1999/xhtml"> +setTimeout(function() {document.getElementById('a').getCTM()},10); +</script> +</svg> diff --git a/layout/svg/crashtests/512890-1.svg b/layout/svg/crashtests/512890-1.svg new file mode 100644 index 000000000..044f69389 --- /dev/null +++ b/layout/svg/crashtests/512890-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <filter id="f" height="1em"/> + <rect width="50" height="50" filter="url(#f)"/> +</svg> diff --git a/layout/svg/crashtests/515288-1.html b/layout/svg/crashtests/515288-1.html new file mode 100644 index 000000000..d78cbbfbe --- /dev/null +++ b/layout/svg/crashtests/515288-1.html @@ -0,0 +1,5 @@ +<script> +var svgElem = document.createElementNS("http://www.w3.org/2000/svg", "svg"); +document.createElement("script").appendChild(svgElem); +svgElem.getScreenCTM(); +</script>
\ No newline at end of file diff --git a/layout/svg/crashtests/522394-1.svg b/layout/svg/crashtests/522394-1.svg new file mode 100644 index 000000000..f745c47dd --- /dev/null +++ b/layout/svg/crashtests/522394-1.svg @@ -0,0 +1,12 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<svg xmlns="http://www.w3.org/2000/svg"> +<defs> + <filter id="f1" x="0" y="0" width="-100" height="-100" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"> + <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/> + </filter> +</defs> +<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/> +</svg> diff --git a/layout/svg/crashtests/522394-2.svg b/layout/svg/crashtests/522394-2.svg new file mode 100644 index 000000000..1b6f1f089 --- /dev/null +++ b/layout/svg/crashtests/522394-2.svg @@ -0,0 +1,12 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<svg xmlns="http://www.w3.org/2000/svg"> +<defs> + <filter id="f1" x="0" y="0" width="100000000" height="100000000" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"> + <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/> + </filter> +</defs> +<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/> +</svg> diff --git a/layout/svg/crashtests/522394-3.svg b/layout/svg/crashtests/522394-3.svg new file mode 100644 index 000000000..cf3483cfa --- /dev/null +++ b/layout/svg/crashtests/522394-3.svg @@ -0,0 +1,12 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<svg xmlns="http://www.w3.org/2000/svg"> +<defs> + <filter id="f1" x="0" y="0" width="4563402752" height="4563402752" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse"> + <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/> + </filter> +</defs> +<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/> +</svg> diff --git a/layout/svg/crashtests/566216-1.svg b/layout/svg/crashtests/566216-1.svg new file mode 100644 index 000000000..999aaf4f0 --- /dev/null +++ b/layout/svg/crashtests/566216-1.svg @@ -0,0 +1,19 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"><animate id="y"/><script> +<![CDATA[ + +function boom() +{ + var r = document.createRange(); + r.setEnd(document.getElementById('y'), 0); + r.extractContents(); +} + +window.addEventListener("load", boom, false); + +]]> +</script> +</svg> + + diff --git a/layout/svg/crashtests/587336-1.html b/layout/svg/crashtests/587336-1.html new file mode 100644 index 000000000..811f483dd --- /dev/null +++ b/layout/svg/crashtests/587336-1.html @@ -0,0 +1,9 @@ +<html> +<head><script> +function boom() +{ + var b = document.getElementById("b"); + b.setAttributeNS(null, "style", "filter: url(#a);"); +} +</script></head> +<body onload="boom();" id="a"><span id="b">B</span></body></html> diff --git a/layout/svg/crashtests/590291-1.svg b/layout/svg/crashtests/590291-1.svg new file mode 100644 index 000000000..db26fac3a --- /dev/null +++ b/layout/svg/crashtests/590291-1.svg @@ -0,0 +1,9 @@ +<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1" width="0cm" height="0cm">
+
+<text id="a">a</text>
+
+<script><![CDATA[
+var x=document.getElementById('a').getExtentOfChar(0);
+]]></script>
+</svg>
diff --git a/layout/svg/crashtests/601999-1.html b/layout/svg/crashtests/601999-1.html new file mode 100644 index 000000000..7e8a3d39d --- /dev/null +++ b/layout/svg/crashtests/601999-1.html @@ -0,0 +1,5 @@ +<html class="reftest-wait"> + <body onload="document.getElementsByTagName('div')[0].id='b'; + document.documentElement.removeAttribute('class');" + ><div style="overflow-x: scroll; filter: url(#b)">abc</div></body> +</html> diff --git a/layout/svg/crashtests/605626-1.svg b/layout/svg/crashtests/605626-1.svg new file mode 100644 index 000000000..678b01179 --- /dev/null +++ b/layout/svg/crashtests/605626-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> +<image width="10" height="10" xlink:href="data:text/plain,g"/> +</svg> diff --git a/layout/svg/crashtests/610594-1.html b/layout/svg/crashtests/610594-1.html new file mode 100644 index 000000000..ee48e762c --- /dev/null +++ b/layout/svg/crashtests/610594-1.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<html> +<body> +<svg><path d="M 0 5 a 2 5 -30 104 -5" marker-mid="url(#q)"></path></svg> +</body> +</html> diff --git a/layout/svg/crashtests/610954-1.html b/layout/svg/crashtests/610954-1.html new file mode 100644 index 000000000..f5080df8b --- /dev/null +++ b/layout/svg/crashtests/610954-1.html @@ -0,0 +1 @@ +<!DOCTYPE html><html><body dir=rtl onload="document.getElementById('g').style.filter = 'url(#filter1)';"><span id="g">‎---</span></body></html> diff --git a/layout/svg/crashtests/612662-1.svg b/layout/svg/crashtests/612662-1.svg new file mode 100644 index 000000000..73dc98ed1 --- /dev/null +++ b/layout/svg/crashtests/612662-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="background: url(#a); direction: rtl; margin: -32944px;"></svg> diff --git a/layout/svg/crashtests/612662-2.svg b/layout/svg/crashtests/612662-2.svg new file mode 100644 index 000000000..b46841132 --- /dev/null +++ b/layout/svg/crashtests/612662-2.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg" + style="direction: rtl; margin: -32944px; + background: url(data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3C%2Fsvg%3E)"></svg> diff --git a/layout/svg/crashtests/612736-1.svg b/layout/svg/crashtests/612736-1.svg new file mode 100644 index 000000000..cb3044efd --- /dev/null +++ b/layout/svg/crashtests/612736-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink" + class="reftest-wait"> + <path id="path"/> + <text> + <textPath xlink:href="#path">f</textPath> + <textPath xlink:href="#path">f</textPath> + </text> + + <script> + function boom() + { + var path = document.getElementById("path"); + path.parentNode.removeChild(path); + document.documentElement.removeAttribute("class"); + } + window.addEventListener("load", boom, false); + </script> +</svg> diff --git a/layout/svg/crashtests/612736-2.svg b/layout/svg/crashtests/612736-2.svg new file mode 100644 index 000000000..30b8245a9 --- /dev/null +++ b/layout/svg/crashtests/612736-2.svg @@ -0,0 +1,8 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + <path id="path" d="M0 100 h50" stroke="black"/> + <text> + <textPath xlink:href="#path">abc</textPath> + <textPath xlink:href="#path">def</textPath> + </text> +</svg> diff --git a/layout/svg/crashtests/614367-1.svg b/layout/svg/crashtests/614367-1.svg new file mode 100644 index 000000000..3af7b491d --- /dev/null +++ b/layout/svg/crashtests/614367-1.svg @@ -0,0 +1,8 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"> + <polygon id="p" transform="?" /> + <script> + document.getElementById("p").transform.baseVal.removeItem(0); + </script> +</svg> diff --git a/layout/svg/crashtests/620034-1.html b/layout/svg/crashtests/620034-1.html new file mode 100644 index 000000000..bfffd3ffa --- /dev/null +++ b/layout/svg/crashtests/620034-1.html @@ -0,0 +1,15 @@ +<!DOCTYPE html> +<script> + +function boom() +{ + var f = document.createElementNS("http://www.w3.org/2000/svg", "feFuncB"); + var tvb = f.tableValues.baseVal; + f.setAttribute("tableValues", "3 7 5"); + f.setAttribute("tableValues", "i"); + tvb.numberOfItems; +} + +boom(); + +</script> diff --git a/layout/svg/crashtests/621598-1.svg b/layout/svg/crashtests/621598-1.svg new file mode 100644 index 000000000..dd47967d3 --- /dev/null +++ b/layout/svg/crashtests/621598-1.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="m1"> + <rect/> + <marker> + <line id="z" marker-end="url(#m1)"/> + </marker> + </marker> + <script> + function boom() + { + document.getElementById("z").getBoundingClientRect(); + } + window.addEventListener("load", boom, false); + </script> + +</svg> diff --git a/layout/svg/crashtests/648819-1.html b/layout/svg/crashtests/648819-1.html new file mode 100644 index 000000000..727ca3e55 --- /dev/null +++ b/layout/svg/crashtests/648819-1.html @@ -0,0 +1,6 @@ +<!DOCTYPE html> +<script> +var p = document.createElementNS("http://www.w3.org/2000/svg", "pattern"); +p.setAttribute("patternTransform", "i"); +p.patternTransform.baseVal.clear(); +</script> diff --git a/layout/svg/crashtests/655025-1.svg b/layout/svg/crashtests/655025-1.svg new file mode 100644 index 000000000..4501bb57f --- /dev/null +++ b/layout/svg/crashtests/655025-1.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text id="a">a</text> + <script> + document.getElementById("a").firstChild.nodeValue = ""; + </script> +</svg> diff --git a/layout/svg/crashtests/655025-2.svg b/layout/svg/crashtests/655025-2.svg new file mode 100644 index 000000000..601006e83 --- /dev/null +++ b/layout/svg/crashtests/655025-2.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text id="a">a</text> + <script> + document.getElementById("a").appendChild(document.createTextNode("")); + </script> +</svg> diff --git a/layout/svg/crashtests/655025-3.svg b/layout/svg/crashtests/655025-3.svg new file mode 100644 index 000000000..43e06b6fc --- /dev/null +++ b/layout/svg/crashtests/655025-3.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <script> + var a = document.createElementNS("http://www.w3.org/2000/svg", "text"); + a.appendChild(document.createTextNode("")); + document.documentElement.appendChild(a); + a.getNumberOfChars(); + document.documentElement.removeChild(a); + </script> +</svg> diff --git a/layout/svg/crashtests/657077-1.svg b/layout/svg/crashtests/657077-1.svg new file mode 100644 index 000000000..b0165bd14 --- /dev/null +++ b/layout/svg/crashtests/657077-1.svg @@ -0,0 +1,19 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<svg xmlns="http://www.w3.org/2000/svg"> + +<svg id="a" requiredExtensions="x"/> + +<script> +<![CDATA[ + +function boom() +{ + document.getElementById("a").unsuspendRedrawAll(); +} + +window.addEventListener("load", boom, false); + +]]> +</script> + +</svg> diff --git a/layout/svg/crashtests/669025-1.svg b/layout/svg/crashtests/669025-1.svg new file mode 100644 index 000000000..eb529da4e --- /dev/null +++ b/layout/svg/crashtests/669025-1.svg @@ -0,0 +1,8 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> + <script type="text/javascript"> + + document.createElementNS("http://www.w3.org/2000/svg", "filter").filterResX; + + </script> +</svg> diff --git a/layout/svg/crashtests/669025-2.svg b/layout/svg/crashtests/669025-2.svg new file mode 100644 index 000000000..ccecebef3 --- /dev/null +++ b/layout/svg/crashtests/669025-2.svg @@ -0,0 +1,8 @@ +<?xml version="1.0"?> +<svg xmlns="http://www.w3.org/2000/svg"> + <script type="text/javascript"> + + document.createElementNS("http://www.w3.org/2000/svg", "feGaussianBlur").stdDeviationX; + + </script> +</svg> diff --git a/layout/svg/crashtests/682411-1.svg b/layout/svg/crashtests/682411-1.svg new file mode 100644 index 000000000..92d0c0a72 --- /dev/null +++ b/layout/svg/crashtests/682411-1.svg @@ -0,0 +1,5 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<svg xmlns="http://www.w3.org/2000/svg" style="width: 0pt; padding: 100px;"> + <filter id="s"/> + <g filter="url(#s)"><text>z</text></g> +</svg> diff --git a/layout/svg/crashtests/692203-1.svg b/layout/svg/crashtests/692203-1.svg new file mode 100644 index 000000000..8427b8426 --- /dev/null +++ b/layout/svg/crashtests/692203-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="marker" markerWidth="0"/> + <path d="M0,0 L100,100 200,200" marker-mid="url(#marker)"/> +</svg> diff --git a/layout/svg/crashtests/692203-2.svg b/layout/svg/crashtests/692203-2.svg new file mode 100644 index 000000000..b59926dbb --- /dev/null +++ b/layout/svg/crashtests/692203-2.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="marker" markerHeight="0"/> + <path d="M0,0 L100,100 200,200" marker-mid="url(#marker)"/> +</svg> diff --git a/layout/svg/crashtests/693424-1.svg b/layout/svg/crashtests/693424-1.svg new file mode 100644 index 000000000..8485f6b61 --- /dev/null +++ b/layout/svg/crashtests/693424-1.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="m"> + <foreignObject/> + </marker> + <line marker-end="url(#m)"/> +</svg> diff --git a/layout/svg/crashtests/709920-1.svg b/layout/svg/crashtests/709920-1.svg new file mode 100644 index 000000000..5f2515530 --- /dev/null +++ b/layout/svg/crashtests/709920-1.svg @@ -0,0 +1,23 @@ +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait"> + <!-- Test to be sure that a zero-sized-in-one-dimension viewBox doesn't + make us fail assertions. --> + <script> + document.addEventListener("MozReftestInvalidate", waitAndFinish, false); + + function waitAndFinish() { + // Sadly, MozReftestInvalidate fires sooner than PaintPattern here, so + // we need to wait a little bit to give PaintPattern a chance to hit + // this bug. + setTimeout(finish, 100); + } + + function finish() { + document.documentElement.removeAttribute("class"); + } + </script> + <pattern id="test" viewBox="0 0 1 0"> + <rect/> + </pattern> + <rect width="200" height="200" fill="url(#test)"/> +</svg> diff --git a/layout/svg/crashtests/709920-2.svg b/layout/svg/crashtests/709920-2.svg new file mode 100644 index 000000000..58c51111e --- /dev/null +++ b/layout/svg/crashtests/709920-2.svg @@ -0,0 +1,23 @@ +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait"> + <!-- Test to be sure that a zero-sized-in-one-dimension viewBox doesn't + make us fail assertions. --> + <script> + document.addEventListener("MozReftestInvalidate", waitAndFinish, false); + + function waitAndFinish() { + // Sadly, MozReftestInvalidate fires sooner than PaintPattern here, so + // we need to wait a little bit to give PaintPattern a chance to hit + // this bug. + setTimeout(finish, 100); + } + + function finish() { + document.documentElement.removeAttribute("class"); + } + </script> + <pattern id="test" viewBox="0 0 0 1"> + <rect/> + </pattern> + <rect width="200" height="200" fill="url(#test)"/> +</svg> diff --git a/layout/svg/crashtests/713413-1.svg b/layout/svg/crashtests/713413-1.svg new file mode 100644 index 000000000..713120233 --- /dev/null +++ b/layout/svg/crashtests/713413-1.svg @@ -0,0 +1,12 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<svg xmlns="http://www.w3.org/2000/svg"> + +<marker id="m"></marker> + +<script> +window.addEventListener("load", function() { + document.getElementById("m").appendChild(document.createElementNS("http://www.w3.org/2000/svg", "foreignObject")); +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/722003-1.svg b/layout/svg/crashtests/722003-1.svg new file mode 100644 index 000000000..58e2d5773 --- /dev/null +++ b/layout/svg/crashtests/722003-1.svg @@ -0,0 +1,13 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<marker><foreignObject><span id="x" xmlns="http://www.w3.org/1999/xhtml"></span></foreignObject></marker> + +<script> + +window.addEventListener("load", function() { + document.getElementById("x").getClientRects(); +}, false); + +</script> + +</svg> diff --git a/layout/svg/crashtests/725918-1.svg b/layout/svg/crashtests/725918-1.svg new file mode 100644 index 000000000..5ebdf33f6 --- /dev/null +++ b/layout/svg/crashtests/725918-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text stroke="url(#p)">t</text> + <pattern id="p"/> +</svg> diff --git a/layout/svg/crashtests/732836-1.svg b/layout/svg/crashtests/732836-1.svg new file mode 100644 index 000000000..a9abb4666 --- /dev/null +++ b/layout/svg/crashtests/732836-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" > + + <symbol id="z"> + <use xlink:href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' id='root' />#root" /> + </symbol> + + <use id="a" xlink:href="#z" width="20"/> + + <script> + window.addEventListener("load", function() { + window.scrollByPages(0); + document.getElementById("a").removeAttribute("width"); + document.elementFromPoint(0, 0); + }, false); + </script> + +</svg> diff --git a/layout/svg/crashtests/740627-1.svg b/layout/svg/crashtests/740627-1.svg new file mode 100644 index 000000000..b74fcd2dd --- /dev/null +++ b/layout/svg/crashtests/740627-1.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <pattern id="test" viewBox="0 0 10 10" height="-65%"> + <rect/> + </pattern> + <rect width="100" height="100" fill="url(#test)"/> +</svg> diff --git a/layout/svg/crashtests/740627-2.svg b/layout/svg/crashtests/740627-2.svg new file mode 100644 index 000000000..6241ddaae --- /dev/null +++ b/layout/svg/crashtests/740627-2.svg @@ -0,0 +1,6 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <pattern id="test" viewBox="0 0 10 10" width="-65%"> + <rect/> + </pattern> + <rect width="100" height="100" fill="url(#test)"/> +</svg> diff --git a/layout/svg/crashtests/757704-1.svg b/layout/svg/crashtests/757704-1.svg new file mode 100644 index 000000000..b7e610e0e --- /dev/null +++ b/layout/svg/crashtests/757704-1.svg @@ -0,0 +1,17 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"><script> +<![CDATA[ + +function boom() +{ + var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect"); + document.documentElement.appendChild(rect); + document.removeChild(document.documentElement); + rect.getScreenCTM(); +} + +window.addEventListener("load", boom, false); + +]]> +</script></svg> diff --git a/layout/svg/crashtests/757718-1.svg b/layout/svg/crashtests/757718-1.svg new file mode 100644 index 000000000..fa948c667 --- /dev/null +++ b/layout/svg/crashtests/757718-1.svg @@ -0,0 +1,18 @@ +<!DOCTYPE html> +<html> +<head> +<script> + +function boom() +{ + var svgDoc = (new DOMParser).parseFromString("<svg xmlns='http://www.w3.org/2000/svg'></svg>", "image/svg+xml"); + var svgRoot = svgDoc.documentElement; + var rf = svgRoot.requiredFeatures; + document.adoptNode(svgRoot); + Object.getOwnPropertyNames(rf); +} + +</script> +</head> +<body onload="boom();"></body> +</html> diff --git a/layout/svg/crashtests/757751-1.svg b/layout/svg/crashtests/757751-1.svg new file mode 100644 index 000000000..7ab51d0d1 --- /dev/null +++ b/layout/svg/crashtests/757751-1.svg @@ -0,0 +1,8 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <defs> + <svg id="x" viewBox=" 0 0 10 10"/> + </defs> + <script> + window.addEventListener("load", function() { document.getElementById("x").setAttribute("width", "2"); }, false); + </script> +</svg> diff --git a/layout/svg/crashtests/767056-1.svg b/layout/svg/crashtests/767056-1.svg new file mode 100644 index 000000000..b813d784b --- /dev/null +++ b/layout/svg/crashtests/767056-1.svg @@ -0,0 +1,21 @@ +<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ width="100%"
+ class="reftest-wait">
+ <script>
+
+function resize() {
+ // Set the viewBox to the same width as the content area, but slightly
+ // higher. This checks that we don't enter an infinite reflow loop. See
+ // https://bugzilla.mozilla.org/show_bug.cgi?id=767056#c10
+ var viewBox = "0 0 " + window.innerWidth + " " + (window.innerHeight + 1);
+ document.documentElement.setAttribute("viewBox", viewBox);
+ document.documentElement.removeAttribute("class");
+}
+
+document.addEventListener("MozReftestInvalidate", resize, false);
+setTimeout(resize, 3000); // For non-gecko
+
+ </script>
+ <rect width="100%" height="100%"/>
+</svg>
diff --git a/layout/svg/crashtests/767535-1.xhtml b/layout/svg/crashtests/767535-1.xhtml new file mode 100644 index 000000000..d92bd3b1a --- /dev/null +++ b/layout/svg/crashtests/767535-1.xhtml @@ -0,0 +1,22 @@ +<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-columns: 2 auto;" class="reftest-wait"> + <head> + <script> + +function test() { + var r = document.documentElement; + document.removeChild(r); + document.appendChild(r); + document.documentElement.removeAttribute("class"); +} + + </script> + </head> + <body style="filter:url(#f);" onload="setTimeout(test, 0);"> + <div> + </div> + <svg xmlns="http://www.w3.org/2000/svg"> + <filter id="f"/> + </svg> + </body> +</html> + diff --git a/layout/svg/crashtests/768087-1.html b/layout/svg/crashtests/768087-1.html new file mode 100644 index 000000000..9a7899f9d --- /dev/null +++ b/layout/svg/crashtests/768087-1.html @@ -0,0 +1,4 @@ +<!DOCTYPE html> +<html> +<body onload="setTimeout(function() { document.body.innerHTML = '<span>x<svg viewbox=\'0 0 30 40\' ></svg></span>'; }, 0);"></body> +</html> diff --git a/layout/svg/crashtests/768351.svg b/layout/svg/crashtests/768351.svg new file mode 100644 index 000000000..50a4b9b9c --- /dev/null +++ b/layout/svg/crashtests/768351.svg @@ -0,0 +1,2 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="mask: url('data:text/plain,1#f');" /> + diff --git a/layout/svg/crashtests/778492-1.svg b/layout/svg/crashtests/778492-1.svg new file mode 100644 index 000000000..76deda594 --- /dev/null +++ b/layout/svg/crashtests/778492-1.svg @@ -0,0 +1,4 @@ +<?xml version="1.0"?> +<svg width="1cm" viewBox="0 0 1 1" xmlns="http://www.w3.org/2000/svg"> +<line x2="100" y2="100"/> +</svg> diff --git a/layout/svg/crashtests/779971-1.svg b/layout/svg/crashtests/779971-1.svg new file mode 100644 index 000000000..d57065a0b --- /dev/null +++ b/layout/svg/crashtests/779971-1.svg @@ -0,0 +1,14 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="r" class="reftest-wait"> +<text id="t"><textPath xlink:href="#r">x</textPath>1</text> +<script> + +window.addEventListener("load", function() { + setTimeout(function() { + document.getElementById("t").lastChild.data = "2"; + + document.documentElement.removeAttribute("class"); + }, 200); +}, false); + +</script> +</svg> diff --git a/layout/svg/crashtests/780764-1.svg b/layout/svg/crashtests/780764-1.svg new file mode 100644 index 000000000..6f4eb970b --- /dev/null +++ b/layout/svg/crashtests/780764-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> + +<marker id="marker"><path d="M100,0 l100,100 200,200" filter="url(#filter)"/></marker> + +<filter id="filter"/> + +<path d="M100,0 l100,100 200,200" marker-mid="url(#marker)"/> + +<script> +window.addEventListener("load", function() { + setTimeout(function() { + document.getElementById("filter").style.fontWeight = "bold"; + document.documentElement.removeAttribute("class"); + }, 200); +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/780963-1.html b/layout/svg/crashtests/780963-1.html new file mode 100644 index 000000000..8cbeb1a37 --- /dev/null +++ b/layout/svg/crashtests/780963-1.html @@ -0,0 +1,27 @@ +<!DOCTYPE html> +<html> + <head> + <script> + +function tweak() { + document.body.offsetTop; + + var feImage = document.getElementsByTagName("feImage")[0]; + feImage.setAttribute('filter', 'url(#f1)') + document.body.offsetTop; + + var child = document.createElementNS('http://www.w3.org/2000/svg', 'g') + feImage.appendChild(child); +} + + </script> + </head> + <body onload="tweak()"> + <svg xmlns="http://www.w3.org/2000/svg"> + <filter filterUnits="userSpaceOnUse" id="f1"> + <feImage/> + </filter> + <rect height="100" width="100"/> + </svg> + </body> +</html> diff --git a/layout/svg/crashtests/782141-1.svg b/layout/svg/crashtests/782141-1.svg new file mode 100644 index 000000000..6f0af76ff --- /dev/null +++ b/layout/svg/crashtests/782141-1.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg" version="1.1" + onload="go()"> + <script> + +function go() { + var f = document.getElementById('f'); + var fm = document.getElementById('fm'); + f.appendChild(fm.cloneNode(1)); +} + + </script> + <filter id="f"> + <feMorphology id="fm" radius="2147483500"/> + </filter> + <rect height="28" width="256" filter="url(#f)" /> +</svg> diff --git a/layout/svg/crashtests/784061-1.svg b/layout/svg/crashtests/784061-1.svg new file mode 100644 index 000000000..6a9623154 --- /dev/null +++ b/layout/svg/crashtests/784061-1.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg" + class="reftest-wait"> + +<defs><path id="x"/></defs> + +<script> +function boom() +{ + document.getElementById("x").style.transform = "translate(0px)"; + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/788831-1.svg b/layout/svg/crashtests/788831-1.svg new file mode 100644 index 000000000..b6202a132 --- /dev/null +++ b/layout/svg/crashtests/788831-1.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <pattern id="pattern" width="40" height="40"><stop/></pattern> + <rect id="rect" width="200" height="100"/> + <use xlink:href="#rect" stroke="url(#pattern)" /> +</svg> diff --git a/layout/svg/crashtests/789390-1.html b/layout/svg/crashtests/789390-1.html new file mode 100644 index 000000000..542037f22 --- /dev/null +++ b/layout/svg/crashtests/789390-1.html @@ -0,0 +1 @@ +<html style="transition: 1s;"><body onload="document.documentElement.style.stroke = '-moz-objectStroke';"></body></html> diff --git a/layout/svg/crashtests/790072.svg b/layout/svg/crashtests/790072.svg new file mode 100644 index 000000000..b288251a7 --- /dev/null +++ b/layout/svg/crashtests/790072.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg"><text style="stroke: -moz-objectfill none;">abc</text></svg> diff --git a/layout/svg/crashtests/791826-1.svg b/layout/svg/crashtests/791826-1.svg new file mode 100644 index 000000000..f42261a3a --- /dev/null +++ b/layout/svg/crashtests/791826-1.svg @@ -0,0 +1,14 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="position: fixed;"> +<script> +<![CDATA[ + +function boom() +{ + document.documentElement.setAttribute("preserveAspectRatio", "_"); +} + +window.addEventListener("load", boom, false); + +]]> +</script> +</svg> diff --git a/layout/svg/crashtests/803562-1.svg b/layout/svg/crashtests/803562-1.svg new file mode 100644 index 000000000..e6fc91127 --- /dev/null +++ b/layout/svg/crashtests/803562-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<foreignObject width="500" height="500" style="-moz-appearance: checkbox;"> + <option xmlns="http://www.w3.org/1999/xhtml"></option> +</foreignObject> + +<script> +<![CDATA[ + +window.addEventListener("load", function() { + document.getElementsByTagName("option")[0].appendChild(document.createTextNode("Option 1")); +}, false); + +]]> +</script> + +</svg> + diff --git a/layout/svg/crashtests/808318-1.svg b/layout/svg/crashtests/808318-1.svg new file mode 100644 index 000000000..48907225c --- /dev/null +++ b/layout/svg/crashtests/808318-1.svg @@ -0,0 +1,2 @@ +<svg xmlns="http://www.w3.org/2000/svg" style="-moz-transform-style: preserve-3d"></svg> + diff --git a/layout/svg/crashtests/813420-1.svg b/layout/svg/crashtests/813420-1.svg new file mode 100644 index 000000000..d977c0e98 --- /dev/null +++ b/layout/svg/crashtests/813420-1.svg @@ -0,0 +1,14 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> + <svg id="i" style="mask: url("#none");"> + <marker id="markerEnd"/><polygon marker-end="url(#markerEnd)" points="250,150 200,150"/> + </svg> + <script> + +window.addEventListener("MozReftestInvalidate", function() { + document.getElementById("i").style.mask = "url(#none)"; + document.documentElement.removeAttribute("class"); +}, false); + + </script> +</svg> + diff --git a/layout/svg/crashtests/841163-1.svg b/layout/svg/crashtests/841163-1.svg new file mode 100644 index 000000000..b1bb5198a --- /dev/null +++ b/layout/svg/crashtests/841163-1.svg @@ -0,0 +1,29 @@ +<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"> + +<filter id="f"/> + +<g filter="url(#f)"> + <text>AB</text> +</g> + +<script> + +function forceFrameConstruction() +{ + document.documentElement.getBoundingClientRect(); +} + +function boom() +{ + document.getElementsByTagName("text")[0].firstChild.splitText(1); + forceFrameConstruction(); + document.normalize(); + forceFrameConstruction(); + document.documentElement.removeAttribute("class"); +} + +window.addEventListener("load", boom, false); + +</script> + +</svg> diff --git a/layout/svg/crashtests/841812-1.svg b/layout/svg/crashtests/841812-1.svg new file mode 100644 index 000000000..e5bcaa66e --- /dev/null +++ b/layout/svg/crashtests/841812-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + <text> + <circle> + <textPath id="t" xlink:href="data:text/html,1" /> + </circle> + </text> + + <script> + window.addEventListener("load", function() { document.getElementById("t").removeAttribute('xlink:href'); }, false); + </script> +</svg> diff --git a/layout/svg/crashtests/842009-1.svg b/layout/svg/crashtests/842009-1.svg new file mode 100644 index 000000000..25656ba53 --- /dev/null +++ b/layout/svg/crashtests/842009-1.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> + <title id="hello">hello</title> + <text x="100" y="100"> <tref xlink:href="#hello"/></text> +</svg> diff --git a/layout/svg/crashtests/842630-1.svg b/layout/svg/crashtests/842630-1.svg new file mode 100644 index 000000000..8d36998be --- /dev/null +++ b/layout/svg/crashtests/842630-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg"><text dy="20 20">A<tspan style="display: none;">B</tspan></text></svg> diff --git a/layout/svg/crashtests/842909-1.svg b/layout/svg/crashtests/842909-1.svg new file mode 100644 index 000000000..9a1bc89eb --- /dev/null +++ b/layout/svg/crashtests/842909-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <defs> + <text id="t">X</text> + </defs> + + <script> + window.addEventListener("load", function() { + document.getElementById("t").getSubStringLength(0, 0); + }, false); + </script> +</svg> diff --git a/layout/svg/crashtests/843072-1.svg b/layout/svg/crashtests/843072-1.svg new file mode 100644 index 000000000..590721f05 --- /dev/null +++ b/layout/svg/crashtests/843072-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <defs> + <text id="t"></text> + </defs> + + <script> + window.addEventListener("load", function() { + document.getElementById("t").getExtentOfChar(0); + }, false); + </script> +</svg> diff --git a/layout/svg/crashtests/843917-1.svg b/layout/svg/crashtests/843917-1.svg new file mode 100644 index 000000000..55cf7ab18 --- /dev/null +++ b/layout/svg/crashtests/843917-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <filter id="f"/> + + <g filter="url(#f)"> + <text>a𞠯</text> + </g> + + <script> + + window.addEventListener("load", function() { + var text = document.getElementsByTagName("text")[0]; + text.firstChild.data = "d"; + text.appendChild(document.createElementNS("http://www.w3.org/2000/svg", "g")); + }, false); + + </script> + +</svg> diff --git a/layout/svg/crashtests/847139-1.svg b/layout/svg/crashtests/847139-1.svg new file mode 100644 index 000000000..81fffa4be --- /dev/null +++ b/layout/svg/crashtests/847139-1.svg @@ -0,0 +1,13 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<marker><text>x</text></marker> + +<script> + +window.addEventListener("load", function() { + document.caretPositionFromPoint(0, 0); +}, false); + +</script> + +</svg> diff --git a/layout/svg/crashtests/849688-1.svg b/layout/svg/crashtests/849688-1.svg new file mode 100644 index 000000000..142f04c93 --- /dev/null +++ b/layout/svg/crashtests/849688-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<text></text> + +<script> +window.addEventListener("load", function() { + document.getElementsByTagName('text')[0].getStartPositionOfChar(1); +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/849688-2.svg b/layout/svg/crashtests/849688-2.svg new file mode 100644 index 000000000..4b71b20c7 --- /dev/null +++ b/layout/svg/crashtests/849688-2.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<text>X</text> + +<script> +window.addEventListener("load", function() { + document.getElementsByTagName('text')[0].getStartPositionOfChar(2); +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/860378-1.svg b/layout/svg/crashtests/860378-1.svg new file mode 100644 index 000000000..f4ec09bc4 --- /dev/null +++ b/layout/svg/crashtests/860378-1.svg @@ -0,0 +1,24 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<filter id="f"/> +<g filter="url(#f)"><text>ab</text></g> + +<script> + +function boom() +{ + var svgtext = document.getElementsByTagName("text")[0]; + var text1 = svgtext.firstChild ; + var text2 = text1.splitText(1); + + setTimeout(function() { + text1.data = "c"; + svgtext.removeChild(text2); + }, 200); +} + +window.addEventListener("load", boom, false); + +</script> + +</svg> diff --git a/layout/svg/crashtests/868904-1.svg b/layout/svg/crashtests/868904-1.svg new file mode 100644 index 000000000..c8d7e9437 --- /dev/null +++ b/layout/svg/crashtests/868904-1.svg @@ -0,0 +1,17 @@ +<!DOCTYPE html> +<html> +<head> +<meta charset="UTF-8"> +<style> + +* { animation-name: a; animation-duration: 72ms } +@keyframes a { 60% { transform: skewx(30deg); } } + +</style> +</head> +<body> + +<svg></svg> + +</body> +</html> diff --git a/layout/svg/crashtests/873806-1.svg b/layout/svg/crashtests/873806-1.svg new file mode 100644 index 000000000..e40aff201 --- /dev/null +++ b/layout/svg/crashtests/873806-1.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <foreignObject requiredFeatures="fail"> + <svg> + <text>a</text> + </svg> + </foreignObject> + <script> + document.querySelector("text").getBBox(); + </script> +</svg> diff --git a/layout/svg/crashtests/876831-1.svg b/layout/svg/crashtests/876831-1.svg new file mode 100644 index 000000000..6b6c01f9e --- /dev/null +++ b/layout/svg/crashtests/876831-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<script> + +function boom() +{ + var x = document.getElementById("x").firstChild; + x.data = x.data.slice(1); + document.caretPositionFromPoint(0, 0); +} + +window.addEventListener("load", boom, false); + +</script> + +<text><tspan id="x">@ت</tspan></text> + +</svg> diff --git a/layout/svg/crashtests/877029-1.svg b/layout/svg/crashtests/877029-1.svg new file mode 100644 index 000000000..1a7bad0f1 --- /dev/null +++ b/layout/svg/crashtests/877029-1.svg @@ -0,0 +1,10 @@ +<!-- + Check that we don't crash due to an nsSVGMarkerFrame having a null + mMarkedFrame and incorrectly calling GetCanvasTM() on the nsSVGMarkerFrame. + --> +<svg xmlns="http://www.w3.org/2000/svg"> + <marker><text>a</text></marker> + <script> + document.querySelector("text").getComputedTextLength(); + </script> +</svg> diff --git a/layout/svg/crashtests/880925-1.svg b/layout/svg/crashtests/880925-1.svg new file mode 100644 index 000000000..77efd3c0a --- /dev/null +++ b/layout/svg/crashtests/880925-1.svg @@ -0,0 +1,26 @@ +<?xml version="1.0"?> + +<svg xmlns="http://www.w3.org/2000/svg"> +<script> +<![CDATA[ + +function boom() +{ + var svgText = document.createElementNS("http://www.w3.org/2000/svg", "text"); + document.documentElement.appendChild(svgText); + var text1 = document.createTextNode("A"); + svgText.appendChild(text1); + var text2 = document.createTextNode(""); + svgText.appendChild(text2); + document.caretPositionFromPoint(0, 0); + setTimeout(function() { + text2.data = "B"; + document.caretPositionFromPoint(0, 0); + }, 0); +} + +window.addEventListener("load", boom, false); + +]]> +</script> +</svg> diff --git a/layout/svg/crashtests/881031-1.svg b/layout/svg/crashtests/881031-1.svg new file mode 100644 index 000000000..0738e1299 --- /dev/null +++ b/layout/svg/crashtests/881031-1.svg @@ -0,0 +1,15 @@ +<svg xmlns="http://www.w3.org/2000/svg"> +<script> + +function boom() +{ + var svgText = document.getElementById("t"); + svgText.firstChild.data = "C"; + svgText.appendChild(document.createTextNode("D")); + document.caretPositionFromPoint(0, 0); +} +window.addEventListener("load", boom, false); + +</script> +<text id="t">A</text> +</svg> diff --git a/layout/svg/crashtests/885608-1.svg b/layout/svg/crashtests/885608-1.svg new file mode 100644 index 000000000..0c9677750 --- /dev/null +++ b/layout/svg/crashtests/885608-1.svg @@ -0,0 +1,13 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + +<mask id="m"><text id="t">z</text></mask> + +<rect width="600" height="400" mask="url(#m)"/> + +<script> +window.addEventListener("load", function() { + document.getElementById("t").firstChild.data = "ab"; +}, false); +</script> + +</svg> diff --git a/layout/svg/crashtests/890782-1.svg b/layout/svg/crashtests/890782-1.svg new file mode 100644 index 000000000..686bc73a8 --- /dev/null +++ b/layout/svg/crashtests/890782-1.svg @@ -0,0 +1,16 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <foreignObject requiredFeatures="foo" id="f"> + <svg> + <text id="t"/> + </svg> + </foreignObject> + + <script> + window.addEventListener("load", function() { + document.documentElement.appendChild(document.getElementById("f")) + document.getElementById("t").getNumberOfChars(); + }, false); + </script> + +</svg> diff --git a/layout/svg/crashtests/890783-1.svg b/layout/svg/crashtests/890783-1.svg new file mode 100644 index 000000000..25f54ba2a --- /dev/null +++ b/layout/svg/crashtests/890783-1.svg @@ -0,0 +1,19 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <mask id="m"> + <text> + <tspan id="tspan" /> + </text> + </mask> + + <rect width="600" height="400" mask="url(#m)"/> + + <script> + + window.addEventListener("load", function() { + document.getElementById("tspan").style.dominantBaseline = "alphabetic"; + }, false); + + </script> + +</svg> diff --git a/layout/svg/crashtests/893510-1.svg b/layout/svg/crashtests/893510-1.svg new file mode 100644 index 000000000..bb58be045 --- /dev/null +++ b/layout/svg/crashtests/893510-1.svg @@ -0,0 +1,5 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <g requiredExtensions="foo"> + <text>تz</text> + </g> +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/895311-1.svg b/layout/svg/crashtests/895311-1.svg new file mode 100644 index 000000000..7b0c72804 --- /dev/null +++ b/layout/svg/crashtests/895311-1.svg @@ -0,0 +1,17 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <mask id="m"> + <text> + <tspan id="ts" /> + </text> + </mask> + + <rect width="600" height="400" mask="url(#m)"/> + + <script> + window.addEventListener("load", function() { + document.getElementById("ts").style.overflow = "hidden"; + }, false); + </script> + +</svg> diff --git a/layout/svg/crashtests/897342-1.svg b/layout/svg/crashtests/897342-1.svg new file mode 100644 index 000000000..547e919b7 --- /dev/null +++ b/layout/svg/crashtests/897342-1.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg"><text textLength="50" lengthAdjust="spacingAndGlyphs">‍</text></svg> diff --git a/layout/svg/crashtests/898909-1.svg b/layout/svg/crashtests/898909-1.svg new file mode 100644 index 000000000..8a70cd7b8 --- /dev/null +++ b/layout/svg/crashtests/898909-1.svg @@ -0,0 +1,11 @@ +<svg xmlns="http://www.w3.org/2000/svg" requiredFeatures="foo"> + + <text id="t" /> + + <script> + window.addEventListener("load", function() { + document.getElementById("t").getComputedTextLength(); + }, false); + </script> + +</svg> diff --git a/layout/svg/crashtests/898951-1.svg b/layout/svg/crashtests/898951-1.svg new file mode 100644 index 000000000..f42dbf69f --- /dev/null +++ b/layout/svg/crashtests/898951-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text>X<tspan style="display: none;">2</tspan>́</text> +</svg> diff --git a/layout/svg/crashtests/913990.html b/layout/svg/crashtests/913990.html new file mode 100644 index 000000000..21d8ef3cc --- /dev/null +++ b/layout/svg/crashtests/913990.html @@ -0,0 +1,5 @@ +<!DOCTYPE html> +<html> +<body style="filter: url('feed:javascript:5');"> +</body> +</html> diff --git a/layout/svg/crashtests/919371-1.xhtml b/layout/svg/crashtests/919371-1.xhtml new file mode 100644 index 000000000..b27ba3fa6 --- /dev/null +++ b/layout/svg/crashtests/919371-1.xhtml @@ -0,0 +1,5 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + <svg xmlns="http://www.w3.org/2000/svg"> + <marker style="position: absolute;" /> + </svg> +</html> diff --git a/layout/svg/crashtests/950324-1.svg b/layout/svg/crashtests/950324-1.svg new file mode 100644 index 000000000..a43d84f4d --- /dev/null +++ b/layout/svg/crashtests/950324-1.svg @@ -0,0 +1,3 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <text style="font-family: sans-serif;"> ́</text> +</svg> diff --git a/layout/svg/crashtests/952270-1.svg b/layout/svg/crashtests/952270-1.svg new file mode 100644 index 000000000..69bac47d4 --- /dev/null +++ b/layout/svg/crashtests/952270-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"> + + <path id="path" transform="scale(2,1)" /> + + <text> + <textPath xlink:href="#path">F</textPath> + </text> + +</svg> diff --git a/layout/svg/crashtests/963086-1.svg b/layout/svg/crashtests/963086-1.svg new file mode 100644 index 000000000..3805b46d7 --- /dev/null +++ b/layout/svg/crashtests/963086-1.svg @@ -0,0 +1,18 @@ +<svg xmlns="http://www.w3.org/2000/svg" + viewBox="0 0 64 64"> + <defs> + <filter id="dropShadow"> + <feGaussianBlur stdDeviation="2" /> + <feOffset + result="offsetBlur" + dy="1073741824"/> + <feMerge> + <feMergeNode + in="offsetBlur" /> + <feMergeNode + in="SourceGraphic" /> + </feMerge> + </filter> + </defs> + <rect height="64" width="64" style="filter:url(#dropShadow)" /> +</svg> diff --git a/layout/svg/crashtests/974746-1.svg b/layout/svg/crashtests/974746-1.svg new file mode 100644 index 000000000..c619c25f7 --- /dev/null +++ b/layout/svg/crashtests/974746-1.svg @@ -0,0 +1,9 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <pattern id="patternRotated" width="1" patternTransform="rotate(45 50 50)"> + <rect/> + </pattern> + + <rect width="100" height="100" fill="url(#patternRotated)"/> + +</svg> diff --git a/layout/svg/crashtests/975773-1.svg b/layout/svg/crashtests/975773-1.svg new file mode 100644 index 000000000..dd225eb2a --- /dev/null +++ b/layout/svg/crashtests/975773-1.svg @@ -0,0 +1,10 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + + <filter id="f"> + <feSpecularLighting style="display: none;"/> + <feComposite in="SourceGraphic"/> + </filter> + + <path d="M0,0 h100 v100 h-100 z M20,20 v60 h60 v-60 z" filter="url(#f)"/> + +</svg> diff --git a/layout/svg/crashtests/979407-1.svg b/layout/svg/crashtests/979407-1.svg new file mode 100644 index 000000000..b615f3bec --- /dev/null +++ b/layout/svg/crashtests/979407-1.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="marker" viewBox="0 0 10 10" markerHeight="-1px"/> + <path d="M0,0 h10" marker-start="url(#marker)"/> +</svg> diff --git a/layout/svg/crashtests/979407-2.svg b/layout/svg/crashtests/979407-2.svg new file mode 100644 index 000000000..75aee0634 --- /dev/null +++ b/layout/svg/crashtests/979407-2.svg @@ -0,0 +1,4 @@ +<svg xmlns="http://www.w3.org/2000/svg"> + <marker id="marker" viewBox="0 0 10 10" markerWidth="-1px"/> + <path d="M0,0 h10" marker-start="url(#marker)"/> +</svg> diff --git a/layout/svg/crashtests/993443.svg b/layout/svg/crashtests/993443.svg new file mode 100644 index 000000000..30bd18543 --- /dev/null +++ b/layout/svg/crashtests/993443.svg @@ -0,0 +1,4 @@ +<?xml version="1.0" encoding="UTF-8"?> +<svg xmlns="http://www.w3.org/2000/svg"> +<image width="10" height="10" x="17592186044416pt"/> +</svg>
\ No newline at end of file diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list new file mode 100644 index 000000000..adc2db66b --- /dev/null +++ b/layout/svg/crashtests/crashtests.list @@ -0,0 +1,199 @@ +load 220165-1.svg +load 267650-1.svg +load 294022-1.svg +load 307314-1.svg +load 308615-1.svg +load 308917-1.svg +load 310436-1.svg +load 310638.svg +load 313737-1.xml +load 314244-1.xul +load 322185-1.svg +load 322215-1.svg +load 323704-1.svg +load 325427-1.svg +load 326495-1.svg +load 326974-1.svg +load 327706-1.svg +load 327709-1.svg +load 327711-1.svg +load 328137-1.svg +load 329848-1.svg +load 337408-1.xul +load 338301-1.xhtml +load 338312-1.xhtml +load 340083-1.svg +load 340945-1.svg +load 342923-1.html +load 343221-1.xhtml +load 344749-1.svg +load 344887-1.svg +load 344892-1.svg +load 344898-1.svg +load 344904-1.svg +load 345418-1.svg +load 348982-1.xhtml +load 354777-1.xhtml +load 359516-1.svg +load 361015-1.svg +load 361587-1.svg +load 363611-1.xhtml +load 364688-1.svg +load 366956-1.svg +load 366956-2.svg +load 367111-1.svg +load 367368-1.xhtml +load 369233-1.svg +load 369438-1.svg +load 369438-2.svg +load 371463-1.xhtml +load 371563-1.xhtml +load 375775-1.svg +load 378716.svg +load 380691-1.svg +load 384391-1.xhtml +load 384499-1.svg +load 384637-1.svg +load 384728-1.svg +load 385246-1.svg +load 385246-2.svg +load 385552-1.svg +load 385552-2.svg +load 385840-1.svg +load 385852-1.svg +load 386475-1.xhtml +load 386566-1.svg +load 386690-1.svg +load 387290-1.svg +load 402408-1.svg +load 404677-1.xhtml +load 409565-1.xhtml +load 409573-1.svg +load 420697-1.svg +load 420697-2.svg +load 429774-1.svg +load 441368-1.svg +load 453754-1.svg +load 455314-1.xhtml +load 458453.html +load 459666-1.html +load 459883.xhtml +load 461289-1.svg +load 464374-1.svg +load 466585-1.svg +load 467323-1.svg +load 467498-1.svg +load 470124-1.svg +load 472782-1.svg +load 474700-1.svg +load 475181-1.svg +load 475193-1.html +load 475302-1.svg +load 477935-1.html +load 478128-1.svg +load 478511-1.svg +load 483439-1.svg +load 492186-1.svg +load 508247-1.svg +load 512890-1.svg +load 515288-1.html +load 522394-1.svg +load 522394-2.svg +load 522394-3.svg +load 566216-1.svg +load 587336-1.html +load 590291-1.svg +load 601999-1.html +load 605626-1.svg +load 610594-1.html +load 610954-1.html +load 612662-1.svg +load 612662-2.svg +load 612736-1.svg +load 612736-2.svg +load 614367-1.svg +load 620034-1.html +load 621598-1.svg +load 648819-1.html +load 655025-1.svg +load 655025-2.svg +load 655025-3.svg +load 657077-1.svg +load 669025-1.svg +load 669025-2.svg +load 682411-1.svg +load 692203-1.svg +load 692203-2.svg +load 693424-1.svg +load 709920-1.svg +load 709920-2.svg +load 713413-1.svg +load 722003-1.svg +load 725918-1.svg +load 732836-1.svg +load 740627-1.svg +load 740627-2.svg +load 757704-1.svg +load 757718-1.svg +load 757751-1.svg +load 767056-1.svg +load 767535-1.xhtml +load 768087-1.html +load 768351.svg +load 778492-1.svg +load 779971-1.svg +load 780764-1.svg +load 780963-1.html +load 782141-1.svg +load 784061-1.svg +load 788831-1.svg +load 789390-1.html +load 790072.svg +load 791826-1.svg +load 808318-1.svg +load 803562-1.svg +load 813420-1.svg +load 841163-1.svg +load 841812-1.svg +load 842009-1.svg +load 842630-1.svg +load 842909-1.svg +load 843072-1.svg +load 843917-1.svg +load 847139-1.svg +load 849688-1.svg +load 849688-2.svg +load 860378-1.svg +load 868904-1.svg +load 873806-1.svg +load 876831-1.svg +load 877029-1.svg +load 880925-1.svg +load 881031-1.svg +load 885608-1.svg +load 890782-1.svg +load 890783-1.svg +load 893510-1.svg +load 895311-1.svg +load 897342-1.svg +load 898909-1.svg +load 898951-1.svg +load 913990.html +load 919371-1.xhtml +load 950324-1.svg +load 952270-1.svg +load 963086-1.svg +load 974746-1.svg +load 975773-1.svg +load 979407-1.svg +load 979407-2.svg +load 993443.svg +load 1016145.svg +load 1028512.svg +load 1140080-1.svg +load 1149542-1.svg +load 1156581-1.svg +load 1182496-1.html +load 1209525-1.svg +load 1223281-1.svg +load extref-test-1.xhtml diff --git a/layout/svg/crashtests/extref-test-1-resource.xhtml b/layout/svg/crashtests/extref-test-1-resource.xhtml new file mode 100644 index 000000000..cd47ddc2f --- /dev/null +++ b/layout/svg/crashtests/extref-test-1-resource.xhtml @@ -0,0 +1,24 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> +<body style="margin:0"> + <embed type="application/x-shockwave-flash" src="data:application/x-shockwave-flash,This is a test"></embed> + <iframe src="date:text/plain,aaa"></iframe> + <div style="mask: url(#m1); width:500px; height:500px; background:lime;"></div> + + <svg:svg height="0"> + <svg:mask id="m1" maskUnits="objectBoundingBox" maskContentUnits="objectBoundingBox"> + <svg:linearGradient id="g" gradientUnits="objectBoundingBox" x2="0" y2="1"> + <svg:stop stop-color="white" offset="0"/> + <svg:stop stop-color="white" stop-opacity="0" offset="1"/> + </svg:linearGradient> + <svg:circle cx="0.25" cy="0.25" r="0.25" id="circle" fill="white"/> + <svg:rect x="0.5" y="0" width="0.5" height="1" fill="url(#g)"/> + </svg:mask> + </svg:svg> +</body> +</html> diff --git a/layout/svg/crashtests/extref-test-1.xhtml b/layout/svg/crashtests/extref-test-1.xhtml new file mode 100644 index 000000000..932b679b1 --- /dev/null +++ b/layout/svg/crashtests/extref-test-1.xhtml @@ -0,0 +1,11 @@ +<!-- + Any copyright is dedicated to the Public Domain. + http://creativecommons.org/licenses/publicdomain/ +--> +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:svg="http://www.w3.org/2000/svg" + xmlns:xlink="http://www.w3.org/1999/xlink"> +<body style="margin:0"> + <div style="mask: url(extref-test-1-resource.xhtml#m1); width:500px; height:500px; background:lime;"></div> +</body> +</html> |
