From 5f8de423f190bbb79a62f804151bc24824fa32d8 Mon Sep 17 00:00:00 2001
From: "Matt A. Tobin" <mattatobin@localhost.localdomain>
Date: Fri, 2 Feb 2018 04:16:08 -0500
Subject: Add m-esr52 at 52.6.0

---
 .../crashtests/long-clipPath-reference-chain.svg   | 53 ++++++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 dom/svg/crashtests/long-clipPath-reference-chain.svg

(limited to 'dom/svg/crashtests/long-clipPath-reference-chain.svg')

diff --git a/dom/svg/crashtests/long-clipPath-reference-chain.svg b/dom/svg/crashtests/long-clipPath-reference-chain.svg
new file mode 100644
index 000000000..31a587c74
--- /dev/null
+++ b/dom/svg/crashtests/long-clipPath-reference-chain.svg
@@ -0,0 +1,53 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <title>Test very long clipPath chain - MAY CRASH</title>
+  <script><![CDATA[
+
+// This script creates a very long chain of clipPath elements to test whether
+// that causes a stack overflow that crashes the UA.  The first clipPath clips
+// to a 50x100 rect, the last to a 25x100 rect.  If a UA was to apply the
+// entire clipPath chain (unlikely) a rect 25x100 would be rendered.
+//
+// At the time of writing, Firefox would treat the entire chain of clipPaths as
+// invalid due to its excessive length, and refuse to render the referencing
+// element at all.  One alternative would be to ignore the clipPath reference
+// and render the referencing element without any clipping.  Another
+// alternative would be to break the chain and clip the referencing element,
+// but only using the first X clipPaths in the chain (in which case a 50x100
+// rect would be rendered).
+
+var chainLength = 100000;
+
+var SVG_NS = "http://www.w3.org/2000/svg";
+var template = document.createElementNS(SVG_NS, "clipPath");
+var templatesRect = document.createElementNS(SVG_NS, "rect");
+templatesRect.setAttribute("width", "100");
+templatesRect.setAttribute("height", "100");
+template.appendChild(templatesRect);
+
+function createClipPath(index) {
+  var cp = template.cloneNode(true);
+  cp.id = "c" + index;
+  cp.setAttribute("clip-path", "url(#c" + (index + 1) + ")");
+  return cp;
+}
+
+var de = document.documentElement;
+
+for (var i = chainLength; i > 0; --i) {
+  var cp = createClipPath(i);
+
+  if (i == chainLength) {
+    cp.firstChild.setAttribute("width", "25");
+  }
+  else if (i == 1) {
+    cp.firstChild.setAttribute("width", "50");
+  }
+
+  de.appendChild(cp);
+}
+
+  ]]></script>
+  <rect width="100%" height="100%" fill="lime"/>
+  <!-- We don't expect the following element to render at all -->
+  <rect width="500" height="500" clip-path="url(#c1)"/>
+</svg>
-- 
cgit v1.2.3