Add 19 crashtests
authorJesse Ruderman <jruderman@gmail.com>
Thu, 01 Jan 2009 14:18:58 -0800
changeset 23222 092f31b0eee7a87faccd76c48db6810a8236b5a0
parent 23221 5cce4f89e78c262e1d7da1328fb0f37ed8a87fa3
child 23238 5a1e6eac685cf2540721eb0b8fe1d83849c3f2b4
push id4404
push userjruderman@mozilla.com
push dateThu, 01 Jan 2009 22:19:32 +0000
treeherdermozilla-central@092f31b0eee7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone1.9.2a1pre
Add 19 crashtests
content/html/document/crashtests/468562-1.html
content/html/document/crashtests/468562-2.html
content/html/document/crashtests/crashtests.list
content/svg/content/src/crashtests/466576-1.xhtml
content/svg/content/src/crashtests/crashtests.list
content/xul/content/crashtests/384740-1.xul
content/xul/content/crashtests/crashtests.list
gfx/thebes/crashtests/463307-1.html
gfx/thebes/crashtests/467873-1.html
gfx/thebes/crashtests/470418-1.html
gfx/thebes/crashtests/crashtests.list
js/src/xpconnect/crashtests/468552-1.html
js/src/xpconnect/crashtests/crashtests.list
layout/base/crashtests/384392-1.xhtml
layout/base/crashtests/384392-2.svg
layout/base/crashtests/crashtests.list
layout/generic/crashtests/413079-1.xhtml
layout/generic/crashtests/413079-2.xhtml
layout/generic/crashtests/413079-3.xhtml
layout/generic/crashtests/436969-1.html
layout/generic/crashtests/crashtests.list
layout/svg/crashtests/453754-1.svg
layout/svg/crashtests/464374-1.svg
layout/svg/crashtests/470124-1.svg
layout/svg/crashtests/crashtests.list
layout/xul/base/src/crashtests/470063-1.html
layout/xul/base/src/crashtests/crashtests.list
parser/htmlparser/tests/crashtests/468538-1.xhtml
parser/htmlparser/tests/crashtests/crashtests.list
new file mode 100644
--- /dev/null
+++ b/content/html/document/crashtests/468562-1.html
@@ -0,0 +1,6 @@
+<html>
+<head></head>
+<body>
+<table><script>document.write("Q");</script><link>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/html/document/crashtests/468562-2.html
@@ -0,0 +1,6 @@
+<html>
+<head></head>
+<body>
+<table><script>document.write("Q");</script><link></table>
+</body>
+</html>
--- a/content/html/document/crashtests/crashtests.list
+++ b/content/html/document/crashtests/crashtests.list
@@ -1,5 +1,7 @@
 #load 353713-1.html # Bug 469626
 load 388183-1.html
 load 395340-1.html
 load 407053.html
 load 448564.html
+load 468562-1.html
+load 468562-2.html
new file mode 100644
--- /dev/null
+++ b/content/svg/content/src/crashtests/466576-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  try {
+    document.getElementById("y").gradientTransform.baseVal.appendItem(function(){});
+  } catch(e) { }
+
+  document.documentElement.innerHTML;
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<linearGradient id="y" xmlns="http://www.w3.org/2000/svg" />
+
+</body>
+</html>
--- a/content/svg/content/src/crashtests/crashtests.list
+++ b/content/svg/content/src/crashtests/crashtests.list
@@ -34,8 +34,9 @@ load 410659-1.svg
 load 410659-2.svg
 load 410659-3.svg
 load 412104-1.svg
 load 413174-1.svg
 load 414188-1.svg
 load 427325-1.svg
 load 428228-1.svg
 load 428841-1.svg
+load 466576-1.xhtml
new file mode 100644
--- /dev/null
+++ b/content/xul/content/crashtests/384740-1.xul
@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom()">
+
+<script>
+
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+  var scrollbar = document.createElementNS(XUL_NS, 'scrollbar');
+  document.documentElement.appendChild(scrollbar);
+  var sbb = document.getAnonymousNodes(scrollbar)[0];
+  var action = document.createElementNS(XUL_NS, 'action');
+  action.setAttribute('datasources', "");
+  sbb.appendChild(action);
+}
+
+</script>
+
+</window>
--- a/content/xul/content/crashtests/crashtests.list
+++ b/content/xul/content/crashtests/crashtests.list
@@ -1,12 +1,13 @@
 load 326864-1.xul
 load 326875-1.xul
 load 326881-1.xul
 load 329982-1.xhtml
 load 336096-1.xhtml
 load 354611-1.html
 load 360078-1.xhtml
 load 363791-1.xul
+load 384740-1.xul
 load 386947-1.xul
 load 425821-1.xul
 load 429085-1.xhtml
 load 461917-1.xhtml
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/463307-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html style="position: relative; bottom: 4449920388in; margin: 200px;">
+<head></head>
+<body style="background: url(../../../layout/reftests/bugs/repeatable-diagonal-gradient.png);"></body>
+</html>
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/467873-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('q').appendChild(document.createTextNode('C'));">
+<div style="white-space: pre; direction: rtl;">A<div id="q" style="text-transform: capitalize;">B
+<div></div></div></div>
+</body></html>
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/470418-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body><div style="text-transform: capitalize">&#x06CD;A</div></body>
+</html>
\ No newline at end of file
--- a/gfx/thebes/crashtests/crashtests.list
+++ b/gfx/thebes/crashtests/crashtests.list
@@ -34,10 +34,12 @@ load 410728-1.xml
 load 416637-1.html
 load 419095-1.html
 load 420945-1.html
 load 420962-1.html
 load 421393-1.html
 load 421813-1.html
 load 423270-1.html
 load 429899-1.html
+load 463307-1.html
+load 467873-1.html
+load 470418-1.html
 skip-if(MOZ_WIDGET_TOOLKIT=="gtk2") load 441360.html # filed bug 455463 for gtk2
-
new file mode 100644
--- /dev/null
+++ b/js/src/xpconnect/crashtests/468552-1.html
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var dp = document.__proto__;
+  dp.__proto__ = new XPCNativeWrapper(new XMLSerializer);
+  try {
+    dp.isSupported();
+  } catch(e) { }
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
--- a/js/src/xpconnect/crashtests/crashtests.list
+++ b/js/src/xpconnect/crashtests/crashtests.list
@@ -6,8 +6,9 @@ load 382133-1.html
 load 386680-1.html
 load 394810-1.html
 load 400349-1.html
 load 403356-1.html
 load 418139-1.svg
 load 420513-1.html
 load 453935-1.html
 load 462926.html
+load 468552-1.html
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/384392-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  var table = document.getElementById("table");
+  document.removeChild(document.documentElement);
+  document.appendChild(table);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+
+
+<table border="1" id="table">
+ <tr>
+  <td><input type="text" value="Textbox" /></td>
+ </tr>
+</table>
+
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/384392-2.svg
@@ -0,0 +1,3 @@
+<circle xmlns="http://www.w3.org/2000/svg">
+  <foreignObject/>
+</circle>
\ No newline at end of file
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -67,16 +67,18 @@ load 379419-1.xhtml
 load 379768-1.html
 load 379799-1.html
 load 379920-1.svg
 load 379920-2.svg
 load 380096-1.html
 load 382204-1.html
 load 383102-1.xhtml
 load 383806-1.xhtml
+load 384392-1.xhtml
+load 384392-2.svg
 load 384649-1.xhtml
 load 385866-1.xhtml
 load 385880-1.xhtml
 load 387195-1.html
 load 388715-1.html
 load 390976-1.html
 load 393661-1.html
 load 393801-1.html
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/413079-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body onload='document.getElementById("x").style.letterSpacing = "20px";'>
+
+<div style="-moz-column-count: 15;" id="x"><span>AAA
+<div style="float: left;">BBBB<div>CCCC</div></div></span></div>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/413079-2.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ </head>
+ <body >
+  <div style="-moz-column-count: 12; border: 1px solid green">
+   <span>AAAA
+    <div style="float: left;border: 1px solid blue">BBBB
+    </div>
+   </span>
+  </div>
+ </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/413079-3.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ </head>
+ <body >
+  <div style="-moz-column-count: 2; border: 1px solid green">
+   <span>AAAA
+    <div style="float: left;border: 1px solid blue">BBBB
+    </div>
+   </span>
+  </div>
+ </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/436969-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.documentElement.style.zIndex = 2;">
+
+<div style="direction: rtl; text-transform: uppercase; width: 1px;"><div style="position: absolute; -moz-column-count: 2;"><span style="padding: 6em 0pt; position: absolute; height: 1.2em;">A !BB CCC D,</span></div></div>
+
+</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -132,16 +132,19 @@ load 408749-1.xhtml
 load 408883-1.html
 load 410228-1.html
 load 411213-1.html
 load 411213-2.xml
 load 411851-1.html
 load 412201-1.xhtml
 load 412543-1.html
 load 413048-1.html
+load 413079-1.xhtml
+load 413079-2.xhtml
+load 413079-3.xhtml
 load 413582-1.xhtml
 load 413582-2.html
 load 414061-1.html
 load 414719-1.html
 load 415685-1.html
 load 416264-1.html
 load 416476-1.html
 load 418532-1.html
@@ -151,16 +154,17 @@ load 422301-1.html
 load 423055-1.html
 load 425253-1.html
 load 426272-1.html
 load 428263-1.html
 load 429981-1.html
 load 430352-1.html
 load 435529.html
 load 436823.html
+load 436969-1.html
 load 437156-1.html
 load 438259-1.html
 load 438509-1.html
 load 443528-1.html
 load 448903-1.html
 load 451334-1.html
 load 452157-1.html
 load 452157-2.html
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/453754-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+  <filter id="f" height="-1" filterRes="1"/>
+
+  <rect filter="url(#f)" />
+
+</svg>
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/464374-1.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("b").appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "math"));
+  document.getElementById("defs").setAttribute("filter", "url(#a)");
+}
+
+</script>
+
+<defs id="defs"><filter id="a"/><g id="b"><rect/></g></defs>
+
+</svg>
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/470124-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<filter id="f7" filterUnits="userSpaceOnUse" primitiveUnits="objectBoundingBox"><feComposite/></filter>
+
+<g filter="url(#f7)"/>
+
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -48,11 +48,14 @@ load 386475-1.xhtml
 load 386566-1.svg
 load 387290-1.svg
 load 402408-1.svg
 load 404677-1.xhtml
 load 409565-1.xhtml
 load 409573-1.svg
 load 429774-1.svg
 load 441368-1.svg
+load 453754-1.svg
 load 455314-1.xhtml
 load 458453.html
+load 464374-1.svg
+load 470124-1.svg
 load extref-test-1.xhtml
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/470063-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.removeChild(document.documentElement)
+  document.appendChild(document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox"));
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@@ -22,8 +22,9 @@ load 394120-1.xhtml
 load 397304-1.html
 load 398326-1.xhtml
 load 402912-1.xhtml
 load 408904-1.xul
 load 412479-1.xhtml
 load 430356-1.xhtml
 load 431738.xhtml
 load 434458-1.xul
+load 470063-1.html
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/468538-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var v = document.getElementById("v");
+  document.body.removeChild(document.body.firstChild);
+  v.innerHTML = "f";
+}
+
+</script>
+</head>
+<body onload="boom();"><xul:box><div id="v"/></xul:box></body>
+</html>
--- a/parser/htmlparser/tests/crashtests/crashtests.list
+++ b/parser/htmlparser/tests/crashtests/crashtests.list
@@ -1,1 +1,2 @@
 load 423373-1.html
+load 468538-1.xhtml