diff options
| author | Matt A. Tobin <mattatobin@localhost.localdomain> | 2018-02-02 04:16:08 -0500 |
|---|---|---|
| committer | Matt A. Tobin <mattatobin@localhost.localdomain> | 2018-02-02 04:16:08 -0500 |
| commit | 5f8de423f190bbb79a62f804151bc24824fa32d8 (patch) | |
| tree | 10027f336435511475e392454359edea8e25895d /dom/xbl/crashtests | |
| parent | 49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff) | |
| download | uxp-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz | |
Add m-esr52 at 52.6.0
Diffstat (limited to 'dom/xbl/crashtests')
45 files changed, 1069 insertions, 0 deletions
diff --git a/dom/xbl/crashtests/205735-1.xhtml b/dom/xbl/crashtests/205735-1.xhtml new file mode 100644 index 0000000000..bfc42773bc --- /dev/null +++ b/dom/xbl/crashtests/205735-1.xhtml @@ -0,0 +1,27 @@ +<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>Bug 205735</title>
+<xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl" xmlns="http://www.mozilla.org/xbl">
+<binding id="rd">
+<xbl:content xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl"><div><div>binding content<xbl:children/></div></div></xbl:content>
+ <implementation>
+ <constructor>
+ <![CDATA[
+ var x=document.getAnonymousNodes(this)[0];
+ x.removeChild(x.childNodes[0]);
+ ]]>
+ </constructor>
+ </implementation>
+</binding>
+</xbl:bindings>
+<style type="text/css">
+.chapter{-moz-binding:url(#rd);}
+</style>
+</head>
+<body>
+<div class="chapter">test</div>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/223799-1.xul b/dom/xbl/crashtests/223799-1.xul new file mode 100644 index 0000000000..455ac9e05f --- /dev/null +++ b/dom/xbl/crashtests/223799-1.xul @@ -0,0 +1,27 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> +<window + xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:html="http://www.w3.org/1999/xhtml" + > + <bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="foo"> + <content><xul:box><xul:box><children/></xul:box></xul:box></content> + </binding> + <implementation> + <field name="box">document.getAnonymousNodes(this)[0]</field> + </implementation> + </bindings> + <html:style type="text/css"> + <!-- CSS style rules for XBL bindings go here --> + <![CDATA[ +foo { + -moz-binding: url("#foo"); +} + ]]> + </html:style> + <!-- XUL application goes here --> + + <foo><description>World</description></foo> +</window> diff --git a/dom/xbl/crashtests/226744-1.xhtml b/dom/xbl/crashtests/226744-1.xhtml new file mode 100644 index 0000000000..63915dbe88 --- /dev/null +++ b/dom/xbl/crashtests/226744-1.xhtml @@ -0,0 +1,35 @@ +<?xml version="1.0" encoding="utf-8"?> +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:html="http://www.w3.org/1999/xhtml" + xmlns:xbl="http://www.mozilla.org/xbl"> + + <xbl:bindings> + <xbl:binding id="rd"> + <xbl:resources> +<xbl:stylesheet src="data:text/html;charset=utf-8,"/> +</xbl:resources> + <xbl:content> +<xbl:children/> + </xbl:content> + </xbl:binding> + + </xbl:bindings> + + <head> + <title>testcase bug ?</title> + + <style type="text/css"> + .hoofdstuk { + -moz-binding: url(#rd); + } + </style> + </head> + + <body> +<div class="hoofdstuk">test +</div> +<div class="hoofdstuk">test +</div> + </body> + +</html> diff --git a/dom/xbl/crashtests/232095-1.xul b/dom/xbl/crashtests/232095-1.xul new file mode 100644 index 0000000000..bfd5476e6f --- /dev/null +++ b/dom/xbl/crashtests/232095-1.xul @@ -0,0 +1,44 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> +<window + xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:xbl="http://www.mozilla.org/xbl" + xmlns:html="http://www.w3.org/1999/xhtml" + > +<bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="serverpost_base"> + <implementation> + <method name="getSuccessfulControls"> + <parameter name="aNode"/> + <body><![CDATA[ + dump("<html:input type="file"/> has not been tested yet! This may not work!!!\n"); + ]]></body> + </method> + + <method name='finalizeAndSubmit'> + <body> + return true; + </body> + </method> + </implementation> + </binding> +</bindings> + + <html:style type="text/css"><![CDATA[ + @namespace xbl url("http://www.mozilla.org/xbl"); + @namespace xul url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"); + + xbl|bindings { + display: none; + } + + xul|serverpost { + -moz-binding: url("#serverpost_base"); + } + + ]]></html:style> + + <serverpost/> + <serverpost/> +</window> diff --git a/dom/xbl/crashtests/277523-1.xhtml b/dom/xbl/crashtests/277523-1.xhtml new file mode 100644 index 0000000000..74dc5d8080 --- /dev/null +++ b/dom/xbl/crashtests/277523-1.xhtml @@ -0,0 +1,24 @@ +<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+<title>Testcase bug 277208 - appendChild to a hidden box from a binding crashes</title>
+
+<xbl:bindings><xbl:binding id="crash"><xbl:content>
+<span style="display:none"><xbl:children includes="span"/></span>
+</xbl:content></xbl:binding></xbl:bindings>
+
+<style type="text/css">
+#test{-moz-binding:url(#crash);}
+</style>
+</head>
+<body onload="init()">
+<span id="test"></span>
+<script>
+function init(){
+ document.getElementById('test').appendChild(document.createElement('span'));
+}
+</script>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/277950-1.xhtml b/dom/xbl/crashtests/277950-1.xhtml new file mode 100644 index 0000000000..eae6f1574b --- /dev/null +++ b/dom/xbl/crashtests/277950-1.xhtml @@ -0,0 +1,20 @@ +<?xml version="1.0"?> +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<title>Testcase</title> +<xbl:bindings xmlns="http://www.mozilla.org/xbl" + xmlns:xbl="http://www.mozilla.org/xbl"> + <binding id="test"> + <implementation> + <property/> + </implementation> + </binding> +</xbl:bindings> +<style type="text/css"> + p{ -moz-binding: url(#test); } +</style> +</head> +<body> +<p></p> +</body> +</html> diff --git a/dom/xbl/crashtests/336744-1-inner.html b/dom/xbl/crashtests/336744-1-inner.html new file mode 100644 index 0000000000..4af1fbd52c --- /dev/null +++ b/dom/xbl/crashtests/336744-1-inner.html @@ -0,0 +1,6 @@ +<html><head> +<title>Testcase bug 336744 - Crash when window gets destroyed during popuphiding event</title> +</head><body> +This should not crash Mozilla within 1 second<br> +<iframe src="data:application/vnd.mozilla.xul+xml;charset=utf-8,%3C%3Fxml%20version%3D%221.0%22%3F%3E%0A%3C%3Fxml-stylesheet%20href%3D%22chrome%3A//global/skin%22%20type%3D%22text/css%22%3F%3E%0A%0A%3Cwindow%20xmlns%3Ahtml%3D%22http%3A//www.w3.org/1999/xhtml%22%0A%20%20%20%20%20%20%20%20xmlns%3D%22http%3A//www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%22%3E%0A%3Chtml%3Ascript%3E%0Adocument.addEventListener%28%22popuphiding%22%2C%20doe%2C%20true%29%3B%0Afunction%20doe%28e%29%20%7B%0Avar%20x%3D%20parent.document.getElementsByTagName%28%27iframe%27%29%5B0%5D%3B%0Ax.parentNode.removeChild%28x%29%3B%0A%7D%0AsetTimeout%28function%28%29%20%7B%20document.getElementsByTagName%28%22menupopup%22%29%5B0%5D.showPopup%28%29%3B%20%7D%2C%20800%29%3B%0AsetTimeout%28function%28%29%20%7B%20document.getElementsByTagName%28%22menupopup%22%29%5B0%5D.hidePopup%28%29%3B%20%7D%2C%201000%29%3B%0A%3C/html%3Ascript%3E%0A%3Cscript%3E%0A%0A%3C/script%3E%0A%3Cmenupopup%3E%0A%20%20%3Cmenuitem%20label%3D%22One%22/%3E%0A%3C/menupopup%3E%0A%3C/window%3E%0A"></iframe> +</body></html>
\ No newline at end of file diff --git a/dom/xbl/crashtests/336744-1.html b/dom/xbl/crashtests/336744-1.html new file mode 100644 index 0000000000..48d5c17010 --- /dev/null +++ b/dom/xbl/crashtests/336744-1.html @@ -0,0 +1,9 @@ +<html class="reftest-wait"> +<head> +<script> +setTimeout('document.documentElement.className = ""', 1000); +</script> +<body> +<iframe src="336744-1-inner.html"></iframe> +</body> +</html> diff --git a/dom/xbl/crashtests/336960-1-inner.xhtml b/dom/xbl/crashtests/336960-1-inner.xhtml new file mode 100644 index 0000000000..2064f89779 --- /dev/null +++ b/dom/xbl/crashtests/336960-1-inner.xhtml @@ -0,0 +1,29 @@ +<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+ <script>
+ var x=document.createElementNS('http://www.w3.org/1999/xhtml','style');
+ document.documentElement.appendChild(x);
+ function doe(){
+ var y=document.getElementsByTagName('style')[0];
+ }
+ setTimeout(doe,500);
+ </script>
+
+ <style>
+ style {-moz-binding:url(#randomxbl);}
+ </style>
+
+ <bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="randomxbl">
+ <implementation>
+ <constructor>
+ var x= parent.document.getElementsByTagName('iframe')[0];
+x.parentNode.removeChild(x);
+ </constructor>
+ </implementation>
+ </binding>
+ </bindings>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/336960-1.html b/dom/xbl/crashtests/336960-1.html new file mode 100644 index 0000000000..0263d30958 --- /dev/null +++ b/dom/xbl/crashtests/336960-1.html @@ -0,0 +1,13 @@ +<html class="reftest-wait">
+<head>
+
+<title>Testcase bug 336960 - Crash when window gets destroyed when constructor of xbl is running</title>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+</head><body>
+This page should not crash Mozilla, you should see no iframe<br>
+<iframe src="./336960-1-inner.xhtml"></iframe>
+
+</body>
+</html>
\ No newline at end of file diff --git a/dom/xbl/crashtests/342954-1.xhtml b/dom/xbl/crashtests/342954-1.xhtml new file mode 100644 index 0000000000..dbaa153840 --- /dev/null +++ b/dom/xbl/crashtests/342954-1.xhtml @@ -0,0 +1,46 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl"> + + +<head> + +<script> +<![CDATA[ + +function boo() +{ + s1 = document.getElementById("s1"); + marq = document.getElementById("marq"); + marqAnonymousSomething = document.getAnonymousNodes(marq)[0].childNodes[0]; + + removeNode(marqAnonymousSomething); + s1.appendChild(document.createElement("div")); +} + +function removeNode(q1) { q1.parentNode.removeChild(q1); } + +]]> +</script> + +<xbl:bindings id="marqueeBindings"> + <xbl:binding id="marquee-horizontal-12"> + <xbl:content> + <div> + <xbl:children/> + </div> + </xbl:content> + </xbl:binding> +</xbl:bindings> + +</head> + + +<body onload="boo()"> + +<span id="s1">Span</span> + +<div id="marq" style="-moz-binding: url('#marquee-horizontal-12');">Marquee</div> + +</body> + + +</html> diff --git a/dom/xbl/crashtests/342954-2-xbl.xml b/dom/xbl/crashtests/342954-2-xbl.xml new file mode 100644 index 0000000000..3e73f1355a --- /dev/null +++ b/dom/xbl/crashtests/342954-2-xbl.xml @@ -0,0 +1,19 @@ +<?xml version="1.0"?> + +<bindings id="marqueeBindings" + xmlns="http://www.mozilla.org/xbl" + xmlns:html="http://www.w3.org/1999/xhtml" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:xbl="http://www.mozilla.org/xbl"> + + <binding id="marquee-horizontal-10"> + + <content> + <html:div> + <children/> + </html:div> + </content> + + </binding> + +</bindings> diff --git a/dom/xbl/crashtests/342954-2.xhtml b/dom/xbl/crashtests/342954-2.xhtml new file mode 100644 index 0000000000..4a250e31c2 --- /dev/null +++ b/dom/xbl/crashtests/342954-2.xhtml @@ -0,0 +1,29 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<script> +<![CDATA[ + +function boo() +{ + s1 = document.getElementById("s1"); + marq = document.getElementById("marq"); + marqAnonymousSomething = document.getAnonymousNodes(marq)[0].childNodes[0]; + + removeNode(marqAnonymousSomething); + s1.appendChild(document.createElement("div")); +} + +function removeNode(q1) { q1.parentNode.removeChild(q1); } + +]]> +</script> +</head> + +<body onload="boo()"> + +<span id="s1">Span</span> + +<div id="marq" style="-moz-binding: url('342954-2-xbl.xml#marquee-horizontal-10');">Marquee</div> + +</body> +</html> diff --git a/dom/xbl/crashtests/368276-1.xhtml b/dom/xbl/crashtests/368276-1.xhtml new file mode 100644 index 0000000000..162494b2cd --- /dev/null +++ b/dom/xbl/crashtests/368276-1.xhtml @@ -0,0 +1,33 @@ +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + class="reftest-wait"> + +<head> +<script> + +function boom() +{ + var quote = document.getElementById("quote"); + var para = document.getElementById("para"); + var dialog = document.getElementById("dialog"); + var e = document.getElementById("e"); + + dialog.appendChild(quote); + e.insertBefore(quote, para); + + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="setTimeout(boom, 30)"> + +<p>He said <q id="quote">J<xul:hbox/></q></p> + +<xul:dialog id="dialog"/> + +<div id="e"><p id="para">Foopy</p></div> + +</body> +</html> diff --git a/dom/xbl/crashtests/368641-1.xhtml b/dom/xbl/crashtests/368641-1.xhtml new file mode 100644 index 0000000000..0b42ac8138 --- /dev/null +++ b/dom/xbl/crashtests/368641-1.xhtml @@ -0,0 +1,22 @@ +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> + +<head> +<script> + +function boom() +{ + var yaz = document.getElementById("yaz"); + + document.body.appendChild(yaz); +} + +</script> +</head> + +<body onload="boom()"> + + <xul:tabs><span id="yaz"><xul:hbox><xul:popup/><xul:template/></xul:hbox></span></xul:tabs> +</body> + +</html> diff --git a/dom/xbl/crashtests/378521-1.xhtml b/dom/xbl/crashtests/378521-1.xhtml new file mode 100644 index 0000000000..3db89d49a0 --- /dev/null +++ b/dom/xbl/crashtests/378521-1.xhtml @@ -0,0 +1,18 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml"> +<head> +<bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="foo" extends="html:input"> + <content> + Foo? + <children/> + </content> + </binding> +</bindings> +</head> + +<body> +<div>Hi!</div> +<div style="-moz-binding: url(#foo)">XXX</div> +</body> + +</html>
\ No newline at end of file diff --git a/dom/xbl/crashtests/382376-1.xhtml b/dom/xbl/crashtests/382376-1.xhtml new file mode 100644 index 0000000000..55457f79e2 --- /dev/null +++ b/dom/xbl/crashtests/382376-1.xhtml @@ -0,0 +1,37 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boom1()
+{
+ var c = document.getElementById("c");
+ c.style.MozBinding = "url('#foo')";
+
+ setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+ var v = document.getElementById("v");
+ v.parentNode.removeChild(v);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo">
+ <content>x x x x x <children/></content>
+</binding></bindings>
+
+</head>
+
+<body style="font-family: monospace; width: 10ch;" onload="setTimeout(boom1, 30);">
+
+<div style="background: lightblue; border: 1px solid blue; margin-bottom: 1em;">
+ <span id="c">y y<span id="v">Z<div/></span></span>
+</div>
+
+<div style="background: lightgreen; border: 1px solid green; height: 2000px;">s</div>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/382376-2.xhtml b/dom/xbl/crashtests/382376-2.xhtml new file mode 100644 index 0000000000..4e22b8f4ea --- /dev/null +++ b/dom/xbl/crashtests/382376-2.xhtml @@ -0,0 +1,27 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> +<script> + +function boom() +{ + var v = document.getElementById("v"); + v.parentNode.removeChild(v); + document.documentElement.removeAttribute("class"); +} + +</script> + +<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"> + <content>x x x x x <children/></content> +</binding></bindings> + +</head> + +<body onload="setTimeout(boom, 30);"> + +<div style="background: lightblue; border: 1px solid blue; width: 300px"> + <span style="-moz-binding: url(#foo);" >y y<span id="v">Z<div/></span></span> +</div> + +</body> +</html> diff --git a/dom/xbl/crashtests/397596-1.xhtml b/dom/xbl/crashtests/397596-1.xhtml new file mode 100644 index 0000000000..c7b562b52d --- /dev/null +++ b/dom/xbl/crashtests/397596-1.xhtml @@ -0,0 +1,29 @@ +<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>Testcase bug - 100% cpu usage with binding setting position: fixed in constructor</title>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="b" inheritstyle="false">
+<content>
+<div xmlns="http://www.w3.org/1999/xhtml" style=" -moz-binding: url(#a);"/>
+<children/>
+</content>
+</binding>
+
+<binding id="a">
+<implementation>
+<constructor>
+ this.style.position='fixed';
+</constructor>
+</implementation>
+<content>
+<children xmlns="http://www.mozilla.org/xbl"/>
+</content>
+</binding>
+</bindings>
+
+</head>
+<body>
+<span style="-moz-binding:url();"></span>
+</body>
+</html>
\ No newline at end of file diff --git a/dom/xbl/crashtests/404125-1.xhtml b/dom/xbl/crashtests/404125-1.xhtml new file mode 100644 index 0000000000..46b0fd6f8d --- /dev/null +++ b/dom/xbl/crashtests/404125-1.xhtml @@ -0,0 +1,29 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> + +<head> + +<bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="lc"> + <content> + <xul:listcell> t <children/></xul:listcell> + </content> + </binding> +</bindings> + +<script> +function boom() +{ + var hbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox"); + document.getElementById("vv").appendChild(hbox); +} +</script> + +</head> + +<body onload="boom();"> + +<div style="-moz-binding: url(#lc);" id="vv"></div> + +</body> + +</html> diff --git a/dom/xbl/crashtests/406900-1.xul b/dom/xbl/crashtests/406900-1.xul new file mode 100644 index 0000000000..3b3dc1f870 --- /dev/null +++ b/dom/xbl/crashtests/406900-1.xul @@ -0,0 +1,33 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + onload="boom();"> + +<bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="lit"> + <content> + <children> + <xul:hbox/> + </children> + </content> + </binding> +</bindings> + +<script type="text/javascript"> + +function boom() +{ + var x = document.getElementById("x"); + var anon = document.getAnonymousNodes(x)[0]; + document.documentElement.removeChild(x); + document.documentElement.appendChild(x); + var hbox = document.createElement('hbox'); + anon.appendChild(hbox); +} + +</script> + +<hbox id="x" style="-moz-binding: url(#lit)" /> + +</window> diff --git a/dom/xbl/crashtests/406904-1.xhtml b/dom/xbl/crashtests/406904-1.xhtml new file mode 100644 index 0000000000..758fb04cd8 --- /dev/null +++ b/dom/xbl/crashtests/406904-1.xhtml @@ -0,0 +1,25 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl"> +<head> + +<xbl:bindings xmlns="http://www.mozilla.org/xbl"><xbl:binding id="a"><xbl:content> +<span>foo<xbl:children/></span> +</xbl:content></xbl:binding></xbl:bindings> + +<script type="text/javascript"> + +function boom() +{ + var s = document.getElementById("s"); + var anon = document.getAnonymousNodes(s)[0]; + + while (anon.firstChild) + anon.removeChild(anon.firstChild); + + document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3EQ%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')"; +} + +</script> +</head> + +<body onload="boom();"><span id="s" style="-moz-binding: url('#a');"></span></body> +</html> diff --git a/dom/xbl/crashtests/406904-2.xhtml b/dom/xbl/crashtests/406904-2.xhtml new file mode 100644 index 0000000000..763672b3f6 --- /dev/null +++ b/dom/xbl/crashtests/406904-2.xhtml @@ -0,0 +1,25 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl"> +<head> + +<xbl:bindings xmlns="http://www.mozilla.org/xbl"><xbl:binding id="a"><xbl:content> +<span><span></span><xbl:children/></span> +</xbl:content></xbl:binding></xbl:bindings> + +<script type="text/javascript"> + +function boom() +{ + var s = document.getElementById("s"); + var anon = document.getAnonymousNodes(s)[0]; + + while (anon.firstChild) + anon.removeChild(anon.firstChild); + + document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3EQ%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')"; +} + +</script> +</head> + +<body onload="boom();"><span id="s" style="-moz-binding: url('#a');"></span></body> +</html> diff --git a/dom/xbl/crashtests/415192-1.xul b/dom/xbl/crashtests/415192-1.xul new file mode 100644 index 0000000000..3795ca2205 --- /dev/null +++ b/dom/xbl/crashtests/415192-1.xul @@ -0,0 +1,22 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin/global.css"?> +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();"> +<script type="text/javascript"> + +function boom() +{ + var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"; + + var wizard = document.createElementNS(XUL_NS, "wizard"); + var space = document.createTextNode(" "); + var hbox = document.createElementNS(XUL_NS, "hbox"); + hbox.setAttribute("anonid", "Buttons"); + + document.documentElement.appendChild(wizard); + wizard.appendChild(space); + wizard.appendChild(hbox); + wizard.cloneNode(true); +} + +</script> +</window> diff --git a/dom/xbl/crashtests/415301-1.xul b/dom/xbl/crashtests/415301-1.xul new file mode 100644 index 0000000000..cee274fcd3 --- /dev/null +++ b/dom/xbl/crashtests/415301-1.xul @@ -0,0 +1,34 @@ +<?xml version="1.0"?> +<?xml-stylesheet href="chrome://global/skin/global.css"?> + +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + onload="boom();"> + + +<bindings xmlns="http://www.mozilla.org/xbl"> + +<binding id="chil"><content><children/></content></binding> + +<binding id="ichil"><content> +<xul:hbox style="-moz-binding: url(#chil)"><children/></xul:hbox> +</content></binding> + +</bindings> + + +<script type="text/javascript"> + +function boom() +{ + document.getElementById("inner").removeChild(document.getElementById("lbb")); + document.getElementById("outer").style.MozBinding = ""; +} + +</script> + + +<hbox id="outer" style="-moz-binding: url(#chil)"><hbox id="inner" style="-moz-binding: url(#ichil)"><listboxbody id="lbb" /></hbox></hbox> + + +</window> diff --git a/dom/xbl/crashtests/418133-1.xhtml b/dom/xbl/crashtests/418133-1.xhtml new file mode 100644 index 0000000000..ea821b76ed --- /dev/null +++ b/dom/xbl/crashtests/418133-1.xhtml @@ -0,0 +1,22 @@ +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> +<head> +<script type="text/javascript"> + +function boom() +{ + for(var p in document.getElementById("prefs")) { + } + + for(var p in window) { + } +} + +</script> +</head> +<body onload="boom();"> + +<xul:preferences id="prefs" /> + +</body> +</html> diff --git a/dom/xbl/crashtests/420233-1.xhtml b/dom/xbl/crashtests/420233-1.xhtml new file mode 100644 index 0000000000..8ec4250753 --- /dev/null +++ b/dom/xbl/crashtests/420233-1.xhtml @@ -0,0 +1,21 @@ +<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml"> +<head> + +<bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="ab"><content><html:span>a b<children/></html:span></content></binding> + <binding id="empty"><content></content></binding> +</bindings> + +<script type="text/javascript"> + +function boom() +{ + document.getElementById("td").style.MozBinding = "url('#empty')"; +} + +</script> + +</head> + +<body onload="boom();"><div style="width: 1px;"><span style="-moz-binding: url(#ab);"><td id="td"/></span></div></body> +</html> diff --git a/dom/xbl/crashtests/421997-1.xhtml b/dom/xbl/crashtests/421997-1.xhtml new file mode 100644 index 0000000000..4b91f00fcc --- /dev/null +++ b/dom/xbl/crashtests/421997-1.xhtml @@ -0,0 +1,27 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="g"> + <implementation> + <constructor> + throw 3; + </constructor> + </implementation> + </binding> +</bindings> + +<script type="text/javascript"> + +function e() +{ + var listboxbody = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listboxbody"); + document.getElementById("s").appendChild(listboxbody); +} + +</script> +</head> + +<body onerror="e();"><span id="s" style="-moz-binding: url(#g)"></span></body> + +</html> diff --git a/dom/xbl/crashtests/432813-1-xbl.xml b/dom/xbl/crashtests/432813-1-xbl.xml new file mode 100644 index 0000000000..b2940e638a --- /dev/null +++ b/dom/xbl/crashtests/432813-1-xbl.xml @@ -0,0 +1,7 @@ +<bindings xmlns="http://www.mozilla.org/xbl"> +<binding id="a"> +<content> +<div xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: inherit;"/> +</content> +</binding> +</bindings> diff --git a/dom/xbl/crashtests/432813-1.xhtml b/dom/xbl/crashtests/432813-1.xhtml new file mode 100644 index 0000000000..586ac05f10 --- /dev/null +++ b/dom/xbl/crashtests/432813-1.xhtml @@ -0,0 +1,3 @@ +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"> + <box style="-moz-binding:url(432813-1-xbl.xml);"/> +</window> diff --git a/dom/xbl/crashtests/454820-1.html b/dom/xbl/crashtests/454820-1.html new file mode 100644 index 0000000000..31a8316f62 --- /dev/null +++ b/dom/xbl/crashtests/454820-1.html @@ -0,0 +1,17 @@ +<!DOCTYPE HTML> +<html><head> + <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> + <title>Testcase for bug 454820</title> +</head> +<body> + +<p>PASS if Firefox does not crash.</p> +<script type="text/javascript"> +var evObj = document.createEvent('UIEvents'); +evObj.initUIEvent( 'keypress', true, true, window, 1 ); +document.getElementsByTagName('p')[0].dispatchEvent(evObj); +</script> + + +</body> +</html> diff --git a/dom/xbl/crashtests/460665-1.xhtml b/dom/xbl/crashtests/460665-1.xhtml new file mode 100644 index 0000000000..2ea1f7212b --- /dev/null +++ b/dom/xbl/crashtests/460665-1.xhtml @@ -0,0 +1,28 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="a"> + <content></content> + <implementation> + <field>t</field> + <field/> + <property/> + <property> + <getter>x</getter> + <setter>y</setter> + </property> + <method/> + <method> + <body/> + </method> + <method> + <body>a</body> + </method> + </implementation> + </binding> +</bindings> +</head> + +<body><span id="s" style="-moz-binding: url('#a');"></span></body> +</html> diff --git a/dom/xbl/crashtests/463511-1.xhtml b/dom/xbl/crashtests/463511-1.xhtml new file mode 100644 index 0000000000..a9fec3b509 --- /dev/null +++ b/dom/xbl/crashtests/463511-1.xhtml @@ -0,0 +1,9 @@ +<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)"> +<head> +<bindings xmlns="http://www.mozilla.org/xbl"> +<binding id="foo"><content><listcell xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listcell></content></binding> +</bindings> +</head> + +<body onload="document.documentElement.innerHTML = 'x';"></body> +</html> diff --git a/dom/xbl/crashtests/464863-1.xhtml b/dom/xbl/crashtests/464863-1.xhtml new file mode 100644 index 0000000000..a665afc9c2 --- /dev/null +++ b/dom/xbl/crashtests/464863-1.xhtml @@ -0,0 +1,22 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> + +<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><qqq><children xmlns="http://www.mozilla.org/xbl"/></qqq></content></binding></bindings> + +<script type="text/javascript"> +// <![CDATA[ + +function boom() +{ + var s = document.getElementById("s"); + var o = document.getAnonymousNodes(s)[0]; + (document.body).appendChild(s); + o.appendChild(document.createTextNode("F")); +} + +// ]]> +</script> +</head> + +<body onload="boom();"><span id="s" style="-moz-binding: url(#foo)"></span></body> +</html> diff --git a/dom/xbl/crashtests/472260-1.xhtml b/dom/xbl/crashtests/472260-1.xhtml new file mode 100644 index 0000000000..49d5407d46 --- /dev/null +++ b/dom/xbl/crashtests/472260-1.xhtml @@ -0,0 +1,35 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> + +<bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="foo"><content><span xmlns="http://www.w3.org/1999/xhtml"/></content></binding> + <binding id="bar"><content></content></binding> +</bindings> + +<script type="text/javascript"> +// <![CDATA[ + +function boom() +{ + var bo = document.getElementById("bo"); + var anon = SpecialPowers.wrap(document).getAnonymousNodes(bo)[0]; + + bo.style.MozBinding = "url(#bar)"; + + var fr = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); + fr.setAttribute("src", "javascript:void 0;"); + anon.appendChild(fr); + + document.documentElement.removeAttribute("class"); +} + +]]> +</script> +</head> + +<body onload="setTimeout(boom, 100);"> + +<span style="-moz-binding: url(#foo)" id="bo"></span> + +</body> +</html> diff --git a/dom/xbl/crashtests/477878-1.html b/dom/xbl/crashtests/477878-1.html new file mode 100644 index 0000000000..17e4002b49 --- /dev/null +++ b/dom/xbl/crashtests/477878-1.html @@ -0,0 +1,4 @@ +<html> +<head></head> +<body><iframe style="display:none" src="data:text/html,<marquee>Marquee</marquee>" onload="this.style.display = '';"></iframe></body> +</html> diff --git a/dom/xbl/crashtests/492978-1.xul b/dom/xbl/crashtests/492978-1.xul new file mode 100644 index 0000000000..365ecfc9ec --- /dev/null +++ b/dom/xbl/crashtests/492978-1.xul @@ -0,0 +1,15 @@ +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a" inheritstyle="false">
+<content> +<style xmlns="http://www.w3.org/1999/xhtml">
+window::after, box::after, bindings::after { content:"m"; float:right;}
+</style> +</content>
+</binding> +</bindings>
+ +<box style="-moz-binding:url(crash1.xul);overflow: scroll;"/>
+
+</window>
\ No newline at end of file diff --git a/dom/xbl/crashtests/493123-1.xhtml b/dom/xbl/crashtests/493123-1.xhtml new file mode 100644 index 0000000000..1c568ae15b --- /dev/null +++ b/dom/xbl/crashtests/493123-1.xhtml @@ -0,0 +1,34 @@ +<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait"> +<head> + +<bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="a"><content></content></binding> + <binding id="b"><content><style xmlns="http://www.w3.org/1999/xhtml" style="display: none;">* { overflow: hidden; }</style><children xmlns="http://www.mozilla.org/xbl"/></content></binding> +</bindings> + +<script type="text/javascript" style="display: none"> + +function one() +{ + while (document.documentElement.firstChild) document.documentElement.removeChild(document.documentElement.firstChild) + document.documentElement.style.MozBinding = 'url("#a")'; + setTimeout(two, 1); +} + +function two() +{ + document.documentElement.style.MozBinding = 'url("#b")'; + setTimeout(three, 1); +} + +function three() +{ + document.documentElement.style.MozBinding = 'url("#a")'; + document.documentElement.removeAttribute("class"); +} + +</script> +</head> + +<body onload="one();"></body> +</html> diff --git a/dom/xbl/crashtests/495354-1.xhtml b/dom/xbl/crashtests/495354-1.xhtml new file mode 100644 index 0000000000..2e76fb8462 --- /dev/null +++ b/dom/xbl/crashtests/495354-1.xhtml @@ -0,0 +1,8 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> +<head> +<bindings xmlns="http://www.mozilla.org/xbl"><binding id="x"><content><caption xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></caption></content></binding></bindings> +</head> +<body onload="document.getElementById('x').innerHTML = '9';"> +<span id="x" style="-moz-binding: url(#x)"><div></div></span> +</body> +</html> diff --git a/dom/xbl/crashtests/507628-1.xhtml b/dom/xbl/crashtests/507628-1.xhtml new file mode 100644 index 0000000000..a82871f718 --- /dev/null +++ b/dom/xbl/crashtests/507628-1.xhtml @@ -0,0 +1,12 @@ +<html xmlns="http://www.w3.org/1999/xhtml">
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="b" inheritstyle="false">
+<content>
+<span xmlns="http://www.w3.org/1999/xhtml"/><span xmlns="http://www.w3.org/1999/xhtml"><embed style="display: block;" type="*"/></span>
+</content>
+</binding>
+</bindings>
+
+<div style="-moz-binding:url();"/> + +</html>
\ No newline at end of file diff --git a/dom/xbl/crashtests/507991-1.xhtml b/dom/xbl/crashtests/507991-1.xhtml new file mode 100644 index 0000000000..402e680eec --- /dev/null +++ b/dom/xbl/crashtests/507991-1.xhtml @@ -0,0 +1,18 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + +<head>
+<title>Crash [@ nsSprocketLayout::PopulateBoxSizes] with object and position:absolute;overflow:scroll in binding</title>
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a" inheritstyle="false">
+<content>
+<object xmlns="http://www.w3.org/1999/xhtml" style="display: table;"/>
+<div xmlns="http://www.w3.org/1999/xhtml" style="position: absolute;overflow: scroll; "/>
+</content>
+</binding>
+</bindings>
+</head> + +<body>
+<span style="-moz-binding:url()"></span>
+</body>
+</html>
\ No newline at end of file diff --git a/dom/xbl/crashtests/830614-1.xul b/dom/xbl/crashtests/830614-1.xul new file mode 100644 index 0000000000..f2f9bb352a --- /dev/null +++ b/dom/xbl/crashtests/830614-1.xul @@ -0,0 +1,24 @@ +<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" + onload="document.getElementById('trigger');"> + <box style="display: none"> + <bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="crash"> + <implementation> + <constructor> + // Fetch it + var obj = this.getElementsByTagName("box")[0]; + // And make it preserve its wrapper. Note that this will happen + // while we're wrapping our box as the parent for id="trigger", + // so then we'll unwind and things will be bad. + if (obj) obj.expando = 5; + </constructor> + </implementation> + </binding> + </bindings> + <box style="-moz-binding:url(#crash);"> + <box id="trigger"/> + </box> + </box> + <!-- Make sure we load our XBL before we try to run our test --> + <box style="-moz-binding:url(#crash);"/> +</window> diff --git a/dom/xbl/crashtests/895805-1.xhtml b/dom/xbl/crashtests/895805-1.xhtml new file mode 100644 index 0000000000..a6598de9c6 --- /dev/null +++ b/dom/xbl/crashtests/895805-1.xhtml @@ -0,0 +1,30 @@ +<?xml version="1.0" encoding="utf-8"?> +<html xmlns="http://www.w3.org/1999/xhtml" + xmlns:xbl="http://www.mozilla.org/xbl"> +<head> +<title>Bug 895805 - Adopting bound element to another document.</title> +<xbl:bindings> + <xbl:binding id="crash"> + <xbl:content> + <xbl:children /> + Bug 895805 dummy binding + </xbl:content> + </xbl:binding> +</xbl:bindings> +<style type="text/css"> +#test { + -moz-binding:url(#crash); +} +</style> +</head> +<body onload="init()"> +<span id="test">Test</span> +<script> +function init() { + var boundElement = document.getElementById('test'); + var otherDoc = document.implementation.createDocument('', '', null); + otherDoc.adoptNode(boundElement); +} +</script> +</body> +</html> diff --git a/dom/xbl/crashtests/crashtests.list b/dom/xbl/crashtests/crashtests.list new file mode 100644 index 0000000000..26424c7d85 --- /dev/null +++ b/dom/xbl/crashtests/crashtests.list @@ -0,0 +1,40 @@ +load 205735-1.xhtml +load 223799-1.xul +load 226744-1.xhtml +load 232095-1.xul +load 277523-1.xhtml +load 277950-1.xhtml +skip-if(Android) load 336744-1.html # bug 1268050 +load 336960-1.html +load 342954-1.xhtml +load 342954-2.xhtml +load 368276-1.xhtml +load 368641-1.xhtml +load 378521-1.xhtml +load 382376-1.xhtml +load 382376-2.xhtml +load 397596-1.xhtml +load 404125-1.xhtml +load 406900-1.xul +load 406904-1.xhtml +load 406904-2.xhtml +load 415192-1.xul +load 415301-1.xul +load 418133-1.xhtml +load 420233-1.xhtml +load 421997-1.xhtml +load 432813-1.xhtml +load 454820-1.html +load 460665-1.xhtml +load 463511-1.xhtml +load 464863-1.xhtml +load 472260-1.xhtml +load 477878-1.html +load 492978-1.xul +load 493123-1.xhtml +load 495354-1.xhtml +load 507628-1.xhtml +load 507991-1.xhtml +load 830614-1.xul +load 895805-1.xhtml +load set-field-bad-this.xhtml diff --git a/dom/xbl/crashtests/set-field-bad-this.xhtml b/dom/xbl/crashtests/set-field-bad-this.xhtml new file mode 100644 index 0000000000..7b3dea03a4 --- /dev/null +++ b/dom/xbl/crashtests/set-field-bad-this.xhtml @@ -0,0 +1,31 @@ +<html xmlns="http://www.w3.org/1999/xhtml"> + +<head> + <title>Gracefully handle setting a field on a bad |this|</title> + + <bindings xmlns="http://www.mozilla.org/xbl"> + <binding id="a"> + <implementation> + <field name="f">17</field> + </implementation> + </binding> + </bindings> + + <script type="application/javascript"> + window.onload = function() + { + var bound = document.getElementById("bound"); + try + { + Object.getPrototypeOf(bound).f = 42; + } + catch (e) { /* Throwing's fine, crashing isn't. */ } + }; + </script> +</head> + +<body> + <div id="bound" style="-moz-binding: url(#a)"></div> +</body> + +</html> |