summaryrefslogtreecommitdiff
path: root/dom/plugins/test/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'dom/plugins/test/crashtests')
-rw-r--r--dom/plugins/test/crashtests/110650-1.html11
-rw-r--r--dom/plugins/test/crashtests/41276-1.html28
-rw-r--r--dom/plugins/test/crashtests/48856-1.html10
-rw-r--r--dom/plugins/test/crashtests/539897-1.html35
-rw-r--r--dom/plugins/test/crashtests/540114-1.html40
-rw-r--r--dom/plugins/test/crashtests/570884.html8
-rw-r--r--dom/plugins/test/crashtests/598862.html77
-rw-r--r--dom/plugins/test/crashtests/626602-1.html109
-rw-r--r--dom/plugins/test/crashtests/752340.html19
-rw-r--r--dom/plugins/test/crashtests/843086.xhtml1
-rw-r--r--dom/plugins/test/crashtests/crashtests.list14
11 files changed, 352 insertions, 0 deletions
diff --git a/dom/plugins/test/crashtests/110650-1.html b/dom/plugins/test/crashtests/110650-1.html
new file mode 100644
index 0000000000..9826227b03
--- /dev/null
+++ b/dom/plugins/test/crashtests/110650-1.html
@@ -0,0 +1,11 @@
+<HTML>
+<HEAD>
+<TITLE>123246 testcase</TITLE>
+</HEAD>
+<BODY>
+<object align="right" width=100>
+</object>
+</BODY >
+</HTML>
+
+
diff --git a/dom/plugins/test/crashtests/41276-1.html b/dom/plugins/test/crashtests/41276-1.html
new file mode 100644
index 0000000000..ba35c34fa0
--- /dev/null
+++ b/dom/plugins/test/crashtests/41276-1.html
@@ -0,0 +1,28 @@
+<HTML><HEAD><TITLE>Plugin Limit</TITLE></HEAD>
+<BODY>
+
+Mozilla has a hardcoded limit of 10 simultaneously embedded plugins.<br>
+If that limit is exceeded, plugin instances are prematurely destroyed (see the empty boxes below).<br>
+Leave or reload a page that has a prematurely destroyed plugin and mozilla will crash.<br>
+Sometimes, just loading this page will cause mozilla to crash.<br>
+
+
+<br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player">
+<embed TYPE=audio/x-pn-realaudio-plugin WIDTH=300 HEIGHT=75 CONTROLS="Default" AUTOSTART="FALSE" CONSOLE="RA_Player"><br>
+<br>
+</BODY></HTML>
diff --git a/dom/plugins/test/crashtests/48856-1.html b/dom/plugins/test/crashtests/48856-1.html
new file mode 100644
index 0000000000..cd0de2ab94
--- /dev/null
+++ b/dom/plugins/test/crashtests/48856-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+ "http://www.w3.org/TR/REC-html40/loose.dtd">
+<HTML>
+ <HEAD>
+ <TITLE>Mozilla Bug 48856</TITLE>
+ </HEAD>
+ <BODY>
+ <EMBED></EMBED>
+ </BODY>
+</HTML>
diff --git a/dom/plugins/test/crashtests/539897-1.html b/dom/plugins/test/crashtests/539897-1.html
new file mode 100644
index 0000000000..f280e62e6e
--- /dev/null
+++ b/dom/plugins/test/crashtests/539897-1.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+function crashplugin() {
+ var plugin = document.getElementById('p');
+ plugin.reinitWidget();
+ plugin.reinitWidget();
+}
+
+function getTestCases() {
+ return [
+ { testPassed:
+ (function () {
+ var plugin = document.getElementById('p');
+ try {
+ plugin.getPaintCount();
+ return true;
+ } catch (e) {
+ return false;
+ }
+ }),
+ testDescription:
+ (function () {
+ return "plugin should not crash";
+ })
+ }
+ ];
+}
+</script>
+</head>
+<body onload="crashplugin();">
+<embed id="p" type="application/x-test" wmode="window"/>
+</body>
+</html>
diff --git a/dom/plugins/test/crashtests/540114-1.html b/dom/plugins/test/crashtests/540114-1.html
new file mode 100644
index 0000000000..8243649aa3
--- /dev/null
+++ b/dom/plugins/test/crashtests/540114-1.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+function crashplugin() {
+ var plugin = document.getElementById('removeme');
+ var flush_reflow = plugin.offsetHeight; // this may not be necessary
+ document.body.removeChild(plugin);
+ // Give the plugin time to crash
+ setTimeout(function() { document.documentElement.removeAttribute('class') },
+ 1000);
+}
+
+function getTestCases() {
+ return [
+ { testPassed:
+ (function () {
+ // Assuming the same process is used for removeme and checkme
+ var plugin = document.getElementById('checkme');
+ try {
+ plugin.getPaintCount();
+ return true;
+ } catch (e) {
+ return false;
+ }
+ }),
+ testDescription:
+ (function () {
+ return "plugin should not crash";
+ })
+ }
+ ];
+}
+</script>
+</head>
+<body onload="crashplugin();">
+<embed id="checkme" type="application/x-test"/>
+<embed id="removeme" type="application/x-test" wmode="window" cleanupwidget="false"/>
+</body>
+</html>
diff --git a/dom/plugins/test/crashtests/570884.html b/dom/plugins/test/crashtests/570884.html
new file mode 100644
index 0000000000..7af5cdba53
--- /dev/null
+++ b/dom/plugins/test/crashtests/570884.html
@@ -0,0 +1,8 @@
+<body>
+<embed type="application/x-test" width="20"></embed>
+<embed type="application/x-test" width="10"></embed>
+<embed type="application/x-test" width="0"></embed>
+<embed type="application/x-test" width="20" height="20"></embed>
+<embed type="application/x-test" width="10" height="10"></embed>
+<embed type="application/x-test" width="0" height="0"></embed>
+</body>
diff --git a/dom/plugins/test/crashtests/598862.html b/dom/plugins/test/crashtests/598862.html
new file mode 100644
index 0000000000..9b1ad38d75
--- /dev/null
+++ b/dom/plugins/test/crashtests/598862.html
@@ -0,0 +1,77 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+ <head>
+ <script>
+var unusedScreenX;
+function XSync() {
+ unusedScreenX = window.screenX;
+}
+
+function finish() {
+ document.documentElement.removeAttribute("class");
+}
+
+function cleanup() {
+ try {
+ document.getElementById("plugin").crash();
+ } catch (dontcare) {
+ }
+ window.setTimeout(finish, 100);
+}
+
+function scrollOfDeath() {
+ // Add a listener for the MozAfterPaint after the scrollTo below.
+ // If we don't crash during the scroll, we'll get the
+ // MozAfterPaint.
+ window.addEventListener("MozAfterPaint", cleanup, false);
+ window.scrollTo(0, 50);
+}
+
+//
+// The sequence of events we expect is
+//
+// load (including initial paints of plugin that are cached)
+// destroy X resources
+// [X server has time to observe resource destruction]
+// scrollTo
+// [repaint using cached plugin surface: BOOM if buggy]
+// MozAfterPaint
+// cleanup
+//
+// However, this test is fundamentally nondeterministic. There are
+// two main "failure" modes
+// (1) X server doesn't have time to observer resource destruction
+// before paint-after-scroll
+// (2) plugin's crash notification arrives before
+// paint-after-scroll
+// Both result in spurious passes.
+//
+// This test is anal about cleanup because it must be pretty sure that
+// the plugin subprocess is gone before starting the next test. We
+// double-check that the plugin is gone by the time we're done by
+// trying to crash it again, after we expect it to have crashed already.
+//
+function runTest() {
+ // Have the plugin throw away its X resources, one of which is
+ // probably a drawable to which we hold a reference
+ document.getElementById("plugin").destroySharedGfxStuff();
+
+ // Do something that's (hopefully) equivalent to an XSync() to allow
+ // the resource destruction to propagate to the server
+ XSync();
+
+ // Set up a scroll to happen soon
+ window.setTimeout(scrollOfDeath, 100);
+}
+
+window.addEventListener("MozReftestInvalidate", runTest, false);
+ </script>
+ </head>
+
+ <body style="width: 400px; height: 10000px;">
+ <embed id="plugin" type="application/x-test"
+ style="position:absolute;
+ top:100px; left:50px; width:200px; height:200px;">
+ </embed>
+ </body>
+</html>
diff --git a/dom/plugins/test/crashtests/626602-1.html b/dom/plugins/test/crashtests/626602-1.html
new file mode 100644
index 0000000000..0a878bbd1d
--- /dev/null
+++ b/dom/plugins/test/crashtests/626602-1.html
@@ -0,0 +1,109 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+ <style type="text/css">
+#one {
+ position:absolute;
+ left:0px; top:0px;
+ z-index:4;
+}
+#two {
+ position:absolute;
+ top:100px; left:100px;
+ background-color:rgb(0,0,0,0);
+ z-index:3;
+}
+#three {
+ position:absolute;
+ left:100px; top:100px;
+ width:200px; height:200px;
+ background-color: rgb(255,0,0);
+ opacity:0.6;
+ z-index:2;
+}
+#four {
+ position:absolute;
+ top:100px; left:100px;
+ z-index:1;
+}
+ </style>
+ <script type="text/javascript">
+var plugin, div, canvas;
+function start() {
+ plugin = document.getElementById("four");
+ div = document.getElementById("three");
+ canvas = document.getElementById("two");
+ paintCanvas();
+
+ requestAnimationFrame(moveSomething);
+}
+
+function paintCanvas() {
+ var ctx = canvas.getContext("2d");
+ ctx.fillStyle = "rgba(255,0,0, 0.6)";
+ ctx.fillRect(0,0, 200,200);
+}
+
+var i = 0, numLoops = 20;
+var pluginIn = true, divIn = true, canvasIn = true;
+function moveSomething() {
+ var didSomething = (0 === (i % 2)) ? moveSomethingOut() : moveSomethingIn();
+ if (!didSomething && ++i >= numLoops) {
+ return finish();
+ }
+
+ requestAnimationFrame(moveSomething);
+}
+
+function finish() {
+ document.documentElement.removeAttribute("class");
+}
+
+function moveSomethingOut() {
+ if (pluginIn) {
+ plugin.style.left = "400px";
+ pluginIn = false;
+ } else if (divIn) {
+ div.style.left = "400px";
+ divIn = false;
+ } else if (canvasIn) {
+ canvas.style.left = "400px";
+ canvasIn = false;
+ } else {
+ return false;
+ }
+ return true;
+}
+
+function moveSomethingIn() {
+ if (!pluginIn) {
+ plugin.style.left = "100px";
+ pluginIn = true;
+ } else if (!divIn) {
+ div.style.left = "100px";
+ divIn = true;
+ } else if (!canvasIn) {
+ canvas.style.left = "100px";
+ canvasIn = true;
+ } else {
+ return false;
+ }
+ return true;
+}
+
+function reset() {
+
+}
+ </script>
+</style>
+</head>
+<body onload="start();">
+ <embed id="four" type="application/x-test" width="200" height="200"
+ drawmode="solid" color="FFFF0000"></embed>
+ <div id="three"></div>
+ <canvas id="two" width="200" height="200"></canvas>
+ <embed id="one" type="application/x-test" width="400" height="400"
+ drawmode="solid" color="9900FF00"></embed>
+</body>
+</html>
+
diff --git a/dom/plugins/test/crashtests/752340.html b/dom/plugins/test/crashtests/752340.html
new file mode 100644
index 0000000000..c4c8c464f5
--- /dev/null
+++ b/dom/plugins/test/crashtests/752340.html
@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+ <script type="text/javascript">
+ // Failures in this file can manifest as ###!!! ASSERTION: scope has non-empty map: '0 == mWrappedNativeMap->Count()'
+ // followed by an Assertion failure: allocated() crash during the next GC.
+ // It can also manifest as a leak.
+ function breakthings() {
+ var e = document.createElement("embed");
+ var i = document.getElementById("i");
+ i.contentDocument.body.appendChild(e);
+ i.src = "about:blank";
+ }
+ </script>
+</head>
+<body onload="javascript:breakthings();">
+<iframe id="i" />
+</body>
+</html>
diff --git a/dom/plugins/test/crashtests/843086.xhtml b/dom/plugins/test/crashtests/843086.xhtml
new file mode 100644
index 0000000000..a88e2193fc
--- /dev/null
+++ b/dom/plugins/test/crashtests/843086.xhtml
@@ -0,0 +1 @@
+<applet xmlns="http://www.w3.org/1999/xhtml" />
diff --git a/dom/plugins/test/crashtests/crashtests.list b/dom/plugins/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..aec2195f26
--- /dev/null
+++ b/dom/plugins/test/crashtests/crashtests.list
@@ -0,0 +1,14 @@
+load 41276-1.html
+load 48856-1.html
+load 110650-1.html
+skip-if(!haveTestPlugin) script 539897-1.html
+asserts-if(winWidget&&browserIsRemote,0-1) skip-if(!haveTestPlugin) script 540114-1.html
+load 570884.html
+# This test relies on the reading of screenX/Y forcing a round trip to
+# the X server, which is a bad assumption for <browser remote>.
+# Plugin arch is going to change anyway with OOP content so skipping
+# this test for now is OK.
+skip-if(!haveTestPlugin||http.platform!="X11") load 598862.html
+skip-if(Android) load 626602-1.html # bug 908363
+load 752340.html
+load 843086.xhtml
generated by cgit v1.2.3 (git 2.26.2) at 2024-11-18 06:46:27 +0000