import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo

This commit is contained in:
Roy Tam 2018-01-19 03:59:58 +08:00
commit dcd9973243
150858 changed files with 23884658 additions and 0 deletions

View file

@ -0,0 +1,4 @@
[DEFAULT]
support-files =
[browser_windowless_troubleshoot_crash.js]

View file

@ -0,0 +1,45 @@
let { Services } = Cu.import("resource://gre/modules/Services.jsm", {});
add_task(function* test_windowlessBrowserTroubleshootCrash() {
let webNav = Services.appShell.createWindowlessBrowser(false);
let onLoaded = new Promise((resolve, reject) => {
let docShell = webNav.QueryInterface(Ci.nsIInterfaceRequestor)
.getInterface(Ci.nsIDocShell);
let listener = {
observe(contentWindow, topic, data) {
let observedDocShell = contentWindow.QueryInterface(Ci.nsIInterfaceRequestor)
.getInterface(Ci.nsIWebNavigation)
.QueryInterface(Ci.nsIDocShellTreeItem)
.sameTypeRootTreeItem
.QueryInterface(Ci.nsIDocShell);
if (docShell === observedDocShell) {
Services.obs.removeObserver(listener, "content-document-global-created", false);
resolve();
}
}
}
Services.obs.addObserver(listener, "content-document-global-created", false);
});
webNav.loadURI("about:blank", 0, null, null, null);
yield onLoaded;
let winUtils = webNav.document.defaultView.
QueryInterface(Ci.nsIInterfaceRequestor).
getInterface(Ci.nsIDOMWindowUtils);
is(winUtils.layerManagerType, "None", "windowless browser's layerManagerType should be 'None'");
ok(true, "not crashed");
var Troubleshoot = Cu.import("resource://gre/modules/Troubleshoot.jsm", {}).Troubleshoot;
var data = yield new Promise((resolve, reject) => {
Troubleshoot.snapshot((data) => {
resolve(data);
});
});
ok(data.graphics.windowLayerManagerType !== "None", "windowless browser window should not set windowLayerManagerType to 'None'");
webNav.close();
});

View file

@ -0,0 +1,8 @@
<!DOCTYPE html>
<html>
<head>
</head>
<body style="font-variant: small-caps; font-family: 'Times New Roman';">
<div>x&#xE0131;</div>
</body>
</html>

View file

@ -0,0 +1,14 @@
<svg xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink"
width="400" height="400"
viewBox="694400 -179730 8000 8000">
<defs>
<path id="tp_crash" d="M 698430.938,-174861.922 C 699068.125,-175493.781 699593.562,-176022.531 699499,-177727" />
</defs>
<text font-size="4000">
<textPath xlink:href="#tp_crash">Eisack</textPath>
</text>
<use xlink:href="#tp_crash" fill="none" stroke="green" stroke-width="200"></use>
</svg>

After

Width:  |  Height:  |  Size: 480 B

View file

@ -0,0 +1,20 @@
<!DOCTYPE html>
<html>
<head>
</head>
<body>
<canvas id="canvas0"></canvas>
<script>
var canvas0=document.getElementById("canvas0");
var ctx=canvas0.getContext("2d");
canvas0.addEventListener("DOMAttrModified",
function(event) {
canvas0.toBlob(function(){},"image/jpeg",1);
}, true);
canvas0.setAttribute("height",470)
</script>
</body>
</html>

View file

@ -0,0 +1,13 @@
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta charset="UTF-8">
</head>
<body>
<div style="transform-style: preserve-3d; border-bottom-style: outset; width: 4787550px;">
<div style="margin-left: 4787550px;"></div>
<div style="will-change: contents, transform;"></div>
</div>
</body>
</html>

View file

@ -0,0 +1,11 @@
<!DOCTYPE html>
<html>
<body>
<div style="mix-blend-mode: saturation; margin-right: 1187px; transform: translateX(2px);">
<div style="border-style: outset; mix-blend-mode: color-dodge; display: inherit; padding: 1760px; float: right;"></div>
<div style="height: 2000px; overflow: auto;"></div>
</div>
</body>
</html>

View file

@ -0,0 +1 @@
<html> <head> <meta http-equiv="content-type" content="text/html; charset=Shift_JIS"> </head> <body>    </body> </html>

View file

@ -0,0 +1,23 @@
<html class="reftest-print"><head>
<svg xmlns="http://www.w3.org/2000/svg" width="90" height="20">
<linearGradient id="b" x2="0" y2="100%">
<stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
<stop offset="1" stop-opacity=".1"/>
</linearGradient>
<mask id="a">
<rect width="90" height="20" rx="3" fill="#fff"/>
</mask>
<g mask="url(#a)">
<path fill="#555" d="M0 0h33v20H0z"/>
<path fill="#007ec6" d="M33 0h57v20H33z"/>
<path fill="url(#b)" d="M0 0h90v20H0z"/>
</g>
<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
<text x="16.5" y="15" fill="#010101" fill-opacity=".3">AUR</text>
<text x="16.5" y="14">AUR</text>
<text x="60.5" y="15" fill="#010101" fill-opacity=".3">v2.0.4-1</text>
<text x="60.5" y="14">v2.0.4-1</text>
</g>
</svg>
</head>
<body>

View file

@ -0,0 +1,18 @@
<!DOCTYPE html>
<html>
<style>
#o {
padding: 27660vw;
outline: thick dotted;
mask: subtract url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=), linear-gradient(#FFF, #555);
}
</style>
<script>
document.addEventListener("DOMContentLoaded", function(){
o.appendChild(document.createElement("div"));
o.appendChild(document.createElement("frame"));
o.appendChild(document.createElement("div"));
});
</script>
<span id=o />
</html>

View file

@ -0,0 +1,35 @@
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<style>
#o_1 {
position: absolute;
top: 0px;
width: 100px;
height: 100px;
background: red;
}
#o_2 {
height: 10000px;
}
</style>
<script>
function boom(){
let doc = document.documentElement;
o_2.style.MozBorderEndStyle = "dotted";
doc.style.MozPerspective = "24.5pt";
o_0.style.MozTransformStyle = "preserve-3d";
doc.style.overflow = "-moz-scrollbars-horizontal";
doc.style.textOverflow = "''";
o_0.style.offsetInlineStart = "calc(3*25px)";
doc.style.paddingTop = "calc(67108864%)";
doc.style.width = "3e-0%";
o_0.style.display = "-moz-stack";
o_0.style.position = "relative";
}
addEventListener("DOMContentLoaded", boom);
</script>
</head>
<body id=o_0><div id=o_1></div><div id=o_2></div></body>
</html>

View file

@ -0,0 +1,205 @@
<HTML>
<HEAD>
<META http-equiv="Content-Type" content="charset=x-user-defined">
<TITLE>Testcase</TITLE>
</HEAD>
<BODY>
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
&ouml;
</BODY>
</HTML>

View file

@ -0,0 +1,11 @@
<html>
<head>
<title>foobidu</title>
<meta http-equiv="Content-Type" content="text/html; charset=big5">
</head>
<body bgcolor="#C2C2C2" text="#000000" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0" >
è° <!-- mozilla doesn't like that! //-->
°è <!-- but this works!!! //-->
</body>
</html>

View file

@ -0,0 +1,10 @@
<html>
<head>
<title>bug 199379</title>
</head>
<body>
<form>
<input style="font-size:1000; width:32; height:34;" TYPE="SUBMIT" VALUE="link=basket&prod=96&tariff_id=999&desc=Fast Gate BASIC (ISDN 64K) &tariff=74,82&cp_id=5555&rating_tariff_id=0&parent_tariff_id=978&parent_product_id=&sItemDesc=Fast Gate BASIC (ISDN 64K) &package_id=0">
</form>
</body>
</html>

View file

@ -0,0 +1,8 @@
<html>
<head>
<title>bug 206561</title>
</head>
<body>
<div style="height: 100%; opacity: 0.8;"></div>
</body>
</html>

View file

@ -0,0 +1,7 @@
<html><head>
<style type="text/css">
<!--
body{font: 10pt lucida;}
-->
</style>
</head><body>Hello.</body></html>

View file

@ -0,0 +1 @@
<?xml version="1.0"?> <!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"> <svg xmlns="http://www.w3.org/2000/svg"> <g transform="scale(1e10)"> <rect x="0" y="0" width="400" height="200" rx="50" ry="50" fill="none" stroke="purple" stroke-width="30"/> </g> </svg>

After

Width:  |  Height:  |  Size: 350 B

View file

@ -0,0 +1,14 @@
<?xml version='1.0'?>
<html xmlns="http://www.w3.org/1999/xhtml">
<body>
<math xmlns='http://www.w3.org/1998/Math/MathML' display='block'><msup>
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
</msup></math>
</body>
</html>

View file

@ -0,0 +1,18 @@
<html><head>
<!-- This Source Code Form is subject to the terms of the Mozilla Public
- License, v. 2.0. If a copy of the MPL was not distributed with this
- file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
<!--
Copyright Georgi Guninski
-->
<style>
button
{
font-size: 131131px;
}
</style>
</head><body>
<button>f00</button>
</body></html>

View file

@ -0,0 +1,11 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title>demo 1</title>
</head><body>
These unusual characters, &#1048713;,
cause Firefox to crash &#x100089;
</body></html>

View file

@ -0,0 +1,6 @@
<html>
<head>
</head>
<body>
<font
font-weight=5555555555555555555555555555555555555555555555555555555555555555555555

View file

@ -0,0 +1,7 @@
<html>
<head>
</head>
<body>
<font font-weight="467591">x</font>
</body>
</html>

View file

@ -0,0 +1,11 @@
<html>
<head>
<style>.classname { font-size: 2666.3423423423423424 }</style>
<title>bla crash</title>
</head>
<body>
<p class="classname">crash!</p>
</body>
</html>

View file

@ -0,0 +1,13 @@
<html>
<head>
<script type="text/javascript">
function boom() {
document.body.appendChild(document.createTextNode(String.fromCharCode(25261)))
document.body.style.fontSize = '8388608px';
}
</script>
</head>
<body onload="boom()"></body>
</html>

View file

@ -0,0 +1,7 @@
<html><head>
<title>Uniscribe::Itemize crash</title>
</head><body>
x.&#8205;x.&#8205;x
</body></html>

View file

@ -0,0 +1,19 @@
<html class="reftest-wait">
<head>
<script>
function boom()
{
document.body.style.fontSizeAdjust = 0xffffffff;
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="setTimeout(boom, 30);">
<p>Foo</p>
</body>
</html>

View file

@ -0,0 +1,11 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
</head>
<body>
<pre>bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar bar &rho; foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo foo </pre>
</body>
</html>

View file

@ -0,0 +1,45 @@
<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
<head>
<script>
<![CDATA[
function init()
{
setTimeout(function()
{
targetWindow = window.frames[0];
targetDocument = targetWindow.document;
targetDocument.body.appendChild(targetDocument.importNode(document.getElementById('rootish'), true));
targetDocument.designMode = 'on';
setTimeout(boom, 30);
}, 30);
}
function boom()
{
var r = targetDocument.createRange();
r.setStart(targetDocument.getElementById("bar"), 0);
r.setEnd(targetDocument.getElementById("baz").firstChild, 0);
targetWindow.getSelection().addRange(r);
targetDocument.execCommand("indent", false, null);
document.documentElement.removeAttribute("class");
}
]]>
</script>
</head>
<body onload="init()">
<iframe src="data:text/html," style="width: 95%; height: 500px;"/>
<div id="rootish">
<div>Foo</div>
<div id="bar">Bar</div>
<div><select><option id="baz">baz</option></select></div>
</div>
</body>
</html>

View file

@ -0,0 +1,3 @@
<html>
<body>
&#01;

View file

@ -0,0 +1 @@
<div><span>&#1741;</span><span>&#8232;</span><span>&#1994;</span></div>

View file

@ -0,0 +1,5 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<body style="font-family: arial">
<div>&#1050;&#769;</div>
</body>
</html>

View file

@ -0,0 +1,16 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>
function boom()
{
var div = document.getElementById("div");
div.textContent = "\uFDDE\r\uFDDE";
}
</script>
</head>
<body onload="boom();">
<div id="div"></div>
</body>
</html>

View file

@ -0,0 +1,8 @@
<!DOCTYPE html>
<html>
<body>
<span style="font-size:72px; font-size-adjust:24">X</span>
</body>
</html>

View file

@ -0,0 +1,19 @@
<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml">
<html:style>
#para {
width: 30px;
height: 0.5px;
background: url("data:image/gif;base64,R0lGODlhMQA8ANX%2FAJ22hRgcFI6keHqNZzpDMZ%2B2hqO4iR8jGpythSgsIa28kwoLCGJrULzCoFBQPsfFqb20hRMRDMq4is62hbeidjMuJNC3iJ%2BMaIJyVdK6jdi%2Fm6KUgNfJtSYhGkM5LsetluvGtebLvq2PiPHLwsDAwPbMx7%2BbmdKpqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAEAACQALAAAAAAxADwAAAb%2FQJJwSCwaj8TSqIRsOkmlKNNZCj0UBoPiEZo%2BjVUO5%2FFoNB6cUGgJJYYaBoAcUDCcQ99hiQMvzP91CmYNHEwjDwZ%2Bf3J1HHkkHApzA5SVAweYBwQMCGdwAgwVCaOjFQwABnhPIw1%2BAwkEsbEHC6dyA7F1BaAMAosCDg4ADV8ccbgDiwnJiw62zouTCQAKXkclDaAEzH%2FL0QMOoguk24soqCNOIwoM5dHei%2B22kwTm6E4hAvDR%2FJfc3fYUpGsSAhq%2Fg7gOTvtzTkEXggsP8hPw748wAJXO2SmEJEREiSAPOiCwYFsdA46OeAzJEiSyLCmLHPrYsuYcZzBlRjLw0UFF%2F5sICTRKgkhOxEu%2BgIbENXSIsTmmfAVTypIpyiHr5DhAwVXcT6qLEiqIGeJYvW7zwPJjcNGhkLIANoUlkBSjWgan8CYt8EAIBzkH6s5hm%2FSAWgEBEjgQgIJZNUiARRoGEEAwUMa3ygmEDGByPzls1QKAlzAVJD%2BeQV4Eu8%2FwVbipRUvEPMcwXxJZ3ck%2BCCzt5AZRGgBgQHP3n9B%2FbG9%2BOqCycXM0BSjHUwJRAQYHAmD6%2BrwdHbe4r%2FjR%2FfyXu81C9kgiXx60dzrEiBZg3z4WM9NFytIH4JNRgf8A1qRbfDIpsF85BkCg4IJZKPIHRXMIQBcqDQxkxAOERbONARtAMP%2FBhx9aIAEKE8oBTIl4afGAhUaEYOBqtQmggDMg1ojCVKAFk4kDCHDABj4IjMTNKwloQIEHNYKIggQJkGhfFiqy%2BISL7WQnSwUaTFBBkh%2BiMIEGDWywgQlqqCFlHmFcIeYGHTBwwZZcennmI1R4cYIIb3I5gZd09nmElnry6eegQgAapwWEEmpokihkkOigi9qYwZyPNhGpkpNW%2BsgIRwZqAaWaFqEBXoFOAEKoX1DgAAWlnopqEyBg4ACIFtRYwQUavHrECCCoesGHF9R66wRvWuDqoCcMdIIJzDbL7AUOYPAhBB182EECrLJ1gasjNHvCF6FUUEEw5JLrQQSzTiCRa7odYIDkBB5cK%2B64wVTgwb34eoBBHrzCGwGxFUTwLrzQ%2FkpBBRiAYM2jxHXQgb72YvAmq%2Bo6AC2rBX84AqiriJCAh9B6cEEGGViAQQK%2FQiDyyfe66eGHmfqZpQYlW6wBG7y%2BeauswF4gKwrzTmBBrroKMYIFFyQgsdAhZqDBmhpocGzRJIDwQQdOU%2B2nCZUGAQA7");
}
</html:style>
<foreignObject width="100" height="100" x="100" y="100" transform="scale(.7,.7)">
<html:div>
<html:p id="para">Foo</html:p>
</html:div>
</foreignObject>
</svg>

After

Width:  |  Height:  |  Size: 1.9 KiB

View file

@ -0,0 +1,22 @@
<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 10);" class="reftest-wait">
<script type="text/javascript">
function boom()
{
var ttt = document.getElementById("ttt");
ttt.appendChild(document.createTextNode("Pattern on stroke"));
ttt.appendChild(document.createTextNode("\n"));
ttt.appendChild(document.createTextNode("\n"));
document.documentElement.removeAttribute("class");
}
</script>
<text id="ttt" stroke="url(#pat2)" x="25" y="275"></text>
<pattern id="pat2" width="20" height="1000"><g/></pattern>
</svg>

After

Width:  |  Height:  |  Size: 549 B

View file

@ -0,0 +1,20 @@
<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" width="100%" height="100%" viewBox="0 0 480 360" onload="yaa();" class="reftest-wait">
<g id="g">
<rect width="440" height="340" fill="url(#pat1)"/>
<pattern id="pat1" width="20" height="20"><rect/></pattern>
</g>
<script type="text/javascript">
function yaa()
{
var g = document.getElementById("g");
document.documentElement.removeChild(g);
document.documentElement.appendChild(g);
document.documentElement.removeAttribute("class");
}
</script>
</svg>

After

Width:  |  Height:  |  Size: 547 B

View file

@ -0,0 +1,30 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>
function boom()
{
var mss = document.getElementById("mss");
var j = document.createTextNode("j");
var comb = document.createTextNode("\u0302");
mss.appendChild(j);
mss.appendChild(comb);
}
</script>
</head>
<body onload="boom()">
<div>
<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
<msub id="mss">
<mi>v</mi>
<mn>1</mn>
</msub>
</math>
</div>
</body>
</html>

View file

@ -0,0 +1 @@
<html><body>&#x22A3;&zwnj;</body></html>

View file

@ -0,0 +1,10 @@
<html>
<head>
</head>
<body>
<div><span style="text-transform: capitalize; font-variant: small-caps;">
x</span></div>
</body>
</html>

View file

@ -0,0 +1,17 @@
<html class="reftest-wait">
<head>
<script>
function boom()
{
var div = document.getElementById("div")
div.appendChild(document.createTextNode(String.fromCharCode(0x076F) + String.fromCharCode(13) + String.fromCharCode(0x076F)));
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="setTimeout(boom, 10);">
<div style="text-transform: lowercase" id="div">&#x76F;&#13;&#x76F;</div>
</body>
</html>

View file

@ -0,0 +1,17 @@
<html class="reftest-wait">
<head>
<script>
function boom()
{
var div = document.getElementById("div")
div.appendChild(document.createTextNode(String.fromCharCode(0x076F) + String.fromCharCode(13) + String.fromCharCode(0x076F)));
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="setTimeout(boom, 10);">
<div style="text-transform: lowercase" id="div"></div>
</body>
</html>

View file

@ -0,0 +1 @@
<div>-<span>&zwj;</span>&#xB235;</div>

View file

@ -0,0 +1,29 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>
<![CDATA[
function boom()
{
var f = document.getElementById("f");
var s = document.getElementById("s");
s.insertBefore(f, s.firstChild);
setTimeout(rel, 200);
}
function rel()
{
location.reload();
}
]]>
</script>
</head>
<body onload="boom();">
<font id="f"><b>2</b>"</font>
<b>"<span id="s">="<b></b></span></b>
</body>
</html>

View file

@ -0,0 +1,9 @@
<html class="reftest-wait">
<head>
<script>
setTimeout('document.documentElement.className = ""', 1000);
</script>
<body>
<iframe src="389326-1-inner.xhtml"></iframe>
</body>
</html>

View file

@ -0,0 +1,13 @@
<html><head>
<title>Crash [@ _moz_cairo_win32_scaled_font_select_font] with negative font-size in canvas</title>
<script>
var ctx = document.createElement('canvas').getContext('2d');
ctx.translate(100, 100);
ctx.mozTextStyle = "-14pt sans serif";
ctx.mozDrawText('text');
</script>
</head>
<body>
<canvas id="canvas"></canvas>
</body>
</html>

View file

@ -0,0 +1,14 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>
function boom()
{
var text = document.createTextNode("t");
document.getElementById("foo").appendChild(text);
}
</script>
</head>
<body onload="boom();" dir="rtl"><b id="foo"></b> x </body>
</html>

View file

@ -0,0 +1,18 @@
<html>
<head>
<script>
function boom()
{
var het = document.createTextNode(String.fromCharCode(0x05D7)); // hebrew letter het
document.getElementById("s").appendChild(het);
}
</script>
</head>
<body onload="boom();" dir="rtl">
<div><span id="s">A</span><span>&nbsp;</span>B</div>
</body>
</html>

View file

@ -0,0 +1,32 @@
<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
<head>
<script>
var ff;
var jj;
function boom()
{
ff = document.createElement("font");
ff.setAttribute("size", "-2");
ff.appendChild(document.createTextNode("G"));
jj = document.getElementById("jj");
jj.appendChild(ff);
setTimeout(boom2, 30);
}
function boom2()
{
jj.removeChild(ff);
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="boom();" dir="rtl"><div id="jj">h </div></body>
</html>

View file

@ -0,0 +1,16 @@
<html>
<head>
<script>
function boom()
{
var div = document.getElementById("div");
div.innerHTML = div.innerHTML.slice(1);
}
</script>
</head>
<body onload="boom();">
<div id="div">t
&#769;</div>
</body></html>

View file

@ -0,0 +1,23 @@
<html class="reftest-wait">
<head>
<script>
function boom()
{
var div = document.getElementById("div");
div.innerHTML = div.innerHTML.slice(1);
setTimeout(c, 30);
}
function c()
{
div.innerHTML = div.innerHTML.slice(1);
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="boom();">
<div id="div">t
&#769;</div>
</body></html>

View file

@ -0,0 +1,26 @@
<html class="reftest-wait">
<head>
<script>
function boom()
{
var t1 = document.createTextNode(String.fromCharCode(0x2011) + String.fromCharCode(13));
document.body.appendChild(t1);
setTimeout(boom2, 30);
}
function boom2()
{
var letterA = document.createTextNode(String.fromCharCode(65));
document.body.appendChild(letterA);
document.documentElement.removeAttribute("class");
}
</script>
</head>
<body onload="setTimeout(boom, 50);"></body>
</html>

File diff suppressed because one or more lines are too long

View file

@ -0,0 +1,20 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
<head>
<script>
function boom()
{
document.getElementById("tree").firstChild.data = "xyz";
}
</script>
</head>
<body onload="boom();">
<xul:tree id="tree">a</xul:tree>
</body>
</html>

View file

@ -0,0 +1,5 @@
<html>
<body style="direction: rtl;">
&#30;
</body>
</html>

View file

@ -0,0 +1,5 @@
<svg xmlns="http://www.w3.org/2000/svg">
<text>&#x202B;x</text>
</svg>

After

Width:  |  Height:  |  Size: 73 B

View file

@ -0,0 +1,13 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<style id="s">
maligngroup { white-space: pre; }
</style>
</head>
<body onload="document.getElementById('s').disabled = true;">
<ms xmlns="http://www.w3.org/1998/Math/MathML"><maligngroup>
</maligngroup></ms>
</body>
</html>

View file

@ -0,0 +1,13 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<style id="s">
maligngroup { white-space: pre; }
</style>
</head>
<body onload="document.getElementById('s').disabled = true;">
<ms xmlns="http://www.w3.org/1998/Math/MathML"><maligngroup>
</maligngroup></ms>
</body>
</html>

View file

@ -0,0 +1,10 @@
<html>
<head>
</head>
<body style="font-size: 15000px; word-spacing: 10px;">
ABCDE&#xA2C9;
&zwj;&#x9BB8;&#x9143;
</body>
</html>

View file

@ -0,0 +1,134 @@
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title></title>
<script type="text/javascript" src="jquery.js"></script>
<script type="text/javascript">
</script>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></meta>
<style type="text/css">
body { margin: 0 4em; font-family: sans-serif; font-size:xx-large;}
#content { width: 800px; margin: 0 auto; padding: 10em 0;}
</style>
</head>
<body>
<div id="content">
ừ̴̵̶̷̸̡̢̧̨̖̗̘̙̜̝̞̟̠̣̤̥̦̩̪̫̬̭̮̯̰̱̲̳̹̺̻̼͇͈͉͍͎́̂̃̄̅̆̇̈̉̊̋̌̍̎̏̐̑̒̓̔̽̾̿̀́͂̓̈́͆͊͋͌̕̚ͅ͏͓͔͕͖͙͚͐͑͒͗͛ͣ͘͜͟͢͝͞͠͡
</div><!-- #content -->
<pre>
u LATIN SMALL LETTER U
̀ COMBINING GRAVE ACCENT
́ COMBINING ACUTE ACCENT
̂ COMBINING CIRCUMFLEX ACCENT
̃ COMBINING TILDE
̄ COMBINING MACRON
̅ COMBINING OVERLINE
̆ COMBINING BREVE
̇ COMBINING DOT ABOVE
̈ COMBINING DIAERESIS
̉ COMBINING HOOK ABOVE
̊ COMBINING RING ABOVE
̋ COMBINING DOUBLE ACUTE ACCENT
̌ COMBINING CARON
̍ COMBINING VERTICAL LINE ABOVE
̎ COMBINING DOUBLE VERTICAL LINE ABOVE
̏ COMBINING DOUBLE GRAVE ACCENT
̐ COMBINING CANDRABINDU
̑ COMBINING INVERTED BREVE
̒ COMBINING TURNED COMMA ABOVE
̓ COMBINING COMMA ABOVE
̔ COMBINING REVERSED COMMA ABOVE
̕ COMBINING COMMA ABOVE RIGHT
̖ COMBINING GRAVE ACCENT BELOW
̗ COMBINING ACUTE ACCENT BELOW
̘ COMBINING LEFT TACK BELOW
̙ COMBINING RIGHT TACK BELOW
̚ COMBINING LEFT ANGLE ABOVE
̛ COMBINING HORN
̜ COMBINING LEFT HALF RING BELOW
̝ COMBINING UP TACK BELOW
̞ COMBINING DOWN TACK BELOW
̟ COMBINING PLUS SIGN BELOW
̠ COMBINING MINUS SIGN BELOW
̡ COMBINING PALATALIZED HOOK BELOW
̢ COMBINING RETROFLEX HOOK BELOW
̣ COMBINING DOT BELOW
̤ COMBINING DIAERESIS BELOW
̥ COMBINING RING BELOW
̦ COMBINING COMMA BELOW
̧ COMBINING CEDILLA
̨ COMBINING OGONEK
̩ COMBINING VERTICAL LINE BELOW
̪ COMBINING BRIDGE BELOW
̫ COMBINING INVERTED DOUBLE ARCH BELOW
̬ COMBINING CARON BELOW
̭ COMBINING CIRCUMFLEX ACCENT BELOW
̮ COMBINING BREVE BELOW
̯ COMBINING INVERTED BREVE BELOW
̰ COMBINING TILDE BELOW
̱ COMBINING MACRON BELOW
̲ COMBINING LOW LINE
̳ COMBINING DOUBLE LOW LINE
̴ COMBINING TILDE OVERLAY
̵ COMBINING SHORT STROKE OVERLAY
̶ COMBINING LONG STROKE OVERLAY
̷ COMBINING SHORT SOLIDUS OVERLAY
̸ COMBINING LONG SOLIDUS OVERLAY
̹ COMBINING RIGHT HALF RING BELOW
̺ COMBINING INVERTED BRIDGE BELOW
̻ COMBINING SQUARE BELOW
̼ COMBINING SEAGULL BELOW
̽ COMBINING X ABOVE
̾ COMBINING VERTICAL TILDE
̿ COMBINING DOUBLE OVERLINE
̀ COMBINING GRAVE TONE MARK
́ COMBINING ACUTE TONE MARK
͂ COMBINING GREEK PERISPOMENI
̓ COMBINING GREEK KORONIS
̈́ COMBINING GREEK DIALYTIKA TONOS
ͅ COMBINING GREEK YPOGEGRAMMENI
͆ COMBINING BRIDGE ABOVE
͇ COMBINING EQUALS SIGN BELOW
͈ COMBINING DOUBLE VERTICAL LINE BELOW
͉ COMBINING LEFT ANGLE BELOW
͊ COMBINING NOT TILDE ABOVE
͋ COMBINING HOMOTHETIC ABOVE
͌ COMBINING ALMOST EQUAL TO ABOVE
͍ COMBINING LEFT RIGHT ARROW BELOW
͎ COMBINING UPWARDS ARROW BELOW
͏ COMBINING GRAPHEME JOINER
͐ COMBINING RIGHT ARROWHEAD ABOVE
͑ COMBINING LEFT HALF RING ABOVE
͒ COMBINING FERMATA
͓ COMBINING X BELOW
͔ COMBINING LEFT ARROWHEAD BELOW
͕ COMBINING RIGHT ARROWHEAD BELOW
͖ COMBINING RIGHT ARROWHEAD AND UP ARROWHEAD BELOW
͗ COMBINING RIGHT HALF RING ABOVE
͘ COMBINING DOT ABOVE RIGHT
͙ COMBINING ASTERISK BELOW
͚ COMBINING DOUBLE RING BELOW
͛ COMBINING ZIGZAG ABOVE
͜ COMBINING DOUBLE BREVE BELOW
͝ COMBINING DOUBLE BREVE
͞ COMBINING DOUBLE MACRON
͟ COMBINING DOUBLE MACRON BELOW
͠ COMBINING DOUBLE TILDE
͡ COMBINING DOUBLE INVERTED BREVE
͢ COMBINING DOUBLE RIGHTWARDS ARROW BELOW
ͣ COMBINING LATIN SMALL LETTER A
</pre>
<p>Friends and neighbors, this terrifying piece of Unicode technology was created by Mr SBP of <a href="http://inamidst.com/odds/supercombiner">inamidst.com</a></p>
</body>
</html>

View file

@ -0,0 +1,10 @@
<html>
<head>
<title>Google</title>
</head>
<style>body,td,a,p,.h{font-family:arial,sans-serif}.h{color:#3366cc}.q{color:#00c}.ts td{padding:0}.ts{border-collapse:collapse}#gbar{float:left;font-weight:bold;height:22px;padding-left:2px}#gbh{border-top:1px solid #c9d7f1;font-size:0;height:0;position:absolute;right:0;top:24px;width:200%}#gbi{background:#fff;border:1px solid;border-color:#c9d7f1 #36c #36c #a2bae7;font-size:13px;top:24px;z-index:1000}#guser{padding-bottom:7px !important}#gbar,#guser{font-size:13px;padding-top:1px !important}@media all{.gb1,.gb3{height:22px;margin-right:.73em;vertical-align:top}}#gbi,.gb2{display:none;position:absolute;width:8em}.gb2{z-index:1001}#gbar a,#gbar a:active,#gbar a:visited{color:#00c;font-weight:normal}.gb2 a,.gb3 a{text-decoration:none}.gb2 a{display:block;padding:.2em .5em}#gbar .gb2 a:hover{background:#36c;color:#fff}
</style>
<body>
<div id="gbh"></div>
</body>
</html>

View file

@ -0,0 +1,8 @@
<html>
<head>
<title>bug 404112</title>
</head>
<body>
<div style="font-size: 0"></div>
</body>
</html>

View file

@ -0,0 +1,20 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
<script type="text/javascript">
//<![CDATA[
function boom()
{
var div = document.createElementNS('http://www.w3.org/1999/xhtml', 'div');
document.body.appendChild(div);
div.style.fontSize = '68719476736px';
div.appendChild(document.createTextNode(String.fromCharCode(0)));
}
//]]>
</script>
</head>
<body onload="boom()">
</body>
</html>

View file

@ -0,0 +1,8 @@
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html> <head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title></title>
</head>
<body>
<span style="font-family: Verdana">IIIIIiiii'm dumb. ಠ_ಠ</span>
</body> </html>

View file

@ -0,0 +1,18 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="" xml:lang="">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Gecko Crash Demo</title>
</head>
<body>
<div>
<span style="font-size:463.25em"><a href="#">Hello World!</a></span>
</div>
</body>
</html>

View file

@ -0,0 +1,13 @@
<html>
<head>
<style>
.a { width: 17895680}
.b { width: 10}
</style>
</head>
<body>
<table><tr>
<td class="a">a</td><td class="b">b</td>
</tr></table>
</body>
</html>

View file

@ -0,0 +1,14 @@
<?xml version="1.0"?>
<!DOCTYPE html PUBLIC
"-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN"
"http://www.w3.org/TR/MathML2/dtd/xhtml-math11-f.dtd"
[
<!ENTITY mathml "http://www.w3.org/1998/Math/MathML">
]>
<math display="block" xmlns="&mathml;">
<mi>f &#x0332;</mi>
<mi>-</mi>
<mo>+</mo>
<mo> -</mo>
<mo>&#x0332;</mo>
</math>

View file

@ -0,0 +1,5 @@
<!DOCTYPE html>
<html>
<head></head>
<body style="font-size: 10000%">&#x2029;&#x0301;</body>
</html>

View file

@ -0,0 +1,20 @@
<!DOCTYPE html>
<html>
<head>
<script type="text/javascript">
function boom()
{
document.body.appendChild(document.createTextNode(String.fromCharCode(0x202E)));
document.body.appendChild(document.createTextNode(String.fromCharCode(0x000D)));
document.body.appendChild(document.createTextNode(String.fromCharCode(0x200D)));
document.body.appendChild(document.createTextNode(String.fromCharCode(0xD75A)));
document.body.appendChild(document.createTextNode(String.fromCharCode(0xD63F)));
}
</script>
</head>
<body onload="boom();">
</body>
</html>

View file

@ -0,0 +1,4 @@
<html>
<head></head>
<body><div style="text-transform: capitalize">&#x5426; &#x200C;</body>
</html>

View file

@ -0,0 +1,4 @@
<html>
<head></head>
<body dir="rtl"><div>&#x200C;&#x2028;</div></body>
</html>

View file

@ -0,0 +1,4 @@
<html>
<head></head>
<body><div>&#x0301;&#x2029;</div></body>
</html>

View file

@ -0,0 +1,14 @@
<html>
<head>
<script type="text/javascript">
function boom()
{
document.body.appendChild(document.createTextNode("\uCEDD\u5C76\u000D\uCA34"));
}
</script>
</head>
<body onload="boom();"><span>&#x202E;&#x05BC;</span></body>
</html>

View file

@ -0,0 +1,4 @@
<html>
<head></head>
<body onload="document.body.appendChild(document.createTextNode('y'));">x&#x2028;&#x200D;&#x202D;<span>&#x0643;</span></body>
</html>

View file

@ -0,0 +1 @@
<html xmlns="http://www.w3.org/1999/xhtml" style="min-width: -moz-max-content; float: left;"><head style="padding: 200%; display: -moz-inline-box; float: inherit;"></head></html>

View file

@ -0,0 +1,5 @@
<html>
<body>
<p style="font-family: DejaVu Sans">&#814;</p>
</body>
</html>

View file

@ -0,0 +1,5 @@
<!DOCTYPE html>
<html>
<head></head>
<body>A&#x101747;AAAAAAA&#x4f47;AAAAA&#xe33;AAAAAA</body>
</html>

View file

@ -0,0 +1 @@
<!DOCTYPE html><html><body><span>&#x1104</span><span>&#x1104</span><span>&#x116A</span></body></html>

View file

@ -0,0 +1,39 @@
<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>Testcase for bug </title>
<style type="text/css">
html,body {
color:black; background-color:white; font-size:16px; padding:0; margin:0;
}
</style>
</head>
<body>
<div id="Image"></div>
<script>
var v;
function insertImage() {
var img_node = document.createElement('iframe');
img_node.src = "441360_data.gif";
var image_div = document.getElementById('Image');
image_div.appendChild(img_node);
}
insertImage();
v = document.body.offsetHeight;
insertImage();
v = document.body.offsetHeight;
insertImage();
v = document.body.offsetHeight;
insertImage();
v = document.body.offsetHeight;
</script>
</body>
</html>

Binary file not shown.

After

Width:  |  Height:  |  Size: 2.9 KiB

View file

@ -0,0 +1,11 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/REC-html401-19991224/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Tamil testcase</title>
</head>
<body>
<p>&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;&#x0BCC;</p>
</body>
</html>

View file

@ -0,0 +1,5 @@
<!DOCTYPE html>
<html style="position: relative; bottom: 4449920388in; margin: 200px;">
<head></head>
<body style="background: url(../../../layout/reftests/bugs/repeatable-diagonal-gradient.png);"></body>
</html>

View file

@ -0,0 +1 @@
<html xmlns="http://www.w3.org/1999/xhtml" style="margin: 78504em; background: url(../../../testing/crashtest/images/tree.gif); font-size: 305203ch; position: relative; left: 65em;"><head></head><body></body></html>

View file

@ -0,0 +1,8 @@
<!DOCTYPE html>
<html>
<head>
</head>
<body onload="document.getElementById('q').appendChild(document.createTextNode('C'));">
<div style="white-space: pre; direction: rtl;">A<div id="q" style="text-transform: capitalize;">B
<div></div></div></div>
</body></html>

View file

@ -0,0 +1,5 @@
<!DOCTYPE html>
<html>
<head></head>
<body><div style="text-transform: capitalize">&#x06CD;A</div></body>
</html>

View file

@ -0,0 +1,16 @@
<!DOCTYPE html>
<html>
<head>
<style type="text/css">
div { -moz-transform: matrix(3, 1, 16.8, 5.6, 0, 0); }
div > div { border: 1px dashed #9ab; }
</style>
</head>
<body>
<div><div></div></div>
</body>
</html>

View file

@ -0,0 +1,23 @@
<html xmlns="http://www.w3.org/1999/xhtml" style="font-family: monospace;">
<head>
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="w"><content><div xmlns="http://www.w3.org/1999/xhtml"><children xmlns="http://www.mozilla.org/xbl"/></div></content></binding>
<binding id="empty"><content/></binding>
</bindings>
<script type="text/javascript">
function boom()
{
document.createElementNS("http://www.w3.org/2000/svg", "rect");
document.getElementById("d").previousSibling.data += "C";
document.getElementById("d").style.MozBinding = "url('#empty')";
}
</script>
</head>
<body onload="boom();"><span>A&#x202E;<span style="-moz-binding: url('#w');"></span>B<span id="d" style="font-size: 80%; color: green;">D</span></span></body>
</html>

View file

@ -0,0 +1,22 @@
<html xmlns="http://www.w3.org/1999/xhtml" style="font-family: monospace;">
<head>
<bindings xmlns="http://www.mozilla.org/xbl">
<binding id="w"><content><div xmlns="http://www.w3.org/1999/xhtml"><children xmlns="http://www.mozilla.org/xbl"/></div></content></binding>
<binding id="empty"><content/></binding>
</bindings>
<script type="text/javascript">
function boom()
{
document.getElementById("d").previousSibling.data += "C";
document.getElementById("d").style.MozBinding = "url('#empty')";
}
</script>
</head>
<body onload="boom();"><span>A&#x202E;<span style="-moz-binding: url('#w');"></span>B<span id="d" style="font-size: 80%; color: green;">D</span></span></body>
</html>

View file

@ -0,0 +1,23 @@
<html>
<head>
<title>Bad kern table - bug 487549</title>
<!--
The font used here has an invalid 'kern' table that will crash ATSUI
if we attempt to use it.
See https://bugzilla.mozilla.org/show_bug.cgi?id=487549
-->
<style>
@font-face {
font-family: bad-kern-font;
src: url(487549-bad_kern_table.ttf) format("truetype");
}
body {
font-family: bad-kern-font;
}
</style>
</head>
<body>
ABC abc 123
</body>
</html>

Binary file not shown.

View file

@ -0,0 +1,23 @@
<!DOCTYPE html>
<html>
<head>
<script type="text/javascript">
function boom()
{
var w = document.getElementById("w");
var q = document.getElementById("q");
var e = document.createTextNode("");
document.documentElement.appendChild(document.body);
w.appendChild(e);
document.documentElement.offsetHeight;
w.removeChild(q);
document.documentElement.offsetHeight;
e.data += " x ";
}
</script>
</head>
<body onload="boom();"><span id="w">s&#x202E;<span id="q"></span><div></div><span>a</span></span></body>
</html>

View file

@ -0,0 +1,9 @@
<!-- This crashed on Mac OS X with the modified ATSUI font backend implemented in
bug 481948. Crash occurs due to an unpaired low surrogate in text with the
right-to-left direction override; this cannot occur in direct HTML content
because the unpaired surrogate will be replaced with U+FFFD, but it can be
generated from Javascript. -->
<html>
<body onload="document.body.appendChild(document.createTextNode('\u202E\u4839\uDC1D'));">
</body>
</html>

View file

@ -0,0 +1,5 @@
<!DOCTYPE HTML>
<html style="font-size: 70368744177663%; -moz-background-size: 2199023255552em 809464690865px; background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVR42mP4%2F58BAAT%2FAf9jgNErAAAAAElFTkSuQmCC);">
<body>
</body>
</html>

View file

@ -0,0 +1,5 @@
<html>
<body style="word-spacing: 10px">
<div>X &#x0301;&#x0000;</div>
</body>
</html>

View file

@ -0,0 +1,14 @@
<html>
<head>
<title>Testcase for bug 538065</title>
<style type="text/css">
span.test { background: #ff0; }
</style>
</head>
<body>
<p>U+FEFF: <span class="test">&#xfeff;</span></p>
<p>U+FFF9: <span class="test">&#xfff9;</span></p>
<p>U+FFFA: <span class="test">&#xfffa;</span></p>
<p>U+FFFB: <span class="test">&#xfffb;</span></p>
</body>
</html>

View file

@ -0,0 +1,8 @@
<!DOCTYPE html>
<html>
<head>
</head>
<body onload="document.getElementById('button').value='';">
<input id="button" type="button" value="Should not crash" style="width: 1px; white-space: normal;">
</body>
</html>

View file

@ -0,0 +1 @@
<html style="background: -moz-repeating-radial-gradient(left center , circle closest-side, red, white 100px, black); width: 300px; height: 1px;"></html>

View file

@ -0,0 +1,2 @@
<html><body style="font-size-adjust: -18446744073709552000; font-weight: bold;">&#x9385;</body></html>

View file

@ -0,0 +1,7 @@
<html><head>
<style>@font-face{font-family:t;src:url(580100-bad_hhea_table.ttf);}
p.t{font-size:40px;font-family:t;}</style>
</head>
<body>
<p class="t">Lorem ipsum</p></body>
</html>

Binary file not shown.

View file

@ -0,0 +1,7 @@
<html><head>
<style>@font-face{font-family:t;src:url(580212-bad_loca_table.ttf);}
p.t{font-size:40px;font-family:t;}</style>
</head>
<body>
<p class="t">Lorem ipsum</p></body>
</html>

Some files were not shown because too many files have changed in this diff Show more