Skip to content

Commit c3f7c55

Browse files
Sharon Yangchromium-wpt-export-bot
Sharon Yang
authored and
chromium-wpt-export-bot
committed
Migrate dom/transforms/css/html crashtests to WPT
The following tests were migrated to external/wpt. This includes 12 tests: - external/wpt/css/css-motion-path/crashtests/rotation-overflow.html - external/wpt/css/css-transforms/crashtests/transform-origin.html - external/wpt/css/css-transforms/crashtests/transformed-scroller-snapping.html - external/wpt/css/css-values/crashtests/calc-with-percent-and-number-in-line-height.html - external/wpt/css/css-values/crashtests/transition-asan.html - external/wpt/dom/crashtests/adoptNode-reparenting.html - external/wpt/dom/crashtests/append-child-recurse.html - external/wpt/dom/crashtests/appendChild-document.html - external/wpt/html/semantics/embedded-content/crashtests/iframe-load-before-load.html - external/wpt/html/semantics/obsolete/crashtests/marquee-inside-template-tag.html - external/wpt/html/semantics/obsolete/crashtests/marquee-zero-width.html - external/wpt/html/semantics/text-level-semantics/crashtests/q-empty.html Bug: 485677942 Change-Id: Iba1b136582d0b49248d545a4fd42474c8313b598 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8021270 Reviewed-by: Christian Biesinger <cbiesinger@chromium.org> Commit-Queue: Sharon Yang <yangsharon@igalia.com> Cr-Commit-Position: refs/heads/main@{#1654734}
1 parent 7a6dc3b commit c3f7c55

25 files changed

Lines changed: 371 additions & 0 deletions

‎css/css-motion-path/crashtests/rotation-overflow.html‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>Very large rotation angles in offset should not crash</title>
4+
<link rel="help" href="https://crbug.com/40459168">
5+
<style>
6+
body {
7+
offset: path("M 2 9223372036854775640 h 112 v 18446744073709551478") 44px 6772159099343311147963407119496477758278323944392504792520726726528445908706753060030057770863072007690525803528990028771578716997626504007399536732362342681220306922677405220428480102113641824539771557937974021684448585322739937495322648385679803197878862537591342648461579499923703493989594208073045976755073456313663842125268129997886257177874866252782866713636942669286588447097343808037614382288341687498451651245152153424054000300383726062592046846049867203248174598084843154rad reverse;
8+
}
9+
</style>

‎css/css-transforms/crashtests/transform-origin.html‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>transform-origin with bottom keyword should not crash</title>
4+
<link rel="help" href="https://crbug.com/40380283">
5+
<style>pants { transform-origin: bottom 8px; }</style>

‎css/css-transforms/crashtests/transformed-scroller-snapping.html‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
<!DOCTYPE html>
2+
<html class="test-wait">
3+
<meta charset="utf-8">
4+
<title>Transformed scroll height subpixel snapping should not crash</title>
5+
<link rel="help" href="https://crbug.com/40587031">
6+
<style>
7+
#heightChange {
8+
vertical-align: 10%;
9+
height: 200px;
10+
display: inline-block;
11+
}
12+
#scroller {
13+
overflow: scroll;
14+
position: absolute;
15+
padding-bottom: 101%;
16+
transform: scale(0.9);
17+
height: 10px;
18+
}
19+
#text {
20+
vertical-align: 10%;
21+
}
22+
</style>
23+
<div id="heightChange"></div>
24+
<div id="scroller"><span id="text">PASS</span></div>
25+
<script>
26+
requestAnimationFrame(function() {
27+
heightChange.style.height = '0';
28+
document.documentElement.classList.remove('test-wait');
29+
});
30+
</script>
31+
</html>

‎css/css-transitions/crashtests/transition-asan.html‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<!DOCTYPE html>
2+
<html class="test-wait">
3+
<meta charset="utf-8">
4+
<title>Disposing a calc transition should not cause a heap-use-after-free crash</title>
5+
<link rel="help" href="https://crbug.com/40332981">
6+
<style>
7+
#test { transition: width 1s; }
8+
</style>
9+
<div id="test"></div>
10+
<script>
11+
test.style.width = 'calc(100px + 100%)';
12+
requestAnimationFrame(function() {
13+
test.style.width = '100px';
14+
requestAnimationFrame(function() {
15+
document.body.removeChild(test);
16+
document.documentElement.classList.remove('test-wait');
17+
});
18+
});
19+
</script>
20+
</html>

‎css/css-values/crashtests/calc-with-percent-and-number-in-line-height.html‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>calc() with percent and number in line-height should not crash</title>
4+
<link rel="help" href="https://crbug.com/40358562">
5+
<style>
6+
* {
7+
line-height: calc(100% + 30);
8+
}
9+
</style>

‎dom/crashtests/adoptNode-reparenting.html‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>Reparenting in removeNode() in adoptNode() should not crash</title>
4+
<link rel="help" href="https://crbug.com/40509368">
5+
<div id="test-container"><script>
6+
var sacrifice;
7+
let testContainer = document.getElementById('test-container');
8+
let iframe = document.createElement('iframe');
9+
testContainer.appendChild(iframe);
10+
let doc = iframe.contentDocument;
11+
let script = doc.createElementNS('http://www.w3.org/2000/svg', 'script');
12+
script.type = 'invalid-type';
13+
script.textContent = 'document.body.appendChild(parent.sacrifice)';
14+
sacrifice = document.createElement('div');
15+
script.appendChild(sacrifice);
16+
doc.body.appendChild(script);
17+
script.type = '';
18+
document.adoptNode(sacrifice);
19+
</script>

‎dom/crashtests/append-child-recurse.html‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>Adopting parent node in DOMSubtreeModified event handler should not cause a crash</title>
4+
<link rel="help" href="https://crbug.com/41329392">
5+
<div>
6+
<p id="parent">bar</p>
7+
<span id="test-title">title</span>
8+
</div>
9+
<script>
10+
var parent = document.querySelector('#parent');
11+
var test_title = document.querySelector('#test-title');
12+
13+
function tCF_custom_1() {
14+
var doc = document.implementation.createDocument('http://www.w3.org/1999/xhtml', 'html');
15+
doc.adoptNode(parent);
16+
parent.appendChild(test_title);
17+
}
18+
parent.addEventListener('DOMSubtreeModified', tCF_custom_1, false);
19+
20+
parent.appendChild(test_title);
21+
</script>

‎dom/crashtests/appendChild-document.html‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>appendChild between documents should not crash</title>
4+
<link rel="help" href="https://crbug.com/40573841">
5+
<span id="e1"></span>
6+
<span id="e2">
7+
<span id="e3"></span>
8+
</span>
9+
<script>
10+
var e1 = document.getElementById("e1");
11+
var e2 = document.getElementById("e2");
12+
var e3 = document.getElementById("e3");
13+
var doc1 = document.implementation.createDocument("", "", null);
14+
doc1.appendChild(e2);
15+
16+
e2.addEventListener(
17+
"DOMSubtreeModified", () => {e1.appendChild(e3)}, {once: true});
18+
e2.appendChild(e3);
19+
</script>

‎html/semantics/embedded-content/crashtests/iframe-load-before-load.html‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>Loading an IFRAME element twice should not crash</title>
4+
<link rel="help" href="https://crbug.com/40084937">
5+
<script>
6+
var iframe1;
7+
window.addEventListener('load', () => {
8+
var fragment = document.createDocumentFragment();
9+
var script = fragment.appendChild(document.createElement('script'));
10+
iframe1 = fragment.appendChild(document.createElement('iframe'));
11+
fragment.appendChild(document.createTextNode('foo'));
12+
script.textContent = 'document.body.appendChild(iframe1);';
13+
document.body.appendChild(fragment);
14+
});
15+
</script>

‎html/semantics/obsolete/crashtests/marquee-inside-template-tag.html‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>Marquee elements inside a template tag should not crash</title>
4+
<link rel="help" href="https://crbug.com/40387977">
5+
<template>
6+
<p>Marquee elements inside a template tag crash.
7+
<marquee>
8+
</template>

0 commit comments

Comments
 (0)