Skip to content

Commit

Permalink
Export more MathML crashtests to WPT.
Browse files Browse the repository at this point in the history 
Follow-up of bug 1795630 for some crashtests that were not in `mathml`
directories. The list was extracted in a subjective way from [1] by
looking at some tests that seem to contain essentially MathML with
some simple HTML or CSS. The changes to `crashtest.list` files have
been generated by [2].

[1] https://searchfox.org/mozilla-central/search?q=%3Cmath%7Cmathml&path=crashtest&case=true&regexp=true
[2] `for file in $(^Ct ~/list-of-tests.txt); do D=$(dirname $file); F=$(filename $file); sed -i "/$F/d" $D/crashtests.list; done`

Differential Revision: https://phabricator.services.mozilla.com/D203614

bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1883606
gecko-commit: c306d54c8963e4dda4426d48bf41774947f5138d
gecko-reviewers: emilio
  • Loading branch information
@fred-wang @moz-wptsync-bot
fred-wang authored and moz-wptsync-bot committed Mar 11, 2024
1 parent b886a9b commit eae49b8
Show file tree
Hide file tree
Showing 32 changed files with 513 additions and 0 deletions.
1 change: 1 addition & 0 deletions lint.ignore
View file
Expand Up @@ -745,5 +745,6 @@ HTML INVALID SYNTAX: domparsing/DOMParser-parseFromString-xml-parsererror.html
HTML INVALID SYNTAX: domparsing/XMLSerializer-serializeToString.html
HTML INVALID SYNTAX: html/canvas/element/manual/unclosed-canvas-4.htm
HTML INVALID SYNTAX: html/syntax/parsing/unclosed-svg-script.html
HTML INVALID SYNTAX: mathml/crashtests/mozilla/411603-1.html
HTML INVALID SYNTAX: quirks/percentage-height-calculation.html
HTML INVALID SYNTAX: trusted-types/TrustedTypePolicyFactory-getAttributeType-namespace.html
18 changes: 18 additions & 0 deletions mathml/crashtests/mozilla/1140268-1.html
View file
@@ -0,0 +1,18 @@
<!DOCTYPE html>
<html>
<head>
<meta charset=utf-8>
<script>
function boom()
{
var e = document.getElementsByTagName("mo")[0];
e.setAttribute("style", "position: absolute; top: 0px;");
document.documentElement.offsetHeight;
e.setAttribute("style", "position: absolute; top: 100px;");
}
</script>
</head>
<body onload="boom();">
<math><mo>boom!</mo></math>
</body>
</html>
6 changes: 6 additions & 0 deletions mathml/crashtests/mozilla/1397439-1.html
View file
@@ -0,0 +1,6 @@
<!DOCTYPE html>
<math>
<mstyle scriptlevel=101>
<mstyle scriptlevel=-204>
</math>

24 changes: 24 additions & 0 deletions mathml/crashtests/mozilla/1403465.html
View file
@@ -0,0 +1,24 @@
<!DOCTYPE html>
<html>
<body>
<math class="hidden">
<mi>x</mi>
<mo>=</mo>
</math>
<script>
window.onload = function() {
let s = document.createElement("style");
s.textContent = `
body {
line-height: 1.42857143;
}
.hidden {
display: none;
}
`;
document.body.appendChild(s);
};
</script>
</body>
</html>
9 changes: 9 additions & 0 deletions mathml/crashtests/mozilla/1435015.html
View file
@@ -0,0 +1,9 @@
<!doctype html>
<style>
div { display: contents; }
</style>
<math></math>
<script>
let div = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'div');
document.querySelector('math').appendChild(div);
</script>
16 changes: 16 additions & 0 deletions mathml/crashtests/mozilla/1555757-1.html
View file
@@ -0,0 +1,16 @@
<html>
<head>
<style>
.class_1 {
transition-delay: 2129ms;
contain: strict;
}
</style>
</head>
<math>
<mover>
<ms></ms>
<mtable class="class_1"></mtable>
</mover>
</math>
</html>
27 changes: 27 additions & 0 deletions mathml/crashtests/mozilla/1555757-2.html
View file
@@ -0,0 +1,27 @@
<!DOCTYPE html>
<html>
<head>
<style>
#testElem {
border: 1px solid black;
background: yellow;
contain: layout size;
width: 300px;
}
</style>
<script>
function go() {
/* trigger an incremental reflow.
* Note: elem.style is undefined for MathML elements, so we have
* to use setAttribute().
*/
testElem.setAttribute("style", "width:150px");
}
</script>
</head>
<body onload="go()">
<math>
<mtable id="testElem">Change my size</mtable>
</math>
</body>
</html>
20 changes: 20 additions & 0 deletions mathml/crashtests/mozilla/1701975-1.html
View file
@@ -0,0 +1,20 @@
<!DOCTYPE html>
<html>
<head>
<style>
#id_0 {
font-size: 10000% ! important
}

* {
border-top-style: groove;
}
</style>

</head>
<math>
<semantics style='border-inline: 1000000em outset !important'>
<mmultiscripts id='id_0'></mmultiscripts>
</semantics>
</math>
</html>
25 changes: 25 additions & 0 deletions mathml/crashtests/mozilla/243159-2.xhtml
View file
@@ -0,0 +1,25 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:mathml="http://www.w3.org/1998/Math/MathML">
<body onload="run()">
<mathml:math id="test" style="display: block">
</mathml:math>
<script>
function run() {
var t1 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
"mtable");
var t2 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
"mtable");
var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
"mtr");
var r2 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
"mtr");
var test =
document.getElementsByTagNameNS("http://www.w3.org/1998/Math/MathML", "math")[0];
t1.appendChild(r1);
test.appendChild(t1);
test.appendChild(t2);
t2.appendChild(r2);
}
</script>
</body>
</html>
14 changes: 14 additions & 0 deletions mathml/crashtests/mozilla/306902-1.xml
View file
@@ -0,0 +1,14 @@
<?xml version='1.0'?>

<html xmlns="http://www.w3.org/1999/xhtml">

<body>

<math xmlns='http://www.w3.org/1998/Math/MathML' display='block'><msup>

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

</msup></math>

</body>
</html>
23 changes: 23 additions & 0 deletions mathml/crashtests/mozilla/347506-1.xhtml
View file
@@ -0,0 +1,23 @@
<html xmlns="http://www.w3.org/1999/xhtml">

<body>

<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">

<mtable>
<mtr>
<mtd><mi>x</mi></mtd>
<mtd rowspan="4" columnspan="4"><mi>y</mi></mtd>
</mtr>
<mtr>
<mtd rowspan="0" columnspan="0"><mi>z</mi></mtd>
<mtd><mi>w</mi></mtd>
</mtr>
</mtable>


</math></div>

</body>

</html>
26 changes: 26 additions & 0 deletions mathml/crashtests/mozilla/355993-1.xhtml
View file
@@ -0,0 +1,26 @@
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<style>
body, body * { position: fixed; }
</style>
</head>

<body>


<div>
<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">

<mtable>
<mtr>
<mtd>
<mn>1</mn>
</mtd>
</mtr>
</mtable>
</math>
</div>

</body>
</html>
11 changes: 11 additions & 0 deletions mathml/crashtests/mozilla/364686-1.xhtml
View file
@@ -0,0 +1,11 @@
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:math="http://www.w3.org/1998/Math/MathML">

<body>

<math:merror>
<img/>
</math:merror>

</body>
</html>
11 changes: 11 additions & 0 deletions mathml/crashtests/mozilla/368461-1.xhtml
View file
@@ -0,0 +1,11 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">

<head>
</head>

<body>

<p><math:msubsup><span>Foo bar baz<td></td></span></math:msubsup></p>

</body>
</html>
14 changes: 14 additions & 0 deletions mathml/crashtests/mozilla/370884-1.xhtml
View file
@@ -0,0 +1,14 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
<head>
</head>

<body>

<math:mroot>
<div>
<div style="position: fixed;">Y</div>
</div>
</math:mroot>

</body>
</html>
7 changes: 7 additions & 0 deletions mathml/crashtests/mozilla/382208-1.xhtml
View file
@@ -0,0 +1,7 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
<body>

<div><math:mfrac><math:mmultiscripts/><math:mi/></math:mfrac></div>

</body>
</html>
7 changes: 7 additions & 0 deletions mathml/crashtests/mozilla/382396-1.xhtml
View file
@@ -0,0 +1,7 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
<body>

<p style="text-indent: 0%">a<math:ms/></p>

</body>
</html>
31 changes: 31 additions & 0 deletions mathml/crashtests/mozilla/384649-1.xhtml
View file
@@ -0,0 +1,31 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<style>

/* use attribute selector instead of the .class shorthand to work around bug 379178 */

*[class="fixed"] { position: fixed; }

math, mtable, mtr { position: inherit; }

</style>
</head>

<body>

<div class="fixed">
<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
<mtable>
<mtr class="fixed">
<mtd><mi>x</mi></mtd>
</mtr>
<mtr>
<mtd><mi>y</mi></mtd>
</mtr>
</mtable>
</math>
</div>

</body>

</html>
13 changes: 13 additions & 0 deletions mathml/crashtests/mozilla/385265-1.xhtml
View file
@@ -0,0 +1,13 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<body>

<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
<mtable>
<mtr>
<mtd><mi>x</mi></mtd>
</mtr>
</mtable>
</math>

</body>
</html>
30 changes: 30 additions & 0 deletions mathml/crashtests/mozilla/385289-1.xhtml
View file
@@ -0,0 +1,30 @@
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<script>
function boom()
{
var mss = document.getElementById("mss");

var j = document.createTextNode("j");
var comb = document.createTextNode("\u0302");

mss.appendChild(j);
mss.appendChild(comb);
}
</script>
</head>

<body onload="boom()">

<div>
<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
<msub id="mss">
<mi>v</mi>
<mn>1</mn>
</msub>
</math>
</div>

</body>

</html>
27 changes: 27 additions & 0 deletions mathml/crashtests/mozilla/394150-1.xhtml
View file
@@ -0,0 +1,27 @@
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
<head>
<script>

function boom()
{
var ms = document.createElementNS("http://www.w3.org/1998/Math/MathML", "ms");
var textNode = document.getElementById("emptyset").firstChild;
var mrow = document.getElementById("mrow");

ms.appendChild(textNode); // *move* the text node from one place to another!
mrow.appendChild(ms);
}

</script>
</head>

<body onload="boom();">

<math xmlns="http://www.w3.org/1998/Math/MathML">
<merror><emptyset id="emptyset">
<mrow id="mrow"></mrow></emptyset></merror>
</math>

</body>

</html>

0 comments on commit eae49b8

Please sign in to comment.