Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-02-13 03:24:26 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1226400 - crashtest for FontFaceSet::Load() crasher. r=birtles

Browse Source
This commit is contained in:
Boris Zbarsky 2015-11-27 08:22:37 +09:00
parent 92313d241f
commit 3c44c61fbe
2 changed files with 56 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
layout/style/crashtests/1226400-1.html Normal file
View File

@ -0,0 +1,55 @@
<!DOCTYPE HTML>
<html>
<head>
<title>FontFaceSet::Load crasher</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<style type="text/css">
body {
margin: 50px;
}
p {
margin: 0;
font-size: 300%;
}
</style>
</head>
<body>
<p>This may crash on load...</p>
<script>
var scriptText = `
var fontFaceSet = document.fonts;
var link = document.createElement("link");
link.onerror = link.onload = function() {
fontFaceSet.load("12px foo");
}
link.rel = "stylesheet";
link.href = "data:text/css,";
document.body.appendChild(link);
`;
var styleText = `
@font-face {
font-family: foo;
src: url("data:text/ttf,");
}
`;
var ifr = document.createElement("iframe");
document.body.appendChild(ifr);
var style = ifr.contentDocument.createElement("style");
style.textContent = styleText;
ifr.contentDocument.body.appendChild(style);
var script = ifr.contentDocument.createElement("script");
script.textContent = scriptText;
ifr.contentDocument.body.appendChild(script);
ifr.remove();
</script>
</body>
</html>

1
layout/style/crashtests/crashtests.list
View File

@ -130,6 +130,7 @@ load 1200568-1.html
load 1206105-1.html
load 1223688-1.html
load 1223694-1.html
load 1226400-1.html
load 1227501-1.html
load border-image-visited-link.html
load font-face-truncated-src.html