dom/svg/crashtests/long-clipPath-reference-chain.svg

   1 <svg xmlns="http://www.w3.org/2000/svg">
   2   <title>Test very long clipPath chain - MAY CRASH</title>
   3   <script><![CDATA[
   4
   5 // This script creates a very long chain of clipPath elements to test whether
   6 // that causes a stack overflow that crashes the UA.  The first clipPath clips
   7 // to a 50x100 rect, the last to a 25x100 rect.  If a UA was to apply the
   8 // entire clipPath chain (unlikely) a rect 25x100 would be rendered.
   9 //
  10 // At the time of writing, Firefox would treat the entire chain of clipPaths as
  11 // invalid due to its excessive length, and refuse to render the referencing
  12 // element at all.  One alternative would be to ignore the clipPath reference
  13 // and render the referencing element without any clipping.  Another
  14 // alternative would be to break the chain and clip the referencing element,
  15 // but only using the first X clipPaths in the chain (in which case a 50x100
  16 // rect would be rendered).
  17
  18 var chainLength = 100000;
  19
  20 var SVG_NS = "http://www.w3.org/2000/svg";
  21 var template = document.createElementNS(SVG_NS, "clipPath");
  22 var templatesRect = document.createElementNS(SVG_NS, "rect");
  23 templatesRect.setAttribute("width", "100");
  24 templatesRect.setAttribute("height", "100");
  25 template.appendChild(templatesRect);
  26
  27 function createClipPath(index) {
  28   var cp = template.cloneNode(true);
  29   cp.id = "c" + index;
  30   cp.setAttribute("clip-path", "url(#c" + (index + 1) + ")");
  31   return cp;
  32 }
  33
  34 var de = document.documentElement;
  35
  36 for (var i = chainLength; i > 0; --i) {
  37   var cp = createClipPath(i);
  38
  39   if (i == chainLength) {
  40     cp.firstChild.setAttribute("width", "25");
  41   }
  42   else if (i == 1) {
  43     cp.firstChild.setAttribute("width", "50");
  44   }
  45
  46   de.appendChild(cp);
  47 }
  48
  49   ]]></script>
  50   <rect width="100%" height="100%" fill="lime"/>
  51   <!-- We don't expect the following element to render at all -->
  52   <rect width="500" height="500" clip-path="url(#c1)"/>
  53 </svg>