summaryrefslogtreecommitdiffstats
path: root/dom/xbl/crashtests
diff options
context:
space:
mode:
authorMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
committerMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
commit5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree10027f336435511475e392454359edea8e25895d /dom/xbl/crashtests
parent49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
downloadUXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
Add m-esr52 at 52.6.0
Diffstat (limited to 'dom/xbl/crashtests')
-rw-r--r--dom/xbl/crashtests/205735-1.xhtml27
-rw-r--r--dom/xbl/crashtests/223799-1.xul27
-rw-r--r--dom/xbl/crashtests/226744-1.xhtml35
-rw-r--r--dom/xbl/crashtests/232095-1.xul44
-rw-r--r--dom/xbl/crashtests/277523-1.xhtml24
-rw-r--r--dom/xbl/crashtests/277950-1.xhtml20
-rw-r--r--dom/xbl/crashtests/336744-1-inner.html6
-rw-r--r--dom/xbl/crashtests/336744-1.html9
-rw-r--r--dom/xbl/crashtests/336960-1-inner.xhtml29
-rw-r--r--dom/xbl/crashtests/336960-1.html13
-rw-r--r--dom/xbl/crashtests/342954-1.xhtml46
-rw-r--r--dom/xbl/crashtests/342954-2-xbl.xml19
-rw-r--r--dom/xbl/crashtests/342954-2.xhtml29
-rw-r--r--dom/xbl/crashtests/368276-1.xhtml33
-rw-r--r--dom/xbl/crashtests/368641-1.xhtml22
-rw-r--r--dom/xbl/crashtests/378521-1.xhtml18
-rw-r--r--dom/xbl/crashtests/382376-1.xhtml37
-rw-r--r--dom/xbl/crashtests/382376-2.xhtml27
-rw-r--r--dom/xbl/crashtests/397596-1.xhtml29
-rw-r--r--dom/xbl/crashtests/404125-1.xhtml29
-rw-r--r--dom/xbl/crashtests/406900-1.xul33
-rw-r--r--dom/xbl/crashtests/406904-1.xhtml25
-rw-r--r--dom/xbl/crashtests/406904-2.xhtml25
-rw-r--r--dom/xbl/crashtests/415192-1.xul22
-rw-r--r--dom/xbl/crashtests/415301-1.xul34
-rw-r--r--dom/xbl/crashtests/418133-1.xhtml22
-rw-r--r--dom/xbl/crashtests/420233-1.xhtml21
-rw-r--r--dom/xbl/crashtests/421997-1.xhtml27
-rw-r--r--dom/xbl/crashtests/432813-1-xbl.xml7
-rw-r--r--dom/xbl/crashtests/432813-1.xhtml3
-rw-r--r--dom/xbl/crashtests/454820-1.html17
-rw-r--r--dom/xbl/crashtests/460665-1.xhtml28
-rw-r--r--dom/xbl/crashtests/463511-1.xhtml9
-rw-r--r--dom/xbl/crashtests/464863-1.xhtml22
-rw-r--r--dom/xbl/crashtests/472260-1.xhtml35
-rw-r--r--dom/xbl/crashtests/477878-1.html4
-rw-r--r--dom/xbl/crashtests/492978-1.xul15
-rw-r--r--dom/xbl/crashtests/493123-1.xhtml34
-rw-r--r--dom/xbl/crashtests/495354-1.xhtml8
-rw-r--r--dom/xbl/crashtests/507628-1.xhtml12
-rw-r--r--dom/xbl/crashtests/507991-1.xhtml18
-rw-r--r--dom/xbl/crashtests/830614-1.xul24
-rw-r--r--dom/xbl/crashtests/895805-1.xhtml30
-rw-r--r--dom/xbl/crashtests/crashtests.list40
-rw-r--r--dom/xbl/crashtests/set-field-bad-this.xhtml31
45 files changed, 1069 insertions, 0 deletions
diff --git a/dom/xbl/crashtests/205735-1.xhtml b/dom/xbl/crashtests/205735-1.xhtml
new file mode 100644
index 000000000..bfc42773b
--- /dev/null
+++ b/dom/xbl/crashtests/205735-1.xhtml
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>Bug 205735</title>
+<xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl" xmlns="http://www.mozilla.org/xbl">
+<binding id="rd">
+<xbl:content xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl"><div><div>binding content<xbl:children/></div></div></xbl:content>
+ <implementation>
+ <constructor>
+ <![CDATA[
+ var x=document.getAnonymousNodes(this)[0];
+ x.removeChild(x.childNodes[0]);
+ ]]>
+ </constructor>
+ </implementation>
+</binding>
+</xbl:bindings>
+<style type="text/css">
+.chapter{-moz-binding:url(#rd);}
+</style>
+</head>
+<body>
+<div class="chapter">test</div>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/223799-1.xul b/dom/xbl/crashtests/223799-1.xul
new file mode 100644
index 000000000..455ac9e05
--- /dev/null
+++ b/dom/xbl/crashtests/223799-1.xul
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window
+ xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ >
+ <bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="foo">
+ <content><xul:box><xul:box><children/></xul:box></xul:box></content>
+ </binding>
+ <implementation>
+ <field name="box">document.getAnonymousNodes(this)[0]</field>
+ </implementation>
+ </bindings>
+ <html:style type="text/css">
+ <!-- CSS style rules for XBL bindings go here -->
+ <![CDATA[
+foo {
+ -moz-binding: url("#foo");
+}
+ ]]>
+ </html:style>
+ <!-- XUL application goes here -->
+
+ <foo><description>World</description></foo>
+</window>
diff --git a/dom/xbl/crashtests/226744-1.xhtml b/dom/xbl/crashtests/226744-1.xhtml
new file mode 100644
index 000000000..63915dbe8
--- /dev/null
+++ b/dom/xbl/crashtests/226744-1.xhtml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ xmlns:xbl="http://www.mozilla.org/xbl">
+
+ <xbl:bindings>
+ <xbl:binding id="rd">
+ <xbl:resources>
+<xbl:stylesheet src="data:text/html;charset=utf-8,"/>
+</xbl:resources>
+ <xbl:content>
+<xbl:children/>
+ </xbl:content>
+ </xbl:binding>
+
+ </xbl:bindings>
+
+ <head>
+ <title>testcase bug ?</title>
+
+ <style type="text/css">
+ .hoofdstuk {
+ -moz-binding: url(#rd);
+ }
+ </style>
+ </head>
+
+ <body>
+<div class="hoofdstuk">test
+</div>
+<div class="hoofdstuk">test
+</div>
+ </body>
+
+</html>
diff --git a/dom/xbl/crashtests/232095-1.xul b/dom/xbl/crashtests/232095-1.xul
new file mode 100644
index 000000000..bfd5476e6
--- /dev/null
+++ b/dom/xbl/crashtests/232095-1.xul
@@ -0,0 +1,44 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window
+ xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ xmlns:xbl="http://www.mozilla.org/xbl"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ >
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="serverpost_base">
+ <implementation>
+ <method name="getSuccessfulControls">
+ <parameter name="aNode"/>
+ <body><![CDATA[
+ dump("<html:input type="file"/> has not been tested yet! This may not work!!!\n");
+ ]]></body>
+ </method>
+
+ <method name='finalizeAndSubmit'>
+ <body>
+ return true;
+ </body>
+ </method>
+ </implementation>
+ </binding>
+</bindings>
+
+ <html:style type="text/css"><![CDATA[
+ @namespace xbl url("http://www.mozilla.org/xbl");
+ @namespace xul url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
+
+ xbl|bindings {
+ display: none;
+ }
+
+ xul|serverpost {
+ -moz-binding: url("#serverpost_base");
+ }
+
+ ]]></html:style>
+
+ <serverpost/>
+ <serverpost/>
+</window>
diff --git a/dom/xbl/crashtests/277523-1.xhtml b/dom/xbl/crashtests/277523-1.xhtml
new file mode 100644
index 000000000..74dc5d808
--- /dev/null
+++ b/dom/xbl/crashtests/277523-1.xhtml
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+<title>Testcase bug 277208 - appendChild to a hidden box from a binding crashes</title>
+
+<xbl:bindings><xbl:binding id="crash"><xbl:content>
+<span style="display:none"><xbl:children includes="span"/></span>
+</xbl:content></xbl:binding></xbl:bindings>
+
+<style type="text/css">
+#test{-moz-binding:url(#crash);}
+</style>
+</head>
+<body onload="init()">
+<span id="test"></span>
+<script>
+function init(){
+ document.getElementById('test').appendChild(document.createElement('span'));
+}
+</script>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/277950-1.xhtml b/dom/xbl/crashtests/277950-1.xhtml
new file mode 100644
index 000000000..eae6f1574
--- /dev/null
+++ b/dom/xbl/crashtests/277950-1.xhtml
@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>Testcase</title>
+<xbl:bindings xmlns="http://www.mozilla.org/xbl"
+ xmlns:xbl="http://www.mozilla.org/xbl">
+ <binding id="test">
+ <implementation>
+ <property/>
+ </implementation>
+ </binding>
+</xbl:bindings>
+<style type="text/css">
+ p{ -moz-binding: url(#test); }
+</style>
+</head>
+<body>
+<p></p>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/336744-1-inner.html b/dom/xbl/crashtests/336744-1-inner.html
new file mode 100644
index 000000000..4af1fbd52
--- /dev/null
+++ b/dom/xbl/crashtests/336744-1-inner.html
@@ -0,0 +1,6 @@
+<html><head>
+<title>Testcase bug 336744 - Crash when window gets destroyed during popuphiding event</title>
+</head><body>
+This should not crash Mozilla within 1 second<br>
+<iframe src="data:application/vnd.mozilla.xul+xml;charset=utf-8,%3C%3Fxml%20version%3D%221.0%22%3F%3E%0A%3C%3Fxml-stylesheet%20href%3D%22chrome%3A//global/skin%22%20type%3D%22text/css%22%3F%3E%0A%0A%3Cwindow%20xmlns%3Ahtml%3D%22http%3A//www.w3.org/1999/xhtml%22%0A%20%20%20%20%20%20%20%20xmlns%3D%22http%3A//www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%22%3E%0A%3Chtml%3Ascript%3E%0Adocument.addEventListener%28%22popuphiding%22%2C%20doe%2C%20true%29%3B%0Afunction%20doe%28e%29%20%7B%0Avar%20x%3D%20parent.document.getElementsByTagName%28%27iframe%27%29%5B0%5D%3B%0Ax.parentNode.removeChild%28x%29%3B%0A%7D%0AsetTimeout%28function%28%29%20%7B%20document.getElementsByTagName%28%22menupopup%22%29%5B0%5D.showPopup%28%29%3B%20%7D%2C%20800%29%3B%0AsetTimeout%28function%28%29%20%7B%20document.getElementsByTagName%28%22menupopup%22%29%5B0%5D.hidePopup%28%29%3B%20%7D%2C%201000%29%3B%0A%3C/html%3Ascript%3E%0A%3Cscript%3E%0A%0A%3C/script%3E%0A%3Cmenupopup%3E%0A%20%20%3Cmenuitem%20label%3D%22One%22/%3E%0A%3C/menupopup%3E%0A%3C/window%3E%0A"></iframe>
+</body></html> \ No newline at end of file
diff --git a/dom/xbl/crashtests/336744-1.html b/dom/xbl/crashtests/336744-1.html
new file mode 100644
index 000000000..48d5c1701
--- /dev/null
+++ b/dom/xbl/crashtests/336744-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="336744-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/336960-1-inner.xhtml b/dom/xbl/crashtests/336960-1-inner.xhtml
new file mode 100644
index 000000000..2064f8977
--- /dev/null
+++ b/dom/xbl/crashtests/336960-1-inner.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+ <script>
+ var x=document.createElementNS('http://www.w3.org/1999/xhtml','style');
+ document.documentElement.appendChild(x);
+ function doe(){
+ var y=document.getElementsByTagName('style')[0];
+ }
+ setTimeout(doe,500);
+ </script>
+
+ <style>
+ style {-moz-binding:url(#randomxbl);}
+ </style>
+
+ <bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="randomxbl">
+ <implementation>
+ <constructor>
+ var x= parent.document.getElementsByTagName('iframe')[0];
+x.parentNode.removeChild(x);
+ </constructor>
+ </implementation>
+ </binding>
+ </bindings>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/336960-1.html b/dom/xbl/crashtests/336960-1.html
new file mode 100644
index 000000000..0263d3095
--- /dev/null
+++ b/dom/xbl/crashtests/336960-1.html
@@ -0,0 +1,13 @@
+<html class="reftest-wait">
+<head>
+
+<title>Testcase bug 336960 - Crash when window gets destroyed when constructor of xbl is running</title>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+</head><body>
+This page should not crash Mozilla, you should see no iframe<br>
+<iframe src="./336960-1-inner.xhtml"></iframe>
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/xbl/crashtests/342954-1.xhtml b/dom/xbl/crashtests/342954-1.xhtml
new file mode 100644
index 000000000..dbaa15384
--- /dev/null
+++ b/dom/xbl/crashtests/342954-1.xhtml
@@ -0,0 +1,46 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+
+
+<head>
+
+<script>
+<![CDATA[
+
+function boo()
+{
+ s1 = document.getElementById("s1");
+ marq = document.getElementById("marq");
+ marqAnonymousSomething = document.getAnonymousNodes(marq)[0].childNodes[0];
+
+ removeNode(marqAnonymousSomething);
+ s1.appendChild(document.createElement("div"));
+}
+
+function removeNode(q1) { q1.parentNode.removeChild(q1); }
+
+]]>
+</script>
+
+<xbl:bindings id="marqueeBindings">
+ <xbl:binding id="marquee-horizontal-12">
+ <xbl:content>
+ <div>
+ <xbl:children/>
+ </div>
+ </xbl:content>
+ </xbl:binding>
+</xbl:bindings>
+
+</head>
+
+
+<body onload="boo()">
+
+<span id="s1">Span</span>
+
+<div id="marq" style="-moz-binding: url('#marquee-horizontal-12');">Marquee</div>
+
+</body>
+
+
+</html>
diff --git a/dom/xbl/crashtests/342954-2-xbl.xml b/dom/xbl/crashtests/342954-2-xbl.xml
new file mode 100644
index 000000000..3e73f1355
--- /dev/null
+++ b/dom/xbl/crashtests/342954-2-xbl.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+
+<bindings id="marqueeBindings"
+ xmlns="http://www.mozilla.org/xbl"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ xmlns:xbl="http://www.mozilla.org/xbl">
+
+ <binding id="marquee-horizontal-10">
+
+ <content>
+ <html:div>
+ <children/>
+ </html:div>
+ </content>
+
+ </binding>
+
+</bindings>
diff --git a/dom/xbl/crashtests/342954-2.xhtml b/dom/xbl/crashtests/342954-2.xhtml
new file mode 100644
index 000000000..4a250e31c
--- /dev/null
+++ b/dom/xbl/crashtests/342954-2.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boo()
+{
+ s1 = document.getElementById("s1");
+ marq = document.getElementById("marq");
+ marqAnonymousSomething = document.getAnonymousNodes(marq)[0].childNodes[0];
+
+ removeNode(marqAnonymousSomething);
+ s1.appendChild(document.createElement("div"));
+}
+
+function removeNode(q1) { q1.parentNode.removeChild(q1); }
+
+]]>
+</script>
+</head>
+
+<body onload="boo()">
+
+<span id="s1">Span</span>
+
+<div id="marq" style="-moz-binding: url('342954-2-xbl.xml#marquee-horizontal-10');">Marquee</div>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/368276-1.xhtml b/dom/xbl/crashtests/368276-1.xhtml
new file mode 100644
index 000000000..162494b2c
--- /dev/null
+++ b/dom/xbl/crashtests/368276-1.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ class="reftest-wait">
+
+<head>
+<script>
+
+function boom()
+{
+ var quote = document.getElementById("quote");
+ var para = document.getElementById("para");
+ var dialog = document.getElementById("dialog");
+ var e = document.getElementById("e");
+
+ dialog.appendChild(quote);
+ e.insertBefore(quote, para);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30)">
+
+<p>He said <q id="quote">J<xul:hbox/></q></p>
+
+<xul:dialog id="dialog"/>
+
+<div id="e"><p id="para">Foopy</p></div>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/368641-1.xhtml b/dom/xbl/crashtests/368641-1.xhtml
new file mode 100644
index 000000000..0b42ac813
--- /dev/null
+++ b/dom/xbl/crashtests/368641-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<head>
+<script>
+
+function boom()
+{
+ var yaz = document.getElementById("yaz");
+
+ document.body.appendChild(yaz);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+ <xul:tabs><span id="yaz"><xul:hbox><xul:popup/><xul:template/></xul:hbox></span></xul:tabs>
+</body>
+
+</html>
diff --git a/dom/xbl/crashtests/378521-1.xhtml b/dom/xbl/crashtests/378521-1.xhtml
new file mode 100644
index 000000000..3db89d49a
--- /dev/null
+++ b/dom/xbl/crashtests/378521-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="foo" extends="html:input">
+ <content>
+ Foo?
+ <children/>
+ </content>
+ </binding>
+</bindings>
+</head>
+
+<body>
+<div>Hi!</div>
+<div style="-moz-binding: url(#foo)">XXX</div>
+</body>
+
+</html> \ No newline at end of file
diff --git a/dom/xbl/crashtests/382376-1.xhtml b/dom/xbl/crashtests/382376-1.xhtml
new file mode 100644
index 000000000..55457f79e
--- /dev/null
+++ b/dom/xbl/crashtests/382376-1.xhtml
@@ -0,0 +1,37 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boom1()
+{
+ var c = document.getElementById("c");
+ c.style.MozBinding = "url('#foo')";
+
+ setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+ var v = document.getElementById("v");
+ v.parentNode.removeChild(v);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo">
+ <content>x x x x x <children/></content>
+</binding></bindings>
+
+</head>
+
+<body style="font-family: monospace; width: 10ch;" onload="setTimeout(boom1, 30);">
+
+<div style="background: lightblue; border: 1px solid blue; margin-bottom: 1em;">
+ <span id="c">y y<span id="v">Z<div/></span></span>
+</div>
+
+<div style="background: lightgreen; border: 1px solid green; height: 2000px;">s</div>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/382376-2.xhtml b/dom/xbl/crashtests/382376-2.xhtml
new file mode 100644
index 000000000..4e22b8f4e
--- /dev/null
+++ b/dom/xbl/crashtests/382376-2.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var v = document.getElementById("v");
+ v.parentNode.removeChild(v);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo">
+ <content>x x x x x <children/></content>
+</binding></bindings>
+
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<div style="background: lightblue; border: 1px solid blue; width: 300px">
+ <span style="-moz-binding: url(#foo);" >y y<span id="v">Z<div/></span></span>
+</div>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/397596-1.xhtml b/dom/xbl/crashtests/397596-1.xhtml
new file mode 100644
index 000000000..c7b562b52
--- /dev/null
+++ b/dom/xbl/crashtests/397596-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>Testcase bug - 100% cpu usage with binding setting position: fixed in constructor</title>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="b" inheritstyle="false">
+<content>
+<div xmlns="http://www.w3.org/1999/xhtml" style=" -moz-binding: url(#a);"/>
+<children/>
+</content>
+</binding>
+
+<binding id="a">
+<implementation>
+<constructor>
+ this.style.position='fixed';
+</constructor>
+</implementation>
+<content>
+<children xmlns="http://www.mozilla.org/xbl"/>
+</content>
+</binding>
+</bindings>
+
+</head>
+<body>
+<span style="-moz-binding:url();"></span>
+</body>
+</html> \ No newline at end of file
diff --git a/dom/xbl/crashtests/404125-1.xhtml b/dom/xbl/crashtests/404125-1.xhtml
new file mode 100644
index 000000000..46b0fd6f8
--- /dev/null
+++ b/dom/xbl/crashtests/404125-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="lc">
+ <content>
+ <xul:listcell> t <children/></xul:listcell>
+ </content>
+ </binding>
+</bindings>
+
+<script>
+function boom()
+{
+ var hbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox");
+ document.getElementById("vv").appendChild(hbox);
+}
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<div style="-moz-binding: url(#lc);" id="vv"></div>
+
+</body>
+
+</html>
diff --git a/dom/xbl/crashtests/406900-1.xul b/dom/xbl/crashtests/406900-1.xul
new file mode 100644
index 000000000..3b3dc1f87
--- /dev/null
+++ b/dom/xbl/crashtests/406900-1.xul
@@ -0,0 +1,33 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="boom();">
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="lit">
+ <content>
+ <children>
+ <xul:hbox/>
+ </children>
+ </content>
+ </binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var x = document.getElementById("x");
+ var anon = document.getAnonymousNodes(x)[0];
+ document.documentElement.removeChild(x);
+ document.documentElement.appendChild(x);
+ var hbox = document.createElement('hbox');
+ anon.appendChild(hbox);
+}
+
+</script>
+
+<hbox id="x" style="-moz-binding: url(#lit)" />
+
+</window>
diff --git a/dom/xbl/crashtests/406904-1.xhtml b/dom/xbl/crashtests/406904-1.xhtml
new file mode 100644
index 000000000..758fb04cd
--- /dev/null
+++ b/dom/xbl/crashtests/406904-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+
+<xbl:bindings xmlns="http://www.mozilla.org/xbl"><xbl:binding id="a"><xbl:content>
+<span>foo<xbl:children/></span>
+</xbl:content></xbl:binding></xbl:bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var s = document.getElementById("s");
+ var anon = document.getAnonymousNodes(s)[0];
+
+ while (anon.firstChild)
+ anon.removeChild(anon.firstChild);
+
+ document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3EQ%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><span id="s" style="-moz-binding: url('#a');"></span></body>
+</html>
diff --git a/dom/xbl/crashtests/406904-2.xhtml b/dom/xbl/crashtests/406904-2.xhtml
new file mode 100644
index 000000000..763672b3f
--- /dev/null
+++ b/dom/xbl/crashtests/406904-2.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+
+<xbl:bindings xmlns="http://www.mozilla.org/xbl"><xbl:binding id="a"><xbl:content>
+<span><span></span><xbl:children/></span>
+</xbl:content></xbl:binding></xbl:bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var s = document.getElementById("s");
+ var anon = document.getAnonymousNodes(s)[0];
+
+ while (anon.firstChild)
+ anon.removeChild(anon.firstChild);
+
+ document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3EQ%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><span id="s" style="-moz-binding: url('#a');"></span></body>
+</html>
diff --git a/dom/xbl/crashtests/415192-1.xul b/dom/xbl/crashtests/415192-1.xul
new file mode 100644
index 000000000..3795ca220
--- /dev/null
+++ b/dom/xbl/crashtests/415192-1.xul
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+<script type="text/javascript">
+
+function boom()
+{
+ var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+ var wizard = document.createElementNS(XUL_NS, "wizard");
+ var space = document.createTextNode(" ");
+ var hbox = document.createElementNS(XUL_NS, "hbox");
+ hbox.setAttribute("anonid", "Buttons");
+
+ document.documentElement.appendChild(wizard);
+ wizard.appendChild(space);
+ wizard.appendChild(hbox);
+ wizard.cloneNode(true);
+}
+
+</script>
+</window>
diff --git a/dom/xbl/crashtests/415301-1.xul b/dom/xbl/crashtests/415301-1.xul
new file mode 100644
index 000000000..cee274fcd
--- /dev/null
+++ b/dom/xbl/crashtests/415301-1.xul
@@ -0,0 +1,34 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="boom();">
+
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+
+<binding id="chil"><content><children/></content></binding>
+
+<binding id="ichil"><content>
+<xul:hbox style="-moz-binding: url(#chil)"><children/></xul:hbox>
+</content></binding>
+
+</bindings>
+
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("inner").removeChild(document.getElementById("lbb"));
+ document.getElementById("outer").style.MozBinding = "";
+}
+
+</script>
+
+
+<hbox id="outer" style="-moz-binding: url(#chil)"><hbox id="inner" style="-moz-binding: url(#ichil)"><listboxbody id="lbb" /></hbox></hbox>
+
+
+</window>
diff --git a/dom/xbl/crashtests/418133-1.xhtml b/dom/xbl/crashtests/418133-1.xhtml
new file mode 100644
index 000000000..ea821b76e
--- /dev/null
+++ b/dom/xbl/crashtests/418133-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ for(var p in document.getElementById("prefs")) {
+ }
+
+ for(var p in window) {
+ }
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<xul:preferences id="prefs" />
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/420233-1.xhtml b/dom/xbl/crashtests/420233-1.xhtml
new file mode 100644
index 000000000..8ec425075
--- /dev/null
+++ b/dom/xbl/crashtests/420233-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="ab"><content><html:span>a b<children/></html:span></content></binding>
+ <binding id="empty"><content></content></binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("td").style.MozBinding = "url('#empty')";
+}
+
+</script>
+
+</head>
+
+<body onload="boom();"><div style="width: 1px;"><span style="-moz-binding: url(#ab);"><td id="td"/></span></div></body>
+</html>
diff --git a/dom/xbl/crashtests/421997-1.xhtml b/dom/xbl/crashtests/421997-1.xhtml
new file mode 100644
index 000000000..4b91f00fc
--- /dev/null
+++ b/dom/xbl/crashtests/421997-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="g">
+ <implementation>
+ <constructor>
+ throw 3;
+ </constructor>
+ </implementation>
+ </binding>
+</bindings>
+
+<script type="text/javascript">
+
+function e()
+{
+ var listboxbody = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listboxbody");
+ document.getElementById("s").appendChild(listboxbody);
+}
+
+</script>
+</head>
+
+<body onerror="e();"><span id="s" style="-moz-binding: url(#g)"></span></body>
+
+</html>
diff --git a/dom/xbl/crashtests/432813-1-xbl.xml b/dom/xbl/crashtests/432813-1-xbl.xml
new file mode 100644
index 000000000..b2940e638
--- /dev/null
+++ b/dom/xbl/crashtests/432813-1-xbl.xml
@@ -0,0 +1,7 @@
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a">
+<content>
+<div xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: inherit;"/>
+</content>
+</binding>
+</bindings>
diff --git a/dom/xbl/crashtests/432813-1.xhtml b/dom/xbl/crashtests/432813-1.xhtml
new file mode 100644
index 000000000..586ac05f1
--- /dev/null
+++ b/dom/xbl/crashtests/432813-1.xhtml
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <box style="-moz-binding:url(432813-1-xbl.xml);"/>
+</window>
diff --git a/dom/xbl/crashtests/454820-1.html b/dom/xbl/crashtests/454820-1.html
new file mode 100644
index 000000000..31a8316f6
--- /dev/null
+++ b/dom/xbl/crashtests/454820-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html><head>
+ <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+ <title>Testcase for bug 454820</title>
+</head>
+<body>
+
+<p>PASS if Firefox does not crash.</p>
+<script type="text/javascript">
+var evObj = document.createEvent('UIEvents');
+evObj.initUIEvent( 'keypress', true, true, window, 1 );
+document.getElementsByTagName('p')[0].dispatchEvent(evObj);
+</script>
+
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/460665-1.xhtml b/dom/xbl/crashtests/460665-1.xhtml
new file mode 100644
index 000000000..2ea1f7212
--- /dev/null
+++ b/dom/xbl/crashtests/460665-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="a">
+ <content></content>
+ <implementation>
+ <field>t</field>
+ <field/>
+ <property/>
+ <property>
+ <getter>x</getter>
+ <setter>y</setter>
+ </property>
+ <method/>
+ <method>
+ <body/>
+ </method>
+ <method>
+ <body>a</body>
+ </method>
+ </implementation>
+ </binding>
+</bindings>
+</head>
+
+<body><span id="s" style="-moz-binding: url('#a');"></span></body>
+</html>
diff --git a/dom/xbl/crashtests/463511-1.xhtml b/dom/xbl/crashtests/463511-1.xhtml
new file mode 100644
index 000000000..a9fec3b50
--- /dev/null
+++ b/dom/xbl/crashtests/463511-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="foo"><content><listcell xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listcell></content></binding>
+</bindings>
+</head>
+
+<body onload="document.documentElement.innerHTML = 'x';"></body>
+</html>
diff --git a/dom/xbl/crashtests/464863-1.xhtml b/dom/xbl/crashtests/464863-1.xhtml
new file mode 100644
index 000000000..a665afc9c
--- /dev/null
+++ b/dom/xbl/crashtests/464863-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><qqq><children xmlns="http://www.mozilla.org/xbl"/></qqq></content></binding></bindings>
+
+<script type="text/javascript">
+// <![CDATA[
+
+function boom()
+{
+ var s = document.getElementById("s");
+ var o = document.getAnonymousNodes(s)[0];
+ (document.body).appendChild(s);
+ o.appendChild(document.createTextNode("F"));
+}
+
+// ]]>
+</script>
+</head>
+
+<body onload="boom();"><span id="s" style="-moz-binding: url(#foo)"></span></body>
+</html>
diff --git a/dom/xbl/crashtests/472260-1.xhtml b/dom/xbl/crashtests/472260-1.xhtml
new file mode 100644
index 000000000..49d5407d4
--- /dev/null
+++ b/dom/xbl/crashtests/472260-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="foo"><content><span xmlns="http://www.w3.org/1999/xhtml"/></content></binding>
+ <binding id="bar"><content></content></binding>
+</bindings>
+
+<script type="text/javascript">
+// <![CDATA[
+
+function boom()
+{
+ var bo = document.getElementById("bo");
+ var anon = SpecialPowers.wrap(document).getAnonymousNodes(bo)[0];
+
+ bo.style.MozBinding = "url(#bar)";
+
+ var fr = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ fr.setAttribute("src", "javascript:void 0;");
+ anon.appendChild(fr);
+
+ document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(boom, 100);">
+
+<span style="-moz-binding: url(#foo)" id="bo"></span>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/477878-1.html b/dom/xbl/crashtests/477878-1.html
new file mode 100644
index 000000000..17e4002b4
--- /dev/null
+++ b/dom/xbl/crashtests/477878-1.html
@@ -0,0 +1,4 @@
+<html>
+<head></head>
+<body><iframe style="display:none" src="data:text/html,<marquee>Marquee</marquee>" onload="this.style.display = '';"></iframe></body>
+</html>
diff --git a/dom/xbl/crashtests/492978-1.xul b/dom/xbl/crashtests/492978-1.xul
new file mode 100644
index 000000000..365ecfc9e
--- /dev/null
+++ b/dom/xbl/crashtests/492978-1.xul
@@ -0,0 +1,15 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a" inheritstyle="false">
+<content>
+<style xmlns="http://www.w3.org/1999/xhtml">
+window::after, box::after, bindings::after { content:"m"; float:right;}
+</style>
+</content>
+</binding>
+</bindings>
+
+<box style="-moz-binding:url(crash1.xul);overflow: scroll;"/>
+
+</window> \ No newline at end of file
diff --git a/dom/xbl/crashtests/493123-1.xhtml b/dom/xbl/crashtests/493123-1.xhtml
new file mode 100644
index 000000000..1c568ae15
--- /dev/null
+++ b/dom/xbl/crashtests/493123-1.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="a"><content></content></binding>
+ <binding id="b"><content><style xmlns="http://www.w3.org/1999/xhtml" style="display: none;">* { overflow: hidden; }</style><children xmlns="http://www.mozilla.org/xbl"/></content></binding>
+</bindings>
+
+<script type="text/javascript" style="display: none">
+
+function one()
+{
+ while (document.documentElement.firstChild) document.documentElement.removeChild(document.documentElement.firstChild)
+ document.documentElement.style.MozBinding = 'url("#a")';
+ setTimeout(two, 1);
+}
+
+function two()
+{
+ document.documentElement.style.MozBinding = 'url("#b")';
+ setTimeout(three, 1);
+}
+
+function three()
+{
+ document.documentElement.style.MozBinding = 'url("#a")';
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="one();"></body>
+</html>
diff --git a/dom/xbl/crashtests/495354-1.xhtml b/dom/xbl/crashtests/495354-1.xhtml
new file mode 100644
index 000000000..2e76fb846
--- /dev/null
+++ b/dom/xbl/crashtests/495354-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="x"><content><caption xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></caption></content></binding></bindings>
+</head>
+<body onload="document.getElementById('x').innerHTML = '9';">
+<span id="x" style="-moz-binding: url(#x)"><div></div></span>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/507628-1.xhtml b/dom/xbl/crashtests/507628-1.xhtml
new file mode 100644
index 000000000..a82871f71
--- /dev/null
+++ b/dom/xbl/crashtests/507628-1.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="b" inheritstyle="false">
+<content>
+<span xmlns="http://www.w3.org/1999/xhtml"/><span xmlns="http://www.w3.org/1999/xhtml"><embed style="display: block;" type="*"/></span>
+</content>
+</binding>
+</bindings>
+
+<div style="-moz-binding:url();"/>
+
+</html> \ No newline at end of file
diff --git a/dom/xbl/crashtests/507991-1.xhtml b/dom/xbl/crashtests/507991-1.xhtml
new file mode 100644
index 000000000..402e680ee
--- /dev/null
+++ b/dom/xbl/crashtests/507991-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<title>Crash [@ nsSprocketLayout::PopulateBoxSizes] with object and position:absolute;overflow:scroll in binding</title>
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a" inheritstyle="false">
+<content>
+<object xmlns="http://www.w3.org/1999/xhtml" style="display: table;"/>
+<div xmlns="http://www.w3.org/1999/xhtml" style="position: absolute;overflow: scroll; "/>
+</content>
+</binding>
+</bindings>
+</head>
+
+<body>
+<span style="-moz-binding:url()"></span>
+</body>
+</html> \ No newline at end of file
diff --git a/dom/xbl/crashtests/830614-1.xul b/dom/xbl/crashtests/830614-1.xul
new file mode 100644
index 000000000..f2f9bb352
--- /dev/null
+++ b/dom/xbl/crashtests/830614-1.xul
@@ -0,0 +1,24 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="document.getElementById('trigger');">
+ <box style="display: none">
+ <bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="crash">
+ <implementation>
+ <constructor>
+ // Fetch it
+ var obj = this.getElementsByTagName("box")[0];
+ // And make it preserve its wrapper. Note that this will happen
+ // while we're wrapping our box as the parent for id="trigger",
+ // so then we'll unwind and things will be bad.
+ if (obj) obj.expando = 5;
+ </constructor>
+ </implementation>
+ </binding>
+ </bindings>
+ <box style="-moz-binding:url(#crash);">
+ <box id="trigger"/>
+ </box>
+ </box>
+ <!-- Make sure we load our XBL before we try to run our test -->
+ <box style="-moz-binding:url(#crash);"/>
+</window>
diff --git a/dom/xbl/crashtests/895805-1.xhtml b/dom/xbl/crashtests/895805-1.xhtml
new file mode 100644
index 000000000..a6598de9c
--- /dev/null
+++ b/dom/xbl/crashtests/895805-1.xhtml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+<title>Bug 895805 - Adopting bound element to another document.</title>
+<xbl:bindings>
+ <xbl:binding id="crash">
+ <xbl:content>
+ <xbl:children />
+ Bug 895805 dummy binding
+ </xbl:content>
+ </xbl:binding>
+</xbl:bindings>
+<style type="text/css">
+#test {
+ -moz-binding:url(#crash);
+}
+</style>
+</head>
+<body onload="init()">
+<span id="test">Test</span>
+<script>
+function init() {
+ var boundElement = document.getElementById('test');
+ var otherDoc = document.implementation.createDocument('', '', null);
+ otherDoc.adoptNode(boundElement);
+}
+</script>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/crashtests.list b/dom/xbl/crashtests/crashtests.list
new file mode 100644
index 000000000..26424c7d8
--- /dev/null
+++ b/dom/xbl/crashtests/crashtests.list
@@ -0,0 +1,40 @@
+load 205735-1.xhtml
+load 223799-1.xul
+load 226744-1.xhtml
+load 232095-1.xul
+load 277523-1.xhtml
+load 277950-1.xhtml
+skip-if(Android) load 336744-1.html # bug 1268050
+load 336960-1.html
+load 342954-1.xhtml
+load 342954-2.xhtml
+load 368276-1.xhtml
+load 368641-1.xhtml
+load 378521-1.xhtml
+load 382376-1.xhtml
+load 382376-2.xhtml
+load 397596-1.xhtml
+load 404125-1.xhtml
+load 406900-1.xul
+load 406904-1.xhtml
+load 406904-2.xhtml
+load 415192-1.xul
+load 415301-1.xul
+load 418133-1.xhtml
+load 420233-1.xhtml
+load 421997-1.xhtml
+load 432813-1.xhtml
+load 454820-1.html
+load 460665-1.xhtml
+load 463511-1.xhtml
+load 464863-1.xhtml
+load 472260-1.xhtml
+load 477878-1.html
+load 492978-1.xul
+load 493123-1.xhtml
+load 495354-1.xhtml
+load 507628-1.xhtml
+load 507991-1.xhtml
+load 830614-1.xul
+load 895805-1.xhtml
+load set-field-bad-this.xhtml
diff --git a/dom/xbl/crashtests/set-field-bad-this.xhtml b/dom/xbl/crashtests/set-field-bad-this.xhtml
new file mode 100644
index 000000000..7b3dea03a
--- /dev/null
+++ b/dom/xbl/crashtests/set-field-bad-this.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+ <title>Gracefully handle setting a field on a bad |this|</title>
+
+ <bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="a">
+ <implementation>
+ <field name="f">17</field>
+ </implementation>
+ </binding>
+ </bindings>
+
+ <script type="application/javascript">
+ window.onload = function()
+ {
+ var bound = document.getElementById("bound");
+ try
+ {
+ Object.getPrototypeOf(bound).f = 42;
+ }
+ catch (e) { /* Throwing's fine, crashing isn't. */ }
+ };
+ </script>
+</head>
+
+<body>
+ <div id="bound" style="-moz-binding: url(#a)"></div>
+</body>
+
+</html>