Add m-esr52 at 52.6.0

46 files changed, 748 insertions, 0 deletions

diff --git a/dom/xul/crashtests/107518-1.xml b/dom/xul/crashtests/107518-1.xml
new file mode 100644
index 000000000..0fa41240a
--- /dev/null
+++ b/dom/xul/crashtests/107518-1.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>

+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> 

+<!DOCTYPE window>

+

+<window

+   id         = "xulnote-main-window"

+   xmlns      = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"

+   xmlns:html = "http://www.w3.org/1999/xhtml" 

+   onload     = "init();"

+>

+  <scrollbox>

+   <vbox style="background-color:white;">

+      <text value="hahaha  0"/>

+      <text value="hahaha  1"/>

+      <text value="hahaha  2"/>

+      <text value="hahaha  3"/>

+      <text value="hahaha  4"/>

+      <text value="hahaha  5"/>

+      <text value="hahaha  6"/>

+      <text value="hahaha  7"/>

+      <text value="hahaha  8"/>

+      <text value="hahaha  9"/>

+      <text value="hahaha 10"/>

+      <text value="hahaha 11"/>

+      <text value="hahaha 12"/>

+      <text value="hahaha 13"/>

+      <text value="hahaha 14"/>

+      <text value="hahaha 15"/>

+      <text value="hahaha 16"/>

+      <text value="hahaha 17"/>

+      <text value="hahaha 18"/>

+      <text value="hahaha 19"/>

+   </vbox>

+<scrollbar

+    id="identifier"

+    align="horizontal"

+    curpos="20"

+    maxpos="100"

+    increment="1"

+    pageincrement="10"/>

+

+  </scrollbox>

+

+ <script type="application/x-javascript">

+  <![CDATA[

+   function init()

+   {

+   }

+ ]]>

+ </script>

+

+</window>

diff --git a/dom/xul/crashtests/252448-1.xul b/dom/xul/crashtests/252448-1.xul
new file mode 100644
index 000000000..68813e740
--- /dev/null
+++ b/dom/xul/crashtests/252448-1.xul
@@ -0,0 +1,10 @@
+<?xml version="1.0"?>

+<?xml-stylesheet type="text/css" href="chrome://global/skin/"?>

+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"

+  onload="document.documentElement.firstChild.focus();">

+  <menulist>

+    <menupopup style="-moz-binding: none;">

+      <spacer/>

+    </menupopup>

+  </menulist>

+</window>

diff --git a/dom/xul/crashtests/253479-1.xul b/dom/xul/crashtests/253479-1.xul
new file mode 100644
index 000000000..5860d2200
--- /dev/null
+++ b/dom/xul/crashtests/253479-1.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>

+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"

+        xmlns:html="http://www.w3.org/1999/xhtml"

+>

+<html:div style="position:fixed;"/>

+</window>
\ No newline at end of file
diff --git a/dom/xul/crashtests/253479-2.xul b/dom/xul/crashtests/253479-2.xul
new file mode 100644
index 000000000..5af86f1e9
--- /dev/null
+++ b/dom/xul/crashtests/253479-2.xul
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>

+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

+  <x style="position:fixed;"/>

+</window>
\ No newline at end of file
diff --git a/dom/xul/crashtests/326204-1.xul b/dom/xul/crashtests/326204-1.xul
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/dom/xul/crashtests/326204-1.xul
diff --git a/dom/xul/crashtests/326644-1-inner.xul b/dom/xul/crashtests/326644-1-inner.xul
new file mode 100644
index 000000000..63ed9b721
--- /dev/null
+++ b/dom/xul/crashtests/326644-1-inner.xul
@@ -0,0 +1,34 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml"

+ title="Testcase bug 326644 - Crash when changing enumerated properties of objects in xul">

+

+<html:script><![CDATA[

+var timers=0;

+function doe(aObj, aNested, aCurrentTimer){

+var temp =0;

+for (var i in aObj) {

+try {

+if (typeof aObj[i] == 'object') {

+  if (aNested >= 19 || aObj[i] == window.location)

+    continue;

+  setTimeout(doe,500, aObj[i], ++aNested, timers);

+  timers++;

+}

+}

+catch(e){}

+try {

+ //if (temp == 68 && aNested == 21 && aCurrentTimer >= 116) {

+ // alert(i + '-'+ aObj[i]);

+ // return;

+ // }

+ aObj[i]= i;

+ temp+=1;

+}

+catch (e) {

+

+}

+}

+}

+var s=document.getElementsByTagName('window')[0];

+setTimeout(doe,100, s, 0);

+]]></html:script>

+</window>

diff --git a/dom/xul/crashtests/326644-1.html b/dom/xul/crashtests/326644-1.html
new file mode 100644
index 000000000..41f2cc67f
--- /dev/null
+++ b/dom/xul/crashtests/326644-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="326644-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/xul/crashtests/326644-2-inner.xul b/dom/xul/crashtests/326644-2-inner.xul
new file mode 100644
index 000000000..efbbc1c62
--- /dev/null
+++ b/dom/xul/crashtests/326644-2-inner.xul
@@ -0,0 +1,10 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml"

+ title="Testcase bug 326644 - Crash when changing enumerated properties of objects in xul">

+<html:script><![CDATA[

+function doe() {

+document.documentElement.boxObject.firstChild.hidden = true;

+document.documentElement.boxObject.firstChild.tooltip = 'test';

+}

+setTimeout(doe,100);

+]]></html:script>

+</window>

diff --git a/dom/xul/crashtests/326644-2.html b/dom/xul/crashtests/326644-2.html
new file mode 100644
index 000000000..68fd49c75
--- /dev/null
+++ b/dom/xul/crashtests/326644-2.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="326644-2-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/xul/crashtests/326864-1.xul b/dom/xul/crashtests/326864-1.xul
new file mode 100644
index 000000000..5515ca259
--- /dev/null
+++ b/dom/xul/crashtests/326864-1.xul
@@ -0,0 +1,34 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+
+<script>
+
+function getAnonymousNodes(e) {
+  return SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(e));
+}
+
+function init()
+{
+  var tt = document.getElementById("textbox");
+  var hb = getAnonymousNodes(tt)[0]; // hbox
+  var men = getAnonymousNodes(hb)[1]; // menupopup
+  var menitem = men.childNodes[0]; // menuitem
+  var hb2 = getAnonymousNodes(menitem)[1]; // hbox
+  var label2 = hb2.childNodes[0]; // label
+
+  men.menu = null;
+  label2.click();
+}
+
+window.addEventListener("load", init, false);
+
+</script>
+
+
+<textbox id="textbox"/>
+
+    
+</window>
diff --git a/dom/xul/crashtests/326875-1.xul b/dom/xul/crashtests/326875-1.xul
new file mode 100644
index 000000000..e4c3f1d6d
--- /dev/null
+++ b/dom/xul/crashtests/326875-1.xul
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+
+
+<script>
+
+
+function init() { 
+
+  var m = document.getElementById("m"); 
+  m.parentNode.removeChild(m);
+  m.controllers;
+};
+
+
+window.addEventListener("load", init, false);
+
+</script>
+
+
+
+<hbox id="m" />
+    
+</window>
diff --git a/dom/xul/crashtests/326881-1.xul b/dom/xul/crashtests/326881-1.xul
new file mode 100644
index 000000000..021da398a
--- /dev/null
+++ b/dom/xul/crashtests/326881-1.xul
@@ -0,0 +1,13 @@
+<?xml version="1.0"?>
<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>

<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

+
<script>

+
+function init() { 

+  var n1 = document.getElementsByTagName("textbox")[0];
+  n1.cloneNode(false);
+}
+
+window.addEventListener("load", init, false);
+
</script>

+
+<textbox/>
+
</window>
\ No newline at end of file
diff --git a/dom/xul/crashtests/329982-1.xhtml b/dom/xul/crashtests/329982-1.xhtml
new file mode 100644
index 000000000..43f374a57
--- /dev/null
+++ b/dom/xul/crashtests/329982-1.xhtml
@@ -0,0 +1,42 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+
+function init()
+{
+  var A = document.getElementById("z");
+  var B = A.nextSibling;
+  var C = B.nextSibling;
+  var P = A.parentNode;
+  
+  document.addEventListener("DOMNodeRemoved", fizzy, false);
+  P.removeChild(B);
+  document.removeEventListener("DOMNodeRemoved", fizzy, false);
+  
+  function fizzy()
+  {
+    document.removeEventListener("DOMNodeRemoved", fizzy, false); // avoid recursion
+    P.removeChild(A);
+  }
+    
+  document.documentElement.appendChild(C);
+}
+
+
+window.addEventListener("load", init, false);
+
+</script>
+
+</head>
+
+<body>
+
+<hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<menupopup y="x">
  <menuitem id="z"/>
  <menuitem/>
  <menuitem/>
</menupopup>

+
+</hbox>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/xul/crashtests/336096-1.xhtml b/dom/xul/crashtests/336096-1.xhtml
new file mode 100644
index 000000000..e15691d88
--- /dev/null
+++ b/dom/xul/crashtests/336096-1.xhtml
@@ -0,0 +1,41 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function init()
+{
+    var targetWindow = window.frames[0];
+    var targetDocument = targetWindow.document;
+    
+    targetDocument.body.appendChild(document.getElementById('rootish'));
+    targetDocument.designMode = 'on';
+
+    var r = targetDocument.createRange(); 
+    r.setStart(targetDocument.getElementById("start"), 0); 
+    r.setEnd  (targetDocument.getElementById("end"), 0); 
+    targetWindow.getSelection().addRange(r);
+
+    targetDocument.execCommand('bold', false, null);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(init, 200);">
+
+<iframe src="data:text/html," style="width: 95%; height: 500px;"></iframe>
+
+<div id="rootish">
+  <div id="start"></div>
+  <hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+    <hbox/>
+    <vbox id="end">
+      <hbox/>
+    </vbox>
+  </hbox>
+</div>
+
+</body>
+</html>
diff --git a/dom/xul/crashtests/344215-1.xul b/dom/xul/crashtests/344215-1.xul
new file mode 100644
index 000000000..6443c22d6
--- /dev/null
+++ b/dom/xul/crashtests/344215-1.xul
@@ -0,0 +1,7 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<observes/>
+
+<description>You should not see any assertions in a debug build.</description>
+
+</window>
\ No newline at end of file
diff --git a/dom/xul/crashtests/354611-1.html b/dom/xul/crashtests/354611-1.html
new file mode 100644
index 000000000..fe25de366
--- /dev/null
+++ b/dom/xul/crashtests/354611-1.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+
+var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+  var z = document.createElementNS(XUL_NS, "window");
+  document.body.appendChild(z);
+  z.setAttribute("hidechrome", "true");
+}
+
+</script>
+
+<body onload="boom();">
+
+</body>
+
+</html>
\ No newline at end of file
diff --git a/dom/xul/crashtests/360078-1.xhtml b/dom/xul/crashtests/360078-1.xhtml
new file mode 100644
index 000000000..a29087014
--- /dev/null
+++ b/dom/xul/crashtests/360078-1.xhtml
@@ -0,0 +1,42 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<style>
+<![CDATA[
+#baz { -moz-binding: url(360078-1xbl.xml#foo); }
+]]>
+</style>
+
+<script>
+<![CDATA[
+
+function stuff()
+{
+  var baz = document.getElementById("baz");
+  var count = 0;
+  
+  setTimeout(step, 30);
+  
+  function step()
+  {
+    ++count;
+    if (count < 15) {
+      baz.cloneNode(true);
+      setTimeout(step, 30);
+    }
+    else {
+      document.documentElement.removeAttribute("class");
+    }
+  }
+  
+}
+
+]]>
+</script>
+</head>
+<body onload="stuff()">
+
+<hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="baz"></hbox>
+
+</body>
+</html>
diff --git a/dom/xul/crashtests/360078-1xbl.xml b/dom/xul/crashtests/360078-1xbl.xml
new file mode 100644
index 000000000..c0f428c05
--- /dev/null
+++ b/dom/xul/crashtests/360078-1xbl.xml
@@ -0,0 +1,3 @@
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content>

+<a xmlns="http://www.w3.org/1999/xhtml" href="http://www.mozilla.org/" id="mlink">Foo<children xmlns="http://www.mozilla.org/xbl"/></a>

+</content></binding></bindings>

diff --git a/dom/xul/crashtests/363791-1.xul b/dom/xul/crashtests/363791-1.xul
new file mode 100644
index 000000000..08d2c99e4
--- /dev/null
+++ b/dom/xul/crashtests/363791-1.xul
@@ -0,0 +1,44 @@
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="setTimeout(boom, 30);" class="reftest-wait">
+
+<script>
+
+function boom()
+{
+  var tree = document.getElementById("tree");
+  var treecols = document.getElementById("treecols");
+  var treechildren = document.getElementById("treechildren");
+
+  tree.appendChild(treechildren); // no real change
+  
+  function boom2() {
+    treecols.parentNode.removeChild(treecols);
+    document.documentElement.removeAttribute("class");
+  }
+
+  setTimeout(boom2, 30);
+}
+
+</script>
+
+
+<tree rows="6" id="tree">
+
+  <treecols id="treecols">
+      <treecol id="firstname" label="First Name"/>
+  </treecols>
+
+  <treechildren id="treechildren">
+    <treeitem>
+      <treerow>
+        <treecell label="Bob"/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+
+</tree>
+
+
+</window>
diff --git a/dom/xul/crashtests/384740-1.xul b/dom/xul/crashtests/384740-1.xul
new file mode 100644
index 000000000..374f47c3d
--- /dev/null
+++ b/dom/xul/crashtests/384740-1.xul
@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom()">
+
+<script>
+
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+  var scrollbar = document.createElementNS(XUL_NS, 'scrollbar');
+  document.documentElement.appendChild(scrollbar);
+  var sbb = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(scrollbar))[0];
+  var action = document.createElementNS(XUL_NS, 'action');
+  action.setAttribute('datasources', "");
+  sbb.appendChild(action);
+}
+
+</script>
+
+</window>
diff --git a/dom/xul/crashtests/384877-1-inner.xul b/dom/xul/crashtests/384877-1-inner.xul
new file mode 100644
index 000000000..9bbfc07bd
--- /dev/null
+++ b/dom/xul/crashtests/384877-1-inner.xul
@@ -0,0 +1,15 @@
+<menupopup xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="d" popup="d">
+<script>
+function doe() {
+var d = document.getElementById('d');
+if (d.openPopup) {
+  d.openPopup(document.documentElement, 'before_start', 0, 0, false, false);
+//  alert(d.state);
+}
+  
+if (d.showPopup)
+  d.showPopup();
+}
+setTimeout(doe, 200);
+</script>
+</menupopup>
diff --git a/dom/xul/crashtests/384877-1.html b/dom/xul/crashtests/384877-1.html
new file mode 100644
index 000000000..28fd2fc58
--- /dev/null
+++ b/dom/xul/crashtests/384877-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="384877-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/xul/crashtests/386914-1-inner.xul b/dom/xul/crashtests/386914-1-inner.xul
new file mode 100644
index 000000000..909889d8b
--- /dev/null
+++ b/dom/xul/crashtests/386914-1-inner.xul
@@ -0,0 +1,10 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="a">
+
+<box id="b" observes="a"/>
+
+<html:script xmlns:html="http://www.w3.org/1999/xhtml">
+document.getElementById('b').addEventListener('DOMAttrModified', function(e) {document.removeChild(document.documentElement);}, true);
+setTimeout(function() {document.getElementById('a').setAttribute('tabindex', '1') ;}, 100);
+</html:script>
+
+</window>
\ No newline at end of file
diff --git a/dom/xul/crashtests/386914-1.html b/dom/xul/crashtests/386914-1.html
new file mode 100644
index 000000000..a8961339b
--- /dev/null
+++ b/dom/xul/crashtests/386914-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="386914-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/xul/crashtests/386947-1.xul b/dom/xul/crashtests/386947-1.xul
new file mode 100644
index 000000000..cf00d35f2
--- /dev/null
+++ b/dom/xul/crashtests/386947-1.xul
@@ -0,0 +1,12 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        style="background-color: red" onload="boom();">
+        
+<script><![CDATA[
+        
+function boom() {
+  document.documentElement.style.MozBinding = "url('#t')";
+}
+
+]]></script>
+</window>
diff --git a/dom/xul/crashtests/425821-1.xul b/dom/xul/crashtests/425821-1.xul
new file mode 100644
index 000000000..9764e64aa
--- /dev/null
+++ b/dom/xul/crashtests/425821-1.xul
@@ -0,0 +1,15 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"  onload="boom();">
+<script type="text/javascript">
+
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+  var wiz = document.createElementNS(XUL_NS, "wizard");
+  var btn = document.createElementNS(XUL_NS, "hbox");
+  btn.setAttribute("anonid", "Buttons");
+  wiz.appendChild(btn);
+  wiz.cloneNode(true);
+}
+
+</script>
+</window>
diff --git a/dom/xul/crashtests/428951-1.xul b/dom/xul/crashtests/428951-1.xul
new file mode 100644
index 000000000..024bc5d5c
--- /dev/null
+++ b/dom/xul/crashtests/428951-1.xul
@@ -0,0 +1,21 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<box>
+  <box style="background: initial;" id="f">
+    <box style="margin-top: -9999999px;"/>
+  </box>
+  <mathml:divergence>
+    <box/>
+  </mathml:divergence>
+  <mathml:moment command="f"/>
+</box>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+function init() {
+    var f = document.getElementsByTagName('mathml:divergence')[0];
+    window.addEventListener('DOMAttrModified',function() { f.parentNode.removeChild(f);}, true);
+    var x=document.getElementsByTagName('mathml:moment')[0];
+    x.parentNode.removeChild(x);
+}
+window.addEventListener("load", init, false);
+]]></script>
+</window>
diff --git a/dom/xul/crashtests/429085-1.xhtml b/dom/xul/crashtests/429085-1.xhtml
new file mode 100644
index 000000000..96e030fd4
--- /dev/null
+++ b/dom/xul/crashtests/429085-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+  var prefs = document.createElementNS(XUL_NS, "preferences");
+  var textbox = document.createElementNS(XUL_NS, "textbox");
+  textbox.setAttribute("onchange", "1");
+  prefs.appendChild(textbox);
+  prefs.cloneNode(true);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/xul/crashtests/431906-1-inner.xul b/dom/xul/crashtests/431906-1-inner.xul
new file mode 100644
index 000000000..367f621b2
--- /dev/null
+++ b/dom/xul/crashtests/431906-1-inner.xul
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<colgroup id="a" command="a">
+<box xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<box id="a" command="a"/>
+<box id="a" command="a"/>
+</box>
+</colgroup>
+<script><![CDATA[
+function doe(){
+document.getElementsByTagName('*')[1].setAttribute('id','');
+document.getElementsByTagName('*')[1].setAttribute('xmlns', '');
+document.getElementsByTagName('*')[3].setAttribute('id','');
+
+document.getElementsByTagName('*')[4].removeAttribute('xmlns');
+document.getElementsByTagName('*')[4].setAttribute('width', '1px');
+}
+setTimeout(doe,100);
+]]></script>
+</html>
\ No newline at end of file
diff --git a/dom/xul/crashtests/431906-1.html b/dom/xul/crashtests/431906-1.html
new file mode 100644
index 000000000..1639d3ea6
--- /dev/null
+++ b/dom/xul/crashtests/431906-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="431906-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/xul/crashtests/451311-1.xul b/dom/xul/crashtests/451311-1.xul
new file mode 100644
index 000000000..f07928b66
--- /dev/null
+++ b/dom/xul/crashtests/451311-1.xul
@@ -0,0 +1 @@
+<overlay xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><iframe/></overlay>
diff --git a/dom/xul/crashtests/461917-1.xhtml b/dom/xul/crashtests/461917-1.xhtml
new file mode 100644
index 000000000..15792f6f0
--- /dev/null
+++ b/dom/xul/crashtests/461917-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+<tabs xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onselect="#"><wizard/></tabs>
+</body>
+</html>
diff --git a/dom/xul/crashtests/468211-1.xul b/dom/xul/crashtests/468211-1.xul
new file mode 100644
index 000000000..b6364f1bf
--- /dev/null
+++ b/dom/xul/crashtests/468211-1.xul
@@ -0,0 +1,23 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" style="-moz-binding:url(#xbl2)" class="reftest-wait">
+<tooltip/>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">
+function doe() {
+document.getElementsByTagName('tooltip')[0].setAttribute('style', '-moz-binding:url(#xbl)');
+document.getElementsByTagName('tooltip')[0].setAttribute('onDOMAttrModified', 'this.focus()');
+document.documentElement.removeAttribute("class");
+}
+setTimeout(doe, 1);
+</script>
+
+<bindings xmlns="http://www.mozilla.org/xbl" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<binding id="xbl">
+<content>
+<xul:box onbroadcast="document.documentElement.setAttribute('a','a')" id="g"/>
+<xul:box onDOMAttrModified="document.documentElement.style.display = 'none'" observes="g"/>
+</content>
+</binding>
+
+<binding id="xbl2"></binding>
+</bindings>
+</window>
\ No newline at end of file
diff --git a/dom/xul/crashtests/468211-2-binding.xml b/dom/xul/crashtests/468211-2-binding.xml
new file mode 100644
index 000000000..6a9d14f13
--- /dev/null
+++ b/dom/xul/crashtests/468211-2-binding.xml
@@ -0,0 +1,12 @@
+<bindings xmlns="http://www.mozilla.org/xbl">
+
+<binding id="xbl">
+
+<content>
+<mrow xmlns="http://www.w3.org/1998/Math/MathML" id="f">
+<box observes="f" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/>
+</mrow>
+</content>
+
+</binding>
+</bindings>
\ No newline at end of file
diff --git a/dom/xul/crashtests/468211-2.xul b/dom/xul/crashtests/468211-2.xul
new file mode 100644
index 000000000..ca3104875
--- /dev/null
+++ b/dom/xul/crashtests/468211-2.xul
@@ -0,0 +1,10 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<html:div onDOMAttrModified="this.parentNode.removeChild(this)">
+<html:div/>
+<html:style>div {-moz-binding:url(468211-2-binding.xml#xbl);</html:style>
+</html:div>
+
+</window>
\ No newline at end of file
diff --git a/dom/xul/crashtests/468211-3.xul b/dom/xul/crashtests/468211-3.xul
new file mode 100644
index 000000000..4d221616e
--- /dev/null
+++ b/dom/xul/crashtests/468211-3.xul
@@ -0,0 +1,18 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

+<box style="-moz-binding:url(#xbl)"/>
+
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="xbl" inheritstyle="false">
+<content>
+<g xmlns="http://www.w3.org/2000/svg" onDOMAttrModified="document.removeChild(document.documentElement)" id="a"/>
+<box xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" observes="a"/>
+
+<children xmlns="http://www.mozilla.org/xbl"/>
+
+</content>
+</binding>
+</bindings>
+

+</window>
\ No newline at end of file
diff --git a/dom/xul/crashtests/495635-1.xul b/dom/xul/crashtests/495635-1.xul
new file mode 100644
index 000000000..3d42a10bb
--- /dev/null
+++ b/dom/xul/crashtests/495635-1.xul
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>

+<?xul-overlay href="extA1.xul"?>

+<?xul-overlay href="extB1.xul"?>

+<?xul-overlay href="extA2.xul"?>

+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

+<vbox id="browser-bottombox">

+</vbox>

+</window>

diff --git a/dom/xul/crashtests/509719-1-overlay.xul b/dom/xul/crashtests/509719-1-overlay.xul
new file mode 100644
index 000000000..880edc1cd
--- /dev/null
+++ b/dom/xul/crashtests/509719-1-overlay.xul
@@ -0,0 +1,3 @@
+<overlay xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <window id="win" removeelement="true"/>
+</overlay>
diff --git a/dom/xul/crashtests/509719-1.xul b/dom/xul/crashtests/509719-1.xul
new file mode 100644
index 000000000..4d869b323
--- /dev/null
+++ b/dom/xul/crashtests/509719-1.xul
@@ -0,0 +1,3 @@
+<?xul-overlay href="509719-1-overlay.xul"?>
+<window id="win" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+</window>
diff --git a/dom/xul/crashtests/509719-2-overlay.xul b/dom/xul/crashtests/509719-2-overlay.xul
new file mode 100644
index 000000000..fefbe194a
--- /dev/null
+++ b/dom/xul/crashtests/509719-2-overlay.xul
@@ -0,0 +1,8 @@
+<overlay xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <script>
+    if (document.getElementById("testnode")) {
+      document.loadOverlay(window.location.href.substr(0,window.location.href.lastIndexOf('/')+1)+'509719-2-overlay.xul', null);
+    }
+  </script>
+  <box xmlns="http://www.w3.org/1999/xhtml" id="testnode" removeelement="true"/>
+</overlay>
diff --git a/dom/xul/crashtests/509719-2.xul b/dom/xul/crashtests/509719-2.xul
new file mode 100644
index 000000000..5a64dc76e
--- /dev/null
+++ b/dom/xul/crashtests/509719-2.xul
@@ -0,0 +1,7 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window id="win" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <box id="testnode" onDOMAttrModified="this.parentNode.removeChild(this)"/>
+  <script>
+document.loadOverlay(window.location.href.substr(0,window.location.href.lastIndexOf('/')+1)+'509719-2-overlay.xul', null);
+  </script>
+</window>
diff --git a/dom/xul/crashtests/583230.xul b/dom/xul/crashtests/583230.xul
new file mode 100644
index 000000000..0361b619d
--- /dev/null
+++ b/dom/xul/crashtests/583230.xul
@@ -0,0 +1,23 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<richlistbox id="a" datasources="" template="d"/>
+<script><![CDATA[    
+function doe() {
+var node = document.getElementById('a');
+var b = node.builder;
+document.removeChild(document.documentElement);
+b.addResult({}, node);
+b.removeResult({});
+b.replaceResult({}, {}, node);
+b.resultBindingChanged({});
+try { b.addResult(null, null); } catch(ex) { }
+try { b.removeResult(null); } catch(ex) { }
+try { b.replaceResult(null, null, null); } catch(ex) { }
+try { b.resultBindingChanged(null); } catch(ex) { }
+try { b.getResultForId("empty"); } catch(ex) { }
+try { b.getResultForContent(node); } catch(ex) { }
+try { b.hasGeneratedContent(null, null); } catch(ex) { }
+}
+window.addEventListener("load", doe, false);
+]]></script>
+</window>
diff --git a/dom/xul/crashtests/crashtests.list b/dom/xul/crashtests/crashtests.list
new file mode 100644
index 000000000..737a32f60
--- /dev/null
+++ b/dom/xul/crashtests/crashtests.list
@@ -0,0 +1,33 @@
+load 107518-1.xml
+load 252448-1.xul
+load 253479-1.xul
+load 253479-2.xul
+load 326204-1.xul
+load 326644-1.html
+load 326644-2.html
+load 326864-1.xul
+load 326875-1.xul
+load 326881-1.xul
+load 329982-1.xhtml
+load 336096-1.xhtml
+load 344215-1.xul
+load 354611-1.html
+load 360078-1.xhtml
+load 363791-1.xul
+load 384740-1.xul
+load 384877-1.html
+load 386914-1.html
+load 386947-1.xul
+load 425821-1.xul
+load 428951-1.xul
+load 429085-1.xhtml
+load 431906-1.html
+load 451311-1.xul
+load 461917-1.xhtml
+load 468211-1.xul
+load 468211-2.xul
+load 468211-3.xul
+load 495635-1.xul
+load 509719-1.xul
+asserts(3) load 509719-2.xul # bug 909819
+load 583230.xul
diff --git a/dom/xul/crashtests/extA1.xul b/dom/xul/crashtests/extA1.xul
new file mode 100644
index 000000000..bfd2c0d44
--- /dev/null
+++ b/dom/xul/crashtests/extA1.xul
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE overlay SYSTEM "chrome://exta/locale/exta.dtd">
+<overlay id="extA1"
+         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <vbox id="browser-bottombox">
+    <statusbar id="extAbar" />
+  </vbox>
+</overlay>
diff --git a/dom/xul/crashtests/extA2.xul b/dom/xul/crashtests/extA2.xul
new file mode 100644
index 000000000..8d77a4995
--- /dev/null
+++ b/dom/xul/crashtests/extA2.xul
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE overlay SYSTEM "chrome://exta/locale/exta.dtd">
+<overlay id="extA2"
+         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <statusbar id="extAbar">
+    <statusbarpanel id="extApanel" label="panel 1">
+    </statusbarpanel>
+    <statusbarpanel id="extApanel2" label="panel 2" />
+  </statusbar>
+</overlay>
diff --git a/dom/xul/crashtests/extB1.xul b/dom/xul/crashtests/extB1.xul
new file mode 100644
index 000000000..9e2f5c418
--- /dev/null
+++ b/dom/xul/crashtests/extB1.xul
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<overlay id="extA2"
+         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <statusbar id="extAbar" removeelement="true" />
+</overlay>