Add m-esr52 at 52.6.0

author: Matt A. Tobin <mattatobin@localhost.localdomain> 2018-02-02 04:16:08 -0500
committer: Matt A. Tobin <mattatobin@localhost.localdomain> 2018-02-02 04:16:08 -0500
commit: 5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree: 10027f336435511475e392454359edea8e25895d /layout/generic/crashtests
parent: 49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
download: UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
662 files changed, 14741 insertions, 0 deletions
diff --git a/layout/generic/crashtests/1001233.html b/layout/generic/crashtests/1001233.html
new file mode 100644
index 000000000..ef5922122
--- /dev/null
+++ b/layout/generic/crashtests/1001233.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+li::-moz-list-bullet {
+  direction: rtl;
+  margin-right: 1em;
+}
+</style>
+</head>
+<body>
+Body
+<ul>
+<li>list item</li>
+</ul>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1001258-1.html b/layout/generic/crashtests/1001258-1.html
new file mode 100644
index 000000000..fdb852351
--- /dev/null
+++ b/layout/generic/crashtests/1001258-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+.r {
+    display: inline-block;
+    width: 40px;
+    height: 40px;
+}
+
+</style>
+</head>
+
+<body onload="document.getElementById('willFloatLeft').style.cssFloat = 'left';">
+    <div style="width: 100px; background: lightgray;">
+        <div class="r" style="background: red; width: 10px; float: left;"></div>
+        <div class="r" style="background: violet; width: 120px;" id="willFloatLeft" ></div>
+        <div style="clear: left;"></div>
+        <div class="r" style="background: blue;"></div>
+        <div class="r" style="background: yellow; float: right;"></div>
+        <div class="r" style="background: orange; position: relative;"></div>
+    </div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/1003441.xul b/layout/generic/crashtests/1003441.xul
new file mode 100644
index 000000000..998f5ca98
--- /dev/null
+++ b/layout/generic/crashtests/1003441.xul
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(boom,0,1)">
+
+<splitter style="all: inherit;">
+    <box/>
+    <box/>
+    <box/>
+    <box/>
+    <iframe id="a" src="aaa"/>
+</splitter>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">
+
+    <![CDATA[//<![CDATA[
+
+var doc = document;
+function boom(i) {
+  if (i>6)
+    return;
+  var x=doc.getElementsByTagName('*');
+  if (x[i] && x[i+1]) {
+    var temp = x[i+1].getAttribute('style');
+    x[i+1].setAttribute('style', x[i].getAttribute('style'));
+    x[i].setAttribute('style', temp);
+  } else { 
+    return;
+  }
+  i++;
+  setTimeout(boom,50,i);
+}
+
+//]]>
+
+    </script>
+
+    </window>
diff --git a/layout/generic/crashtests/1015562.html b/layout/generic/crashtests/1015562.html
new file mode 100644
index 000000000..8975e64f2
--- /dev/null
+++ b/layout/generic/crashtests/1015562.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+/*
+user_pref("layout.css.grid.enabled", true);
+*/
+
+function boom()
+{
+    document.getElementById("r").appendChild(document.createTextNode("B"));
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="r" style="display: grid;">A</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1015563-1.html b/layout/generic/crashtests/1015563-1.html
new file mode 100644
index 000000000..5acfb644d
--- /dev/null
+++ b/layout/generic/crashtests/1015563-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html style="display: inline-flex;">
+<body style="margin: -3642924795px; flex-grow: 1;"></body>
+</html>
diff --git a/layout/generic/crashtests/1015563-2.html b/layout/generic/crashtests/1015563-2.html
new file mode 100644
index 000000000..0245bb45c
--- /dev/null
+++ b/layout/generic/crashtests/1015563-2.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+  <div style="display: flex">
+    <div style="margin: -3642924795px; flex-grow: 1;"></div>
+  </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1015844.html b/layout/generic/crashtests/1015844.html
new file mode 100644
index 000000000..b1a19afe6
--- /dev/null
+++ b/layout/generic/crashtests/1015844.html
@@ -0,0 +1,25 @@
+<style>
+.multicol {
+  width: 500px;
+  -moz-column-width: 100px;
+  height: 100px;
+  position: relative;
+}
+#clear {
+  position: absolute;
+}
+.float {
+  height: 300px;
+}
+</style>
+<div class="multicol">
+<div class="float">
+<div class="multicol">
+<div id="clear">
+<div class="float">
+<div class="multicol">
+<div class="float">&nbsp;
+</div>
+<div class="multicol">
+<div class="multicol">
+<div class="float">a
diff --git a/layout/generic/crashtests/1032450.html b/layout/generic/crashtests/1032450.html
new file mode 100644
index 000000000..b09637e52
--- /dev/null
+++ b/layout/generic/crashtests/1032450.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+</head>
+
+<body style="display: -moz-inline-grid;">
+<div style="display: table;position: relative; float: left;">
+<button style="display: table-column-group;">
+ <iframe style="position: absolute;"></iframe>
+</button>
+</div>
+
+</body></html>
diff --git a/layout/generic/crashtests/1032613-1.svg b/layout/generic/crashtests/1032613-1.svg
new file mode 100644
index 000000000..c1e863980
--- /dev/null
+++ b/layout/generic/crashtests/1032613-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="tweak()">
+    <pattern>
+        <rect id="r" />
+    </pattern>
+    <script>
+      function tweak() {
+        document.getElementById("r").style.textDecoration = "underline";
+      }
+    </script>
+</svg>
diff --git a/layout/generic/crashtests/1032613-2.html b/layout/generic/crashtests/1032613-2.html
new file mode 100644
index 000000000..9ba11b314
--- /dev/null
+++ b/layout/generic/crashtests/1032613-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+  <script>
+    function tweak() {
+      document.getElementById("c").style.textShadow = "3px 3px gray";
+    }
+  </script>
+  <body onload="tweak()">
+    <div id="c">hello
+      <svg height="0">
+        <clipPath>
+          <path d=""/>
+        </clipPath>
+      </svg>
+    </div>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/1037903.html b/layout/generic/crashtests/1037903.html
new file mode 100644
index 000000000..3905967ec
--- /dev/null
+++ b/layout/generic/crashtests/1037903.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html style="-moz-column-width: calc(15px);">
+<body>
+<video></video><audio style="box-decoration-break: clone; display: block; direction: rtl;"></audio>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1039454-1.html b/layout/generic/crashtests/1039454-1.html
new file mode 100644
index 000000000..b049cbfa3
--- /dev/null
+++ b/layout/generic/crashtests/1039454-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML>
+<body>
+<div id="outer" style="width:200px; height:200px; background:blue; transform:translateY(10px)">
+  <div id="inner" style="width:200px; height:100px; background:yellow; transform:translateX(100px)">
+  </div>
+</div>
+<script>
+console.log(outer.getBoundingClientRect());
+outer.style.width = "400px";
+console.log(outer.getBoundingClientRect());
+outer.style.transform = "translateY(100px)";
+</script>
diff --git a/layout/generic/crashtests/1042489.html b/layout/generic/crashtests/1042489.html
new file mode 100644
index 000000000..0a1cdfa30
--- /dev/null
+++ b/layout/generic/crashtests/1042489.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html style="-moz-column-width: 1px;">
+<body style="-moz-column-width: 1px; box-decoration-break: clone;">
+<div>A B</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1054010-1.html b/layout/generic/crashtests/1054010-1.html
new file mode 100644
index 000000000..52557340a
--- /dev/null
+++ b/layout/generic/crashtests/1054010-1.html
@@ -0,0 +1,97 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <style type="text/css">
+      .flexRow {
+        display: flex;
+        flex-direction: row;
+        flex-wrap: wrap;
+        justify-content: center;
+      }
+
+      .flexColumn {
+        display: flex;
+        flex-direction: column;
+        justify-content: center;
+        flex-basis: 100%;
+      }
+
+      .flexBlock {
+        flex: 0;
+        display: flex;
+        flex-direction: column;
+        padding: 5px;
+        border: 1px solid blue;
+      }
+
+      .flexColumn > .flexBlock:last-child {
+        flex: 1;
+      }
+    </style>
+  </head>
+  <body>
+    <div class="flexRow">
+      <div class="flexColumn">
+        <div class="flexBlock">
+          Nested layout 1
+          <div class="flexRow">
+            <div class="flexColumn">
+              <div class="flexBlock">
+                Nested layout 2
+                <div class="flexRow">
+                  <div class="flexColumn">
+                    <div class="flexBlock">
+                      Nested layout 3
+                      <div class="flexRow">
+                        <div class="flexColumn">
+                          <div class="flexBlock">
+                            Nested layout 4
+                            <div class="flexRow">
+                              <div class="flexColumn">
+                                <div class="flexBlock">
+                                  Nested layout 5
+                                  <div class="flexRow">
+                                    <div class="flexColumn">
+                                      <div class="flexBlock">
+                                        Nested layout 6
+                                        <div class="flexRow">
+                                          <div class="flexColumn">
+                                            <div class="flexBlock">
+                                              Nested layout 7
+                                              <div class="flexRow">
+                                                <div class="flexColumn">
+                                                  <div class="flexBlock">
+                                                    Nested layout 8
+                                                    <div class="flexRow">
+                                                      <div class="flexColumn">
+                                                        <div class="flexBlock">
+                                                          Nested layout 9
+                                                        </div>
+                                                      </div>
+                                                    </div>
+                                                  </div>
+                                                </div>
+                                              </div>
+                                            </div>
+                                          </div>
+                                        </div>
+                                      </div>
+                                    </div>
+                                  </div>
+                                </div>
+                              </div>
+                            </div>
+                          </div>
+                        </div>
+                      </div>
+                    </div>
+                  </div>
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/1058954-1.html b/layout/generic/crashtests/1058954-1.html
new file mode 100644
index 000000000..bfd06016c
--- /dev/null
+++ b/layout/generic/crashtests/1058954-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+    <div style="display: -moz-grid-line;">
+        <div style="position: relative; direction: rtl;">
+            <div style="position: absolute;">
+            </div>
+        </div>
+    </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1134531.html b/layout/generic/crashtests/1134531.html
new file mode 100644
index 000000000..35ddbb060
--- /dev/null
+++ b/layout/generic/crashtests/1134531.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body onload="x.style.textTransform = 'capitalize';"><div id="x">b</div></body>
+</html>
diff --git a/layout/generic/crashtests/1134667.html b/layout/generic/crashtests/1134667.html
new file mode 100644
index 000000000..e33eb99dd
--- /dev/null
+++ b/layout/generic/crashtests/1134667.html
@@ -0,0 +1,2 @@
+x
+<ruby><x>
diff --git a/layout/generic/crashtests/1137723-1.html b/layout/generic/crashtests/1137723-1.html
new file mode 100644
index 000000000..a507ead85
--- /dev/null
+++ b/layout/generic/crashtests/1137723-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-print">
+<head> 
+	<meta charset="utf-8">
+<title>Testcase bug 1137723</title>
+
+<style>
+ .grid-comment{position:fixed;top:100%;}
+ a[href]:after{content:" (" attr(href) ")";}
+ </style>
+
+<style>
+@font-face { font-family: "slick"; src: url("non-existent-file.eot"); }
+</style>
+</head>
+
+<body>
+	<div style="height:7in"></div>
+	
+	<div class="grid-comment">Artikel teilen
+
+<div>
+<a href="https://www.facebook.com/sharer/sharer.php?u=http://www.stuttgarter-zeitung.de/inhalt.griechenland-hilfe-bundestag-stimmt-verlaengerung-zu.daa3baae-e17d-47e8-ad28-62eece0b4cfa.html">shares</a>
+<a href="https://twitter.com/share?text=Griechenland-Hilfe:Bundestag stimmt Verlängerung zu&amp;url=http://www.stuttgarter-zeitung.de/inhalt.griechenland-hilfe-bundestag-stimmt-verlaengerung-zu.daa3baae-e17d-47e8-ad28-62eece0b4cfa.html">tweets</a>
+</div>
+
+	</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1137723-2.html b/layout/generic/crashtests/1137723-2.html
new file mode 100644
index 000000000..ed8761a81
--- /dev/null
+++ b/layout/generic/crashtests/1137723-2.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-print">
+<head> 
+	<meta charset="utf-8">
+<title>Testcase bug 1137723</title>
+
+<style>
+ .grid-comment{position:fixed;top:100%;}
+ a[href]:after{content:" (" attr(href) ")";}
+ </style>
+
+<style>
+@font-face { font-family: "slick"; src: url("non-existent-file.eot"); }
+</style>
+</head>
+
+<body>
+	<div style="height:3in"></div>
+	
+	<div class="grid-comment">Artikel teilen
+
+<div>
+<a href="https://www.facebook.com/sharer/sharer.php?u=http://www.stuttgarter-zeitung.de/inhalt.griechenland-hilfe-bundestag-stimmt-verlaengerung-zu.daa3baae-e17d-47e8-ad28-62eece0b4cfa.html">shares</a>
+<a href="https://twitter.com/share?text=Griechenland-Hilfe:Bundestag stimmt Verlängerung zu&amp;url=http://www.stuttgarter-zeitung.de/inhalt.griechenland-hilfe-bundestag-stimmt-verlaengerung-zu.daa3baae-e17d-47e8-ad28-62eece0b4cfa.html">tweets</a>
+</div>
+
+	</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1140268-1.html b/layout/generic/crashtests/1140268-1.html
new file mode 100644
index 000000000..5e5510ba7
--- /dev/null
+++ b/layout/generic/crashtests/1140268-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset=utf-8>
+<script>
+function boom()
+{
+    var e = document.getElementsByTagName("mo")[0];
+    e.setAttribute("style", "position: absolute; top: 0px;");
+    document.documentElement.offsetHeight;
+    e.setAttribute("style", "position: absolute; top: 100px;");
+}
+</script>
+</head>
+<body onload="boom();">
+<math><mo>boom!</mo></math>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1145768.html b/layout/generic/crashtests/1145768.html
new file mode 100644
index 000000000..b8e6938db
--- /dev/null
+++ b/layout/generic/crashtests/1145768.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+
+<script>
+
+function boom()
+{
+  document.documentElement.offsetHeight;
+  var emptyTail = q.firstChild.splitText(2);
+  document.documentElement.offsetHeight;
+  emptyTail.splitText(0);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div style="width: 1px; height: 1px;"><div id="q" style="writing-mode: vertical-rl;">&#x07;R</div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/1146103.html b/layout/generic/crashtests/1146103.html
new file mode 100644
index 000000000..876e08bd6
--- /dev/null
+++ b/layout/generic/crashtests/1146103.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: ruby-text; margin: -47891343%"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1146107.html b/layout/generic/crashtests/1146107.html
new file mode 100644
index 000000000..661fa876c
--- /dev/null
+++ b/layout/generic/crashtests/1146107.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: ruby-base; margin: -47891343%"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1146114.html b/layout/generic/crashtests/1146114.html
new file mode 100644
index 000000000..5f148a167
--- /dev/null
+++ b/layout/generic/crashtests/1146114.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: ruby-text; margin: 288230376151711740%"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1153695.html b/layout/generic/crashtests/1153695.html
new file mode 100644
index 000000000..a7d7010d3
--- /dev/null
+++ b/layout/generic/crashtests/1153695.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+
+    <head>
+        <meta charset="UTF-8">
+        <script>
+            function boom()
+            {
+                document.documentElement.offsetHeight;
+                document.body.appendChild(document.getElementById("x"));
+                document.documentElement.offsetHeight;
+            }
+        </script>
+    </head>
+
+    <body style="-moz-column-count: 4;" onload="boom();">
+        <div style="float: left; height: 10px; width: 10px;">
+            <div id="x">
+                <div style="height: 80px;"></div>
+                <div style="float: left; height: 10px;"></div>
+            </div>
+        </div>
+    </body>
+
+</html>
diff --git a/layout/generic/crashtests/1156222.html b/layout/generic/crashtests/1156222.html
new file mode 100644
index 000000000..75dcc85d2
--- /dev/null
+++ b/layout/generic/crashtests/1156222.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div><span dir="rtl"></span><audio style="display: ruby-base;"></audio></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1156257.html b/layout/generic/crashtests/1156257.html
new file mode 100644
index 000000000..e58c1ba5d
--- /dev/null
+++ b/layout/generic/crashtests/1156257.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<!--
+user_pref("layout.css.grid.enabled", true);
+-->
+<script>
+function boom()
+{
+    document.documentElement.offsetHeight;
+    document.getElementById("g").firstChild.remove();
+}
+</script>
+</head>
+<body onload="boom();">
+<div style="display: grid;" id="g">a b<br></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1157011.html b/layout/generic/crashtests/1157011.html
new file mode 100644
index 000000000..c5fe133a8
--- /dev/null
+++ b/layout/generic/crashtests/1157011.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="display: inline-flex;"><div><div style="display: ruby-base;">f<br style="display: ruby-base-container;"></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/1169420-1.html b/layout/generic/crashtests/1169420-1.html
new file mode 100644
index 000000000..1ddbaea4f
--- /dev/null
+++ b/layout/generic/crashtests/1169420-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html style="writing-mode: vertical-lr;">
+    <body>
+        <div style="display: inline-flex;">
+            <div style="margin-inline-start: auto; margin-inline-end: 75px; direction: rtl;"></div>
+        </div>
+    </body>
+</html>
diff --git a/layout/generic/crashtests/1169420-2.html b/layout/generic/crashtests/1169420-2.html
new file mode 100644
index 000000000..e096ed7f9
--- /dev/null
+++ b/layout/generic/crashtests/1169420-2.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html style="writing-mode: vertical-lr;">
+    <body>
+        <div style="display: inline-flex;">
+            <div style="margin-bottom: auto; margin-top: 75px; direction: rtl;"></div>
+        </div>
+    </body>
+</html>
diff --git a/layout/generic/crashtests/1183431.html b/layout/generic/crashtests/1183431.html
new file mode 100644
index 000000000..e1d4c87c0
--- /dev/null
+++ b/layout/generic/crashtests/1183431.html
@@ -0,0 +1,6 @@
+<!DOCTYPE>
+<html>
+<body>
+<div style="writing-mode: vertical-lr;"><div style="position: fixed;"></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1221112-1.html b/layout/generic/crashtests/1221112-1.html
new file mode 100644
index 000000000..24e60a37b
--- /dev/null
+++ b/layout/generic/crashtests/1221112-1.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    .flexContainer {
+      display: flex;
+
+      /* Just for easier visualization: */
+      width: 600px;
+      justify-content: space-around;
+      border: 1px solid black;
+    }
+
+    .flexContainer:before {
+      position:absolute;
+      content:'before';
+    }
+    .flexContainer:after {
+      position:absolute;
+      content:'after'
+    }
+
+    .ordered-item {
+      position:relative;
+      order:5;
+    }
+    </style>
+  </head>
+  <body>
+    <div class="flexContainer">
+      <div class="ordered-item">ItemWithOrderSet
+        <!-- It's important that this remain unclosed, for some reason. -->
diff --git a/layout/generic/crashtests/1221112-2.html b/layout/generic/crashtests/1221112-2.html
new file mode 100644
index 000000000..2ae372a9d
--- /dev/null
+++ b/layout/generic/crashtests/1221112-2.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    .flexContainer {
+      display: flex;
+
+      /* Just for easier visualization: */
+      width: 600px;
+      justify-content: space-around;
+      border: 1px solid black;
+    }
+
+    .flexContainer:before {
+      position:absolute;
+      content:'before';
+    }
+    .flexContainer:after {
+      position:absolute;
+      content:'after'
+    }
+    </style>
+  </head>
+  <body>
+    <div class="flexContainer">
+      <div class="ordered-item">NormalFlexItem
+        <!-- It's important that this remain unclosed, for some reason. -->
diff --git a/layout/generic/crashtests/1221874-1.html b/layout/generic/crashtests/1221874-1.html
new file mode 100644
index 000000000..85d5bab3c
--- /dev/null
+++ b/layout/generic/crashtests/1221874-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    document.documentElement.offsetHeight;
+    document.body.style.textOrientation = "sideways";
+}
+
+</script>
+</head>
+<body onload="boom();" style="writing-mode: tb-rl; display: table;">Hello</body>
+</html>
diff --git a/layout/generic/crashtests/1222783.xhtml b/layout/generic/crashtests/1222783.xhtml
new file mode 100644
index 000000000..29cba980f
--- /dev/null
+++ b/layout/generic/crashtests/1222783.xhtml
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<!DOCTYPE html>
+<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
+<title>Test, bug 1222783</title>
+<body>
+
+
+<div id="container" style="width: 400px">
+  <div id="float1" style="float: left; height: 50px; width: 50px"></div>
+  <div id="float2" style="float: left; clear: left; height: 50px; width: 200px"></div>
+
+  <frameset cols="50%,50%">
+    <frame></frame>
+    <frame></frame>
+  </frameset>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1223568-1.html b/layout/generic/crashtests/1223568-1.html
new file mode 100644
index 000000000..8d09d878b
--- /dev/null
+++ b/layout/generic/crashtests/1223568-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<div style="display:flex; justify-content: stretch end">a
diff --git a/layout/generic/crashtests/1223568-2.html b/layout/generic/crashtests/1223568-2.html
new file mode 100644
index 000000000..6b44e485c
--- /dev/null
+++ b/layout/generic/crashtests/1223568-2.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<span style="justify-content: stretch end true; display: inline-flex;"><span style="writing-mode: vertical-rl; display: -moz-inline-box;">f</span></span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1224230-1.html b/layout/generic/crashtests/1224230-1.html
new file mode 100644
index 000000000..2743b43ae
--- /dev/null
+++ b/layout/generic/crashtests/1224230-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script>
+function boom() {
+  var div = document.querySelector("div");
+  div.offsetHeight;
+  div.style.fontSize = "120%";
+}
+</script>
+<body onload="boom()">
+<div style="float:left; position:relative;">
+  <div style="display:inline;">
+    <img src="foo.jpg" style="float:left;">
+    Lorem ipsum dolor sit amet, consectetur adipiscing elit. Etiam tortor nulla,
+eleifend eu eleifend eu, scelerisque sit amet sapien. Sed iaculis tellus ut quam
+pharetra consequat. Donec vitae nulla eu mi porta vulputate. In vestibulum, erat
+quis aliquam tempor, lectus augue viverra justo, vitae semper nibh neque tempor
+orci. Etiam luctus aliquet magna id pellentesque. Interdum et malesuada fames ac
+ante ipsum primis in faucibus. Suspendisse sit amet eros volutpat, convallis
+purus non, porta sapien. Duis fermentum at tortor nec ultricies. Morbi et lacus
+vitae risus elementum condimentum quis vitae justo. Cum sociis natoque penatibus
+et magnis dis parturient montes, nascetur ridiculus mus.<br><br>
diff --git a/layout/generic/crashtests/1225005.html b/layout/generic/crashtests/1225005.html
new file mode 100644
index 000000000..8c2164df2
--- /dev/null
+++ b/layout/generic/crashtests/1225005.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="padding: 810520769306363pt; -moz-column-count: 10; transform: translate(50%);"><div style="position: absolute;"></div></body>
+</html>
diff --git a/layout/generic/crashtests/1225118.html b/layout/generic/crashtests/1225118.html
new file mode 100644
index 000000000..833596243
--- /dev/null
+++ b/layout/generic/crashtests/1225118.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html style="width: -moz-fit-content; display: grid;">
+<body style="border: 1px solid green; padding-right: 56030668px;"></body>
+</html>
diff --git a/layout/generic/crashtests/1225376.html b/layout/generic/crashtests/1225376.html
new file mode 100644
index 000000000..f6e35be3e
--- /dev/null
+++ b/layout/generic/crashtests/1225376.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="display: inline-grid;">
+    <div style="display: flex; align-self: right safe;"></div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1225592.html b/layout/generic/crashtests/1225592.html
new file mode 100644
index 000000000..e4b5e6e6d
--- /dev/null
+++ b/layout/generic/crashtests/1225592.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="grid-template-columns: repeat(16384, auto); display: grid;"></div>
+<div style="grid-template-columns: repeat(9000, auto) repeat(9000, auto); display: grid;"></div>
+
+<div style="grid-template-columns: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ; display: grid;"></div>
+
+
+<div style='grid-template-areas: ". . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . "; display: grid;'></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1229437-1.html b/layout/generic/crashtests/1229437-1.html
new file mode 100644
index 000000000..2f1e66c31
--- /dev/null
+++ b/layout/generic/crashtests/1229437-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<style>
+  rbc { display: ruby-base-container; }
+</style>
+<div style="-moz-column-width: 1px">
+  <ruby><rbc></rbc><rb><div style="float: right"></div></rb></ruby>X
+</div>
diff --git a/layout/generic/crashtests/1229437-2.html b/layout/generic/crashtests/1229437-2.html
new file mode 100644
index 000000000..5b6ce6329
--- /dev/null
+++ b/layout/generic/crashtests/1229437-2.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<div style="-moz-column-width: 1px">
+  <ruby><rb></rb><rb><div style="float: right"></div></rb></ruby>X
+</div>
diff --git a/layout/generic/crashtests/1233191.html b/layout/generic/crashtests/1233191.html
new file mode 100644
index 000000000..6a6a06edf
--- /dev/null
+++ b/layout/generic/crashtests/1233191.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="width: 1px;"><fieldset style="display: grid;">y<legend></legend>x</fieldset></div>
+<div style="width: 1px;"><fieldset style="display: grid; overflow:hidden">y<legend></legend>x</fieldset></div>
+<div style="width: 1px;"><fieldset style="display: flex;">y<legend></legend>x</fieldset></div>
+<div style="width: 1px;"><fieldset style="display: flex; overflow:hidden">y<legend></legend>x</fieldset></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1272983-1.html b/layout/generic/crashtests/1272983-1.html
new file mode 100644
index 000000000..32a5a302e
--- /dev/null
+++ b/layout/generic/crashtests/1272983-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    div.foo {
+      margin-bottom: 50%;
+      display: -moz-box;
+      direction: rtl;
+    }
+  </style>
+</head>
+<body>
+  <div class="foo"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1272983-2.html b/layout/generic/crashtests/1272983-2.html
new file mode 100644
index 000000000..cff041891
--- /dev/null
+++ b/layout/generic/crashtests/1272983-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    div.foo {
+      padding-bottom: 50%;
+      display: -moz-box;
+      direction: rtl;
+    }
+  </style>
+</head>
+<body>
+  <div class="foo"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1275059.html b/layout/generic/crashtests/1275059.html
new file mode 100644
index 000000000..bfcbfa6be
--- /dev/null
+++ b/layout/generic/crashtests/1275059.html
@@ -0,0 +1,3 @@
+<div style="writing-mode: vertical-rl">
+<span style="text-combine-upright: all">
+<p>
diff --git a/layout/generic/crashtests/1278007.html b/layout/generic/crashtests/1278007.html
new file mode 100644
index 000000000..f4e9e40da
--- /dev/null
+++ b/layout/generic/crashtests/1278007.html
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<html><head>
+  <meta charset="utf-8">
+  <title></title>
+  <style type="text/css">
+.grid {
+  display: grid;
+}
+
+.sfb { align-self:baseline; }
+.slb { align-self:last baseline; }
+
+.vl { writing-mode: vertical-lr; }
+
+</style>
+</head>
+<body>
+
+<div class="grid"><input class="slb"></div>
+<div class="grid"><input class="sfb"></div>
+
+<div class="grid"><input class="slb vl"></div>
+<div class="grid"><input class="sfb vl"></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1278461-1.html b/layout/generic/crashtests/1278461-1.html
new file mode 100644
index 000000000..998f4d7d1
--- /dev/null
+++ b/layout/generic/crashtests/1278461-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252">
+<script>
+
+function boom()
+{
+    x.style.display = "contents";
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+    <div style="-moz-column-width: 1px;">
+        <div style="display: grid;">
+            <div style="height: 200px;">v</div>
+            <div style="height: 200px;" id="x">x</div>
+        </div>
+    </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1278461-2.html b/layout/generic/crashtests/1278461-2.html
new file mode 100644
index 000000000..291410cf7
--- /dev/null
+++ b/layout/generic/crashtests/1278461-2.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait"><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252"></head><body>
+<style>
+html{-moz-columns:50px auto}
+body{display:grid}
+div{height:200px}
+</style>
+<script>
+window.onload=function(){
+var b = document.body, v;
+b.appendChild(document.createElementNS('http://www.w3.org/1999/xhtml', 'div'));
+b.appendChild(document.createElementNS('http://www.w3.org/1999/xhtml', 'div'));
+b.appendChild(v = document.createElementNS('http://www.w3.org/1999/xhtml', 'div'));
+setTimeout(function(){
+  v.style.overflow = "-moz-scrollbars-none";
+  document.documentElement.className = '';
+  },100);
+};
+</script>
+
+<div></div><div></div><div style="overflow: hidden;"></div></body></html>
diff --git a/layout/generic/crashtests/1279814.html b/layout/generic/crashtests/1279814.html
new file mode 100644
index 000000000..71a9a6e3b
--- /dev/null
+++ b/layout/generic/crashtests/1279814.html
@@ -0,0 +1,35 @@
+<!-- 128 LRI / RLI -->
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+<!-- 64 PDI -->
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+<!-- 64 LRI / RLI -->
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
diff --git a/layout/generic/crashtests/1297427-non-equal-centers.html b/layout/generic/crashtests/1297427-non-equal-centers.html
new file mode 100644
index 000000000..e51c8df32
--- /dev/null
+++ b/layout/generic/crashtests/1297427-non-equal-centers.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<html>
+<meta charset="utf-8" />
+<style>
+#box {
+  border-radius: 335px;
+  width: 600px;
+  height: 401px;
+  border-style: dotted;
+  border-width: 41px 1px;
+}
+</style>
+<div id="box"></div>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/1304441.html b/layout/generic/crashtests/1304441.html
new file mode 100644
index 000000000..26d7dcdd6
--- /dev/null
+++ b/layout/generic/crashtests/1304441.html
@@ -0,0 +1,9 @@
+<details>
+<summary>
+<li>
+<style>
+summary{
+all:initial
+}
+:first-child::first-line
+{}
diff --git a/layout/generic/crashtests/1316649.html b/layout/generic/crashtests/1316649.html
new file mode 100644
index 000000000..cfef7d0f0
--- /dev/null
+++ b/layout/generic/crashtests/1316649.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<html>
+<script>
+addEventListener('DOMContentLoaded', function(){
+  obj1.style.writingMode = "rl";
+  obj2.style.writingMode = "rl";
+  //obj3.style.writingMode = "rl";
+  //obj4.style.writingMode = "rl";
+  obj5.style.writingMode = "rl";
+  sobj1.style.writingMode = "rl";
+  sobj2.style.writingMode = "rl";
+  //sobj3.style.writingMode = "rl";
+  //sobj4.style.writingMode = "rl";
+  sobj5.style.writingMode = "rl";
+});
+</script>
+<body style="writing-mode:tb">
+<button style="display:grid">
+<div id=obj1></div>
+</button>
+<button style="display:inline-grid">
+<div id=obj2></div>
+</button>
+<!--
+<button style="display:flex">
+<div id=obj3></div>
+</button>
+<button style="display:inline-flex">
+<div id=obj4></div>
+</button>
+-->
+<button style="columns:2">
+<div id=obj5></div>
+</button>
+
+<button style="display:grid; overflow:hidden">
+<div id=sobj1></div>
+</button>
+<button style="display:inline-grid; overflow:hidden">
+<div id=sobj2></div>
+</button>
+<!--
+<button style="display:flex; overflow:hidden">
+<div id=sobj3></div>
+</button>
+<button style="display:inline-flex; overflow:hidden">
+<div id=sobj4></div>
+</button>
+-->
+<button style="columns:2; overflow:hidden">
+<div id=sobj5></div>
+</button>
+</body>
+</html>
diff --git a/layout/generic/crashtests/225868-1-inner.html b/layout/generic/crashtests/225868-1-inner.html
new file mode 100644
index 000000000..db8fbc73c
--- /dev/null
+++ b/layout/generic/crashtests/225868-1-inner.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<style type="text/css">
+
+html { overflow: hidden; }
+
+</style>
+</head>
+<body onload="setTimeout(function(){document.write('<body onload=&quot;parent.document.documentElement.removeAttribute(\'class\');&quot;>2</body>'); document.close();}, 0);">
+
+1
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/225868-1.html b/layout/generic/crashtests/225868-1.html
new file mode 100644
index 000000000..55f221a7c
--- /dev/null
+++ b/layout/generic/crashtests/225868-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head></head>
+<body>
+<iframe src="225868-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/layout/generic/crashtests/255468.xhtml b/layout/generic/crashtests/255468.xhtml
new file mode 100644
index 000000000..62a859511
--- /dev/null
+++ b/layout/generic/crashtests/255468.xhtml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
+    "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+<head>
+<title>Iridescence</title>
+<style type="text/css" title="Crashme" disabled="disabled">
+ul.tree ul {
+  list-style-position: inside;
+}
+
+span.type:after {
+  content: ": ";
+}
+
+</style>
+</head>
+<body>
+<h1>Crash Test</h1>
+<table><tbody>
+<tr><td><ul class="struct tree"><li><span class="type">A</span> X<ul><li><span class="type">L</span> <var>Size</var></li><li><var>data</var></li></ul></li></ul></td></tr>
+</tbody></table>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/255982-1.html b/layout/generic/crashtests/255982-1.html
new file mode 100644
index 000000000..293886a2e
--- /dev/null
+++ b/layout/generic/crashtests/255982-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html class="reftest-print">
+<body>
+<style type="text/css">
+@page { size:5in 3in; margin:0.5in; }
+</style>
+<div style="width: 60%; float: left; height: 1.6in; ">a float</div>
+<div style="width: 60%; float: left; height: 1.6in; border:1px solid black; ">overlaps page break</div>
+<br />
+<div style="width: 60%; float: left;">3rd float</div>
+<div style="width: 60%; float: left;">4th float</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/255982-2.html b/layout/generic/crashtests/255982-2.html
new file mode 100644
index 000000000..6e45016d8
--- /dev/null
+++ b/layout/generic/crashtests/255982-2.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html class="reftest-print">
+<body>
+<div style="width: 60%; float: left; height: 1.6in; ">a float</div>
+<div style="width: 60%; float: left; height: 1.6in; border:1px solid black; ">overlaps page break</div>
+Some text
+<div style="width: 60%; float: left;">3rd float</div>
+<div style="width: 60%; float: left;">4th float</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/255982-3.html b/layout/generic/crashtests/255982-3.html
new file mode 100644
index 000000000..2f62ee88e
--- /dev/null
+++ b/layout/generic/crashtests/255982-3.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html class="reftest-print">
+<body>
+<div style="width: 60%; float: left; height: 1.6in; ">a float</div>
+<div style="width: 60%; float: left; height: 1.6in; border:1px solid black;">overlaps page break</div>
+Some text
+<div style="width: 60%; float: left;">3rd float</div>
+<div style="width: 60%; float: left;">4th float</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/255982-4.html b/layout/generic/crashtests/255982-4.html
new file mode 100644
index 000000000..7578e15b3
--- /dev/null
+++ b/layout/generic/crashtests/255982-4.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html class="reftest-print">
+<body>
+<style type="text/css">
+@page { size:5in 3in; margin:0.5in; }
+</style>
+<div style="width: 60%; float: left; height: 1.6in; ">a float</div>
+<div style="width: 60%; float: left; height: 1.6in; border:1px solid black; ">overlaps page break</div>
+This is enough text to trigger a line break.
+<div style="width: 60%; float: left;">3rd float</div>
+<div style="width: 60%; float: left;">4th float</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/25888-1.html b/layout/generic/crashtests/25888-1.html
new file mode 100644
index 000000000..bfe0f79e5
--- /dev/null
+++ b/layout/generic/crashtests/25888-1.html
@@ -0,0 +1,6 @@
+<title>Hang while developing patch for bug 25888</title>
+
+<div style="width:500px">
+<div style="float:left;width:600px;height:30px"></div>
+Hello
+</div>
diff --git a/layout/generic/crashtests/25888-2.html b/layout/generic/crashtests/25888-2.html
new file mode 100644
index 000000000..065218f31
--- /dev/null
+++ b/layout/generic/crashtests/25888-2.html
@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<title>Testcase for hang while developing bug 25888 (hit on www.flightaware.com)</title>
+
+<div style="border: solid 1em; width: 500px; height: 500px">
+  <div style="float:right; width: 300px; height: 3px;background:yellow;"></div>
+  <div style="float:left; width: 220px; height: 100px;background:aqua;"></div>
+  hi
+</div>
diff --git a/layout/generic/crashtests/264937-1.html b/layout/generic/crashtests/264937-1.html
new file mode 100644
index 000000000..fe0291481
--- /dev/null
+++ b/layout/generic/crashtests/264937-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html><head>
+    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+    <title>Testcase for bug 264937</title>
+
+<style type="text/css">
+        p:first-letter { 
+                background-color: lime;
+        }
+</style>
+
+</head>
+<body>
+
+	<p>"Test word</p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/265867-1.html b/layout/generic/crashtests/265867-1.html
new file mode 100644
index 000000000..e9da8c7f6
--- /dev/null
+++ b/layout/generic/crashtests/265867-1.html
@@ -0,0 +1,11 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<BODY STYLE="FLOAT:RIGHT;"></BODY>
+<MARQUEE STYLE="MARGIN:99999999999px;"></MARQUEE>
+<B STYLE="FLOAT:RIGHT; PADDING:99999999999px;"></B>
+</BODY>
+</HTML>
+
+
diff --git a/layout/generic/crashtests/265867-2.html b/layout/generic/crashtests/265867-2.html
new file mode 100644
index 000000000..c0ece7c27
--- /dev/null
+++ b/layout/generic/crashtests/265867-2.html
@@ -0,0 +1,3 @@
+<DIV STYLE="display:table-column-group;">
+  <DIV>Hello</DIV>
+</DIV>
diff --git a/layout/generic/crashtests/286491.html b/layout/generic/crashtests/286491.html
new file mode 100644
index 000000000..5b7e632f0
--- /dev/null
+++ b/layout/generic/crashtests/286491.html
@@ -0,0 +1,26 @@
+<html><head><title>Testcase bug 286491 - Crash with evil testcase with iframe and flash inside it</title>
+<style>a:hover{display:block;}</style>
+<script>
+function doe(){
+document.links[1].style.display='block';
+setTimeout(doe2,0);
+}
+function doe2(){
+document.links[1].style.display='';
+document.links[0].style.display='block';
+setTimeout(doe3,0);
+}
+function doe3(){
+document.links[0].style.display='';
+}
+</script>
+</head>
+<body onload="setInterval(doe,20)">
+<button onclick="doe()">doe()</button>
+<button onclick="setInterval(doe,20)">setInterval(doe,20)</button><br>
+<span><a href="#">link1</a><a href="#">link2</a></span>
+<br>
+<iframe src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%0A%3Cobject%20classid%3D%22clsid%3AD27CDB6E-AE6D-11cf-96B8-444553540000%22%20codebase%3D%22https%3A//download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab%23version%3D3%2C0%2C0%2C0%22%3E%3Cembed%20src%3D%22data%3Aapplication/x-shockwave-flash%2CFWS%2505d%2500%2500%2500%2560%2500%253E%2580%2500%2519%2500%2500%250C%2501%2500C%2502%25FF%25CC%2500%253F%250C%250E%2500%2500%2500%2501%2500%2511%2500%2505Arial%2500%2500%2502%2500%257F%2509%2523%2500%2500%2500%2502%2500g%25EC%252Fg%25EC%250F0%250D0%2501%2500%2518%2501%2500%2500%2500%25FF%2502%2500%2500%2500%2500%2500%2500%28%2500mytext%2500%2589%2506%2506%2501%2500%2502%2500%2514%2583%2516%2520%2540%2500%2500%2500%22%20pluginspage%3D%22http%3A//www.macromedia.com/go/getflashplayer%22%20type%3D%22application/x-shockwave-flash%22%20height%3D%2240%22%20width%3D%22100%22%3E%3C/object%3E%0A%3C/body%3E%3C/html%3E"></iframe>
+
+
+</body></html>
diff --git a/layout/generic/crashtests/289864-1.html b/layout/generic/crashtests/289864-1.html
new file mode 100644
index 000000000..ed8299a9a
--- /dev/null
+++ b/layout/generic/crashtests/289864-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<img src="289864-1.jpg" height="9999999" width="9999999" />
+</body>
+</html>
diff --git a/layout/generic/crashtests/289864-1.jpg b/layout/generic/crashtests/289864-1.jpg
new file mode 100644
index 000000000..6337fc571
--- /dev/null
+++ b/layout/generic/crashtests/289864-1.jpg
diff --git a/layout/generic/crashtests/295292-1.html b/layout/generic/crashtests/295292-1.html
new file mode 100644
index 000000000..1961db536
--- /dev/null
+++ b/layout/generic/crashtests/295292-1.html
@@ -0,0 +1,13 @@
+<html>
+ <head>
+  <style type="text/css">
+   div{overflow:hidden;}
+   div.menubar{position:fixed;width:100%;}
+  </style>
+ </head>
+ <body>
+  <div class="menubar">
+  </div>
+  if you can't see this, it crashed.
+ </body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/295292-2.html b/layout/generic/crashtests/295292-2.html
new file mode 100644
index 000000000..15d070f83
--- /dev/null
+++ b/layout/generic/crashtests/295292-2.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<title>Test Page</title>
+<style>
+#problem {
+  left:0;
+  top:0;
+  width: 0;
+  overflow: hidden;
+  position: fixed;
+}
+</style>
+</head>
+<body>
+
+<div id="problem">
+this should be hidden
+</div>
+
+page loaded
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/302260-1.html b/layout/generic/crashtests/302260-1.html
new file mode 100644
index 000000000..ce4e0fb7a
--- /dev/null
+++ b/layout/generic/crashtests/302260-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head>
+
+<style type="text/css">
+
+body {
+	text-indent:20px;
+}
+
+span {
+	float:right;
+}
+</style>
+</head>
+
+<body><span>What's Clicking Now</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/307979-1.html b/layout/generic/crashtests/307979-1.html
new file mode 100644
index 000000000..eb73d1215
--- /dev/null
+++ b/layout/generic/crashtests/307979-1.html
@@ -0,0 +1,27 @@
+<html class="reftest-wait">
+<head>
+
+<title>Crash testcase</title>
+
+<script>
+
+function foo()
+{
+  document.body.appendChild(document.createElement('frameset'));
+  setTimeout(bar, 30);
+}
+
+function bar()
+{
+  document.body.style.display = '-moz-groupbox';
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(foo, 30);">
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/309322-1.html b/layout/generic/crashtests/309322-1.html
new file mode 100644
index 000000000..438206174
--- /dev/null
+++ b/layout/generic/crashtests/309322-1.html
@@ -0,0 +1,56 @@
+<html><head>
+<title>Testcase1 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
+<style>
+*[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
+display:table-caption;
+}
+</style>
+<script>
+function doe(i){
+var x=document.body.getElementsByTagName('*');
+var xl=x.length;i=i+1;
+x[i-1].removeAttribute('toggle_style');
+if ((i)<xl) x[i].setAttribute('toggle_style','toggle_style');
+if ((i+1)<xl) {x[i+1].setAttribute('toggle_style1','toggle_style');
+x[i].removeAttribute('toggle_style1');
+}
+if ((i+2)<xl) {x[i+2].setAttribute('toggle_style2','toggle_style');
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+3)<xl) {x[i+3].setAttribute('toggle_style3','toggle_style');
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+4)<xl) {x[i+4].setAttribute('toggle_style4','toggle_style');
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+4)==xl) {
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+3)==xl) {
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+2)==xl) {
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+1)==xl) {
+x[i].removeAttribute('toggle_style1');
+}
+setTimeout(doe,20,i);
+}
+
+function doe2(){
+var x=document.links[0].cloneNode(true);
+document.links[0].appendChild(x);
+}
+</script>
+</head>
+<body onload="doe(1)">
+<button onclick="doe(1)">Clicking on this button should not crash Mozilla</button>
+<table><tbody><tr><td> 
+
+<span><br></span>
+<a href="#">Galloway<span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span></a>
+
+</td></tr></tbody></table>
+
+</body></html>
diff --git a/layout/generic/crashtests/309322-2.html b/layout/generic/crashtests/309322-2.html
new file mode 100644
index 000000000..f1450a047
--- /dev/null
+++ b/layout/generic/crashtests/309322-2.html
@@ -0,0 +1,56 @@
+<html><head>
+<title>Testcase2 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
+<style>
+*[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
+display:table-caption;
+}
+</style>
+<script>
+function doe(i){
+var x=document.body.getElementsByTagName('*');
+var xl=x.length;i=i+1;
+x[i-1].removeAttribute('toggle_style');
+if ((i)<xl) x[i].setAttribute('toggle_style','toggle_style');
+if ((i+1)<xl) {x[i+1].setAttribute('toggle_style1','toggle_style');
+x[i].removeAttribute('toggle_style1');
+}
+if ((i+2)<xl) {x[i+2].setAttribute('toggle_style2','toggle_style');
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+3)<xl) {x[i+3].setAttribute('toggle_style3','toggle_style');
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+4)<xl) {x[i+4].setAttribute('toggle_style4','toggle_style');
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+4)==xl) {
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+3)==xl) {
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+2)==xl) {
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+1)==xl) {
+x[i].removeAttribute('toggle_style1');
+}
+setTimeout(doe,20,i);
+}
+
+function doe2(){
+var x=document.links[0].cloneNode(true);
+document.links[0].appendChild(x);
+}
+</script>
+</head>
+<body onload="doe(1)">
+<button onclick="doe(1)">Clicking on this button should not crash Mozilla</button>
+<table><tbody><tr><td> 
+
+<span><br></span>
+<a href="#">Galloway<span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span></a>
+
+</td></tr></tbody></table>
+
+</body></html>
diff --git a/layout/generic/crashtests/309322-3.html b/layout/generic/crashtests/309322-3.html
new file mode 100644
index 000000000..96148ffe4
--- /dev/null
+++ b/layout/generic/crashtests/309322-3.html
@@ -0,0 +1,48 @@
+<html><head>
+<title>Testcase3 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
+<style>
+*[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
+display:table-caption;
+}
+</style>
+<script>
+function doe(i){
+var x=document.body.getElementsByTagName('*');
+var xl=x.length;i=i+1;
+x[i-1].removeAttribute('toggle_style');
+x[i].setAttribute('toggle_style','toggle_style');
+if ((i+1)<xl) {x[i+1].setAttribute('toggle_style1','toggle_style');
+x[i].removeAttribute('toggle_style1');
+}
+if ((i+2)<xl) {x[i+2].setAttribute('toggle_style2','toggle_style');
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+3)<xl) {x[i+3].setAttribute('toggle_style3','toggle_style');
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+4)<xl) {x[i+4].setAttribute('toggle_style4','toggle_style');
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+4)==xl) {
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+3)==xl) {
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+2)==xl) {
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+1)==xl) {
+x[i].removeAttribute('toggle_style1');
+}
+setTimeout(doe,20,i);
+}
+
+
+</script></head><body onload="doe(3)">
+<button onclick="doe(3)">Clicking on this button should not create extra "Galloway" text</button>
+<table><tbody><tr><td> 
+<span><br></span>
+<a href="#">Galloway</a>
+</td></tr></tbody></table>
+</body></html>
diff --git a/layout/generic/crashtests/309322-4.html b/layout/generic/crashtests/309322-4.html
new file mode 100644
index 000000000..9b9b6a5bb
--- /dev/null
+++ b/layout/generic/crashtests/309322-4.html
@@ -0,0 +1,48 @@
+<html><head>
+<title>Testcase4 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
+<style>
+*[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
+display:table-caption;
+}
+</style>
+<script>
+function doe(i){
+var x=document.body.getElementsByTagName('*');
+var xl=x.length;i=i+1;
+x[i-1].removeAttribute('toggle_style');
+x[i].setAttribute('toggle_style','toggle_style');
+if ((i+1)<xl) {x[i+1].setAttribute('toggle_style1','toggle_style');
+x[i].removeAttribute('toggle_style1');
+}
+if ((i+2)<xl) {x[i+2].setAttribute('toggle_style2','toggle_style');
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+3)<xl) {x[i+3].setAttribute('toggle_style3','toggle_style');
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+4)<xl) {x[i+4].setAttribute('toggle_style4','toggle_style');
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+4)==xl) {
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+3)==xl) {
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+2)==xl) {
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+1)==xl) {
+x[i].removeAttribute('toggle_style1');
+}
+setTimeout(doe,20,i);
+}
+
+
+</script></head><body onload="doe(3)">
+<button onclick="doe(3)">Clicking on this button and then closing this tab/window should not crash Mozilla</button>
+<table><tbody><tr><td> 
+<span><br></span>
+<a href="#"><img src="data:image/gif;base64,R0lGODlhAQABAIABAAD/AP///ywAAAAAAQABAAACAkQBADs="></a>
+</td></tr></tbody></table>
+</body></html>
diff --git a/layout/generic/crashtests/310556-1.xhtml b/layout/generic/crashtests/310556-1.xhtml
new file mode 100644
index 000000000..260960008
--- /dev/null
+++ b/layout/generic/crashtests/310556-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+
+<style type="text/css">
+
+span:before { 
+  content: "";
+}
+
+</style>
+
+</head>
+
+<body>
+
+X<span/>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/321224.xul b/layout/generic/crashtests/321224.xul
new file mode 100644
index 000000000..a21c4b7b0
--- /dev/null
+++ b/layout/generic/crashtests/321224.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <tabpanels>
+   <nativescrollbar/> 
+ </tabpanels>
+</window>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/322780-1.xul b/layout/generic/crashtests/322780-1.xul
new file mode 100644
index 000000000..71eb058ce
--- /dev/null
+++ b/layout/generic/crashtests/322780-1.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <label>
+    <foopy style="float:left;" />
+  </label>
+</window>
diff --git a/layout/generic/crashtests/323381-1.html b/layout/generic/crashtests/323381-1.html
new file mode 100644
index 000000000..3f2c17f9c
--- /dev/null
+++ b/layout/generic/crashtests/323381-1.html
@@ -0,0 +1 @@
+<iframe src="data:text/html,foo" width="808080"></iframe>
diff --git a/layout/generic/crashtests/323381-2.html b/layout/generic/crashtests/323381-2.html
new file mode 100644
index 000000000..ab28e6bb5
--- /dev/null
+++ b/layout/generic/crashtests/323381-2.html
@@ -0,0 +1 @@
+<div style="width: 808080px;">foo</div>
diff --git a/layout/generic/crashtests/323386-1.html b/layout/generic/crashtests/323386-1.html
new file mode 100644
index 000000000..437b9a16b
--- /dev/null
+++ b/layout/generic/crashtests/323386-1.html
@@ -0,0 +1 @@
+<TEXTAREA COLS="381762666">
+\ No newline at end of file
diff --git a/layout/generic/crashtests/323389-1.html b/layout/generic/crashtests/323389-1.html
new file mode 100644
index 000000000..591ebb539
--- /dev/null
+++ b/layout/generic/crashtests/323389-1.html
@@ -0,0 +1,7 @@
+<HTML>
+<HEAD>
+<meta http-equiv="Content-Type" content="text/html; charset=GB18030">
+
+<TEXTAREA>
+ ������ 
+
diff --git a/layout/generic/crashtests/323389-2.html b/layout/generic/crashtests/323389-2.html
new file mode 100644
index 000000000..74fea379a
--- /dev/null
+++ b/layout/generic/crashtests/323389-2.html
@@ -0,0 +1,8 @@
+<html><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=ISO-8859-1"></head>
+
+<body>
+
+blocking&#8209;aviary1.0.8
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/323493-1.html b/layout/generic/crashtests/323493-1.html
new file mode 100644
index 000000000..12e14f6a8
--- /dev/null
+++ b/layout/generic/crashtests/323493-1.html
@@ -0,0 +1,16 @@
+<html><head><style>
+* {
+  display: table;
+  position: absolute;
+}
+</style>
+
+</head>
+
+<body>
+<table><tbody><tr><td>One</td><td>Two</td></tr><tr><td>Three</td><td>Four</td></tr></tbody></table>
+<ul><li>One</li><li>Two</li><li>Three</li></ul>
+
+<p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Typi non habent claritatem insitam; est usus legentis in iis qui facit eorum claritatem. Investigationes demonstraverunt lectores legere me lius quod ii legunt saepius. Claritas est etiam processus dynamicus, qui sequitur mutationem consuetudium lectorum. Mirum est notare quam littera gothica, quam nunc putamus parum claram, anteposuerit litterarum formas humanitatis per seacula quarta decima et quinta decima. Eodem modo typi, qui nunc nobis videntur parum clari, fiant sollemnes in futurum.</p>
+
+</body></html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/323495-1.html b/layout/generic/crashtests/323495-1.html
new file mode 100644
index 000000000..fcffe0166
--- /dev/null
+++ b/layout/generic/crashtests/323495-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+
+<style>
+select { width: 1000000px; }
+</style>
+
+</head>
+
+<body>
+
+<select><option>a</option></select>
+
+</body></html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/324318-1.html b/layout/generic/crashtests/324318-1.html
new file mode 100644
index 000000000..2c1d0cdbb
--- /dev/null
+++ b/layout/generic/crashtests/324318-1.html
@@ -0,0 +1,29 @@
+<script>
+
+var tr;
+
+function init() { 
+
+  tr = one.document.getElementsByTagName("tr")[0];
+  tr = document.adoptNode(tr);
+  document.getElementsByTagName("html")[0].appendChild(tr);
+
+  setTimeout(
+    function(){
+      var frameset = document.getElementsByTagName("frameset")[0];
+      document.getElementsByTagName("td")[0].appendChild(frameset);
+      document.documentElement.removeAttribute("class");
+    }, 
+    100);
+  
+}
+
+window.addEventListener("load", init, false);
+document.documentElement.setAttribute("class", "reftest-wait");
+
+</script>
+
+<frameset resizable="yes" rows="50%,*">
+ <frame name="one" src="data:text/html,<table border='1'><tr><td>tdc</td></tr></table>">
+ <frame name="two" src="data:text/html,">
+</frameset>
diff --git a/layout/generic/crashtests/328946-1.html b/layout/generic/crashtests/328946-1.html
new file mode 100644
index 000000000..75345ce5d
--- /dev/null
+++ b/layout/generic/crashtests/328946-1.html
@@ -0,0 +1 @@
+<table>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/331284-1.xhtml b/layout/generic/crashtests/331284-1.xhtml
new file mode 100644
index 000000000..fc1bf1847
--- /dev/null
+++ b/layout/generic/crashtests/331284-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+  <hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+    <ttt style="float: right">
+      <img src="../../../testing/crashtest/images/animfish.gif" xmlns="http://www.w3.org/1999/xhtml" />
+    </ttt>
+  </hbox>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/331292.html b/layout/generic/crashtests/331292.html
new file mode 100644
index 000000000..dfc4cf60b
--- /dev/null
+++ b/layout/generic/crashtests/331292.html
@@ -0,0 +1,258 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en"><head>
+<title>Testcase bug 331292 - Loading page causes freeze, no Talkback, both WindowsXP & Linux</title>
+<style>
+.floatA{
+	width:110px;
+	float: left;
+	border:1px solid red;
+}
+.floatB{
+	width:430px;
+	float: left;
+	border:1px solid green;
+}
+.floatC{
+	width:430px;
+	float: left;
+	border:1px solid blue;
+}
+.floatclear{
+clear: both;
+}
+</style>
+</head>
+<body>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+ 
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+ 
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear"></div>
+</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
+</body></html>
diff --git a/layout/generic/crashtests/334105-1.xhtml b/layout/generic/crashtests/334105-1.xhtml
new file mode 100644
index 000000000..6b5c135f8
--- /dev/null
+++ b/layout/generic/crashtests/334105-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<style>
+html { width: 2em; border: 1px solid red; }
+body { display: inline; }
+.padded { padding: 1em; border: 1px solid black; }
+#float1 { background: lightgreen; }                    /* float is added to this one dynamically */
+#float2 { float: right; background: lightblue; }
+</style>
+
+<script>
+
+function foo()
+{
+  document.getElementById("float1").style.cssFloat = "right";
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", function() { setTimeout(foo, 30); }, false);
+
+</script>
+
+</head>
+
+<body>
+
+  X
+  <span id="float1">FFFFFF</span>
+  <span id="float2">GGGGGG</span>
+  <span class="padded"/>
+
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/334107-1.xhtml b/layout/generic/crashtests/334107-1.xhtml
new file mode 100644
index 000000000..3e6b25a5c
--- /dev/null
+++ b/layout/generic/crashtests/334107-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<p style="letter-spacing: -2em;">Foo</p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/334147-1.xhtml b/layout/generic/crashtests/334147-1.xhtml
new file mode 100644
index 000000000..549015722
--- /dev/null
+++ b/layout/generic/crashtests/334147-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<style>
+.x:first-letter { }
+.x { direction: rtl; }
+</style>
+
+</head>
+
+<body>
+
+<p class="x">2 3</p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/334148-1.xhtml b/layout/generic/crashtests/334148-1.xhtml
new file mode 100644
index 000000000..dab508324
--- /dev/null
+++ b/layout/generic/crashtests/334148-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+* { float: right; }
+* { display: list-item; }
+</style>
+</head>
+
+<body>
+
+<menupopup xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" />
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/334602-1.html b/layout/generic/crashtests/334602-1.html
new file mode 100644
index 000000000..2bb820ebc
--- /dev/null
+++ b/layout/generic/crashtests/334602-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<title>Testcase bug 334602 - ASSERTION: Reparenting something that has no usable parent? Shouldn't happen!: 'Not Reached'</title>
+<style>
+html::first-line { }
+html::before { content:"This should not give an assertion in Mozilla";}
+</style>
+</head>
+<body>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/337412-1.html b/layout/generic/crashtests/337412-1.html
new file mode 100644
index 000000000..25a7cce61
--- /dev/null
+++ b/layout/generic/crashtests/337412-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<style>
+
+.columns {
+	-moz-column-width: 20em;
+	-moz-column-gap: 3em;
+}
+
+
+</style>
+
+</head>
+
+<body>
+
+<div class="columns">
+
+<ul>
+<li>XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX!</li>
+</ul>
+
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/337883-1.html b/layout/generic/crashtests/337883-1.html
new file mode 100644
index 000000000..d89466a51
--- /dev/null
+++ b/layout/generic/crashtests/337883-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<html class="reftest-wait">
+<head>
+<script>
+
+function foop()
+{
+  document.getElementById("xxx").style.height = "10%";
+  document.getElementById("yyy").style.position = "relative";
+  
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", function(){setTimeout(foop, 30)}, false);
+
+</script>
+</head>
+
+<body>--<a id="yyy"><IMG align="right"></a><br id="xxx">==</body></html>
+
diff --git a/layout/generic/crashtests/337883-2.html b/layout/generic/crashtests/337883-2.html
new file mode 100644
index 000000000..1334bf46b
--- /dev/null
+++ b/layout/generic/crashtests/337883-2.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<html class="reftest-wait">
+<head>
+<style id="s"></style>
+<script>
+
+function foop()
+{
+  var stylesheet = document.getElementById("s");
+  stylesheet.textContent = "#xxx { height: 10%; } #yyy { position: relative; }";
+  
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", function(){setTimeout(foop, 30)}, false);
+
+</script>
+</head>
+
+<body>--<a id="yyy"><IMG align="right"></a><br id="xxx">==</body></html>
+
diff --git a/layout/generic/crashtests/339769-1.html b/layout/generic/crashtests/339769-1.html
new file mode 100644
index 000000000..a9772e34a
--- /dev/null
+++ b/layout/generic/crashtests/339769-1.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function foo()
+{
+  var div = document.getElementById("div");
+  div.parentNode.removeChild(div);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(foo, 0);">
+
+  <div id="div" style="display: inline;"><p>x</p></div>
+
+  <iframe src='data:text/html,<html><body><input value="q">'></iframe>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/342322-1.html b/layout/generic/crashtests/342322-1.html
new file mode 100644
index 000000000..9d0d08261
--- /dev/null
+++ b/layout/generic/crashtests/342322-1.html
@@ -0,0 +1,28 @@
+<html class="reftest-wait">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var q1 = document.getElementById("q1");
+  var q2 = document.getElementById("q2");
+  
+  q1.style.cssFloat = "right"
+  q2.style.cssFloat = "right"
+
+  setTimeout(function(){
+    q1.style.cssFloat = "none";
+    document.documentElement.removeAttribute("class");
+  }, 30);
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 30);">
+  <b id="q1">AAA</b>
+  <b id="q2">BBB</b>
+</body>
+</html>
diff --git a/layout/generic/crashtests/343206-1.xhtml b/layout/generic/crashtests/343206-1.xhtml
new file mode 100644
index 000000000..5be6fc2a6
--- /dev/null
+++ b/layout/generic/crashtests/343206-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<style id="sty">
+html::before { 
+  content: "before text"; 
+  float: right; 
+}
+</style>
+
+<script>
+function boom()
+{ 
+  var sty = document.getElementById("sty"); 
+  sty.appendChild(document.createTextNode(" "));
+  document.documentElement.removeAttribute("class");
+}
+  
+setTimeout(boom, 30);
+</script>
+
+</html>
diff --git a/layout/generic/crashtests/344557-1.html b/layout/generic/crashtests/344557-1.html
new file mode 100644
index 000000000..0ed806257
--- /dev/null
+++ b/layout/generic/crashtests/344557-1.html
@@ -0,0 +1,32 @@
+<html class="reftest-wait"><head>
+<title>Testcase bug 344557 - [columns] Crash [@ nsLineBox::DeleteLineList] with moz-column-count and generated content</title>
+<script>
+function removestyles(i){
+document.getElementsByTagName('div')[0].removeAttribute('style');
+document.documentElement.removeAttribute("class");
+}
+window.resizeTo(1440, 600);
+setTimeout(removestyles,200);
+</script>
+
+<style>
+ div::first-line, ul::first-line { text-transform: uppercase;  font-size:110%;}
+sub::after, div::after { content:"anonymous text"; border:3px solid black;text-transform: uppercase;}
+sub::before, div::before { content:"before text"; font-size: 10px;}
+</style>
+</head>
+<body>
+
+<ul>
+  <sub>t</sub>
+  <div style="-moz-column-count: 3;">
+    <sub>t-column-councode&gt;text</sub>
+    <div style="-moz-column-count: 3;"><sub>text styletttmoztcolumntcountt 2;ttext</sub>
+      <div>
+        <sub>text</sub>
+      </div>
+    </div>
+  </div>
+</ul>
+
+</body></html>
diff --git a/layout/generic/crashtests/345139-1.xhtml b/layout/generic/crashtests/345139-1.xhtml
new file mode 100644
index 000000000..1dfbe8f23
--- /dev/null
+++ b/layout/generic/crashtests/345139-1.xhtml
@@ -0,0 +1,53 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head style="display: none ! important;">
+
+<style>
+#a { direction: rtl; }
+#a { position: absolute; }
+#a { right: 5px; }
+#a { left: -10em; }
+#b { direction: ltr; }
+#b { width: 10%; }
+#b { display: -moz-inline-block; }
+#c { display: -moz-inline-block; }
+#e { display: -moz-inline-block; }
+#d { display: -moz-inline-block; }
+#d { padding: 5px 10px; }
+#d dl, #d dt, #d dd { display: inline; }
+#d dt { margin-left: 5px; }
+#d dd { margin-left: 2px; }
+#d dd:before { content: "="; }
+</style>
+
+<style id="newstyle"></style>
+<script>
+function change()
+{
+  document.getElementById("newstyle").appendChild(document.createTextNode("#b { white-space: pre; }"));
+  document.documentElement.removeAttribute("class");
+}
+</script>
+
+</head>
+
+<body onload="setTimeout(change, 1);">
+
+<div id="a"><div id="b">
+
+<div id="c"></div>
+
+<div id="d">   
+<dl>
+<dt>0</dt><dd><span id="e">Accessibility Statement</span></dd>
+<dt>1</dt><dd>Main Page</dd>
+<dt>2</dt><dd>Skip to Content</dd>
+<dt>3</dt><dd>List of Posts</dd>
+<dt>4</dt><dd>Search</dd>
+<dt>p</dt><dd>Previous (individual/monthly archive page)</dd>
+</dl>
+</div>
+
+</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/345617-1.html b/layout/generic/crashtests/345617-1.html
new file mode 100644
index 000000000..03de63958
--- /dev/null
+++ b/layout/generic/crashtests/345617-1.html
@@ -0,0 +1,8 @@
+<html>
+<body style="line-height: 30760827em;">
+
+x
+<p>y
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/348510-1.html b/layout/generic/crashtests/348510-1.html
new file mode 100644
index 000000000..6e00e71f1
--- /dev/null
+++ b/layout/generic/crashtests/348510-1.html
@@ -0,0 +1,7 @@
+<marquee>
+<a>
+<object>
+<dd>
+<form>
+</object>
+aaaaaaa
diff --git a/layout/generic/crashtests/348510-2.html b/layout/generic/crashtests/348510-2.html
new file mode 100644
index 000000000..8f8c998cf
--- /dev/null
+++ b/layout/generic/crashtests/348510-2.html
@@ -0,0 +1,7 @@
+<listing>
+<marquee>
+<aa>
+<object>
+<fieldset>
+</object>
+a
+\ No newline at end of file
diff --git a/layout/generic/crashtests/348887-1-inner.html b/layout/generic/crashtests/348887-1-inner.html
new file mode 100644
index 000000000..f78cd351f
--- /dev/null
+++ b/layout/generic/crashtests/348887-1-inner.html
@@ -0,0 +1,21 @@
+<html><head>
+<style>
+blockquote::first-letter {float: right;}
+</style>
+<title>
+Testcase bug - Crash [@ nsFrameList::DestroyFrames] on reload with -moz-column-count, -moz-inline-block and blockquote::first-letter
+</title>
+</head>
+<body>
+This page should not crash on reload
+<div style=" -moz-column-count: 2;">
+<span style="display: table;"></span>
+<blockquote style="display: -moz-inline-block;">anonymous text</blockquote>
+</div>
+
+<script>
+document.location.reload();
+</script>
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/348887-1.html b/layout/generic/crashtests/348887-1.html
new file mode 100644
index 000000000..b865b4beb
--- /dev/null
+++ b/layout/generic/crashtests/348887-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="348887-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/layout/generic/crashtests/348991-1.xhtml b/layout/generic/crashtests/348991-1.xhtml
new file mode 100644
index 000000000..a4e312d7a
--- /dev/null
+++ b/layout/generic/crashtests/348991-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <body>
+    <div style="width: 10em; display: -moz-grid;">
+      <select><option>A</option></select>
+      <select><option>B</option></select>
+    </div>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/350370.html b/layout/generic/crashtests/350370.html
new file mode 100644
index 000000000..61a230f86
--- /dev/null
+++ b/layout/generic/crashtests/350370.html
@@ -0,0 +1,42 @@
+<html><head>
+<title>Testcase bug 350370 - Crash [@ nsStyleContext::FindChildWithRules] with ::first-line, appending rows and table-cells, etc</title>
+<style>
+#b td::first-line { font-size:110%;}
+nobr::first-line { font-size:110%;}
+
+#b td::after { content:"anonymous text"; }
+nobr::after{ content:"anonymous text"; }
+
+#b::before { content:"before text";}
+#b td::before { content:"before text";}
+</style>
+</head>
+<body>
+<table style="display: table-row;"></table><nobr style="display: list-item; -moz-column-count: 2;">
+<table id="b" style="display: inline;"></table>
+</nobr>
+<br>
+This page should not crash Mozilla
+<script>
+function doe(){
+   var td = document.createElement('td');;
+   td.setAttribute('height', '50%');
+   var tr = document.createElement('tr');;
+   tr.setAttribute('height', '50%');
+   tr.appendChild(td);
+   document.getElementsByTagName('table')[1].appendChild(tr);
+   document.body.offsetHeight;
+
+   var td = document.createElement('td');;
+   td.setAttribute('height', '50%');
+   document.getElementsByTagName('tr')[0].appendChild(td); 
+   document.body.offsetHeight;
+
+   var td = document.createElement('td');;
+   td.setAttribute('height', '50%');
+   document.getElementsByTagName('tr')[0].appendChild(td); 
+} 
+setTimeout(doe, 60);
+</script>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/354458-1.html b/layout/generic/crashtests/354458-1.html
new file mode 100644
index 000000000..2f361ffaf
--- /dev/null
+++ b/layout/generic/crashtests/354458-1.html
@@ -0,0 +1,10 @@
+<html>
+
+<body>
+  <div style="height: 5px; -moz-column-count: 3;">
+    Text!
+    <span style="float: left">Float!</span>
+  </div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/354458-2.html b/layout/generic/crashtests/354458-2.html
new file mode 100644
index 000000000..27a80c1c6
--- /dev/null
+++ b/layout/generic/crashtests/354458-2.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"
+	"http://www.w3.org/TR/html4/strict.dtd">
+<html lang="en-US">
+<head>
+	<title></title>
+	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+	<meta http-equiv="Content-Style-Type" content="text/css">
+	<style type="text/css">
+
+	p { margin: 0; }
+
+	</style>
+</head>
+<body>
+
+<div style="-moz-column-width: 10em; height: 2.5em">
+  text
+  <img src="../../../testing/crashtest/images/tree.gif" width="197" height="200" style="float:left">
+  <p>text</p>
+  <p>text</p>
+  <p>text</p>
+  <p>text</p>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/355426-1.html b/layout/generic/crashtests/355426-1.html
new file mode 100644
index 000000000..a651c48d2
--- /dev/null
+++ b/layout/generic/crashtests/355426-1.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+
+<script>
+
+function foo()
+{
+  document.getElementById("navish").style.display = "inline-block";
+}
+</script>
+
+</head>
+
+
+<body onload="foo()">
+
+<div style="-moz-column-count: 2;">
+  <ol id="ol1" style="height: 30px;">
+    <li>A</li>
+    <li><p id="p3" style="width: 1em;">Foo Foo Foo Foo Foo Foo Foo Foo Foo Foo Foo</p></li>
+  </ol>
+</div>
+
+<p id="navish">E</p>		
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/359371-1.html b/layout/generic/crashtests/359371-1.html
new file mode 100644
index 000000000..d9c59633d
--- /dev/null
+++ b/layout/generic/crashtests/359371-1.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body {
+  width: 500px;
+}
+
+p {
+	font-family: monospace;
+	font-size: 12px;
+}
+.columns {
+	-moz-column-count: 3;
+}
+
+.toppadded
+{
+	padding-top: 20px;
+}
+
+.floatbox {
+	float: left;
+	margin: 3px 10px 0 0;
+	padding: 8px 3px;
+	width: 55px;
+}
+
+</style>	
+</head>
+
+<body onload="document.getElementById('foo').appendChild(document.createTextNode('aaaaaaa'));">
+
+<div class="columns">
+
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		
+		<p id="foo">xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx </p>
+
+    <div class="toppadded">
+      T
+      <p class="floatbox">W W W W W W</p>
+    </div>
+
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/359371-2.html b/layout/generic/crashtests/359371-2.html
new file mode 100644
index 000000000..61e42aa7b
--- /dev/null
+++ b/layout/generic/crashtests/359371-2.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body {
+  width: 500px;
+}
+
+p {
+	font-family: monospace;
+	font-size: 12px;
+}
+.columns {
+	-moz-column-count: 3;
+}
+
+.toppadded
+{
+	padding-top: 18px;
+}
+
+.floatbox {
+	float: left;
+	margin: 20px 0px 0 0;
+	width: 90px;
+}
+
+</style>	
+</head>
+
+<!-- <body onload="document.getElementById('foo').appendChild(document.createTextNode('aaaaaaa'));"> -->
+<div class="columns">
+
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		<p>C
+		
+		<p id="foo">xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx </p>
+
+    <div class="toppadded">
+      T
+      <p class="floatbox">W W W W W W W W Waaaaaaa</p>
+    </div>
+
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/360599.html b/layout/generic/crashtests/360599.html
new file mode 100644
index 000000000..210add23d
--- /dev/null
+++ b/layout/generic/crashtests/360599.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<style>
+#b::first-letter { }
+#c::first-line { }
+</style>
+<title>Testcase bug 360599 - Crash [@ nsFrameList::DestroyFrames] with first-letter/first-line css and position: fixed</title>
+</head>
+<body>
+This page should not crash Mozilla
+<div id="c">
+  <table>
+    <div id="b" style="display:table-header-group;">
+      <q>
+        text
+        <div style="position:fixed;">
+          <q>y</q>
+        </div>
+      </q>  
+    </div>
+    <span style="display: table;"></span>
+</div>
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/361109.html b/layout/generic/crashtests/361109.html
new file mode 100644
index 000000000..fef9c6be8
--- /dev/null
+++ b/layout/generic/crashtests/361109.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<title>Testcase bug 361109 - Crash [@ nsBlockBandData::Init] with position:fixed on select</title>
+</head>
+<body>
+This page should not crash Mozilla
+<select style="position: fixed;"><select>
+</body>
+</html>
diff --git a/layout/generic/crashtests/363448.html b/layout/generic/crashtests/363448.html
new file mode 100644
index 000000000..960aa5445
--- /dev/null
+++ b/layout/generic/crashtests/363448.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<title>Testcase bug 363448 - Crash [@ nsCachedStyleData::GetStyleData] with testcase, using floating and absolutely positioned iframes</title>
+</head>
+<body>
+This page should not crash Mozilla
+<div style="width:300px;">
+  <span id="b">
+    <iframe style="float: left;" id="a"></iframe>
+    <wbr>text
+    <iframe id="c" style="position: absolute;"></iframe>
+  </span>
+</div>
+
+<script>
+function stirdom(){
+  document.body.appendChild(document.getElementById('a'));
+  document.getElementById('b').appendChild(document.getElementById('c'));
+}
+setTimeout(stirdom,200);
+</script>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/363722-1.html b/layout/generic/crashtests/363722-1.html
new file mode 100644
index 000000000..f83671c5a
--- /dev/null
+++ b/layout/generic/crashtests/363722-1.html
@@ -0,0 +1,9 @@
+<html>
+<body>
+ <marquee style="background: yellow;">
+  <marquee style="background: lightgreen;">
+   I am a double-marquee.
+  </marquee>
+ </marquee>
+</body>
+</html>
diff --git a/layout/generic/crashtests/363722-2.html b/layout/generic/crashtests/363722-2.html
new file mode 100644
index 000000000..1a12a227e
--- /dev/null
+++ b/layout/generic/crashtests/363722-2.html
@@ -0,0 +1,10 @@
+<html>
+<body>
+ <marquee style="background: yellow;">
+  [inside OUTER marquee]
+  <marquee style="background: lightgreen;">
+   [inside INNER marquee]
+  </marquee>
+ </marquee>
+</body>
+</html>
diff --git a/layout/generic/crashtests/363848-1.xhtml b/layout/generic/crashtests/363848-1.xhtml
new file mode 100644
index 000000000..0af2085ef
--- /dev/null
+++ b/layout/generic/crashtests/363848-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+      
+<body>
+
+<xul:listbox />
+
+</body>
+
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/364220.html b/layout/generic/crashtests/364220.html
new file mode 100644
index 000000000..12299ecec
--- /dev/null
+++ b/layout/generic/crashtests/364220.html
@@ -0,0 +1,17 @@
+<html><head>
+<title>Testcase bug 364220 - [reflow branch][columns] Crash [@ nsLineLayout::ReflowFrame] using moz-column-count, floats, generated content and first-line</title>
+<style>
+body > span::first-line { }
+span::before { content:"before text"; border:3px solid black;}
+</style>
+</head>
+<body>
+
+<span style=" float: left; -moz-column-count: 2;">
+  <span style="float: right;">
+    <span style=" float: right;-moz-column-count: 2;"></span>
+  </span>
+</span>
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/364407-1.html b/layout/generic/crashtests/364407-1.html
new file mode 100644
index 000000000..2ae181886
--- /dev/null
+++ b/layout/generic/crashtests/364407-1.html
@@ -0,0 +1,44 @@
+<html>
+<body>
+
+<div style="overflow: scroll">
+  <table border="1">
+    <tr> 
+      <td> 
+        <select style="height: 200%">
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+          <option>Option</option>
+        </select>
+      </td>
+    </tr>
+  </table>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/364686-1.xhtml b/layout/generic/crashtests/364686-1.xhtml
new file mode 100644
index 000000000..93a1eeaa4
--- /dev/null
+++ b/layout/generic/crashtests/364686-1.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:math="http://www.w3.org/1998/Math/MathML">
+      
+<body>
+
+<math:merror>
+  <img/>
+</math:merror>
+
+</body>
+</html>
+
diff --git a/layout/generic/crashtests/366021-1.xhtml b/layout/generic/crashtests/366021-1.xhtml
new file mode 100644
index 000000000..5bbc7fe18
--- /dev/null
+++ b/layout/generic/crashtests/366021-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("xulwin").appendChild(document.getElementById("sss"));
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+
+<body onload="setTimeout(boom, 10)">
+
+<span id="sss"><tr><td style="position: absolute;">td</td></tr></span>
+
+<window id="xulwin" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"></window>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/366667-1.html b/layout/generic/crashtests/366667-1.html
new file mode 100644
index 000000000..a50ce84e4
--- /dev/null
+++ b/layout/generic/crashtests/366667-1.html
@@ -0,0 +1,6 @@
+<html>
+  <body>
+    <span><span style="display: -moz-inline-box"><img></span></span>
+  </body>
+</html>
+
diff --git a/layout/generic/crashtests/366952-1.html b/layout/generic/crashtests/366952-1.html
new file mode 100644
index 000000000..96007b8eb
--- /dev/null
+++ b/layout/generic/crashtests/366952-1.html
@@ -0,0 +1,17 @@
+<html>
+
+<head>
+</head>
+
+<body>
+
+<div style="display: -moz-inline-grid;">
+  <div style="padding-right: 3%;">
+    <div style="position: fixed;">
+      Foo
+    </div>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/367246-1.html b/layout/generic/crashtests/367246-1.html
new file mode 100644
index 000000000..5a5a84565
--- /dev/null
+++ b/layout/generic/crashtests/367246-1.html
@@ -0,0 +1,9 @@
+<html>
+<body>
+
+<div style="direction: rtl">
+  <div style="padding: 10px; width: 1px; overflow: scroll;">Foopy</div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/367360.html b/layout/generic/crashtests/367360.html
new file mode 100644
index 000000000..3381ad34e
--- /dev/null
+++ b/layout/generic/crashtests/367360.html
@@ -0,0 +1,30 @@
+<html><head>
+<title>Testcase bug - Crash [@ nsHTMLButtonControlFrame::GetContentInsertionFrame] with -moz-column-count and display: list-item</title>
+</head>
+<body>
+<div style="display: table;">
+text
+<listing style="-moz-column-count: 2;">
+<dl>
+
+
+
+
+
+
+
+
+tesxt
+
+
+<menu>
+<span style="display: list-item;  -moz-column-count: 1;">
+<span style="display: list-item;  -moz-column-count: 1;">
+text
+</span></span>
+</menu>
+<div>text</div>
+</dl>
+</listing>
+</div>
+</body></html>
diff --git a/layout/generic/crashtests/368330-1.html b/layout/generic/crashtests/368330-1.html
new file mode 100644
index 000000000..1a4c93e39
--- /dev/null
+++ b/layout/generic/crashtests/368330-1.html
@@ -0,0 +1,15 @@
+<html>
+
+<body>
+
+<div style="width: 1px">
+  <h3 style="float: right;">Foo bar</h3>
+  <ul>
+    <li style="float: right;">E</li>
+    <li style="float: right;">PPP XXXXXX</li>
+  </ul>
+</div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/368461-1.xhtml b/layout/generic/crashtests/368461-1.xhtml
new file mode 100644
index 000000000..d5baccf52
--- /dev/null
+++ b/layout/generic/crashtests/368461-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<head>
+</head>
+
+<body>
+
+<p><math:msubsup><span>Foo bar baz<td></td></span></math:msubsup></p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/368568.html b/layout/generic/crashtests/368568.html
new file mode 100644
index 000000000..85330fad5
--- /dev/null
+++ b/layout/generic/crashtests/368568.html
@@ -0,0 +1,14 @@
+<html><head>
+<style>
+*::first-line { }
+*::after { content:"anonymous text"; }
+*::before { content:"before text"; }
+</style>
+</head>
+<body>
+
+<ol style="overflow: hidden;  float: right; -moz-column-count: 3;">
+<span style="overflow: auto;  float: left;"></span>
+</ol>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/368752.html b/layout/generic/crashtests/368752.html
new file mode 100644
index 000000000..07d5c7002
--- /dev/null
+++ b/layout/generic/crashtests/368752.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait"><head>
+<title>Testcase bug - Crash [@ nsIFrame::Invalidate] with display: inherit, large margin and padding and generated content</title>
+<script>
+function addstyle(){
+var x=document.createElementNS('http://www.w3.org/1999/xhtml','style');
+x.innerHTML='body::before {content: "text"; }';
+document.documentElement.appendChild(x);
+document.documentElement.offsetHeight;
+document.documentElement.removeAttribute("class");
+}
+</script>
+
+</head>
+<body onload="setTimeout(addstyle,0);">
+<div style="display: table;">
+<div style="display: inherit;float: left;margin-bottom: -9999999px;padding-top: 9999999999px;">
+<span style="position: fixed;">t</span>
+</div>
+</div>
+</body></html>
diff --git a/layout/generic/crashtests/368860-1.html b/layout/generic/crashtests/368860-1.html
new file mode 100644
index 000000000..f38b5b3c4
--- /dev/null
+++ b/layout/generic/crashtests/368860-1.html
@@ -0,0 +1,12 @@
+<html>
+
+<head></head>
+
+<body>
+
+<table border="1"><tr><td>
+  <span>&rlm;X</span>
+</td></tr></table>
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/368863-1.html b/layout/generic/crashtests/368863-1.html
new file mode 100644
index 000000000..ea281da70
--- /dev/null
+++ b/layout/generic/crashtests/368863-1.html
@@ -0,0 +1,5 @@
+<style>
+*::first-line { }
+*::before { content:"before text";}
+</style>
+<object style="position: fixed;-moz-column-count: 100;"><ol style="float: right;">
+\ No newline at end of file
diff --git a/layout/generic/crashtests/369038-1.xhtml b/layout/generic/crashtests/369038-1.xhtml
new file mode 100644
index 000000000..dea9972e6
--- /dev/null
+++ b/layout/generic/crashtests/369038-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      class="reftest-wait">
+
+<head>
+<script>
+
+var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+  var hbox = document.getElementById("hbox");
+  var checkbox = document.createElementNS(XUL_NS, "checkbox");
+    
+  hbox.appendChild(checkbox);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30)">
+
+<xul:scrollbar><span><xul:hbox id="hbox"/></span></xul:scrollbar>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/369150-1.html b/layout/generic/crashtests/369150-1.html
new file mode 100644
index 000000000..b492c0a06
--- /dev/null
+++ b/layout/generic/crashtests/369150-1.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+
+<script>
+
+function boom()
+{
+  document.getElementById("frameset").appendChild(document.createTextNode(""));
+  document.getElementById("frameset").setAttribute("rows", "100%, *"); 
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+ <frameset id="frameset" cols="130, *" onload="setTimeout(boom, 30);">
+   <frame src="data:text/html,foo">
+   <frame src="data:text/html,bar">
+ </frameset>
+ 
+</html>
diff --git a/layout/generic/crashtests/369150-2.html b/layout/generic/crashtests/369150-2.html
new file mode 100644
index 000000000..59215b14a
--- /dev/null
+++ b/layout/generic/crashtests/369150-2.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<title>Bug 369150 - Crash [@ nsHTMLFramesetFrame::GetNoResize] with dynamic changes</title>
+<script>
+
+function boom()
+{
+  document.getElementById("frameset").appendChild(document.createElement("frame"));
+  document.getElementById("frameset").setAttribute("rows", "100%, *"); 
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+ <frameset id="frameset" cols="130, *" onload="setTimeout(boom, 30);">
+   <frame src="data:text/html,foo">
+   <frame src="data:text/html,bar">
+ </frameset>
+ 
+</html>
diff --git a/layout/generic/crashtests/369227-1.xhtml b/layout/generic/crashtests/369227-1.xhtml
new file mode 100644
index 000000000..7a61e4c20
--- /dev/null
+++ b/layout/generic/crashtests/369227-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>document.documentElement.offsetHeight</script>
+</head>
+<body>
+
+<div style="height: 3000px; background: lightgreen;"/>
+
+<div style="width: 4px; float: left; background: yellow;">
+  A
+  <span style="padding: 5px">
+    <span style="float: left;" />
+  </span>
+  Z
+</div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/369542-1.html b/layout/generic/crashtests/369542-1.html
new file mode 100644
index 000000000..ff62a3d05
--- /dev/null
+++ b/layout/generic/crashtests/369542-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+<style>
+body::first-letter { float: right; }
+body::before { content:"before text"; }
+</style>
+</head><body></body></html>
diff --git a/layout/generic/crashtests/369542-2.html b/layout/generic/crashtests/369542-2.html
new file mode 100644
index 000000000..b2c208591
--- /dev/null
+++ b/layout/generic/crashtests/369542-2.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<style>
+html::first-letter { float: right; }
+html::before { content:"before text"; float:right; }
+span::before { content:"before text"; float:right; }
+</style>
+</head>
+<body>
+<span>
+  <div></div>
+</span>
+<button onclick="document.body.style.width='100px'">Click</button>
+</body>
+</html>
diff --git a/layout/generic/crashtests/369547-1.html b/layout/generic/crashtests/369547-1.html
new file mode 100644
index 000000000..2f7516d35
--- /dev/null
+++ b/layout/generic/crashtests/369547-1.html
@@ -0,0 +1,16 @@
+<html class="reftest-wait"><head><script>
+function doe2() {
+document.getElementById('a').setAttribute('style', 'display: inline-block;');
+document.body.offsetHeight;
+document.getElementById('b').removeAttribute('style');
+document.body.offsetHeight;
+document.documentElement.className = '';
+}
+setTimeout(doe2,200,0);
+</script>
+</head>
+<body style="display: -moz-inline-box;"><span style="display: inline-block;"><span style="display: inline-block;"></span></span><span id="a">
+<iframe></iframe>
+<div id="b" style="display: table-footer-group;"></div>
+</span></body>
+</html>
diff --git a/layout/generic/crashtests/370174-1.html b/layout/generic/crashtests/370174-1.html
new file mode 100644
index 000000000..57493a7d3
--- /dev/null
+++ b/layout/generic/crashtests/370174-1.html
@@ -0,0 +1,566 @@
+<html>
+<head>
+<style style="display: none; direction: ltr;">
+<label style="display: table-column-group;direction: rtl;">
+</big>
+</textarea>
+</q>
+<q style="display: table-row;direction: ltr;">
+</span>
+</ol>
+</dir>
+<html style="display: table-row;direction: rtl;">
+</strong>
+<basefont style="display: inline-table;direction: auto;">
+<map style="display: table-footer-group;direction: ltr;">
+<dir="rtl" style="display: inline-block;direction: ltr;">
+<center style="display: none;direction: ltr;">
+<style style="display: block;direction: auto;">
+<samp style="display: -moz-inline-box;direction: rtl;">
+<noframes style="display: inline;direction: rtl;">
+<code style="display: table-header-group;direction: ltr;">
+</li>
+</body>
+</div>
+<embed style="display: table-header-group;direction: auto;">
+</table>
+</fieldset>
+<legend style="display: table-row;direction: auto;">
+</ul>
+<canvas style="display: table;direction: ltr;">
+<font style="display: inline-table;direction: auto;">
+</option>
+</code>
+</menu>
+<thead style="display: inline-table;direction: rtl;">
+</button>
+</div>
+</ol>
+</isindex>
+<code style="display: table-row-group;direction: rtl;">
+<dl style="display: table-row;direction: ltr;">
+<style style="display: table-footer-group;direction: ltr;">
+<marquee style="display: table-row;direction: auto;">
+</object>
+</hx>
+<nobr style="display: table-cell;direction: rtl;">
+<a style="display: table-header-group;direction: ltr;">
+</thead>
+<tr style="display: table-caption;direction: ltr;">
+<tr style="display: table-row;direction: rtl;">
+<base style="display: inline;direction: auto;">
+</input>
+<hx style="display: inline-block;direction: auto;">
+<link style="display: table-column;direction: rtl;">
+<code style="display: inline;direction: ltr;">
+<li style="display: table-column-group;direction: ltr;">
+</dd>
+</spacer>
+<address style="display: table-header-group;direction: auto;">
+</object>
+</hx>
+</th>
+</sup>
+<u style="display: -moz-inline-box;direction: auto;">
+</del>
+<bdo style="display: table-column-group;direction: ltr;">
+<param style="display: block;direction: auto;">
+<td rowspan="5" style="display: inline-table;direction: rtl;">
+<head style="display: none;direction: ltr;">
+</abbr>
+<address style="display: table-row;direction: rtl;">
+</input type="password">
+</li>
+<area style="display: -moz-inline-box;direction: ltr;">
+</noframes>
+</b>
+</input type="image">
+<title style="display: -moz-inline-box;direction: ltr;">
+</font>
+<blockquote style="display: table-column-group;direction: auto;">
+<area style="display: none;direction: auto;">
+</script>
+<colgroup style="display: -moz-inline-box;direction: auto;">
+<font style="display: list-item;direction: auto;">
+<isindex style="display: table-cell;direction: ltr;">
+<sup style="display: table-footer-group;direction: ltr;">
+<abbr style="display: block;direction: auto;">
+<address style="display: table-caption;direction: rtl;">
+</span>
+</code>
+</strong>
+<select style="display: table-cell;direction: auto;">
+<dl style="display: inline-table;direction: rtl;">
+</small>
+</listing>
+<colgroup style="display: table-header-group;direction: rtl;">
+<title style="display: none;direction: auto;">
+</input type="submit">
+<tbody style="display: table-column-group;direction: rtl;">
+</blink>
+<i style="display: table;direction: ltr;">
+</td>
+</dir>
+</tt>
+</a<bgsound style="display: inline;direction: auto;">
+<multicol style="display: -moz-inline-box;direction: auto;">
+</th>
+</font>
+</base>
+<textarea style="display: inline-block;direction: ltr;">
+<frameset style="display: list-item;direction: rtl;">
+</span>
+<blockquote style="display: table-caption;direction: auto;">
+</code>
+<dir style="display: inline-table;direction: rtl;">
+<fieldset style="display: table-column;direction: ltr;">
+</kbd>
+<noframes style="display: none;direction: rtl;">
+</spacer type="block">
+</i>
+<area style="display: table-column-group;direction: ltr;">
+<form style="display: none;direction: rtl;">
+<tt style="display: table-row;direction: auto;">
+</bdo>
+</th>
+<cite style="display: none;direction: auto;">
+</td colspan="5">
+</dir>
+</noscript>
+<spacer style="display: table-caption;direction: rtl;">
+</legend>
+<ins style="display: table-row-group;direction: rtl;">
+</multicol>
+</base>
+</img>
+<nobr style="display: table-header-group;direction: auto;">
+</map>
+<br style="display: none;direction: rtl;">
+</spacer type="block">
+<table style="display: table-row-group;direction: ltr;">
+</td rowspan="5">
+</caption>
+<embed style="display: inline-table;direction: auto;">
+</script>
+<style style="display: list-item;direction: rtl;">
+</nobr>
+<button style="display: table-column;direction: auto;">
+</select>
+</strike>
+<hx style="display: table-header-group;direction: ltr;">
+</bdo>
+<td rowspan="5" style="display: none;direction: ltr;">
+</code>
+<input type="hidden" style="display: table;direction: auto;">
+<spacer type="block" style="display: inline-block;direction: ltr;">
+</marquee>
+</dir="rtl">
+</html>
+<le</i>gend style="display: table-caption;direction: ltr;">
+<sup style="display: table-column-group;direction: ltr;">
+</address>
+<title style="display: none;direction: rtl;">
+<font style="display: table-row;direction: ltr;">
+<ol style="display: inline-table;direction: rtl;">
+</th>
+</link>
+</isindex>
+</iframe>
+<th style="display: table;direction: rtl;">
+</hx>
+<object style="display: table-caption;direction: auto;">
+</embed>
+<small style="display: block;direction: auto;">
+</abbr>
+<object style="display: inline-table;direction: ltr;">
+<div style="display: table-column-group;direction: auto;">
+</i>
+</u>
+</wbr>
+<abbr style="display: inline;direction: ltr;">
+</sub>
+<dir style="display: block;direction: auto;">
+</small>
+</code>
+<style style="display: table-column;direction: ltr;">
+<fieldset style="display: table-cell;direction: rtl;">
+</b>
+<blockquote style="display: table-header-group;direction: rtl;">
+<q style="display: inline;direction: auto;">
+<iframe style="display: block;direction: rtl;">
+<button style="display: table-footer-group;direction: auto;">
+</s>
+</caption>
+<input type="submit" style="display: inline-block;direction: auto;">
+</wbr>
+</link>
+</sub>
+<dt style="display: table-column-group;direction: auto;">
+<noscript style="display: table-cell;direction: ltr;">
+<spacer type="block" style="display: inline-table;direction: rtl;">
+<dl style="display: inline;direction: auto;">
+<thead style="display: table-row;direction: auto;">
+</td>
+</strike>
+<body style="display: inline;direction: auto;">
+<img style="display: table-column;direction: rtl;">
+</input type="hidden">
+</label>
+<img src="fish.gif" style="display: inline-table;direction: auto;">
+</ins>
+<img src="fish.gif" style="display: block;direction: rtl;">
+</caption>
+<abbr style="display: table-header-group;direction: auto;">
+</meta>
+<area style="display: list-item;direction: auto;">
+<ul style="display: table-row-group;direction: rtl;">
+<img style="display: table-cell;direction: rtl;">
+</nobr>
+<blockquote style="display: table;direction: ltr;">
+<a style="display: table-header-group;direction: auto;">
+</basefont>
+</tbody>
+<dt style="display: table-footer-group;direction: auto;">
+</address>
+<strong style="display: table-header-group;direction: auto;">
+<strong style="display: table-row;direction: rtl;">
+<u style="display: table;direction: rtl;">
+</font>
+</dir>gend style="display: ta<samp style="display: table-row-group;direction: rt<kbd style="display: table-column;direction: auto;">
+<acronym style="display: table-footer-group;direction: auto;">
+</html>
+</cite>
+</keygen>
+<kbd style="display: none;direction: ltr;">
+</spacer>
+<div style="display: inline;direction: rtl;">
+</marquee>
+</code>
+<select style="display: table-cell;direction: rtl;">
+<i style="display: none;direction: rtl;">
+<bgsound style="display: table-header-group;direction: ltr;">
+</isindex>
+<table style="display: none;direction: rtl;">
+</td>
+<bgsound style="display: inline-table;direction: rtl;">
+<canvas style="display: inline-table;direction: ltr;">
+<textarea style="display: table-header-group;direction: auto;">
+</tbody>
+</li>
+</th>
+</body>
+<th style="display: inline;direction: ltr;">
+</sub>
+</sup>
+<li style="display: table;direction: ltr;">
+<l<sup style="display: none;direction: ltr;">
+</bgsound>
+<select style="display: table-row;direction: auto;">
+</del>
+</cite>
+</img>
+<abbr style="display: table-row;direction: ltr;">
+<multicol style="display: table;direction: ltr;">
+<style style="display: inline-table;direction: ltr;">
+<code style="display: table-caption;direction: ltr;">
+</tbody>
+<button style="display: -moz-inline-box;direction: rtl;">
+<basefont style="display: table-column-group;direction: auto;">
+<img style="display: inline;direction: auto;">
+<wbr style="display: table-row;direction: rtl;">
+</isindex>
+<html style="display: table-footer-group;direction: rtl;">
+</nobr>
+<col style="display: table-column;direction: ltr;">
+</li>
+<fieldset style="display: table-row-group;direction: auto;">
+<a style="display: inline;direction: rtl;">
+</textarea>
+<input type="hidden" style="display: table;direction: auto;">
+</td rowspan="5">
+</wbr>
+</script>
+</optgroup>
+</noframes>
+<le</i>
+</label>
+</li>
+<frame style="display: table-footer-group;direction: ltr;">
+<noscript style="display: table-column;direction: ltr;">
+<thead style="display: none;direction: rtl;">
+</blink>
+<style style="display: -moz-inline-box;direction: ltr;">
+</strike>
+<noframes style="display: -moz-inline-box;direction: auto;">
+</u>
+</frame>
+</big>
+</strike>
+<label style="display: table-cell;direction: rtl;">
+</p>
+</optgroup>
+<kbd style="display: table-row-group;direction: rtl;">
+<hx style="display: block;direction: ltr;">
+</spacer type="block">
+<strike style="display: -moz-inline-box;direction: rtl;">
+</td>
+<input type="submit" style="display: inline-block;direction: auto;">
+</fieldset>
+</dir="rtl">
+<label style="display: list-item;direction: rtl;">
+<base style="display: -moz-inline-box;direction: ltr;">
+<iframe style="display: table-footer-group;direction: ltr;">
+</link>
+</s>
+<sup style="display: table-row;direction: rtl;">
+</colgroup>
+<map style="display: inline;direction: rtl;">
+<script style="display: -moz-inline-box;direction: auto;">
+<spacer style="display: list-item;direction: auto;">
+</acronym>
+<spacer style="display: none;direction: rtl;">
+</spacer>
+</menu>
+</blockquote>
+<a style="display: table;direction: ltr;">
+</big>
+<script style="display: table-column;direction: auto;">
+</dd>
+<div style="display: table-caption;direction: rtl;">
+</object>
+<label style="display: block;direction: ltr;">
+<colgroup style="display: table;direction: rtl;">
+</cite>
+<ol style="display: inline-table;direction: auto;">
+</cite>
+</small>
+</big>
+<input type="hidden" style="display: inline-table;direction: auto;">
+<big style="display: -moz-inline-box;direction: rtl;">
+<strong style="display: table-row-group;direction: rtl;">
+<dd style="display: block;direction: ltr;">
+</font>
+<dt style="display: list-item;direction: rtl;">
+<cite style="display: table-header-group;direction: rtl;">
+<em style="display: table-row-group;direction: rtl;">
+<basefont style="display: table-column;direction: rtl;">
+<legend style="display: -moz-inline-box;direction: auto;">
+</img>
+<tt style="display: table-row-group;direction: ltr;">
+<link style="display: table-caption;direction: ltr;">
+<q style="display: block;direction: ltr;">
+</title>
+</bdo>
+</meta>
+</iframe>
+<b style="display: table-header-group;direction: rtl;">
+<script style="display: block;direction: auto;">
+</link>
+</embed>
+<code style="display: -moz-inline-box;direction: rtl;">
+</select>
+</label>
+</hx>
+</td>
+</textarea>
+<q style="display: none;direction: rtl;">
+<del style="display: table-cell;direction: auto;">
+<input type="submit" style="display: -moz-inline-box;direction: rtl;">
+<tfoot style="display: inline;direction: rtl;">
+</abbr>
+</tr>
+<strike style="display: inline;direction: rtl;">
+</big>
+<input type="hidden" style="display: inline-block;direction: rtl;">
+</strong>
+<q style="display: table-header-group;direction: rtl;">
+</big>
+<tr style="display: list-item;direction: auto;">
+</object>
+</input type="hidden">
+</bdo>
+</thead>
+</span>
+</tt>
+</listing>
+</blink>
+</dfn>
+</b>
+</a>
+</tt>
+</dir>
+</a<nobr</keygen> styl<sup style="display: -moz-inline-box;direction: ltr<ol style="display: table;direction: auto;">
+</span>
+</ins>
+<div style="display: table-row-group;direction: auto;">
+<pre style="display: -moz-inline-box;direction: rtl;">
+</tfoot>
+<frameset style="display: table-footer-group;direction: auto;">
+</img>
+</keygen>
+<span style="display: table-caption;direction: auto;">
+</samp>
+</object>
+<code style="display: table-row-group;direction: ltr;">
+<sup style="display: table-column-group;direction: ltr;">
+<frame style="display: table-cell;direction: ltr;">
+</spacer type="block">
+<button style="display: table-caption;direction: rtl;">
+<td style="display: table;direction: ltr;">
+<td colspan="5" style="display: inline-table;direction: ltr;">
+<pre style="display: inline-table;direction: ltr;">
+<object style="display: table-row-group;direction: auto;">
+</a>
+</tt>
+</optgroup>
+</span>
+<style style="display: table-footer-group;direction: auto;">
+<hx style="display: block;direction: rtl;">
+<spacer style="display: list-item;direction: auto;">
+</title>
+<ins style="display: table-column;direction: auto;">
+</object>
+</br>
+<frameset style="display: inline-block;direction: rtl;">
+<span style="display: block;direction: auto;">
+<kbd style="display: list-item;direction: auto;">
+<dir style="display: table;direction: rtl;">
+</address>
+</cite>
+</big>
+<optgroup style="display: inline-block;direction: ltr;">
+</fieldset>
+</base>
+<input type="image" style="display: inline-block;direction: ltr;">
+</object>
+<col style="display: table-row-group;direction: auto;">
+<noscript style="display: none;direction: auto;">
+</blink>
+</script>
+<input type="hidden" style="display: -moz-inline-box;direction: rtl;">
+<ul style="display: -moz-inline-box;direction: rtl;">
+</menu>
+<sup style="display: table-row-group;direction: ltr;">
+<tr style="display: table-column;direction: auto;">
+<ul style="display: table-row;direction: ltr;">
+<noscript style="display: table;direction: ltr;">
+</i>
+</dir="rtl">
+</input type="submit">
+</cite>
+</code>
+<title style="display: table-footer-group;direction: rtl;">
+<sub style="display: block;direction: rtl;">
+</code>
+</acronym>
+</caption>
+</code>
+</font>
+</em>
+</optgroup>
+<multicol style="display: table-row-group;direction: auto;">
+<bdo style="display: list-item;direction: auto;">
+<canvas style="display: table-header-group;direction: rtl;">
+</form>
+<tt style="display: table-footer-group;direction: ltr;">
+<frame style="display: -moz-inline-box;direction: rtl;">
+</multicol>
+</acronym>
+<em style="display: -moz-inline-box;direction: ltr;">
+</wbr>
+<legend style="display: inline-block;direction: auto;">
+</samp>
+</var>
+<dir style="display: table-footer-group;direction: auto;">
+</title>
+</input type="submit">
+<spacer style="display: inline-block;direction: auto;">
+<ol style="display: table-header-group;direction: ltr;">
+</option>
+<i style="display: list-item;direction: rtl;">
+</caption>
+</spacer>
+</noframes>
+</sub>
+</tfoot>
+</legend>
+</select>
+<marquee style="display: table-caption;direction: ltr;">
+<script style="display: table-footer-group;direction: rtl;">
+</q>
+</strong>
+</code>
+</div>
+</code>
+</td>
+</optgroup>
+<map style="display: table-row-group;direction: ltr;">
+</marquee>
+<optgroup style="display: none;direction: ltr;">
+<hr style="display: table-row-group;direction: rtl;">
+</br>
+<param style="display: table-row;direction: ltr;">
+</dfn>
+</keygen>
+<param style="display: none;direction: ltr;">
+<legend style="display: list-item;direction: ltr;">
+<b style="display: list-item;direction: ltr;">
+</bdo>
+</dfn>
+</option>
+</input>
+</u>
+</code>
+<ul style="display: table-header-group;direction: ltr;">
+</thead>
+</span>
+</link>
+<img src="fish.gif" style="display: inline-table;direction: auto;">
+</menu>
+<u style="display: table-row;direction: rtl;">
+</cite>
+<listing style="display: inline-block;direction: auto;">
+</style>
+</head>
+<body>
+<code style="display: table-row-group; direction: ltr;">
+<button style="display: list-item; direction: ltr;">
+<kbd style="display: table-row; direction: rtl;">
+<input style="display: list-item; direction: rtl;" type="hidden">
+<iframe style="display: table-column-group;">
+</iframe>gend style="display: ta<samp style="display: table-row-group;" display:="" table-column;direction:="" auto;="">
+</samp>
+</kbd>
+</button>
+</code>
+<script>
+//<![CDATA[
+/*template*/
+var doc = document;
+if (document.getElementById('content'))
+  doc = document.getElementById('content').contentDocument;var tt;
+var l=0;
+function replacestyles(i){
+l++;
+window.status=l+':'+i;
+if (l>70)
+ return;
+var x=doc.getElementsByTagName('*');
+
+if (x[i] && x[i+1])
+  {
+var temp = x[i+1].getAttribute('style');
+x[i+1].setAttribute('style', x[i].getAttribute('style'));
+x[i].setAttribute('style', temp);
+}
+else { i = 0;}
+  i++;
+tt=setTimeout(replacestyles,10,i);
+}
+//window.onmousedown=function(){clearTimeout(tt);}
+tt=setTimeout(replacestyles,100,0);
+/*template*/
+//]]>
+</script>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/370174-2.html b/layout/generic/crashtests/370174-2.html
new file mode 100644
index 000000000..fd9649636
--- /dev/null
+++ b/layout/generic/crashtests/370174-2.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+<title>Bug 370174 � Crash [@ FindBlockFrameOrBR] with unminimised testcase triple-clicking at the bottom of the page</title>
+</head>
+<body>
+<script>
+function doe() {
+document.documentElement.innerHTML = '';
+}
+setTimeout(doe, 300);
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/370174-3.html b/layout/generic/crashtests/370174-3.html
new file mode 100644
index 000000000..bfbcd25ad
--- /dev/null
+++ b/layout/generic/crashtests/370174-3.html
@@ -0,0 +1,26 @@
+<HTML><HEAD style="display: table-row;"></HEAD>
+<BODY style="display: table-row;">
+<CODE>
+<span>
+<IFRAME style="display:table-column-group;"></IFRAME>
+</span>
+</CODE>
+<span style="display:table-column-group;"></span>
+<SCRIPT>
+function doe2() {
+document.body.setAttribute('style', '');
+document.getElementsByTagName('head')[0].setAttribute('style', '');
+document.body.offsetHeight;
+document.getElementsByTagName('span')[0].setAttribute('style', 'display: table-row;');
+}
+setTimeout(doe2,100);
+
+function tripleclick(){
+var wu = SpecialPowers.DOMWindowUtils;
+wu.sendMouseEvent('mousedown',  500, 500, 0, 3, 0);
+setTimeout(tripleclick,20);
+setTimeout(function(){window.location.reload()}, 200);
+}
+setTimeout(tripleclick,200);
+</SCRIPT>
+</BODY></HTML>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/370174-4.html b/layout/generic/crashtests/370174-4.html
new file mode 100644
index 000000000..a5a562dbd
--- /dev/null
+++ b/layout/generic/crashtests/370174-4.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+
+<html>
+<head>
+<title>Untitled</title>
+
+<style>
+
+
+</style>
+</head>
+<body>
+
+
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%0A%3Cscript%3E%0Avar%20wu%20%3D%20SpecialPowers.DOMWindowUtils%3B%0Avar%20i%20%3D%20Math.floor%28Math.random%28%29*20%29%3B%0Awu.sendMouseEvent%28%27mousedown%27%2C%20%2020*i%2C%2020*i%2C%200%2C%203%2C%200%29%3B%0Awu.sendMouseEvent%28%27mouseup%27%2C%20%2020*i%2C%2020*i%2C%200%2C%203%2C%200%29%3B%0A%3C/script%3E%0A%0A%3Cembed%20type%3D%22bbb%22%20style%3D%22display%3A%20-moz-inline-stack%3B%22%3E%0A%0A%3C/body%3E%3C/html%3E%22%20style%3D%22width%3A1000px%3Bheight%3A%20700px%3B"></iframe>
+<script>
+function doe2() {
+document.getElementById('content').src = document.getElementById('content').src + '?1';
+
+}
+setInterval(doe2, 1000);
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/370699-1.html b/layout/generic/crashtests/370699-1.html
new file mode 100644
index 000000000..d977c937a
--- /dev/null
+++ b/layout/generic/crashtests/370699-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+</head>
+
+<body style="width: 100px; border: 2px solid yellow;">
+
+<span style="position: relative;">
+  <img width="200" height="100" align="left">
+  <span style="position:absolute; float:left;"></span>
+  Foo
+</span>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/370794-1.html b/layout/generic/crashtests/370794-1.html
new file mode 100644
index 000000000..d4f489d14
--- /dev/null
+++ b/layout/generic/crashtests/370794-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="overflow: hidden; padding-right: 3%;">
+  <h2 style="position: fixed;">H2</h2>
+</div>
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/370866-1.xhtml b/layout/generic/crashtests/370866-1.xhtml
new file mode 100644
index 000000000..dbc673cc4
--- /dev/null
+++ b/layout/generic/crashtests/370866-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+</head>
+
+<body>
+
+<table style="display: -moz-deck;"><tbody><tr><td>
+  <span style="position: relative;"><marquee><marquee><span style="position: absolute;">X</span></marquee></marquee></span>
+</td></tr></tbody></table>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/370884-1.xhtml b/layout/generic/crashtests/370884-1.xhtml
new file mode 100644
index 000000000..3959d4b17
--- /dev/null
+++ b/layout/generic/crashtests/370884-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+
+<body>
+
+<math:mroot>
+  <div>
+    <div style="position: fixed;">Y</div>
+  </div>
+</math:mroot>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/371348-1.xhtml b/layout/generic/crashtests/371348-1.xhtml
new file mode 100644
index 000000000..1b2252f11
--- /dev/null
+++ b/layout/generic/crashtests/371348-1.xhtml
@@ -0,0 +1,41 @@
+<html xmlns="http://www.w3.org/1999/xhtml"  
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      class="reftest-wait">
+
+<head>
+<script>
+
+function boom()
+{
+  var span = document.getElementById("span");
+  var table = document.getElementById("table");
+  
+  table.appendChild(span);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+
+<body onload="setTimeout(boom, 20)">
+
+<span id="span"></span>
+
+<table id="table">
+  <tbody>
+    <tr>
+      <td style="float: left">
+        Table
+        <xul:box>
+          <input type="checkbox"/>
+        </xul:box>
+        cell
+      </td>
+    </tr>
+  </tbody>
+</table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/371561-1.html b/layout/generic/crashtests/371561-1.html
new file mode 100644
index 000000000..bce6075c4
--- /dev/null
+++ b/layout/generic/crashtests/371561-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <div style="position: relative; display: inline;">
+      <table style="position: absolute;"><tr><td></td></tr></table>
+    </div>
+  <body>
+</html>
diff --git a/layout/generic/crashtests/371566-1.xhtml b/layout/generic/crashtests/371566-1.xhtml
new file mode 100644
index 000000000..2797f1567
--- /dev/null
+++ b/layout/generic/crashtests/371566-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+  <div style="display: -moz-inline-stack;">
+    <div style="float: left; padding-right: 3%">
+      <div style="position: absolute;"></div>
+    </div>
+  </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/372376-1.xhtml b/layout/generic/crashtests/372376-1.xhtml
new file mode 100644
index 000000000..ddb7d2d17
--- /dev/null
+++ b/layout/generic/crashtests/372376-1.xhtml
@@ -0,0 +1,39 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+<![CDATA[
+
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+
+function boom()
+{
+  var $table = document.getElementById('table');
+  var $oldtd = document.getElementById('oldtd');
+
+  $table.style.outline = "1px solid green";
+
+  var $tr = document.createElementNS(HTML_NS, 'tr');
+  $tr.style.display = "inherit";
+  $table.insertBefore($tr, $oldtd);
+
+  var $td = document.createElementNS(HTML_NS, 'td'); 
+  $tr.appendChild($td);
+
+  var $anothertr = document.createElementNS(HTML_NS, 'tr'); 
+  $table.insertBefore($anothertr, $tr);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30)">
+
+<table border="1" id="table">
+<td id="oldtd"></td>
+</table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/373859-1.html b/layout/generic/crashtests/373859-1.html
new file mode 100644
index 000000000..9fbb147cb
--- /dev/null
+++ b/layout/generic/crashtests/373859-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+  document.getElementById("k").style.display = "-moz-inline-stack";
+}
+</script>
+
+<body onload="boom();">
+
+<div style="display: table;"><div id="k" style="height: 18000000px;">x</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/373868-1.xhtml b/layout/generic/crashtests/373868-1.xhtml
new file mode 100644
index 000000000..712569386
--- /dev/null
+++ b/layout/generic/crashtests/373868-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+<span style="float: left; height: 18000000px"/>
+<p style="clear: left;"/>
+<div>
+  <span style="float: right; height: 100px;">a</span>
+  b
+  <span style="float: right; height: 18000000px;"/>
+  <p/>
+  <span style="float: right; height: 18000000px;">c</span>
+  <table style="height: 20000000px;"/>
+  <p style="float: right;"/>
+</div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/374090.html b/layout/generic/crashtests/374090.html
new file mode 100644
index 000000000..250f8c11d
--- /dev/null
+++ b/layout/generic/crashtests/374090.html
@@ -0,0 +1,11 @@
+<html><head><script>
+function doe() {
+window.location.reload();
+}
+setTimeout(doe, 500);
+</script></head><noframes style="overflow: scroll; display: block;"></noframes><body><li></li>
+
+<script>
+document.documentElement.setAttribute('style','-moz-binding: url(binding.xml#randomxbl);');
+</script>
+</body></html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/374420.xhtml b/layout/generic/crashtests/374420.xhtml
new file mode 100644
index 000000000..e1cfa13dd
--- /dev/null
+++ b/layout/generic/crashtests/374420.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<title>Testcase bug - Crash [@ nsHTMLReflowState::GetNearestContainingBlock] with testcase using generated content, xbl and mathml</title>
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="a">
+<content><children>
+<div xmlns="http://www.w3.org/1999/xhtml" style="position: absolute;">
+<div style="position: absolute;"/>
+</div>
+</children></content>
+</binding></bindings>
+<style>
+  mtable::after { content:"anonymous text"; }
+  mtable::before { content:"before text"; }
+</style>
+
+<thead style="overflow: scroll;">
+  <mathml:mrow>
+    <mathml:mtable>
+      <tfoot style="-moz-binding: url(#a);" id="a_1">
+        <td style="-moz-binding: url(#a);"/>
+      </tfoot>
+    </mathml:mtable>
+    <td id="a_2"/>
+  </mathml:mrow>
+</thead>
+
+<script xmlns="http://www.w3.org/1999/xhtml">
+  function doe() {
+    document.getElementById('a_1').style.borderCollapse = "";
+    document.documentElement.offsetHeight;
+    document.getElementById('a_2').parentNode.removeChild(document.getElementById('a_2'));  
+  }
+  setTimeout(doe, 400);
+</script>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/375462-1.html b/layout/generic/crashtests/375462-1.html
new file mode 100644
index 000000000..a0d9dca75
--- /dev/null
+++ b/layout/generic/crashtests/375462-1.html
@@ -0,0 +1,781 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
+      lang="en">
+
+  <head>
+    <meta http-equiv="Content-Type"
+          content="text/html;charset=utf-8" />
+
+    <title>Testcase #1 for bug 375462</title>
+
+<!-- Reduced from http://www.bethelmaine.com/events/index_events_bugy -->        
+                    
+                    
+  </head>
+
+  <body class="section-events" dir="ltr">
+  
+
+ 
+    <div>
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">"Remembering Sis Post"</h3>
+           <h3 style="float: right;">
+            <span>07/01</span>
+            
+           </h3>
+          <div style="clear: both;" />
+          <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+          </div>
+          <div style="position: relative;">BHS members and friends will gather to share stories and memories in celebration of the life of the late Persis G. Post, who was an outstanding volunteer at the Society for more than 20 years.</div>
+          <br />
+          <div style="position: relative;" class="stx">1:00 PM, Mason House Exhibit Hall</div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>Dr. Moses Mason House</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>Bethel Historical Society</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:info@bethelhistorical.org"><span>info@bethelhistorical.org</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207-824-2908</span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">"An Androscoggin Sampler"</h3>
+           <h3 style="float: right;">
+            <span>07/01</span>
+            
+           </h3>
+          <div style="clear: both;" />
+          <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+          </div>
+          <div style="position: relative;">In conjunction with the Society's newest exhibit, "A River's Journey: The Story of the Androscoggin," a series of slides of old photos taken in various locations throughout the Androscoggin valley will be shown.  Free and open to the public.</div>
+          <br />
+          <div style="position: relative;" class="stx">2:00 PM, Mason House Exhibit Hall (the exhibit will be open at the Robinson House following the program)</div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>Bethel Historical Society</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>Bethel Historical Society</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:info@bethelhistorical.org"><span>info@bethelhistorical.org</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207-824-2908</span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">Summer Season Mason House Period Room Tours</h3>
+           <h3 style="float: right;">
+            <span>07/02</span>
+            <span>- 08/01</span>
+           </h3>
+          <div style="clear: both;" />
+          <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+          </div>
+          <div style="position: relative;">Summer season guided tours of the Mason House period rooms begin (Tuesday through Sunday, 1:00 to 4:00 PM, until Labor Day); tours may be arranged during the remainder of the year by calling 207-824-2908.</div>
+          <br />
+          <div style="position: relative;" class="stx"></div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>Dr. Moses Mason House</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>Bethel Historical Society</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:info@bethelhistorical.org"><span>info@bethelhistorical.org</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207-824-2908</span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">4th of July Community Picnic</h3>
+           <h3 style="float: right;">
+            <span>07/04</span>
+            
+           </h3>
+          <div style="clear: both;" />
+          <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+          </div>
+          <div style="position: relative;"></div>
+          <br />
+          <div style="position: relative;" class="stx"><p>In the 1850s, Dr. Moses Mason began hosting a Fourth of July community picnic in "the grove" behind his residence. Today, the Bethel Historical Society proudly carries on this tradition. </p><p>This year's event will start at noon on the lawn beside the Mason house, and after the presentation of colors and the National Anthem, a two-hour concert will be presented by the Portland Brass Quintet. </p><p>In case of rain, the picnic and concert will be held in the historic Middle Intervale Meetinghouse (1816) on Intervale Road, approximately four miles down river from Bethel Hill village. Bring your lunch and a lawn chair or blanket. Free and open to the public (donations accepted).</p></div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>14 Broad Street</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>Bethel Historical Society</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:info@bethelhistorical.org"><span>info@bethelhistorical.org</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207-824-2908</span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">Mama's Night Out</h3>
+           <h3 style="float: right;">
+            <span>07/05</span>
+            
+           </h3>
+          <div style="clear: both;" />
+          <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+          </div>
+          <div style="position: relative;">You don't have to be a mother to enjoy the hilarious comedy of these three finalists in Nick at Nite's “Search for the Funniest Mom in America.”  The uproarious views on life and laughter of these ladies’ – a southerner living in Maine, a sassy Brit, and a New Yorker - are for everyone.  Okay, perhaps they are not really for children, but that's why it's called a night out.  For further information and reservations please call the Deertrees Box Office at 207 583 6747 or visit www.deertreestheatre.org</div>
+          <br />
+          <div style="position: relative;" class="stx"><p>8pm  $18
+<br />
+<br />The Box Office is open from 10 AM until 5 PM Tuesday through Saturday and one hour before performances.
+<br />
+<br />Tickets are also available at:
+<br />Books-N-Things, Bethel
+<br />The Cool Moose, Bridgton
+<br />Center Lovell Market, Lovell
+<br />The Country Sleigh, Naples
+<br />Fare Share, Norway 
+<br />
+<br />Deertrees Theatre is handicap accessible.
+<br />Free parking on the grounds.</p></div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>Deertrees Theatre</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>C.Randolph Parker (house manager)</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:deertrees@usa.net"><span>deertrees@usa.net</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207 583 6747</span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">The Casco Bay Tummlers</h3>
+           <h3 style="float: right;">
+            <span>07/06</span>
+            
+           </h3>
+          <div style="clear: both;" />
+          <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+          </div>
+          <div style="position: relative;">Klezmer music is music that speaks, it's Balkans and blues, ancient Jewish culture and prayer and history, spirit and jazz all mixed together. Emotionally charged and played with abandon by musicians who continue to change, expand, and morph musical and cultural boundaries.  For further information and reservations please call the Deertrees Box Office at 207 583 6747 or visit www.deertreestheatre.org 
+ </div>
+          <br />
+          <div style="position: relative;" class="stx"><p>8pm  $18
+<br />
+<br />Box Office open, 10 AM until 5 PM, Tuesday through Saturday, and one hour before performances.
+<br />
+<br />Tickets are also available at:
+<br />Books-N-Things, Bethel
+<br />The Cool Moose, Bridgton
+<br />Center Lovell Market, Lovell
+<br />The Country Sleigh, Naples
+<br />Fare Share, Norway 
+<br />
+<br />Deertrees Theatre is handicapped accessible.
+<br />Free parking on the grounds.</p></div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>Deertrees Theatre</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>C.Randolph Parker (house manager)</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:deertrees@usa.net"><span>deertrees@usa.net</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207 583 6747</span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">18th Annual Bethel Art Fair</h3>
+           <h3 style="float: right;">
+            <span>07/07</span>
+            
+           </h3>
+          <div style="clear: both;" />
+          <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+          </div>
+          <div style="position: relative;">Fifty artists &amp; fine artisans display and sell their creations -- </div>
+          <br />
+          <div style="position: relative;" class="stx"><div><div>Scroll down for complete schedule...<br /></div></div></div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>Bethel Town Common</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>Bethel Area Chamber of Commerce</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:info@bethelmaine.com"><span>info@bethelmaine.com</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207.824.2282</span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">The Hunger Mountain Boys with The Wiyos</h3>
+           <h3 style="float: right;">
+            <span>07/07</span>
+            
+           </h3>
+          <div style="clear: both;" />
+          <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+          </div>
+          <div style="position: relative;">This double dose of traditional music may be resolutely old-school but it is also resolutely eclectic.  With their ears tuned to music from the 30’s, 40’s and 50’s, the Massachusetts bluegrass band, The Hunger Mountain Boys, serve up a hard-hittin’, high energy sound that pays homage to the soulfulness and sincerity of old-time country while subtly incorporating rock, jazz and ska influences.  The opening set by Brooklyn based “the WIYOS” can only be called Vaudevillian Ragtime-Blues and HillBilly Swing.  For further information and reservations please call the Deertrees Box Office at 207 583 6747 or visit www.deertreestheatre.org 
+
+</div>
+          <br />
+          <div style="position: relative;" class="stx"><p>8pm $16
+<br />
+<br />The Box Office is open from 10 AM until 5 PM Tuesday through Saturday and one hour before performances.
+<br />
+<br />Tickets are also available at:
+<br />Books-N-Things, Bethel
+<br />The Cool Moose, Bridgton
+<br />Center Lovell Market, Lovell
+<br />The Country Sleigh, Naples
+<br />Fare Share, Norway 
+<br />
+<br />Deertrees Theatre is handicap accessible.
+<br />Free parking on the grounds.</p></div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>Deertrees Theatre</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>C.Randolph Parker (house manager)</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:deertrees@usa.net"><span>deertrees@usa.net</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207 583 6747</span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">Summer Piano Festival at Gould Academy</h3>
+           <h3 style="float: right;">
+            <span>07/07</span>
+            
+           </h3>
+          <div style="clear: both;" />
+          
+          <div style="position: relative;">Free piano recitals, July 1-20, 2007 at Gould Academy, an all-Steinway school!
+</div>
+          <br />
+          <div style="position: relative;" class="stx"><p>
+
+</p><p>Saturday, July 7, 7 p.m., 
+Bingham Hall</p><p>Distinguished Russian pianist and Master Teacher, Tamara
+Poddubnaya, and her students present free public recitals.</p>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+<p>FULL SCHEDULE:<br />Saturday, July 7, 7 p.m., 
+Bingham Hall<br />Wednesday, July 11, 7 p.m., 
+Bingham Hall<br />Friday, July 13, 7 p.m., 
+Bingham Hall<br />Wednesday, July 18, 7 p.m., 
+Bingham Hall<br />Friday, July 20, 7 p.m., 
+<strong>McLaughlin Science Center, Trustees' Auditorium</strong></p><p><br /></p><p><br /></p><br /><p><br />
+</p>
+
+</div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>Bingham Hall, Gould Academy, Bethel, Maine</span>
+              </td>
+            </tr>
+            
+            
+            
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">5th Annual Skunk Run</h3>
+           <h3 style="float: right;">
+            <span>07/28</span>
+            
+           </h3>
+          <div style="clear: both;" />
+          <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+          </div>
+          <div style="position: relative;">SATURDAY, July 28,2007 -- Benefiting the Sandon A. Morgan Memorial Scholarship Fund awarded exclusively at Telstar Regional High School, Bethel, Maine. The scholarship is awarded each year to a graduating senior at Telstar to attend CMCC in Auburn for 2 full years, all academics are covered. </div>
+          <br />
+          <div style="position: relative;" class="stx"><p>
+
+</p>
+
+<p>MOTORCYCLE RUN</p>
+
+
+
+
+
+
+
+
+
+<p>$10.00 includes run, bottled water, sandwich, chips &amp;
+FUN!<br />Registration 8:30am-9:45am<br />Vertical Outlaws Stunt Team to perform in the morning.<br />Run leaves at 10:00 am </p>
+
+<p>Ride through Bethel to Grafton Notch State Park, into New
+Hampshire and back to Greenwood (Locke Mills). Designated bathroom/rest &amp;
+gas stops. Great scenery and roads! All of our traffic is taken care of by our
+traffic control volunteers, so the run stays together for safety reasons. We
+also have a red Hummer leading the pack of bikes, as well as a tail vehicle.</p>
+
+
+
+<p> </p>
+
+
+
+
+
+
+
+
+
+
+
+<p>PIG ROAST/TURKEY FRY<br />3:00-5:00 PM<br />$10:00<br />Includes pig, turkey, summer salads, bean hole beans, rolls,
+watermelon, homemade desserts, and assorted beverages. BYOB.<br />Music, vendor showcase, Skunk Run T's and assorted items for
+sale. </p>
+
+
+
+<p>Directions:<br />From the south - go north from Gray on Route 26 to Bryant
+Pond, after sharp "S" turn with light, follow Rt. 26 for a few more
+miles. You will see North Pond on your right, take the 2nd right onto Gore
+Road.</p>
+
+
+
+<p>From the north - go west on Route 2 through Rumford to Route
+232 south. Turn right and travel north on Route 26 to Bryant Pond, after sharp
+"S" turn with light, follow Rt. 26 for a few more miles. You will see
+North Pond on your right, take the 2nd right onto Gore Road.</p>
+
+
+
+<p> From the west - take Route 2 east to Route 26 south to
+Greenwood (Locke Mills). Past Mt. Mica Rarities (purple building) take Gore
+Road on left.</p>
+
+
+
+<p>From the east - from Augusta, take Route 202 west to
+Route 133 to Route 219 to Route 26 North to Greenwood (Locke Mills). Past Mt.
+Mica Rarities (purple building) take Gore Road on left.</p><p><br /></p></div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>Gore Road, Greenwood, ME, just off Rt. 26</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>Mark</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:mdmorgandesigns@yahoo.com"><span>mdmorgandesigns@yahoo.com</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207.743.8254 or 207.890.6767</span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">The Bill &amp; Bo Winiker Quartet</h3>
+           <h3 style="float: right;">
+            <span>07/28</span>
+            
+           </h3>
+          <div style="clear: both;" />
+          <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+          </div>
+          <div style="position: relative;">Featuring jazz savant pianist Tony Deblois, this Boston based quartet embarks on an eclectic journey through the many styles of jazz including traditional, swing, bebop, jazzy takes on Broadway classics, world music and even some original compositions. Making music an uplifting and joyous experience.   Sponsored by Gordon Dexter and Barbara Grandolfo.  For further information and reservations please call the Deertrees Box Office at 207 583 6747 or visit www.deertreestheatre.org </div>
+          <br />
+          <div style="position: relative;" class="stx"><p>Saturday, July 28 at 8:00 pm
+<br />
+<br />$20
+<br />
+<br />The Box Office is open from 10 AM until 5 PM Tuesday through Saturday and one hour before performances.
+<br />
+<br />Tickets are also available at:
+<br />Books-N-Things, Bethel
+<br />The Cool Moose, Bridgton
+<br />Center Lovell Market, Lovell
+<br />The Country Sleigh, Naples
+<br />Fare Share, Norway 
+<br />
+<br />Deertrees Theatre is handicap accessible.
+<br />Free parking on the grounds.</p></div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Location:
+              </td>
+              <td>
+                 <span>Deertrees Theatre</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>C.Randolph Parker (house manager)</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:deertrees@usa.net"><span>deertrees@usa.net</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207 583 6747</span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         <hr />
+        
+        
+         <div>
+          <div style="clear: both;" />
+           <h3 style="float: left;">Tenth Annual Canoe and Kayak Outdoor Adventure Day Camp </h3>
+           <h3 style="float: right;">
+            <span>07/30</span>
+            <span>- 08/03</span>
+           </h3>
+          <div style="clear: both;" />
+          
+          <div style="position: relative;">Designed with young people in mind, all aspects of canoeing and kayaking will be taught, as well as some other adventure activities. This is a hands on active program! June 23rd - July 27th from 9am-3pm for ages 8-13. $175.00 for the week session.</div>
+          <br />
+          <div style="position: relative;" class="stx">Included in the session will be basic canoe and kayak strokes, rescue techniques, expeditioning by canoe, simple camping skills, simple white water techniques and other adventure activities. Participants will learn how to skillfully maneuver canoes and kayaks while exploring the many channels and islands on the river, and develop proficiency and confidence in all types of outdoor skills. Meet at Bethel Outdoor Adventure every morning and travel to local lakes , ponds, islands, and the Androscoggin River. To sign up call 207.824.4224 or info@betheloutdooradventure.com
+Event Starts: July 30, 2007  
+Event Ends: August 3, 2007  
+ 
+</div>
+          <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+            
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Name:
+              </td>
+              <td>
+                 <span>Jeff and Pattie Parsons</span>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact E-mail: 
+              </td>
+              <td>
+                <a href="mailto:info@betheloutdooradventure.com"><span>info@betheloutdooradventure.com</span></a>
+              </td>
+            </tr>
+            <tr>
+              <td style="border-right: 1px solid grey;">
+                Contact Phone:
+              </td>
+              <td>
+                 <span>207.824.4224  </span>
+              </td>
+            </tr>
+          </table>
+          
+         </div>
+         
+        
+    </div>
+
+    <hr />
+
+  </div>
+
+                    
+                      <div class="discussion">
+    
+</div>
+                    
+
+                  </div>
+
+                </div>
+
+              
+            </td>
+            
+
+            
+            
+            
+          </tr>
+        </tbody>
+      </table>
+      
+
+      <div class="visualClear"><!-- --></div>
+
+
+      <hr class="netscape4" />
+
+      
+
+        <div id="portal-footer">
+
+<p>
+</p>
+
+</div>
+
+        <div id="portal-colophon">
+    <p>
+    Bethel Area Chamber of Commerce<br />
+    8 Station Place<br />
+    PO Box 1247<br />
+    Bethel, ME 04217<br />
+    Tel: 207.824.2282 or 800.442.5826 Fax: 207.824.7123<br />
+    Email: info@bethelmaine.com
+    </p>
+
+      
+    </div>
+      
+
+    </div>
+
+</body>
+</html>
+
+
diff --git a/layout/generic/crashtests/375831.html b/layout/generic/crashtests/375831.html
new file mode 100644
index 000000000..79c334738
--- /dev/null
+++ b/layout/generic/crashtests/375831.html
@@ -0,0 +1,11 @@
+<html>
+<head style="overflow: scroll; display: block;  float: right; ">
+</head>
+<body>
+
+<script id="script">
+document.documentElement.setAttribute('style', 'overflow: scroll;  ');
+document.getElementsByTagName('head')[0].removeAttribute('style');
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/376419.html b/layout/generic/crashtests/376419.html
new file mode 100644
index 000000000..fd6267c94
--- /dev/null
+++ b/layout/generic/crashtests/376419.html
@@ -0,0 +1,28 @@
+<html><head>
+<style>
+*::first-line { }
+*::after { content:"anonymous text"; border:3px solid black;}
+*::before { content:"before text"; border:3px solid black;font-size: 10px;}
+</style>
+</head>
+<body>
+<div style="-moz-column-count: 2; width: 1400px;">
+  &#1593; tesxt
+  <span>
+    &#1593; tesxt &#1593; tesxt &#1593; tesxt 
+    <span>
+      &#1593; tesxt &#1593; tesxt &#1593; tesxt &#1593; tesxt 
+    </span>
+ </span>
+<div style="-moz-column-count: 2;">
+<div style="-moz-column-count: 2; white-space: nowrap;">
+<div style="-moz-column-count: 2;">
+<span>
+&#1593; tesxt &#1593; tesxt &#1593; tesxt 
+</span>
+</div>
+</div>
+</div>
+</div>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/377522.html b/layout/generic/crashtests/377522.html
new file mode 100644
index 000000000..418fb8552
--- /dev/null
+++ b/layout/generic/crashtests/377522.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+<script>
+
+function boom() { 
+  var div = document.getElementById('div');
+  div.appendChild(document.createTextNode(String.fromCharCode(8238)));
+  div.appendChild(document.createTextNode(String.fromCharCode(50377)));
+  div.appendChild(document.createTextNode(String.fromCharCode(50)));
+  div.textContent = div.textContent.slice(1);
+}
+
+</script>
+</head>
+<body onload="boom()">
+<div id="div" style="word-spacing:2px; text-align:right">x</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/37757-1.html b/layout/generic/crashtests/37757-1.html
new file mode 100644
index 000000000..9a7ddab5d
--- /dev/null
+++ b/layout/generic/crashtests/37757-1.html
@@ -0,0 +1 @@
+<p style="font-size: 1px">Text</p>
diff --git a/layout/generic/crashtests/379217-1.xhtml b/layout/generic/crashtests/379217-1.xhtml
new file mode 100644
index 000000000..0614b9a54
--- /dev/null
+++ b/layout/generic/crashtests/379217-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<button style="width: 3em;"><b>aaa<u>bbb<p style="float: left"/></u></b></button>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/379217-2.xhtml b/layout/generic/crashtests/379217-2.xhtml
new file mode 100644
index 000000000..8a8b32693
--- /dev/null
+++ b/layout/generic/crashtests/379217-2.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body style="width: 1px;">
+
+<span>x
+<span style="border: 1px dotted red;"><span style="float: left;"></span></span></span>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/379917-1.xhtml b/layout/generic/crashtests/379917-1.xhtml
new file mode 100644
index 000000000..a99bd7f4a
--- /dev/null
+++ b/layout/generic/crashtests/379917-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" 
+      xmlns:math="http://www.w3.org/1998/Math/MathML"
+      class="reftest-wait">
+<head>
+<script>
+
+// This testcase uses long timeouts to make sure the marquee has a chance to animate.
+
+function boom()
+{
+  var div1 = document.getElementById("div1");
+  var marquee = document.getElementById("marquee");
+
+  div1.parentNode.removeChild(div1);
+  marquee.width = 4;
+  
+  setTimeout(done, 100);
+}
+
+function done()
+{
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 100);">
+
+<math:math><div id="div1"/>x&#1506;</math:math>
+<marquee id="marquee">m</marquee>
+<div/>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/380012-1.html b/layout/generic/crashtests/380012-1.html
new file mode 100644
index 000000000..6cd7e1018
--- /dev/null
+++ b/layout/generic/crashtests/380012-1.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+
+<style>
+  .fl:first-line { }
+  .inh { position: inherit; }
+  .abs { position: absolute; }
+</style>
+ 
+<script>
+
+var x, y;
+
+function boom()
+{
+  x = document.getElementById("x");
+  y = document.getElementById("y");
+
+  x.setAttribute('class', "fl abs");
+  y.setAttribute('class', "inh");
+  setTimeout(boom2, 5);
+}
+
+function boom2()
+{
+  y.setAttribute('class', "abs");
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 5);">
+<div id="x">
+  <p id="y">foo</p>
+</div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/381152-1.html b/layout/generic/crashtests/381152-1.html
new file mode 100644
index 000000000..23ea97e6c
--- /dev/null
+++ b/layout/generic/crashtests/381152-1.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+<title>Bug 381152 - Hang with float, large padding and margin</title>
+</head>
+<body>
+<div style="float: left;padding-top: 9999999999px;">
+<div style="float: left;margin-top: 9999999999px;margin-bottom: -9999999px;">
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/381786-1.html b/layout/generic/crashtests/381786-1.html
new file mode 100644
index 000000000..fd2bc7dc9
--- /dev/null
+++ b/layout/generic/crashtests/381786-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="display:-moz-deck">
+  <div>
+    <span style="float: right; width: 0;">x</span>
+  </div>
+  <div style="position: relative;">
+    <span style="float: right;">
+      <span style="position: absolute;">y</span>
+    </span>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/382129-1.xhtml b/layout/generic/crashtests/382129-1.xhtml
new file mode 100644
index 000000000..0d52309f3
--- /dev/null
+++ b/layout/generic/crashtests/382129-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<p style="display: -moz-box;"><img style="-moz-appearance: checkbox" src="../../../testing/crashtest/images/tree.gif"/></p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/382131-1.html b/layout/generic/crashtests/382131-1.html
new file mode 100644
index 000000000..82941f2cb
--- /dev/null
+++ b/layout/generic/crashtests/382131-1.html
@@ -0,0 +1,25 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function crash()
+{
+  try {
+    window.getSelection().containsNode([], false);
+  } catch(e) { }
+
+  try {
+    window.getSelection().containsNode(null, false);
+  } catch(e) { }
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(crash, 10);">
+Foo
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/382199-1.html b/layout/generic/crashtests/382199-1.html
new file mode 100644
index 000000000..07aab1381
--- /dev/null
+++ b/layout/generic/crashtests/382199-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+
+<html style="display: table;">
+  <body>
+    <div style="float: left; border: 1px solid blue;">float</div>
+    <div style="position: absolute; border: 1px solid red;">absolute</div>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/382208-1.xhtml b/layout/generic/crashtests/382208-1.xhtml
new file mode 100644
index 000000000..5264b8845
--- /dev/null
+++ b/layout/generic/crashtests/382208-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<body>
+
+<div><math:mfrac><math:mmultiscripts/><math:mi/></math:mfrac></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/382262-1.html b/layout/generic/crashtests/382262-1.html
new file mode 100644
index 000000000..452e68a92
--- /dev/null
+++ b/layout/generic/crashtests/382262-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="-moz-column-count: 2;">
+a<span style="float: right">e<select></select></span> r
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/382396-1.xhtml b/layout/generic/crashtests/382396-1.xhtml
new file mode 100644
index 000000000..f334bbfdf
--- /dev/null
+++ b/layout/generic/crashtests/382396-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<body>
+
+<p style="text-indent: 0%">a<math:ms/></p>
+
+</body>																													
+</html>
diff --git a/layout/generic/crashtests/382745-1-binding.xml b/layout/generic/crashtests/382745-1-binding.xml
new file mode 100644
index 000000000..de8047e0c
--- /dev/null
+++ b/layout/generic/crashtests/382745-1-binding.xml
@@ -0,0 +1,3 @@
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="randomxbl" inheritstyle="false">
+<content><children><style xmlns="http://www.w3.org/1999/xhtml">*::before { content:"before text"; }\</style></children></content></binding></bindings>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/382745-1.xhtml b/layout/generic/crashtests/382745-1.xhtml
new file mode 100644
index 000000000..63c0c1704
--- /dev/null
+++ b/layout/generic/crashtests/382745-1.xhtml
@@ -0,0 +1,10 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<tree/>
+<tree style="-moz-binding:url(382745-1-binding.xml#randomxbl); position: fixed;">
+  <treecols>
+    <treecol style="-moz-binding:url(382745-1-binding.xml#randomxbl);"/>
+  </treecols>
+</tree>
+
+</window>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/383089-1.html b/layout/generic/crashtests/383089-1.html
new file mode 100644
index 000000000..c6497719b
--- /dev/null
+++ b/layout/generic/crashtests/383089-1.html
@@ -0,0 +1,86 @@
+<html style="width: 1px;" class="reftest-wait"><head style="float: left; position: fixed; display: initial;" id="head">
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+
+
+
+<script style="display: none;" type="text/javascript;version=1.7">
+
+var iter;
+var interv;
+
+function olo()
+{
+  iter = foo();
+  interv = setInterval(neext, 30);
+}
+
+function neext()
+{
+  try {
+    iter.next();
+  } catch (e if e instanceof StopIteration) {
+    clearInterval(interv);
+  }
+}
+
+function foo()
+{
+  var docElem = document.documentElement;
+  var head = document.getElementById("head");
+  var br1 = document.getElementById("br1");
+  var br2 = document.getElementById("br2");
+  var br3 = document.getElementById("br3");
+  var br4 = document.getElementById("br4");
+  var br5 = document.getElementById("br5");
+  var br6 = document.getElementById("br6");
+  var br7 = document.getElementById("br7");
+  var tableRow = document.getElementById("tableRow");
+      
+  br6.style.width = "1px";
+  br1.style.overflow = "visible";
+  head.style.cssFloat = "left";
+  br4.style.position = "static";
+  br7.style.color = "green";
+  br3.style.height = "auto";
+  yield;
+
+  br7.style.width = "2px";
+  yield;
+
+  br5.style.background = "yellow";
+  br7.style.color = "black";
+  yield;
+
+  br7.style.display = "table-cell";
+  head.style.position = "fixed";
+  br5.style.display = "inline";
+  br3.style.clear = "both";
+  br6.style.visibility = "visible";
+  yield;
+
+  tableRow.style.display = "list-item";
+  br3.style.width = "auto";
+  br2.style.clear = "none";
+  head.style.display = "initial"; // doesn't seem to crash when this is "block"!
+  docElem.style.width = "1px";
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<style>
+</style>
+
+</head><body onload="setTimeout(olo, 30);">
+
+<br style="overflow: visible;" id="br1">
+<br style="clear: none;" id="br2">
+<br style="height: auto; clear: both; width: auto;" id="br3">
+<br style="position: static;" id="br4">
+<br style="background: yellow none repeat scroll 0% 0%; background-clip: initial; background-origin: initial; display: inline;" id="br5">
+<br style="width: 1px; visibility: visible;" id="br6">
+<br style="color: black; width: 2px; display: table-cell;" id="br7">
+<table border="1"><tbody><tr style="display: list-item;" id="tableRow"><td>x</td></tr></tbody></table>
+
+</body></html>
diff --git a/layout/generic/crashtests/385265-1.xhtml b/layout/generic/crashtests/385265-1.xhtml
new file mode 100644
index 000000000..7994653ff
--- /dev/null
+++ b/layout/generic/crashtests/385265-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+  <mtable>
+    <mtr>
+      <mtd><mi>x</mi></mtd>
+    </mtr>
+  </mtable>
+</math>
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/385295-1.xhtml b/layout/generic/crashtests/385295-1.xhtml
new file mode 100644
index 000000000..734270d75
--- /dev/null
+++ b/layout/generic/crashtests/385295-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="letter-spacing: 1px; -moz-appearance: checkbox;">
+<body onload="document.getElementById('s').style.cssFloat = 'left';">
+<p style="float: left; direction: rtl">zzz yyy <span id="s">foo</span></p>
+</body>
+</html>
diff --git a/layout/generic/crashtests/385344-1.html b/layout/generic/crashtests/385344-1.html
new file mode 100644
index 000000000..7fbb7a73d
--- /dev/null
+++ b/layout/generic/crashtests/385344-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<style id="script">
+  body::first-letter {float: right; }
+</style>
+</head>
+<body>
+<dd style="white-space: -moz-pre-wrap;">m
+  <dt>m</dt>
+</dd>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/385344-2.html b/layout/generic/crashtests/385344-2.html
new file mode 100644
index 000000000..f22336d1b
--- /dev/null
+++ b/layout/generic/crashtests/385344-2.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+<style>body::first-letter {float: right; }
+</style>
+</head>
+<body>
+<span style="direction: rtl; unicode-bidi: embed;">*::first
+m</span>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/385414-1.html b/layout/generic/crashtests/385414-1.html
new file mode 100644
index 000000000..1b86f7bdc
--- /dev/null
+++ b/layout/generic/crashtests/385414-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<div style="font-variant: small-caps">&shy;</div>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/385414-2.html b/layout/generic/crashtests/385414-2.html
new file mode 100644
index 000000000..d2d8c5e28
--- /dev/null
+++ b/layout/generic/crashtests/385414-2.html
@@ -0,0 +1,5 @@
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+</head><body>
+<div style="font-variant: small-caps;">&shy; </div>
+</body></html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/385426-1.html b/layout/generic/crashtests/385426-1.html
new file mode 100644
index 000000000..534e1cef2
--- /dev/null
+++ b/layout/generic/crashtests/385426-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<div><span>&#8238;</span><span>&shy;</span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/385526.html b/layout/generic/crashtests/385526.html
new file mode 100644
index 000000000..629f7cfe3
--- /dev/null
+++ b/layout/generic/crashtests/385526.html
@@ -0,0 +1,116 @@
+<html class="reftest-wait"><head>
+<style>
+*::first-line { font-size:310%; }
+</style>
+</head>
+<body style="display: inline; white-space: nowrap;">
+<span>mmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm�mmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm!mmmmmmm
+
+mmmmmmmm mmmmmmmmmmmmmmmm
+m
+  mm mmmmmmm m mmmmmmmm mmmmmm mmmm mmmmmm mmmmmmm m mmmmmmmmmmm mmm m mmmm mmmmmmmmmmm mmmm mmmmmmmmmmmmm mmm mmmm m mmmm m mmmmmmmm
+  mm mmmmmmm mm mm mmmmmm mm mmmm mmmmmm m mmmmmmmmmmmm mmmm
+  mmmmmmmm mmmmmmmmm m
+	mmmm m mmmmmmmmmm m mmmmmm m mmmmmmmmm
+	mmmmmm mmmmmmmmmmmmmmmm
+  mm
+
+  mm mmmmmmm m mmmmmmmm mmmmmm mmmmmmm mm mmm mmmmm mmm mm mm mmmm mmmmmmmmm
+  mmmmmmmm mmmmmmmmmmmmmm m
+	mmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+  mm
+  
+  mmmmmm mmmmmmm
+m
+
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmm mmm m mmmmmmmmmmmmmmmmmmmmmmm
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm�mmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmm mmmmmmmmmmm ?mmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm m mmmmmmmmmmmmmmm mmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm\mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm�mmmmmmmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm�mmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmm mmmmmmmmmmm mmmmmm!mmmmmmm
+
+mmmmmmmm mmmmmmmmmmmmmmmm
+m
+  mm mmmmmmm m mmmmmmmm mmmmmm mmmm mmmmmm mmmmmmm m mmmmmmmmmmm mmm m mmmm mmmmmmmmmmm mmmm mmmmmmmmmmmmm mmm mmmm m mmmm m mmmmmmmm
+  mm mmmmmmm mm mm mmmmmm mm mmmm mmmmmm m mmmmmmmmmmmm mmmm
+  mmmmmmmm mmmmmmmmm m
+	mmmm m mmmmmmmmmm m mmmmmm m mmmmmmmmm
+	mmmmmm mmmmmmmmmmmmmmmm
+  mm
+
+  mm mmmmmmm m mmmmmmmm mmmmmm mmmmmmm mm mmm mmmmm mmm mm mm mmmm mmmmmmmmm
+  mmmmmmmm mmmmmmmmmmmmmm m
+	mmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+  mm
+  
+  mmmmmm mmmmmmm
+m
+
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmm mmm m mmmmmmmmmmmmmmmmmmmmmmm
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm�mmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmm m mmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm�mmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmm mmmmmmmmmmmmm^mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm!mmmmmmm
+
+mmmmmmmm mmmmmmmmmmmmmmmm
+m
+  mm mmmmmmm m mmmmmmmm mmmmmm mmmm mmmmmm mmmmmmm m mmmmmmmmmmm mmm m mmmm mmmmmmmmmmm mmmm mmmmmmmmmmmmm mmm mmmm m mmmm m mmmmmmmm
+  mm mmmmmmm mm mm mmmmmm mm mmmm mmmmmm m mmmmmmmmmmmm mmmm
+  mmmmmmmm mmmmmmmmm m
+	mmmm m mmmmmmmmmm m mmmmmm m mmmmmmmmm
+	mmmmmm mmmmmmmmmmmmmmmm
+  mm
+
+  mm mmmmmmm m mmmmmmmm mmmmmm mmmmmmm mm mmm mmmmm mmm mm mm mmmm mmmmmmmmm
+  mmmmmmmm mmmmmmmmmmmmmm m
+	mmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+  mm
+  
+  mmmmmm mmmmmmm
+m
+
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmm mmm m mmmmmmmmmmmmmmmmmmmmmmm
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmm mmmm mmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmm mmmmmmmmmmmmmҰm�mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmm mmmm mmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmm mmmmmmm mmmmmmmmm mmmmmmmmmmmm�mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmmmmmmmmmmmmmmmmmmmmmmmmm
+</span>
+<script>
+function finish() {
+  document.documentElement.removeAttribute('class');
+}
+function doe(){
+  document.body.removeAttribute('style');
+  setTimeout(finish, 100);
+}
+setTimeout(doe,300,0);
+</script>
+</body></html>
diff --git a/layout/generic/crashtests/385681.html b/layout/generic/crashtests/385681.html
new file mode 100644
index 000000000..43707f65c
--- /dev/null
+++ b/layout/generic/crashtests/385681.html
@@ -0,0 +1,34 @@
+<html><head>
+<title></title>
+<style>
+a  {
+ font-variant: small-caps; 
+}
+a:hover { 
+  color: red;
+}
+</style>
+</head>
+<body>
+<a href="#">home</a><br>
+<a href="#">login</a><br>
+<a href="#">signup</a><br>
+
+<script>
+function doe(i) {
+if (!i) {
+  document.links[1].style.color='red';
+	document.links[0].offsetHeight;
+	document.links[0].style.color = 'red';
+	}
+else {
+  document.links[1].style.color='blue';
+	document.links[0].style.color = 'blue';
+	}
+setTimeout(doe, 100, !i);
+}
+setTimeout(doe, 500, true);
+</script>
+</body>
+
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/385885-1.xul b/layout/generic/crashtests/385885-1.xul
new file mode 100644
index 000000000..e36a41034
--- /dev/null
+++ b/layout/generic/crashtests/385885-1.xul
@@ -0,0 +1,19 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom()">
+        
+<script>
+<![CDATA[
+
+function boom()
+{
+  var de = document.documentElement; 
+  
+  de.style.MozBinding = "url('data:text/xml,<bindings xmlns=%22http://www.mozilla.org/xbl%22><binding id=%22foo%22><content></content></binding></bindings>')";
+
+  document.removeChild(de);
+  document.appendChild(de);
+}
+
+]]>
+</script>
+
+</window>
diff --git a/layout/generic/crashtests/386799-1.html b/layout/generic/crashtests/386799-1.html
new file mode 100644
index 000000000..2fd2eb130
--- /dev/null
+++ b/layout/generic/crashtests/386799-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <canvas style="padding: 6px; width: 0px;"></canvas>
+  <div style="overflow: scroll;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/386807-1.html b/layout/generic/crashtests/386807-1.html
new file mode 100644
index 000000000..af8169d8a
--- /dev/null
+++ b/layout/generic/crashtests/386807-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+  
+function boom()
+{
+  s = document.getElementById("s");
+  document.body.insertBefore(document.createTextNode("\n"), s);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+<span id="s" style="text-transform: uppercase;">
+</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/386812-1.html b/layout/generic/crashtests/386812-1.html
new file mode 100644
index 000000000..52a4526fe
--- /dev/null
+++ b/layout/generic/crashtests/386812-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom() {
+  document.body.style.textIndent = "0%";
+}
+</script>
+
+<style>
+body { float: left; }
+.c { padding-left: 60%; padding-right: 60%; white-space: pre; }
+.f { float: left; height: 2em; }
+</style>
+</head>
+
+<body onload="boom()">
+
+<div class="c"> <div class="f">a</div>
+ <div class="f">b</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/386827-1.html b/layout/generic/crashtests/386827-1.html
new file mode 100644
index 000000000..fa1ed96b2
--- /dev/null
+++ b/layout/generic/crashtests/386827-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+  document.getElementById("d1").appendChild(document.createElement("span"));
+  document.getElementById("d2").style.direction = "rtl";
+}
+</script>
+</head>
+<body onload="boom()">
+<div id="d1" style="-moz-column-width: 1em;">a b c d</div>
+<div id="d2"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387058-1.html b/layout/generic/crashtests/387058-1.html
new file mode 100644
index 000000000..5a3eebcaa
--- /dev/null
+++ b/layout/generic/crashtests/387058-1.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+<script>
+function boom()
+{
+  document.getElementById("div").style.letterSpacing = "";
+}
+</script>
+</head>
+<body onload="boom()" style="font-family: monospace; width: 20em;">
+<div id="div" style="white-space: pre-wrap; letter-spacing: 3em;">
+  x x x x x x
+  x x x x x x
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387058-2.html b/layout/generic/crashtests/387058-2.html
new file mode 100644
index 000000000..eb5087aed
--- /dev/null
+++ b/layout/generic/crashtests/387058-2.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<script>
+function boom()
+{
+  document.getElementById("div").style.letterSpacing = "";
+}
+</script>
+</head>
+
+<body onload="boom()" style="font-family: monospace; width: 3em;">
+<div id="div" style="white-space: pre-wrap; letter-spacing: 1em;">
+ x
+
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387088-1.html b/layout/generic/crashtests/387088-1.html
new file mode 100644
index 000000000..a92708188
--- /dev/null
+++ b/layout/generic/crashtests/387088-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<div style="line-height: 30760827em;">x</div>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/387209-1.html b/layout/generic/crashtests/387209-1.html
new file mode 100644
index 000000000..c6ac101d9
--- /dev/null
+++ b/layout/generic/crashtests/387209-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: table-header-group; overflow: scroll; top: 10%;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387213-1.html b/layout/generic/crashtests/387213-1.html
new file mode 100644
index 000000000..1b3fd1041
--- /dev/null
+++ b/layout/generic/crashtests/387213-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+  <div style="position: fixed; overflow: scroll;">
+    <div style="position: fixed;"></div>
+  </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387215-1.xhtml b/layout/generic/crashtests/387215-1.xhtml
new file mode 100644
index 000000000..ba14e6766
--- /dev/null
+++ b/layout/generic/crashtests/387215-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+<div style="float: left; height: 18000000px"></div>
+<p style="clear: left;"/>
+<div>
+  <div style="float: right; height: 100px;">a</div>
+  <div style="float: right; height: 18000000px;"></div>
+  <p/>
+</div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/387219-1.xhtml b/layout/generic/crashtests/387219-1.xhtml
new file mode 100644
index 000000000..043932407
--- /dev/null
+++ b/layout/generic/crashtests/387219-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<style id="s"></style>
+</head>
+<body onload="document.getElementById('s').appendChild(document.createTextNode('#sb { display: list-item; }'));">
+<xul:scrollbox id="sb"/>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387233-1.html b/layout/generic/crashtests/387233-1.html
new file mode 100644
index 000000000..3ea2c0544
--- /dev/null
+++ b/layout/generic/crashtests/387233-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="display: -moz-inline-box;">
+  <table style="height: 200%;">
+    <tr>
+      <td></td>
+    </tr>
+  </table>
+  <div>
+    c
+    <div style="height: 200%;">
+    </div>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/387233-2.html b/layout/generic/crashtests/387233-2.html
new file mode 100644
index 000000000..fdad7e872
--- /dev/null
+++ b/layout/generic/crashtests/387233-2.html
@@ -0,0 +1,18 @@
+<html>
+<body>
+
+<div style="display: -moz-inline-box; background: yellow;">
+  <table style="height: 101%; background: lightgreen;">
+    <tr>
+      <td></td>
+    </tr>
+  </table>
+  <div>
+    c
+    <div style="height: 100%; background: lightblue;">
+    </div>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/387282-1.html b/layout/generic/crashtests/387282-1.html
new file mode 100644
index 000000000..a82983d09
--- /dev/null
+++ b/layout/generic/crashtests/387282-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<div id="b" style="float: left; height: 18000000px; overflow: scroll;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/388175-1.html b/layout/generic/crashtests/388175-1.html
new file mode 100644
index 000000000..9e9a2879f
--- /dev/null
+++ b/layout/generic/crashtests/388175-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+  document.getElementById("tr").focus();
+  document.getElementById("b").focus();
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(boom, 30);">
+
+<table border="1">
+  <tbody dir="rtl">
+    <tr id="tr" contenteditable="true"><td>a</td><td contenteditable="false">
+      <div id="b" contenteditable="true">b</div>
+    </td></tr>
+  </tbody>
+</table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/388367-1.html b/layout/generic/crashtests/388367-1.html
new file mode 100644
index 000000000..6c368fcc4
--- /dev/null
+++ b/layout/generic/crashtests/388367-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<pre style="direction: rtl;">&#12;</pre>
+</body>
+</html>
diff --git a/layout/generic/crashtests/388709-1.html b/layout/generic/crashtests/388709-1.html
new file mode 100644
index 000000000..29d01955b
--- /dev/null
+++ b/layout/generic/crashtests/388709-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<style>
+#d:after { content: 'a'; }
+#d:first-letter { float: right; }
+</style>
+</head>
+
+<body>
+<div id="d"></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/389635-1.html b/layout/generic/crashtests/389635-1.html
new file mode 100644
index 000000000..dffd61a4a
--- /dev/null
+++ b/layout/generic/crashtests/389635-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="position: fixed; overflow-x: scroll;">
+  <div style="padding: 0%;">
+    <div style="position: fixed;"></div>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/390050-1.html b/layout/generic/crashtests/390050-1.html
new file mode 100644
index 000000000..625f7cbb1
--- /dev/null
+++ b/layout/generic/crashtests/390050-1.html
@@ -0,0 +1,48 @@
+<html>
+<head>
+<style type="text/css">
+/*<![CDATA[*/
+
+body {
+  font-size: 62.5%; /* Resets 1em to 10px */
+}
+
+#content { font-size: 1.2em; }
+
+.entry p { font-size: 1.05em; }
+
+.entry {
+ -moz-column-width: 25em;
+ -moz-column-gap: 3em;
+}
+
+.entry img {
+  float: left;
+  margin: 3px 10px;
+}
+
+.alt {
+  padding: 10px;
+}
+
+#content {
+  margin-left:  20px;
+  margin-right: 260px;
+  padding: 0 17px 20px 17px;
+}
+
+
+/*]]>*/
+</style>
+</head>
+<body>
+<div id="content" class="entry">
+
+<img width="222" height="164">
+
+				<p class="alt">
+,  .You can follow any responses the
+				</p>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/390050-2.html b/layout/generic/crashtests/390050-2.html
new file mode 100644
index 000000000..66dbde2dd
--- /dev/null
+++ b/layout/generic/crashtests/390050-2.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html>
+<head>
+<style type="text/css">
+.entry {
+ -moz-column-width: 25em;
+ -moz-column-gap: 3em;
+}
+</style>
+
+</script>
+
+</head>
+<body><div class="entry">
+<p>Edit: Wow, quick response there!  Thanks for the pointers guys, looks like the dbginfo
+packages are there, just take a bit to get to.  I had installed the dbg packages (or at
+least some of them, the ones that I saw with apt-cache search dbg that were relevant), but
+there wasn&#8217;t coverage for some packages &#8212; in particular the x server.  I&#8217;m
+going to try Travis&#8217;s suggestion, thanks!</p>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/390050-3.html b/layout/generic/crashtests/390050-3.html
new file mode 100644
index 000000000..a5cb5da4d
--- /dev/null
+++ b/layout/generic/crashtests/390050-3.html
@@ -0,0 +1,4 @@
+<div class="entry" style="margin-right: 260px; padding: 0 17px; -moz-column-width: 25em; -moz-column-gap: 3em">
+<img width="222" style="float: left; margin: 3px 10px;">
+<p style="padding: 10px; font-size: 1.05em;">ABCDEF GHI JKLMNOPQR</p>
+</div>
diff --git a/layout/generic/crashtests/390762-1.html b/layout/generic/crashtests/390762-1.html
new file mode 100644
index 000000000..4ef39654e
--- /dev/null
+++ b/layout/generic/crashtests/390762-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<script>
+function boom()
+{
+  var s = document.getElementById("s");
+  var t = document.getElementById("t");
+
+  s.parentNode.removeChild(s);
+  t.style.display = "none";
+}
+</script>
+
+<style id="s">
+.float { float: right; height: 1em; }
+</style>
+
+<style>
+#t { border: 1px solid green; }
+</style>
+
+</head>
+
+<body onload="boom();">
+<div style="-moz-column-count: 2;"><div id="t" class="float"></div></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/391053-1.xhtml b/layout/generic/crashtests/391053-1.xhtml
new file mode 100644
index 000000000..7a971bcd1
--- /dev/null
+++ b/layout/generic/crashtests/391053-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<div>
+  <select>
+    <option style="margin: 100%;">A</option>
+    <optgroup label="outgroup" style="padding: 10%;">
+      <option style="padding: 10%;">M</option>
+    </optgroup>
+  </select>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/391894-1.html b/layout/generic/crashtests/391894-1.html
new file mode 100644
index 000000000..2753e8511
--- /dev/null
+++ b/layout/generic/crashtests/391894-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style>
+
+#q:first-line { }
+
+</style>
+
+</head>
+<body style="-moz-column-width: 0em">
+
+<div id="q">a b c<span style="float: right;"></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/392698-1.html b/layout/generic/crashtests/392698-1.html
new file mode 100644
index 000000000..9a2d4f237
--- /dev/null
+++ b/layout/generic/crashtests/392698-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script type="application/javascript">
+window.onload = function()
+{
+  document.getElementById("i")
+          .setAttribute("width", 100);
+};
+  </script>
+</head>
+<body>
+<iframe src="data:text/html,&lt;div style='position:fixed'&gt;foo&lt;/div&gt;"
+        id="i" width="75" height="150"></iframe>
+</body>
+</html>
diff --git a/layout/generic/crashtests/393758-1.xhtml b/layout/generic/crashtests/393758-1.xhtml
new file mode 100644
index 000000000..4c90a55f2
--- /dev/null
+++ b/layout/generic/crashtests/393758-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+span { letter-spacing: 1em; unicode-bidi: bidi-override; }
+</style>
+</head>
+<body>
+<table><tbody><tr><td><span>הG</span></td></tr></tbody></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/393906-1.html b/layout/generic/crashtests/393906-1.html
new file mode 100644
index 000000000..22fcfa387
--- /dev/null
+++ b/layout/generic/crashtests/393906-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<script>
+function boom()
+{
+  document.getElementById("div").setAttribute("dir", "rtl");
+}
+</script>
+<body onload="boom()">
+<div id="div" style="width: 0;"> Foo a bar baz</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/393923-1.html b/layout/generic/crashtests/393923-1.html
new file mode 100644
index 000000000..44c886d7d
--- /dev/null
+++ b/layout/generic/crashtests/393923-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+  div::first-letter { color: magenta; }
+</style>
+</head>
+
+<body style="direction: rtl;">
+
+<div>
+ AB</div>
+ 
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/393956-1.html b/layout/generic/crashtests/393956-1.html
new file mode 100644
index 000000000..77f00ae56
--- /dev/null
+++ b/layout/generic/crashtests/393956-1.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<style>
+body {
+  -moz-column-count: 2;
+}
+#x {
+  height: 20px;
+}
+#y {
+  height: 80px;
+}
+</style>
+
+<script>
+function boom()
+{
+  document.getElementById("x").style.content = "'0'";
+}
+</script>
+</head>
+
+<body onload="boom();"><div id="x"><div id="y"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/393956-2.html b/layout/generic/crashtests/393956-2.html
new file mode 100644
index 000000000..3260178e8
--- /dev/null
+++ b/layout/generic/crashtests/393956-2.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<style>
+body {
+  height: 40px;
+  -moz-column-count: 2;
+}
+#x {
+  height: 20px;
+}
+#y {
+  height: 80px;
+}
+</style>
+
+<script>
+function boom()
+{
+  document.getElementById("x").style.content = "'0'";
+}
+</script>
+</head>
+
+<body onload="boom();"><div id="x"><div id="y"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/393956-3.html b/layout/generic/crashtests/393956-3.html
new file mode 100644
index 000000000..afa5ab683
--- /dev/null
+++ b/layout/generic/crashtests/393956-3.html
@@ -0,0 +1,11 @@
+<html>
+<head><style>
+body { -moz-column-count: 1; }
+#x   { height: 1px; }
+#y   { height: 2px; }
+
+</style></head>
+
+<body><div id="x"><div id="y"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/393956-4.html b/layout/generic/crashtests/393956-4.html
new file mode 100644
index 000000000..fe16ea146
--- /dev/null
+++ b/layout/generic/crashtests/393956-4.html
@@ -0,0 +1,11 @@
+<html>
+<head><style>
+body { -moz-column-count: 2; }
+#x   { height: 1px; }
+#y   { height: 2px; }
+
+</style></head>
+
+<body><div id="x"><div id="y"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/394237-1.html b/layout/generic/crashtests/394237-1.html
new file mode 100644
index 000000000..53bbc16f6
--- /dev/null
+++ b/layout/generic/crashtests/394237-1.html
@@ -0,0 +1,38 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+
+body {
+  height: 50px;
+  -moz-column-count: 2;
+}
+.container {
+  height: 10px;
+}
+.overflow {
+  height: 100px;
+}
+.bb {
+  border-bottom: solid 4px magenta;
+}
+
+</style>
+
+<script>
+
+function boom()
+{
+  document.getElementById("x").setAttribute("class", "");
+  document.getElementById("y").setAttribute("class", "bb");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+  <div class="container"><div class="overflow" id="x"></div></div>
+  <div id="y"></div>
+  <div class="container"><div class="overflow"></div></div>
+</body>
+  
+</html>
diff --git a/layout/generic/crashtests/394818-1.html b/layout/generic/crashtests/394818-1.html
new file mode 100644
index 000000000..a6a6fdba8
--- /dev/null
+++ b/layout/generic/crashtests/394818-1.html
@@ -0,0 +1,13 @@
+<html class="reftest-wait"><head>
+</head><body>
+<iframe></iframe><iframe></iframe>
+<script>
+window.frames[0].focus();
+function doe() {
+document.body.setAttribute('onbeforecopy','document.removeChild(document.documentElement)');
+document.body.setAttribute('style','display:none');
+document.documentElement.removeAttribute("class");
+}
+setTimeout(doe, 100);
+</script>
+</body></html>
diff --git a/layout/generic/crashtests/394818-2.html b/layout/generic/crashtests/394818-2.html
new file mode 100644
index 000000000..6aa00e275
--- /dev/null
+++ b/layout/generic/crashtests/394818-2.html
@@ -0,0 +1,16 @@
+<html class="reftest-wait"><head><script>
+  function load() {
+    window.frames[0].focus();
+    setTimeout("load2();", 100);
+  }
+  function load2() {
+    document.body.setAttribute('style','display: inline');
+    document.documentElement.removeAttribute("class");
+  }
+  function beforeCopy() {
+    document.removeChild(document.documentElement);
+  }
+</script></head>
+<body onload="load();" 
+      onbeforecopy="beforeCopy();"><iframe></iframe></body>
+</html>
diff --git a/layout/generic/crashtests/394820-1.html b/layout/generic/crashtests/394820-1.html
new file mode 100644
index 000000000..0c012877c
--- /dev/null
+++ b/layout/generic/crashtests/394820-1.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var d = document.getElementById("d");
+  d.style.direction = "rtl";
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id=d style="white-space: pre;">
+e
+
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/395316-1.html b/layout/generic/crashtests/395316-1.html
new file mode 100644
index 000000000..60c291075
--- /dev/null
+++ b/layout/generic/crashtests/395316-1.html
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  document.getElementById("float").style.cssFloat = "";
+}
+</script>
+</head>
+<body onload="boom();">
+<div style="-moz-column-count: 2; width: 3ch;"><span><span id="float" style="float: right;">za za za za za za za za</span></span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/395450-1.xhtml b/layout/generic/crashtests/395450-1.xhtml
new file mode 100644
index 000000000..79510267b
--- /dev/null
+++ b/layout/generic/crashtests/395450-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<head>
+<style>
+
+/*
+  This testcase uses [class~="foo"] instead of .foo to work around bug 276267
+  (see bug 379178 comment 78)
+*/
+
+[class~="abs"] { position: absolute; }
+[class~="marg"] { margin: 1em; }
+[class="noheight"] {  height: 0; }
+
+</style>
+</head>
+
+<body>
+
+<math:mrow class="noheight">
+  <span class="abs">
+    <math:mroot class="abs marg" />
+    <span class="abs" />
+  </span>
+</math:mrow>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/397007-1.html b/layout/generic/crashtests/397007-1.html
new file mode 100644
index 000000000..628733ba6
--- /dev/null
+++ b/layout/generic/crashtests/397007-1.html
@@ -0,0 +1,37 @@
+<html>
+<head>
+<script type="text/javascript">
+function boom()
+{
+  var img = document.createElement("img");
+  document.getElementById("g").appendChild(img);
+  img.width = 1;
+}
+
+</script>
+
+<style type="text/css">
+
+.margin {
+  margin: 1em 0;
+}
+
+.dd:before {
+  white-space: pre;
+  line-height: 0;
+  content: "b";
+}
+
+</style>
+
+</head>
+
+<body onload="boom();">
+<div style="-moz-column-count: 2;">
+  X
+  <div class="margin">y</div>
+  <span><span id="g"></span>&shy;<div class="margin"></div><span class="dd"><div></div></span></span>
+</div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/397187-1.html b/layout/generic/crashtests/397187-1.html
new file mode 100644
index 000000000..7227a4823
--- /dev/null
+++ b/layout/generic/crashtests/397187-1.html
@@ -0,0 +1,32 @@
+<html class="reftest-wait">
+<head>
+<style type="text/css">
+
+.a:first-letter { float: right; }
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+  document.body.style.overflow = "auto";
+  document.body.className = "a";
+  
+  setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+  var span = document.createElement("span");
+  document.body.appendChild(span);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();">&#65207;
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/397844-1.xhtml b/layout/generic/crashtests/397844-1.xhtml
new file mode 100644
index 000000000..3ad9b8464
--- /dev/null
+++ b/layout/generic/crashtests/397844-1.xhtml
@@ -0,0 +1,55 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<style type="text/css">
+.pad { padding: 3ch; }
+.fl:first-letter { }
+</style>
+
+
+<style id="s" type="text/css"></style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("td").nextSibling.splitText(11);
+  document.getElementById("td").style.padding = "11px";
+  
+  setTimeout(boom2, 10);
+}
+
+function boom2()
+{
+  document.body.style.counterReset = "chicken";
+  
+  setTimeout(boom3, 10);
+}
+
+function boom3()
+{
+  document.getElementById("s").textContent = "#xxx { }";
+  
+  setTimeout(boom4, 10);
+}
+
+function boom4()
+{
+  document.getElementById("td").style.padding = "";
+  setTimeout(boom5, 10);
+}
+
+function boom5()
+{
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body style="width: 10em;" dir="rtl" onload="boom();">
+
+<div class="pad fl"><span><td class="pad fl" id="td"><span>abcd</span></td>ghi jklmnop 2 qrs tuvwxy</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/397844-2.xhtml b/layout/generic/crashtests/397844-2.xhtml
new file mode 100644
index 000000000..d97600812
--- /dev/null
+++ b/layout/generic/crashtests/397844-2.xhtml
@@ -0,0 +1,55 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<style type="text/css">
+.pad { padding: 3ch; }
+.fl:first-letter { }
+td { border: 1px solid green }
+</style>
+
+<style id="s" type="text/css"></style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("td").nextSibling.splitText(6);
+  document.getElementById("td").style.padding = "2px";
+  
+  setTimeout(boom2, 10);
+}
+
+function boom2()
+{
+  document.body.style.counterReset = "chicken";
+  
+  setTimeout(boom3, 10);
+}
+
+function boom3()
+{
+  document.getElementById("s").textContent = "#xxx { }";
+  
+  setTimeout(boom4, 10);
+}
+
+function boom4()
+{
+  document.getElementById("td").style.padding = "";
+  setTimeout(boom5, 10);
+}
+
+function boom5()
+{
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body style="font-family: monospace; width: 14ch; border: 1px solid orange;" dir="rtl" onload="boom();">
+
+<div class="pad fl"><span><td class="pad fl" id="td"><span>abcd</span></td>ghi jk 2</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/397852-1.xhtml b/layout/generic/crashtests/397852-1.xhtml
new file mode 100644
index 000000000..cafb82d9c
--- /dev/null
+++ b/layout/generic/crashtests/397852-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.getElementById('o').style.overflow = 'auto';">
+
+<td></td><div id="o"><table style="margin: 100%;"></table></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/398181-1.html b/layout/generic/crashtests/398181-1.html
new file mode 100644
index 000000000..bc6445f5a
--- /dev/null
+++ b/layout/generic/crashtests/398181-1.html
@@ -0,0 +1,10 @@
+<html style="min-width: -moz-max-content;">
+  <head>
+  </head>
+  <body>
+    <div>
+      <span style="margin: 0 100%; display: inline-block;"></span>
+      t
+    </div>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/398181-2.html b/layout/generic/crashtests/398181-2.html
new file mode 100644
index 000000000..57402aeac
--- /dev/null
+++ b/layout/generic/crashtests/398181-2.html
@@ -0,0 +1,11 @@
+<html style="min-width: -moz-max-content;">
+  <head>
+  </head>
+  <body>
+    <div>
+      <span style="margin: 0 100%; display: inline-block;"></span>
+      t
+      <div style="float: left">foo</div>
+    </div>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/398322-1.html b/layout/generic/crashtests/398322-1.html
new file mode 100644
index 000000000..68f60ba3f
--- /dev/null
+++ b/layout/generic/crashtests/398322-1.html
@@ -0,0 +1,17 @@
+<html class="reftest-print">
+<head>
+<title>Testcase bug - Crash [@ nsFrameList::InsertFrame] on print preview with positioned elements and page-break-before</title>
+</head>
+
+<body>
+<div style="position: relative; page-break-before: always;">
+  <div style="display: list-item;"></div>
+  <div style="position: absolute;">
+    <div style=" position: absolute;">
+      <div style="page-break-before: always; height: 100px;"></div>
+    </div>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/398322-2.html b/layout/generic/crashtests/398322-2.html
new file mode 100644
index 000000000..74f82dae2
--- /dev/null
+++ b/layout/generic/crashtests/398322-2.html
@@ -0,0 +1,12 @@
+<html class="reftest-print">
+<head>
+<style>
+q::after { content:"anonymous text"; text-transform: uppercase;}
+</style>
+</head>
+<body>
+<div style="position: absolute; width: 50px; -moz-column-count: 2;">
+  <div style="position: absolute;"> <q> </q> </div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/398332-1.html b/layout/generic/crashtests/398332-1.html
new file mode 100644
index 000000000..d24d85c04
--- /dev/null
+++ b/layout/generic/crashtests/398332-1.html
@@ -0,0 +1,19 @@
+<html><head>
+<title>Testcase bug - Crash [@ nsHTMLReflowState::GetNearestContainingBlock] with display: -moz-box, generated content, positioning and fieldset</title>
+<style>
+small::before { content: "m m";}
+strike::before { content: "m m";}
+</style>
+</head>
+<body>
+<div style="display: -moz-box;">
+  <strike style="overflow: -moz-hidden-unscrollable; position: absolute;"></strike>
+  <fieldset style="position: relative;">
+    <strike style="overflow: -moz-hidden-unscrollable; position: absolute;"><small style="position: relative;">
+      <span style="position: absolute;"></span>
+    </small>
+  </strike>
+</fieldset>
+</div>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/398332-2.html b/layout/generic/crashtests/398332-2.html
new file mode 100644
index 000000000..79b6f3b60
--- /dev/null
+++ b/layout/generic/crashtests/398332-2.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+<script>
+function removestyles(i){
+document.getElementsByTagName('*')[5].removeAttribute('style');
+document.body.offsetHeight;
+document.getElementsByTagName('*')[6].removeAttribute('style');
+document.body.offsetHeight;
+document.getElementsByTagName('*')[7].removeAttribute('style');
+}
+
+setTimeout(removestyles,300);
+</script>
+
+</head>
+<body>
+<div style="position: relative; width: 500px;">
+  <span style="position: absolute; -moz-column-count: 2;">
+    <span style=" position: absolute;">
+      <span style=" display: inline-block; ">m</span>
+      <input>
+      <input style="position: fixed;">m
+    </span>
+  </span>
+</div>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/398332-3.html b/layout/generic/crashtests/398332-3.html
new file mode 100644
index 000000000..991aa6d3d
--- /dev/null
+++ b/layout/generic/crashtests/398332-3.html
@@ -0,0 +1,4 @@
+<marquee style="position: relative; right: 20%;">"˔�q���;<span style="position: relative; word-spacing: -100px;"><span style="position: absolute;">
+<style>span::before { content:"before textbefore textbefore textbefore textbefore textbefore text"; }</style>
+
+
diff --git a/layout/generic/crashtests/399407-1.xhtml b/layout/generic/crashtests/399407-1.xhtml
new file mode 100644
index 000000000..37e334f4e
--- /dev/null
+++ b/layout/generic/crashtests/399407-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<style id="s">
+    .container {
+      height: 20px;
+    }
+    .overflow {
+      height: 30px;
+    }
+    body {
+      width: 300px;
+      -moz-column-width: 100px;
+    }
+  </style>
+  
+<body>
+  <div class="container">
+    <div class="overflow"></div>
+  </div>
+  <div class="container">
+    <div class="overflow"></div>
+  </div>
+</body>
+  
+</html>
diff --git a/layout/generic/crashtests/399412-1.html b/layout/generic/crashtests/399412-1.html
new file mode 100644
index 000000000..bda3b38f5
--- /dev/null
+++ b/layout/generic/crashtests/399412-1.html
@@ -0,0 +1,32 @@
+<html>
+<head>
+
+<style id="s">
+.container {
+  height: 30px;
+}
+</style>
+
+<style>
+.overflow {
+  height: 150px;
+  border: 1px silver solid;
+}
+body {
+  height: 60px;
+  width: 300px;
+  -moz-column-width: 50px;
+  -moz-column-gap: 1px;
+  -moz-column-fill: auto;
+}
+</style>
+
+</head>
+
+<body onload="s=document.getElementById('s'); s.parentNode.removeChild(s);">
+
+<div class="container"><div class="overflow"></div></div>
+<div class="container"><div class="overflow"></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/399843-1.html b/layout/generic/crashtests/399843-1.html
new file mode 100644
index 000000000..01bdffd71
--- /dev/null
+++ b/layout/generic/crashtests/399843-1.html
@@ -0,0 +1,64 @@
+<html class="reftest-wait">
+<head>
+<style>
+
+    #colset {
+      width: 300pt;
+      height: 2in;
+      -moz-column-count: 3;
+    }
+    
+    .container {
+      height: 1in;
+    }
+
+    .b6 {
+      height: 10in;
+    }
+    
+    .c3 {
+      position: absolute;
+    }
+
+    .c4 {
+      height: 3in;
+    }
+
+</style>
+
+<script>
+
+function boom()
+{
+  document.getElementById("x").setAttribute("class", "c4");
+  setTimeout(boom2, 10);
+}
+
+function boom2()
+{
+  document.getElementById("x").setAttribute("class", "");
+  setTimeout(boom3, 10);
+}
+
+function boom3()
+{
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div id="colset">
+  <div id="x"></div>
+  <div class="container">
+    <div class="b6"></div>
+    <div>
+      <div class="c3"></div>
+    </div>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/400078-1.html b/layout/generic/crashtests/400078-1.html
new file mode 100644
index 000000000..3c2f0552e
--- /dev/null
+++ b/layout/generic/crashtests/400078-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+html, body, table, tbody, tr, td, #colset, #e, #s { height: 100%; }
+
+#colset { -moz-column-count: 2; -moz-column-width: 200px; border: 2px solid black; text-indent: 500px; }
+
+#s { display: inline-block; width: 30px; border: 1px solid red; }
+
+</style>
+</head>
+
+<body>
+
+<table><tbody><tr><td><div id="colset">XXX<span id="s"></span><div id="e"></div></div></td></tr></tbody></table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/400190.html b/layout/generic/crashtests/400190.html
new file mode 100644
index 000000000..46d384108
--- /dev/null
+++ b/layout/generic/crashtests/400190.html
@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+body {
+  position: fixed;
+  font-family: monospace;
+  -moz-column-width: 10px;
+  border: 2px solid #aaa;
+}
+
+#padded {
+  padding-top: 40px;
+  padding-bottom: 40px;
+}
+
+#x {
+  position: absolute;
+  top: 0;
+  left: 0;
+  margin-top: 20px;
+  margin-bottom: 20px;
+}
+
+</style>
+</head>
+
+<body>
+
+<div id="padded"></div>
+
+<div id="x">
+
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/400223-1.html b/layout/generic/crashtests/400223-1.html
new file mode 100644
index 000000000..eb8bf2140
--- /dev/null
+++ b/layout/generic/crashtests/400223-1.html
@@ -0,0 +1,24 @@
+<html>
+<head>
+<style type="text/css">
+
+    #colset {
+      height: 2in;
+      -moz-column-count: 3;
+    }
+    #container {
+      position: relative;
+    }
+    #overflow {
+      position: absolute;
+      height: 5in;
+    }
+  
+</style>
+</head>
+
+<body onload="document.getElementById('container').style.counterIncrement = 'foo';">
+<div id="colset"><div id="container"><div id="overflow"></div></div></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/400232-1.html b/layout/generic/crashtests/400232-1.html
new file mode 100644
index 000000000..8f728ed08
--- /dev/null
+++ b/layout/generic/crashtests/400232-1.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+</head>
+
+<body>
+
+<div style="-moz-column-count: 2; overflow: auto; height: 10px;"><br><div style="float: right; height: 15px;"></div></div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/400244-1.html b/layout/generic/crashtests/400244-1.html
new file mode 100644
index 000000000..3b1b7bfa0
--- /dev/null
+++ b/layout/generic/crashtests/400244-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html> 
+<html>
+<head>
+<style>
+
+  #colset { 
+    -moz-column-count: 2; 
+    -moz-column-gap: 0; 
+    border: 2px solid black; 
+    height: 12em; 
+  }
+
+  #b { 
+    margin: 10em 0pt; 
+  }
+
+  #i { 
+    margin: 12em 0pt; 
+    float: left; 
+    -moz-appearance: radio-small;
+  }
+
+</style>
+</head>
+
+<body onload="document.getElementById('i').style.padding = '1em 0';">
+
+<div id="colset"><br id="b"><div id="i"></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/400768-1.xhtml b/layout/generic/crashtests/400768-1.xhtml
new file mode 100644
index 000000000..1b390a291
--- /dev/null
+++ b/layout/generic/crashtests/400768-1.xhtml
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      onload="document.getElementById('pp').contentHeight;">
+
+<foreignObject>
+  <xul:prefpane id="pp"/>
+</foreignObject>
+
+</svg>
diff --git a/layout/generic/crashtests/400768-2.xhtml b/layout/generic/crashtests/400768-2.xhtml
new file mode 100644
index 000000000..e7e5a5169
--- /dev/null
+++ b/layout/generic/crashtests/400768-2.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" 
+      xmlns:svg="http://www.w3.org/2000/svg"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body onload="document.getElementById('pp').contentHeight;">
+<svg:svg><svg:foreignObject xmlns="http://www.w3.org/2000/svg"><xul:prefpane id="pp"/></svg:foreignObject></svg:svg>
+</body>
+</html>
diff --git a/layout/generic/crashtests/401042-1.xhtml b/layout/generic/crashtests/401042-1.xhtml
new file mode 100644
index 000000000..15395eec9
--- /dev/null
+++ b/layout/generic/crashtests/401042-1.xhtml
@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a">
+<content><span xmlns="http://www.w3.org/1999/xhtml">
+<children xmlns="http://www.mozilla.org/xbl"/>
+</span></content>
+</binding>
+</bindings>
+
+<style>pre::first-letter {float: left; }
+</style>
+</head>
+<body>
+<pre style="-moz-binding: url(#a);">//</pre>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/402380-1.html b/layout/generic/crashtests/402380-1.html
new file mode 100644
index 000000000..3f9e21ec0
--- /dev/null
+++ b/layout/generic/crashtests/402380-1.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+<style type="text/css">
+
+div::first-letter { color: magenta; }
+span:before { content: "\"" "This "; }
+
+</style>
+</head>
+<body style="width: 1em;" onload="document.getElementById('div').style.direction = 'rtl';">
+<div id="div"><span>is text</span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/402380-2.html b/layout/generic/crashtests/402380-2.html
new file mode 100644
index 000000000..f3b021740
--- /dev/null
+++ b/layout/generic/crashtests/402380-2.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+<style type="text/css">
+
+div::first-letter { color: green; }
+span:before { content: open-quote "This "; }
+span:after { content: close-quote; }
+  
+</style>
+</head>
+
+<body style="font-family: monospace; width: 7ch; border: 1px solid orange;"
+      onload="document.getElementById('div').style.direction = 'rtl';">
+
+<div id="div"><span>is text</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/402872-1.html b/layout/generic/crashtests/402872-1.html
new file mode 100644
index 000000000..f23a47060
--- /dev/null
+++ b/layout/generic/crashtests/402872-1.html
@@ -0,0 +1,3 @@
+<table>
+<thead style="float: left; margin-top: 100px; margin-bottom: 9999999999px;">
+
diff --git a/layout/generic/crashtests/402872-2.html b/layout/generic/crashtests/402872-2.html
new file mode 100644
index 000000000..e2a6026ff
--- /dev/null
+++ b/layout/generic/crashtests/402872-2.html
@@ -0,0 +1,2 @@
+<fieldset style="float: left;">
+<legend style="min-height: 999999999px;">
diff --git a/layout/generic/crashtests/403004.html b/layout/generic/crashtests/403004.html
new file mode 100644
index 000000000..a1d04dff3
--- /dev/null
+++ b/layout/generic/crashtests/403004.html
@@ -0,0 +1,3 @@
+<meta http-equiv="Content-Type" content="text/html; charset=windows-1256" />
+<div style="text-transform: uppercase;">
+<a href="httpdisabled://news.maktoob.com"> ÃÎÈÇÑ ãßÊæÈ</a></div>
diff --git a/layout/generic/crashtests/403143-1.html b/layout/generic/crashtests/403143-1.html
new file mode 100644
index 000000000..f51ce723d
--- /dev/null
+++ b/layout/generic/crashtests/403143-1.html
@@ -0,0 +1,19 @@
+<html>
+
+<head>
+<script>
+function boom()
+{
+  document.getElementById("i1").style.counterIncrement = "chicken";
+  document.getElementById("i3").style.counterIncrement = "chicken";
+}
+</script>
+</head>
+
+<body onload="boom();" style="overflow: auto; display: -moz-grid-line;">
+<img id="i1" style="width: 30px; float: right;">
+<img id="i2" style="margin: 0 100%; padding: 0 60px;">
+<img id="i3" style="margin: 100% 0; float: right;">
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/403576-1.html b/layout/generic/crashtests/403576-1.html
new file mode 100644
index 000000000..4b376af6a
--- /dev/null
+++ b/layout/generic/crashtests/403576-1.html
@@ -0,0 +1,5 @@
+<html>
+<body style="width: 11px;">
+<fieldset style="display: table-column-group;"></fieldset>
+</body>
+</html>
diff --git a/layout/generic/crashtests/404140-1.html b/layout/generic/crashtests/404140-1.html
new file mode 100644
index 000000000..fa495caea
--- /dev/null
+++ b/layout/generic/crashtests/404140-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE HTML>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+
+</head><body onload="document.body.style.height = '2px';" style="float: right; height: 2px; -moz-column-width: 0pt;">
+<div style="overflow: -moz-hidden-unscrollable;">a b</div>
+</body></html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/404146-1.html b/layout/generic/crashtests/404146-1.html
new file mode 100644
index 000000000..3ab328069
--- /dev/null
+++ b/layout/generic/crashtests/404146-1.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+<style>
+
+.colset { 
+  -moz-column-count: 2; 
+  -moz-column-width: 50px; 
+  float: left; 
+  border: 2px solid black; 
+  height: 10em; 
+  font: 12px monospace;
+}
+
+#t {
+  display: inline-block;
+  background: lightgreen;
+  height: 7em;
+  width: 29px;
+}
+
+</style>
+</head>
+
+<body onload="document.getElementById('t').style.width = '30px';">
+
+<div class="colset">The quick <span><div id="t"></div>brown</span></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/404204-1.html b/layout/generic/crashtests/404204-1.html
new file mode 100644
index 000000000..2437f4c52
--- /dev/null
+++ b/layout/generic/crashtests/404204-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+
+<body style="font-variant: small-caps;">&#x202B; </body>
+
+</html>
diff --git a/layout/generic/crashtests/404215-1.html b/layout/generic/crashtests/404215-1.html
new file mode 100644
index 000000000..abe7770bc
--- /dev/null
+++ b/layout/generic/crashtests/404215-1.html
@@ -0,0 +1,29 @@
+<html>
+<head>
+<style>
+
+#colset {
+  -moz-column-count: 3;
+}
+.a {
+  height: 3in;
+}
+.b {
+  height: 24pt;
+}
+.c {
+  height: 336pt;
+}
+.d {
+  position: absolute;
+}
+
+</style>
+</head>  
+
+<body onload="document.getElementById('a').className = '';">
+
+<div id="colset"><div><div class="a" id="a"></div><div class="b"><div class="c"></div><div class="d"></div></div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/404215-2.html b/layout/generic/crashtests/404215-2.html
new file mode 100644
index 000000000..7d1f77ed0
--- /dev/null
+++ b/layout/generic/crashtests/404215-2.html
@@ -0,0 +1,37 @@
+<html>
+<head><style>
+/* Sets of heights that trigger crash:
+    100px/50px/51+px
+    100px/30px/74+px
+   Get only an assert unless you set ".d { position: absolute; }".
+   
+   Trigger hang (separate issue, absolute not needed):
+    10px/10px/9999px
+    10px/10px/999999px --> "bad height" notreached
+*/
+#colset { width: 200px;
+          -moz-column-count: 3; }
+#a      { height: 100px;        }
+#b      { height:  50px;        }
+#c      { height:  51px;        }
+#d      { position: absolute;   }
+</style>
+<script>
+  function boom() {
+    document.getElementById('a').style.height = 'auto';
+  }
+</script>
+</head>
+<!-- Removing whitespace in body for simpler frame trees -->
+<body onload="setTimeout('boom()', 1000)"
+ ><div id="colset"
+   ><div
+     ><div id="a"></div
+     ><div id="b"
+       ><div id="c"></div
+       ><div id="d"></div
+     ></div
+   ></div
+ ></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/404215-3.html b/layout/generic/crashtests/404215-3.html
new file mode 100644
index 000000000..0d6b13cc1
--- /dev/null
+++ b/layout/generic/crashtests/404215-3.html
@@ -0,0 +1,32 @@
+<html>
+<head><style>
+/* Sets of heights that trigger crash:
+    100px/50px/51+px
+    100px/30px/74+px
+   Get only an assert unless you set ".d { position: absolute; }".
+   
+   Trigger hang (separate issue, absolute not needed):
+    10px/10px/9999px
+    10px/10px/999999px --> "bad height" notreached
+*/
+#colset { width: 200px;
+          -moz-column-count: 3; }
+#a      { height: 10px;         }
+#b      { height: 10px;         }
+#c      { height: 999999px;     }
+
+</style>
+</head>
+<!-- Removing whitespace in body for simpler frame trees -->
+<body
+ ><div id="colset"
+   ><div
+     ><div id="a"></div
+     ><div id="b"
+       ><div id="c"></div
+       ><div id="d"></div
+     ></div
+   ></div
+ ></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/404219-1.html b/layout/generic/crashtests/404219-1.html
new file mode 100644
index 000000000..bac914826
--- /dev/null
+++ b/layout/generic/crashtests/404219-1.html
@@ -0,0 +1,30 @@
+<html>
+<head>
+<style>
+  body {
+    /* Standize line-height, because the default varies by platform */
+    line-height: 50px;
+  }
+  div#a {
+    width: 3em;
+    -moz-column-count: 2;
+    -moz-column-gap: 0px;
+    background: lightgreen;
+  }
+  div#b {
+    float: left;
+    background: lightblue;
+  }
+  div#c {
+    height: 100px;
+    background: orange;
+  }
+</style>
+</head>
+<body>
+  <div id="a">
+    <div id="b"><br/><br/>b</div>
+    <div id="c">c c c</div>
+  </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/404219-2.html b/layout/generic/crashtests/404219-2.html
new file mode 100644
index 000000000..149877c82
--- /dev/null
+++ b/layout/generic/crashtests/404219-2.html
@@ -0,0 +1,31 @@
+<html>
+<head>
+<style>
+  body {
+    /* Standize line-height, because the default varies by platform */
+    line-height: 50px;
+  }
+  div#a {
+    width: 3em;
+    -moz-column-count: 2;
+    -moz-column-gap: 0px;
+    background: lightgreen;
+  }
+  div#b {
+    height: 100px;
+    float: left;
+    background: lightblue;
+  }
+  div#c {
+    height: 100px;
+    background: orange;
+  }
+</style>
+</head>
+<body>
+  <div id="a">
+    <div id="b"><br/><br/>b</div>
+    <div id="c">c c c</div>
+  </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/406137.html b/layout/generic/crashtests/406137.html
new file mode 100644
index 000000000..75337de72
--- /dev/null
+++ b/layout/generic/crashtests/406137.html
@@ -0,0 +1,16 @@
+<html>
+  <head>
+    <title>redhat.com | Home</title>
+    <style>
+      #navWrap:after { content: "."; display: block; clear: both; }
+    </style>
+  </head>
+  <body>
+    <div id="navWrap">
+      <div style="float: left;">
+        foo
+      </div>
+    </div>
+    <img src="../../../testing/crashtest/images/tree.gif" style="float: right;">
+  </body>
+</html>
diff --git a/layout/generic/crashtests/406380.html b/layout/generic/crashtests/406380.html
new file mode 100644
index 000000000..1ea1820a3
--- /dev/null
+++ b/layout/generic/crashtests/406380.html
@@ -0,0 +1,12 @@
+<html style="direction: rtl;">
+<body onload="document.getElementById('i').style.fontSize = '10em';">
+
+<div style="-moz-column-width: 60px;">
+a
+<div style="overflow: -moz-hidden-unscrollable; white-space: pre;" id="i">
+b
+</div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/406902-1.html b/layout/generic/crashtests/406902-1.html
new file mode 100644
index 000000000..454178c18
--- /dev/null
+++ b/layout/generic/crashtests/406902-1.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style type="text/css">
+
+    .container {
+      position: relative;
+    }
+    #colset {
+      -moz-column-count: 3;
+      -moz-column-gap: 0;
+      border: silver 2pt;
+      border-style: none solid;
+    }
+    .b1 {
+      position: absolute;
+      height: 336pt;
+      margin-left: 20pt;
+    }
+    .b2 {
+      position: absolute;
+      height: 192pt;
+      width: 25pt;
+      margin-left: 50pt;
+    }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  newDiv = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  newDiv.setAttribute("class", "b1");
+  document.getElementById("f").appendChild(newDiv);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div id="colset"><div class="container"><div class="b2"></div><div id="f"></div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/407009-1.xhtml b/layout/generic/crashtests/407009-1.xhtml
new file mode 100644
index 000000000..62ded1562
--- /dev/null
+++ b/layout/generic/crashtests/407009-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body onload="document.getElementById('tree').removeAttribute('hidevscroll');">
+
+<select><xul:tree id="tree"/></select>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/408304-1.xhtml b/layout/generic/crashtests/408304-1.xhtml
new file mode 100644
index 000000000..e0e09801d
--- /dev/null
+++ b/layout/generic/crashtests/408304-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<fieldset><span><fieldset><legend><div ><div style="margin: 0pt 100%;"></div></div></legend></fieldset></span></fieldset>
+</body>
+</html>
diff --git a/layout/generic/crashtests/408602-1.html b/layout/generic/crashtests/408602-1.html
new file mode 100644
index 000000000..b2db8577b
--- /dev/null
+++ b/layout/generic/crashtests/408602-1.html
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body style="position: fixed;">
+
+<div style="position: absolute; -moz-column-width: 20em;"><div style="white-space: pre; float: right; height: 50px;"><div style="width: 100px; height: 12em;"></div>
+</div></div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/408737-1.html b/layout/generic/crashtests/408737-1.html
new file mode 100644
index 000000000..fe8fc2c35
--- /dev/null
+++ b/layout/generic/crashtests/408737-1.html
@@ -0,0 +1,14 @@
+<html>
+<head><style>
+#colset { -moz-column-count: 1; }
+#short  { height: 0px;          }
+#tall   { height: 10000px;      }
+</style></head>
+<body>
+ <div id="colset">
+  <div id="short">
+   <div id="tall"></div>
+  </div>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/408737-2.html b/layout/generic/crashtests/408737-2.html
new file mode 100644
index 000000000..c4b343867
--- /dev/null
+++ b/layout/generic/crashtests/408737-2.html
@@ -0,0 +1,14 @@
+<html>
+<head><style>
+#colset { -moz-column-count: 1; }
+#short  { height: 10px;         }
+#tall   { height: 100000px;     }
+</style></head>
+<body>
+ <div id="colset">
+  <div id="short">
+   <div id="tall"></div>
+  </div>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/408749-1.xhtml b/layout/generic/crashtests/408749-1.xhtml
new file mode 100644
index 000000000..4ef6e4e89
--- /dev/null
+++ b/layout/generic/crashtests/408749-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body style="-moz-column-count: 2;"><caption><div>foo<td></td></div></caption></body></html>
diff --git a/layout/generic/crashtests/408883-1.html b/layout/generic/crashtests/408883-1.html
new file mode 100644
index 000000000..f7d19e5e5
--- /dev/null
+++ b/layout/generic/crashtests/408883-1.html
@@ -0,0 +1,39 @@
+<html>
+<head>
+
+<style type="text/css">
+
+body {
+  -moz-column-count: 2;
+  -moz-column-width: 100px;
+  height: 200px;
+  width: 400px;
+}
+.b {
+  height: 300px;
+}
+.f {
+  float: left;
+}
+.p {
+  padding: 0pt 200px;
+}
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var newDiv = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  var a = document.getElementById("a");
+  a.appendChild(newDiv);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();"><div class="f"><span class="p"></span></div><div id="a"><div class="b f"><input></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/410198.html b/layout/generic/crashtests/410198.html
new file mode 100644
index 000000000..f423fb32b
--- /dev/null
+++ b/layout/generic/crashtests/410198.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN">
+<title>Gecko 1.9 crash with a.p. and inline c.b.</title>
+
+<p>- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
+<span style="position: relative; background-color: #ddd;">- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+<span style="position: absolute; top: 0; left: 0; background-color: #f00;">AP</span>
+</span>
+</p>
diff --git a/layout/generic/crashtests/410228-1.html b/layout/generic/crashtests/410228-1.html
new file mode 100644
index 000000000..b1bd3e0d0
--- /dev/null
+++ b/layout/generic/crashtests/410228-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+
+<body style="text-transform: uppercase; font-family: arial;">&zwnj;&szlig;</body>
+
+</html>
diff --git a/layout/generic/crashtests/410232-1.html b/layout/generic/crashtests/410232-1.html
new file mode 100644
index 000000000..26a9c2c84
--- /dev/null
+++ b/layout/generic/crashtests/410232-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+</head>
+
+<body>
+
+<div style="height: 17895694px;"></div>
+
+<div style="float: left; border: 2px solid red;"></div>
+
+<div style="float: left; border: 2px solid green;"></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/410595-1.html b/layout/generic/crashtests/410595-1.html
new file mode 100644
index 000000000..0ee6e36c9
--- /dev/null
+++ b/layout/generic/crashtests/410595-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+
+<body><div style="padding: 12em 0; position: absolute; font-size: 10000000px;"><div style="position: absolute;"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/411213-1.html b/layout/generic/crashtests/411213-1.html
new file mode 100644
index 000000000..e4589a615
--- /dev/null
+++ b/layout/generic/crashtests/411213-1.html
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="direction: rtl;">
+<body onload="document.getElementById('i').style.fontSize = '10em';">
+
+<div style="-moz-column-width: 60px;"><div id="i" style="overflow: -moz-hidden-unscrollable; white-space: pre;">
+ b
+</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/411213-2.xml b/layout/generic/crashtests/411213-2.xml
new file mode 100644
index 000000000..bcd8beb2a
--- /dev/null
+++ b/layout/generic/crashtests/411213-2.xml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="direction: rtl;">
+<body onload="document.getElementById('i').style.fontSize = '10em';">
+
+<div style="-moz-column-width: 60px;"><div id="i" style="overflow: -moz-hidden-unscrollable; white-space: pre;">
+ b</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/411835.html b/layout/generic/crashtests/411835.html
new file mode 100644
index 000000000..bddc903e5
--- /dev/null
+++ b/layout/generic/crashtests/411835.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div { position: absolute; height: 10px; width: 10px; }
+
+</style>
+</head>
+
+<body onload="document.getElementById('c').style.counterIncrement = 'z';">
+
+<div style="-moz-column-count: 2;"><div id="c" style="white-space: pre;">
+
+<div>
+<div></div></div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/411851-1.html b/layout/generic/crashtests/411851-1.html
new file mode 100644
index 000000000..c7ba0965f
--- /dev/null
+++ b/layout/generic/crashtests/411851-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html style="padding: 17895704px;">
+<head>
+</head>
+<body>
+<div style="float: left;">Foo</div>Bar<span style="margin: 10em; height: 17895697px; float: left;"></span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/412014-1.html b/layout/generic/crashtests/412014-1.html
new file mode 100644
index 000000000..0aa4446d1
--- /dev/null
+++ b/layout/generic/crashtests/412014-1.html
@@ -0,0 +1,17 @@
+<html style="white-space: pre; -moz-column-count: 2;">
+<head></head>
+
+<body onload="document.body.style.MozFloatEdge = 'margin-box'" style="-moz-column-width: 20em;">
+
+<div style="position: relative; height: 80px; margin: 10px;">
+
+
+
+
+<div style="position: absolute; height: 11px; top: 19px;"></div>
+</div>
+
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/412201-1.xhtml b/layout/generic/crashtests/412201-1.xhtml
new file mode 100644
index 000000000..29b3369f8
--- /dev/null
+++ b/layout/generic/crashtests/412201-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="padding: 17895704px;"><body style="margin: 0pt 100% 0pt 96%; display: table; float: right; height: 0pt;"><li style="list-style-position: inside;"></li></body><body style="margin: -1px; padding: 17895704px; display: table-caption; float: right; height: 0pt;"></body></html>
diff --git a/layout/generic/crashtests/412543-1.html b/layout/generic/crashtests/412543-1.html
new file mode 100644
index 000000000..9610be115
--- /dev/null
+++ b/layout/generic/crashtests/412543-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+.c { -moz-column-width: 1px; width: 93px; }
+.c:first-letter { }
+
+</style>
+</head>
+
+<body>
+
+<div class="c"><small>a b . d e f h i , k ; m n o p q</small></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/413048-1.html b/layout/generic/crashtests/413048-1.html
new file mode 100644
index 000000000..958c93023
--- /dev/null
+++ b/layout/generic/crashtests/413048-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="-moz-column-count: 15; width: 16px; height: 16px;"><span><div style="display: inline-block;">a</div><div style="float: left;"></div>
+</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/413079-1.xhtml b/layout/generic/crashtests/413079-1.xhtml
new file mode 100644
index 000000000..d7dd554a8
--- /dev/null
+++ b/layout/generic/crashtests/413079-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body onload='document.getElementById("x").style.letterSpacing = "20px";'>
+
+<div style="-moz-column-count: 15;" id="x"><span>AAA
+<div style="float: left;">BBBB<div>CCCC</div></div></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/413079-2.xhtml b/layout/generic/crashtests/413079-2.xhtml
new file mode 100644
index 000000000..4ee5beaa1
--- /dev/null
+++ b/layout/generic/crashtests/413079-2.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ </head>
+ <body >
+  <div style="-moz-column-count: 12; border: 1px solid green">
+   <span>AAAA
+    <div style="float: left;border: 1px solid blue">BBBB
+    </div>
+   </span>
+  </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/413079-3.xhtml b/layout/generic/crashtests/413079-3.xhtml
new file mode 100644
index 000000000..4a9157d82
--- /dev/null
+++ b/layout/generic/crashtests/413079-3.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ </head>
+ <body >
+  <div style="-moz-column-count: 2; border: 1px solid green">
+   <span>AAAA
+    <div style="float: left;border: 1px solid blue">BBBB
+    </div>
+   </span>
+  </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/413085-1.html b/layout/generic/crashtests/413085-1.html
new file mode 100644
index 000000000..8f1ddad97
--- /dev/null
+++ b/layout/generic/crashtests/413085-1.html
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+
+body:first-letter { float: right; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.body.removeChild(document.body.firstChild);
+  document.body.appendChild(document.createTextNode('x'));  
+}
+
+</script>
+</head>
+
+<body onload="boom();">&#xFEB7;
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/413085-2.html b/layout/generic/crashtests/413085-2.html
new file mode 100644
index 000000000..bb82c6628
--- /dev/null
+++ b/layout/generic/crashtests/413085-2.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<style>
+ body:first-letter { float: right; }
+</style>
+<script>
+  function boom() {
+   document.body.removeChild(document.body.firstChild);
+  }
+</script>
+</head>
+<body onload="boom();">abc&#x05DB;d
+<div>This sentence should be the only text on the page.</div></body>
+</html>
diff --git a/layout/generic/crashtests/413582-1.xhtml b/layout/generic/crashtests/413582-1.xhtml
new file mode 100644
index 000000000..d3ce06463
--- /dev/null
+++ b/layout/generic/crashtests/413582-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<div style="-moz-column-count: 2; text-indent: 11px;"> <div style="float: right;"></div><select style="float: right;"></select></div>
+    
+</body>
+</html>
diff --git a/layout/generic/crashtests/413582-2.html b/layout/generic/crashtests/413582-2.html
new file mode 100644
index 000000000..f1b163b93
--- /dev/null
+++ b/layout/generic/crashtests/413582-2.html
@@ -0,0 +1,9 @@
+<html>
+<head></head>
+<body>
+<div style="-moz-column-count: 2;">r
+<span style="float: right;"></span>
+<textarea style="float: left;"></textarea>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/413712-1.xhtml b/layout/generic/crashtests/413712-1.xhtml
new file mode 100644
index 000000000..5de0511d1
--- /dev/null
+++ b/layout/generic/crashtests/413712-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="display: table">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var tr = document.getElementById("tr");
+  tr.contentEditable = "true";
+  tr.focus();
+  document.execCommand("selectAll", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><tr id="tr"><td></td></tr></body>
+
+</html>
diff --git a/layout/generic/crashtests/414061-1.html b/layout/generic/crashtests/414061-1.html
new file mode 100644
index 000000000..87e471262
--- /dev/null
+++ b/layout/generic/crashtests/414061-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body style="width: 1px; white-space: pre; -moz-column-width: 1px;">
+
+x
+
+<div style="margin: -200em;"></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/414180-1.xul b/layout/generic/crashtests/414180-1.xul
new file mode 100644
index 000000000..98af07821
--- /dev/null
+++ b/layout/generic/crashtests/414180-1.xul
@@ -0,0 +1,7 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<grid style="margin: -1px; display: inline;" />
+
+</window>
diff --git a/layout/generic/crashtests/414719-1.html b/layout/generic/crashtests/414719-1.html
new file mode 100644
index 000000000..94c56b495
--- /dev/null
+++ b/layout/generic/crashtests/414719-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var newDiv = document.createElement("div");
+  var ispan = document.getElementById("ispan");
+  ispan.parentNode.insertBefore(newDiv, ispan);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div style="-moz-column-count: 1; position: fixed;"><div style="overflow: -moz-hidden-unscrollable; display: table-header-group; white-space: pre; position: absolute;">
+ <span id="ispan">
+</span></div></div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/415685-1.html b/layout/generic/crashtests/415685-1.html
new file mode 100644
index 000000000..41f51c2a3
--- /dev/null
+++ b/layout/generic/crashtests/415685-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<style type="text/css">
+
+div { height: 10px; margin: 1em; outline: 1px inset black; }
+
+</style>
+</head>
+
+<body onload="document.getElementById('a').style.padding = '12em 0';" style="-moz-column-count: 2; width: 1px;"><div id="a">aaaa aaaa aaaa</div><div style="border: medium solid blue;"></div><div style="border: medium solid green; margin: 10em 0pt;"></div><div style="border: medium solid magenta;"></div>xxxx xxxx xxxx</body>
+
+</html>
diff --git a/layout/generic/crashtests/416165.html b/layout/generic/crashtests/416165.html
new file mode 100644
index 000000000..e8db388b4
--- /dev/null
+++ b/layout/generic/crashtests/416165.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+function replacestyles(){
+document.getElementById('a').setAttribute('style', 'border: 1px solid black; -moz-border-radius: 2em;');
+document.body.offsetHeight; 
+}
+</script>
+</head>
+<body  style="direction: rtl; -moz-column-count: 2;" onload="document.body.offsetHeight; setTimeout(replacestyles,0);">
+
+<div id="a">
+<pre style="overflow: -moz-hidden-unscrollable;">
+
+
+text
+
+
+
+</pre>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/416264-1.html b/layout/generic/crashtests/416264-1.html
new file mode 100644
index 000000000..783920e9f
--- /dev/null
+++ b/layout/generic/crashtests/416264-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+
+<body style="display: -moz-box;"><div style="-moz-column-count: 2;"><div style="height: 200px;"></div><span style="display: inline-block; width: 100px;"></span></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/416476-1.html b/layout/generic/crashtests/416476-1.html
new file mode 100644
index 000000000..c54affd8e
--- /dev/null
+++ b/layout/generic/crashtests/416476-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><head></head><body></body><body style="width: 800px; -moz-column-count: 4;"><div style="height: 80px; outline-color: blue; outline-style: solid; outline-width: 1px;"></div><div style="height: 80px; outline-color: green; outline-style: solid; outline-width: 1px;"><div style="float: left; height: 10px; width: 10px; outline-color: red; outline-style: solid; outline-width: 1px;"></div><div style="padding: 180px; -moz-column-count: 1; clear: right; outline-color: magenta; outline-style: solid; outline-width: 1px;"></div></div></body></html>
diff --git a/layout/generic/crashtests/417109-1.xhtml b/layout/generic/crashtests/417109-1.xhtml
new file mode 100644
index 000000000..f1b93c4c6
--- /dev/null
+++ b/layout/generic/crashtests/417109-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="foo">
+    <content><html:span> &#x200F;&#x0643;&#xCA84;<children/></html:span></content>
+  </binding>
+  <binding id="empty">
+    <content></content>
+  </binding>
+</bindings>
+
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  document.getElementById("b").style.MozBinding = "url('#empty')";
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><table style="-moz-binding: url(#foo)"><td id="b"/></table></body>
+
+</html>
diff --git a/layout/generic/crashtests/417848-1.xhtml b/layout/generic/crashtests/417848-1.xhtml
new file mode 100644
index 000000000..8a4959812
--- /dev/null
+++ b/layout/generic/crashtests/417848-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head></head>
+  <body style="-moz-column-count: 15; font-size: 144em;">
+    <svg xmlns="http://www.w3.org/2000/svg" style="min-width: 10em;"></svg>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/417902-1.html b/layout/generic/crashtests/417902-1.html
new file mode 100644
index 000000000..0dfff7eed
--- /dev/null
+++ b/layout/generic/crashtests/417902-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body { width: 500px; -moz-column-count: 2; }
+body:first-letter { float: right; }
+#s { padding: 0pt 200px; }
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("s").appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+
+<body onload="boom();">x <span id="s"></span></body>
+
+</html>
diff --git a/layout/generic/crashtests/417902-2.html b/layout/generic/crashtests/417902-2.html
new file mode 100644
index 000000000..b178f59f8
--- /dev/null
+++ b/layout/generic/crashtests/417902-2.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+  <style>
+    div:first-letter {
+      float: left;
+      background: orange;
+    }
+    /* Note: there's an upper-bound on widths that trigger a crash.
+       This bound depends on the width of the characters in the div. */
+    div#v {
+      -moz-column-count: 2;
+      width: 30px;
+      height: 1em;
+      background: lightblue;
+    }
+  </style>
+  <script>
+    function boom() {
+      var v = document.getElementById("v");
+      // Note: This seems to crash regardless of what the text node is;
+      // e.g. it can be the empty string, a space character, or any number of
+      // other characters.
+      v.appendChild(document.createTextNode("CRASH"));
+    }
+  </script>
+</head>
+<body onload="boom();"><div id="v">a b</div></body>
+</html>
diff --git a/layout/generic/crashtests/418532-1.html b/layout/generic/crashtests/418532-1.html
new file mode 100644
index 000000000..da137a4dc
--- /dev/null
+++ b/layout/generic/crashtests/418532-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+div:first-line { font-size: 80%; color: green; }
+</style>
+</head>
+<body style="-moz-column-width: 1px"><div id="div" style="-moz-column-width: 1px"> <span>Foo bar</span></div></body>
+</html>
diff --git a/layout/generic/crashtests/418932-1.html b/layout/generic/crashtests/418932-1.html
new file mode 100644
index 000000000..20cd37253
--- /dev/null
+++ b/layout/generic/crashtests/418932-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><head></head><body><div style="-moz-column-width: 2880000em;"></div></body></html>
diff --git a/layout/generic/crashtests/419352.html b/layout/generic/crashtests/419352.html
new file mode 100644
index 000000000..70b3edba7
--- /dev/null
+++ b/layout/generic/crashtests/419352.html
@@ -0,0 +1,3 @@
+<html>
+<body dir="rtl">&#x2028;&#x200C;</body>
+</html>
diff --git a/layout/generic/crashtests/420000-1.html b/layout/generic/crashtests/420000-1.html
new file mode 100644
index 000000000..1bf8d7b94
--- /dev/null
+++ b/layout/generic/crashtests/420000-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="-moz-column-gap: 24000000em; -moz-column-count: 5;"></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/420718.html b/layout/generic/crashtests/420718.html
new file mode 100644
index 000000000..9626c5cf2
--- /dev/null
+++ b/layout/generic/crashtests/420718.html
@@ -0,0 +1 @@
+<span style="float: left; margin-top: 99999999px;">t</span>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/420785-1.xhtml b/layout/generic/crashtests/420785-1.xhtml
new file mode 100644
index 000000000..3d2d985e2
--- /dev/null
+++ b/layout/generic/crashtests/420785-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl" xmlns:html="http://www.w3.org/1999/xhtml">
+  <binding id="foo">
+    <content><html:span>a b<children xmlns="http://www.mozilla.org/xbl"/></html:span></content>
+  </binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var cap = document.getElementById("cap"); 
+  var lsep = document.createTextNode("\u2028"); // U+2028 LINE SEPARATOR
+  cap.insertBefore(lsep, cap.firstChild);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();"><caption id="cap" style="-moz-binding: url('#foo');"> </caption></body>
+
+</html>
diff --git a/layout/generic/crashtests/421404-1.html b/layout/generic/crashtests/421404-1.html
new file mode 100644
index 000000000..634209849
--- /dev/null
+++ b/layout/generic/crashtests/421404-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="width: -moz-fit-content; width: fit-content; clear: both">
+<div style="float: left; width: 20px; padding: 100%"></div>
+<div style="float: left; width: 20px"></div>
+<div style="float: left; width: 20px"></div> 
+</div>
+<div style="width: -moz-fit-content; width: fit-content; clear: both">
+<div style="float: right; width: 20px; padding: 100%"></div>
+<div style="float: right; width: 20px"></div>
+<div style="float: right; width: 20px"></div> 
+</div>
+<div style="width: -moz-fit-content; width: fit-content; clear: both">
+<div style="float: left; width: 20px; padding: 100%"></div>
+<div style="float: right; width: 20px; padding: 100%; clear: right"></div>
+<div style="float: right; width: 20px; clear: right"></div> 
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/421671.html b/layout/generic/crashtests/421671.html
new file mode 100644
index 000000000..e3919e635
--- /dev/null
+++ b/layout/generic/crashtests/421671.html
@@ -0,0 +1,202 @@
+<marquee>
+<xmp style="-moz-column-count: 99999999">
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+<a>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+<a>
+<a>
+<a>
+<a>
+																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																																						
+<a>
+<a>
+
+<a>
+<a>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/422283-1.html b/layout/generic/crashtests/422283-1.html
new file mode 100644
index 000000000..8f1b9f44f
--- /dev/null
+++ b/layout/generic/crashtests/422283-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+
+<body style="-moz-column-width: 1px;"><div style="padding: 150px 0; height: 80px;"><span>
+</span>x<div></div><span>
+</span>a ! b c<div></div>
+</div></body>
+
+</html>
diff --git a/layout/generic/crashtests/422301-1.html b/layout/generic/crashtests/422301-1.html
new file mode 100644
index 000000000..8c2f2ef33
--- /dev/null
+++ b/layout/generic/crashtests/422301-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style type="text/css">
+
+div { height: .5em; margin: 1em; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("b").style.padding = "";
+  document.getElementById("a").style.padding = "12em";
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="-moz-column-width: 2em;"><div id="a"></div><div></div><div></div><div id="b" style="padding: 12em;">This is text</div>This is textThis is text<div>This is text</div></body>
+
+</html>
diff --git a/layout/generic/crashtests/423055-1.html b/layout/generic/crashtests/423055-1.html
new file mode 100644
index 000000000..d0696307d
--- /dev/null
+++ b/layout/generic/crashtests/423055-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html>
+<head></head>
+<body>
+
+<div style="white-space: pre; position: relative; -moz-column-count: 2;">
+<div style="position: absolute;"></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/423098.html b/layout/generic/crashtests/423098.html
new file mode 100644
index 000000000..5bb9534e4
--- /dev/null
+++ b/layout/generic/crashtests/423098.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("b").style.position = "static";
+  document.body.offsetHeight;
+  document.getElementById("a").style.fontSize = "110%";
+}
+
+</script>
+</head>
+
+<body style="-moz-column-count: 1;" onload="boom();">
+  <div id="a" style="float: right; height: 80px;">
+    <div id="b" style="position: absolute; height: 10px;"></div>
+    <div style="height: 100px; width: 11px;"></div>
+  </div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/423264-1.html b/layout/generic/crashtests/423264-1.html
new file mode 100644
index 000000000..d2027c1d1
--- /dev/null
+++ b/layout/generic/crashtests/423264-1.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<script type="text/javascript">
+
+function boom()
+{
+  var y = document.createTextNode(' Y ');
+  document.getElementById("a").appendChild(y);
+  document.body.offsetHeight;
+  var z = document.createTextNode('Z');
+  document.body.insertBefore(z, document.body.lastChild);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div style="-moz-column-count: 2; width: 1px;"><div id="a">M N矋<span>م</span></div></div>H</body>
+</html>
diff --git a/layout/generic/crashtests/424629.html b/layout/generic/crashtests/424629.html
new file mode 100644
index 000000000..d142897ce
--- /dev/null
+++ b/layout/generic/crashtests/424629.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("o").appendChild(document.createTextNode('d'));
+  document.body.offsetHeight;
+  document.getElementById("b").firstChild.data = "\u202E";
+  document.getElementById("a").firstChild.data = "ZZZZZZZ";
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="font-family: monospace; width: 8ch;">
+
+<div><span id="o"><span id="a">a</span><span id="b">b&#x202E;</span><span> c </span></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/425253-1.html b/layout/generic/crashtests/425253-1.html
new file mode 100644
index 000000000..74c78570d
--- /dev/null
+++ b/layout/generic/crashtests/425253-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+  <span style="border:10px solid blue; text-decoration:underline;">Hello</span>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/426040-1.html b/layout/generic/crashtests/426040-1.html
new file mode 100644
index 000000000..196a541cb
--- /dev/null
+++ b/layout/generic/crashtests/426040-1.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div { height: 1px; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var a = document.getElementById("a"); 
+  a.removeChild(a.firstChild);
+  document.documentElement.style.outline = "none";
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div style="-moz-column-count: 2;" id="a"><div><div style="float: right;"><div></div><span><div></div></span></div></div></div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/426272-1.html b/layout/generic/crashtests/426272-1.html
new file mode 100644
index 000000000..ec29f918e
--- /dev/null
+++ b/layout/generic/crashtests/426272-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var y = document.createTextNode('Y');
+  document.body.insertBefore(y, document.getElementById("v").nextSibling);
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="-moz-column-count: 2; width: 10ch; letter-spacing: 1px; font-family: monospace;">
+<div style="background: lightblue; float: right; height: 14em; width: 1ch;" id="v"></div>a bcd<span>&#x202B;X</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/428263-1.html b/layout/generic/crashtests/428263-1.html
new file mode 100644
index 000000000..2ac656d9d
--- /dev/null
+++ b/layout/generic/crashtests/428263-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html style="display: table;">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.documentElement.appendChild(document.body);
+  document.documentElement.offsetHeight;
+  document.documentElement.appendChild(document.body);
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="-moz-column-count: 2;"><div style="height: 1px;"></div><span style="display: inline-block;"></span></body>
+
+</html>
diff --git a/layout/generic/crashtests/429458.xhtml b/layout/generic/crashtests/429458.xhtml
new file mode 100644
index 000000000..a3597516f
--- /dev/null
+++ b/layout/generic/crashtests/429458.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="foo">
+    <content><html:span><children xmlns="http://www.mozilla.org/xbl"/></html:span></content>
+  </binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var s = document.getAnonymousNodes(document.body)[0];
+  s.appendChild(document.createTextNode("apples and oranges"));
+  document.body.offsetHeight;
+  document.body.appendChild(document.createTextNode("\n\n"));
+}
+
+</script>
+
+</head>
+
+<body onload="boom();" style="-moz-binding: url('#foo'); width: 1px; word-spacing: 1px;"></body>
+
+</html>
diff --git a/layout/generic/crashtests/429960-1.html b/layout/generic/crashtests/429960-1.html
new file mode 100644
index 000000000..069c3f5f2
--- /dev/null
+++ b/layout/generic/crashtests/429960-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html style="direction: rtl;" contenteditable="true">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.body.firstChild.style.MozColumnCount = "3";
+}
+
+</script>
+</head>
+
+<body style="width: 1px;" onload="boom();"><div>examination<span style="font-family: verdana;">x x x x  </span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/429960-2.html b/layout/generic/crashtests/429960-2.html
new file mode 100644
index 000000000..a7c451422
--- /dev/null
+++ b/layout/generic/crashtests/429960-2.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html style="direction: rtl;" contenteditable="true">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.body.firstChild.style.MozColumnCount = "3";
+}
+
+</script>
+</head>
+
+<body style="width: 1px;" onload="boom();"><div>examination<span style="font-family: verdana;">x x x x 
+</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/429969-1.html b/layout/generic/crashtests/429969-1.html
new file mode 100644
index 000000000..4b4b567f0
--- /dev/null
+++ b/layout/generic/crashtests/429969-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+#inner:first-letter { }
+#outer { direction: rtl; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.documentElement.style.whiteSpace = "pre";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div id="outer"><div id="inner"><span id="s"><span>
+
+</span>AB</span></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/429981-1.html b/layout/generic/crashtests/429981-1.html
new file mode 100644
index 000000000..a5cf5b007
--- /dev/null
+++ b/layout/generic/crashtests/429981-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+    body {
+      height: 100px;
+      width: 300pt;
+      -moz-column-width: 100pt;
+      -moz-column-gap: 0;
+    }
+
+    #x { 
+      padding: 100px;
+    }
+
+    #overflow {
+      height: 400px;
+      float: left;
+    }
+
+</style>
+</head>
+
+<body><div id="x"><div id="overflow"></div>K</div></body>
+
+</html>
diff --git a/layout/generic/crashtests/430332-1.html b/layout/generic/crashtests/430332-1.html
new file mode 100644
index 000000000..c9ba00229
--- /dev/null
+++ b/layout/generic/crashtests/430332-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<body style="font-family:monospace; width:6ch;">
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd<span id="s">ef</span>
+<script>
+document.body.clientWidth;
+document.getElementById("s").style.fontSize = "200%";
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/430344-1.html b/layout/generic/crashtests/430344-1.html
new file mode 100644
index 000000000..e79302092
--- /dev/null
+++ b/layout/generic/crashtests/430344-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="width: 1px;"><span>e</span> <br style="clear: both;"></body>
+</html>
diff --git a/layout/generic/crashtests/430352-1.html b/layout/generic/crashtests/430352-1.html
new file mode 100644
index 000000000..e22d64129
--- /dev/null
+++ b/layout/generic/crashtests/430352-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html style="border: 1px dotted red; font-size: 0; -moz-appearance: scrollbartrack-horizontal; width: 12em;">
+<head></head>
+<body style="position: absolute;"></body>
+</html>
diff --git a/layout/generic/crashtests/430744-1.html b/layout/generic/crashtests/430744-1.html
new file mode 100644
index 000000000..7c185921c
--- /dev/null
+++ b/layout/generic/crashtests/430744-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('x').appendChild(document.createTextNode('b'));">
+
+<div style="display: -moz-grid;"><div style="-moz-column-count: 2;">a<div id="x" style="padding: 1em;"></div><wbr></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/430991.html b/layout/generic/crashtests/430991.html
new file mode 100644
index 000000000..69a412500
--- /dev/null
+++ b/layout/generic/crashtests/430991.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var li = document.getElementById("li");
+  li.removeChild(li.lastChild);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<ul id="ul">
+<li id="li" style="-moz-column-count: -1; white-space: pre-wrap;"><span>A</span><span>B</span><span style="float: right;"></span>
+
+</li>
+</ul>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/431260-1.html b/layout/generic/crashtests/431260-1.html
new file mode 100644
index 000000000..0e4bfb812
--- /dev/null
+++ b/layout/generic/crashtests/431260-1.html
@@ -0,0 +1,34 @@
+<html class="reftest-wait"><head><style>
+title::first-letter {font-size:600%;}
+</style><title style="display: table-column-group; position: absolute;">
+mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmm6mmmmm
+mmmm mmmmMmmmmmmmm=mmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmm mmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmm mmmmmmm
+&#1593m
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm 
+&#1593m �&#1593m&#1593m&#1593m���&#1593m�&#1593m�&#1593m�&#1593m�&#1593m�&#1593m�&#1593
+&#1593m �&#1593m&#1593m&#1593m���&#1593m�&#1593m�&#1593m�&#1593m�&#1593m�&#1593m�&#1593
+</title></head>
+<script>
+function innerhtml(i){
+  if (i > 0) {
+    document.documentElement.innerHTML = document.documentElement.innerHTML;
+    setTimeout(innerhtml,0,i-1);
+  } else {
+    document.documentElement.removeAttribute("class");
+  }
+}
+setTimeout(innerhtml,0,30);
+</script>
+</html>
diff --git a/layout/generic/crashtests/431260-2.html b/layout/generic/crashtests/431260-2.html
new file mode 100644
index 000000000..7fc9204c2
--- /dev/null
+++ b/layout/generic/crashtests/431260-2.html
@@ -0,0 +1,26 @@
+<html class="reftest-wait"><head><style>
+  title::first-letter {}
+  title {
+    display: inline;
+    float: left;
+    font-size: 16px;
+  }
+</style>
+<script>
+  function boom() {
+    document.documentElement.innerHTML = document.documentElement.innerHTML;
+    document.documentElement.removeAttribute("class");
+  }
+</script>
+<title>
+a
+b
+&#1593
+c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
+c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
+c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
+</title></head>
+<script>
+setTimeout(boom, 0);
+</script>
+</html>
diff --git a/layout/generic/crashtests/435529.html b/layout/generic/crashtests/435529.html
new file mode 100644
index 000000000..736e3377c
--- /dev/null
+++ b/layout/generic/crashtests/435529.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+  div { 
+    -moz-column-count: 2;
+    white-space: pre; 
+  }
+  
+  div:first-letter { 
+    float: right;
+  }
+
+</style>
+</head>
+
+<body><div> <span>AB</span></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/436194-1.html b/layout/generic/crashtests/436194-1.html
new file mode 100644
index 000000000..4326c9f67
--- /dev/null
+++ b/layout/generic/crashtests/436194-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+#colset { -moz-column-count: 2; outline: 1px solid orange; }
+.ib { height: 100px; display: inline-block; outline: 1px solid blue; }
+div { outline: 1px solid green; }
+span { outline: 1px solid magenta; }
+
+</style>
+</head>
+<body>
+
+<div id="colset"><div></div><div style="width: 10px; float: left;"><span> <span class="ib" style="width: 30px;"></span> <br> </span></div><span class="ib"></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/436602-1.html b/layout/generic/crashtests/436602-1.html
new file mode 100644
index 000000000..cf7bee015
--- /dev/null
+++ b/layout/generic/crashtests/436602-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="-moz-column-width: 1px;"><span>A B C D E</span> <span style="float: right;"></span> <br> </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/436822-1.html b/layout/generic/crashtests/436822-1.html
new file mode 100644
index 000000000..b1b99977e
--- /dev/null
+++ b/layout/generic/crashtests/436822-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body { font-size: 1600000px; }
+body * { font-size: 10em; }
+
+</style>
+</head>
+
+<body>
+  <div>
+    <div style="margin-top: 1em; margin-bottom: 1em;">A</div>
+  </div>
+  <div>
+    <div style="margin-top: 1em; margin-bottom: 1em;">B<div style="display: list-item; padding-left: 3px; float: left;"></div></div>
+  </div>
+  <div style="float: left;"></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/436823.html b/layout/generic/crashtests/436823.html
new file mode 100644
index 000000000..aa6caeff1
--- /dev/null
+++ b/layout/generic/crashtests/436823.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="-moz-column-count: -1;"><div style="float: left;"><div><div style="float: left;">A B</div><div style="clear: both; height: 1px;"></div></div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/436969-1.html b/layout/generic/crashtests/436969-1.html
new file mode 100644
index 000000000..0f9738754
--- /dev/null
+++ b/layout/generic/crashtests/436969-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.documentElement.style.zIndex = 2;">
+
+<div style="direction: rtl; text-transform: uppercase; width: 1px;"><div style="position: absolute; -moz-column-count: 2;"><span style="padding: 6em 0pt; position: absolute; height: 1.2em;">A !BB CCC D,</span></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/437156-1.html b/layout/generic/crashtests/437156-1.html
new file mode 100644
index 000000000..6fac1924d
--- /dev/null
+++ b/layout/generic/crashtests/437156-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('c').style.counterIncrement = 'c';">
+
+<div style="-moz-column-width: 1px;"><div id="c"><div style="float: right;">T<iframe></iframe></div></div></div>
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/437565-1.xhtml b/layout/generic/crashtests/437565-1.xhtml
new file mode 100644
index 000000000..4b2dd1067
--- /dev/null
+++ b/layout/generic/crashtests/437565-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<!-- no body -->
+<div/>
+<div style="float: right;"><span><svg xmlns="http://www.w3.org/2000/svg" style="display: table-row;"/></span>  von qlikworld runterladen. Alle RSS News aus dem Artikelkicker immer sofort und kostenlos auf den Bildschirm. Pressemitteilungen lesen und unbegrenzt viele Feeds gratis abonieren.					</div><div style="float: right; text-indent: 20em;">artikelkicker.de</div><div><div style="float: right; width: 75px; height: 33px;"/><div style="clear: both;"/></div>
+</html>
diff --git a/layout/generic/crashtests/437565-2.xhtml b/layout/generic/crashtests/437565-2.xhtml
new file mode 100644
index 000000000..9213a65df
--- /dev/null
+++ b/layout/generic/crashtests/437565-2.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+ <style>
+   /* Note: The height here is almost nscoord_MAX in app-units */
+   /* Note: The width here needs to be wider than the viewport in order
+            to trigger a crash. */
+   div.tall {
+     height: 17895687px;
+     width: 3000px;
+     background: pink;
+   }
+   div.float  { float: left; }
+   div.clear  { clear: left; }
+   div.square { width: 10px; height: 10px; }
+   div.blue   { background: blue;   }
+   div.green  { background: green;  }
+   div.orange { background: orange; }
+ </style>
+</head>
+<!-- no body (adding a body prevents the crash, for some reason) -->
+  <div class="float"><div class="tall"/><div class="square blue"/></div>
+  <div class="float square green"/>
+  <div><div class="float square orange"/><div class="clear"/></div>
+</html>
diff --git a/layout/generic/crashtests/437565-3.xhtml b/layout/generic/crashtests/437565-3.xhtml
new file mode 100644
index 000000000..dbcf3f84f
--- /dev/null
+++ b/layout/generic/crashtests/437565-3.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+><head>
+ <style>
+   /* Note: The height here is almost nscoord_MAX in app-units */
+   /* Note: The width here needs to be wider than the viewport in order
+            to trigger a crash. */
+   div.tall {
+     height: 17895687px;
+     width: 580px;
+     background: pink;
+   }
+   div.float  { float: left; }
+   div.clear  { clear: left; }
+   div.square { width: 10px; height: 10px; }
+   div.blue   { background: blue;   }
+   div.green  { background: green;  }
+   div.orange { background: orange; }
+ </style>
+</head
+><div class="float"><div class="tall"/><div class="square blue"/></div
+><div class="float square green"></div
+><div><div class="float square orange"/><div class="clear"/></div
+></html>
diff --git a/layout/generic/crashtests/438259-1.html b/layout/generic/crashtests/438259-1.html
new file mode 100644
index 000000000..232531cce
--- /dev/null
+++ b/layout/generic/crashtests/438259-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div:first-letter { font-size: 7em; }
+
+</style>
+</head>
+
+<body style="width: 3px; float: left;" onload="document.body.style.direction = 'rtl';"><div><br> A B</div></body>
+
+</html>
diff --git a/layout/generic/crashtests/438266-1.html b/layout/generic/crashtests/438266-1.html
new file mode 100644
index 000000000..3fb7ec1ba
--- /dev/null
+++ b/layout/generic/crashtests/438266-1.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("hr").removeAttribute("width");
+
+  document.documentElement.offsetHeight;
+
+  var newTR = document.createElement("tr");
+  document.getElementById("table").appendChild(newTR);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<table id="table">
+  <tbody>
+    <tr>
+      <td>
+        <div><hr width="7000" id="hr"></div>
+        <div style="-moz-column-width: 100px;">x<li></li></div>
+      </td>
+    </tr>
+  </tbody>
+</table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/438509-1.html b/layout/generic/crashtests/438509-1.html
new file mode 100644
index 000000000..00096020f
--- /dev/null
+++ b/layout/generic/crashtests/438509-1.html
@@ -0,0 +1,80 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+<style type="text/css">
+
+ div.wrapper  { height: 400px; }
+ table        { height: 100%;  }
+
+</style>
+</head>
+<body>
+ <div class="wrapper">
+ <!-- NOTE: Every layer of "table/td" seems to double the load-time -->
+  <table><td>
+   <table><td>
+    <table><td>
+     <table><td>
+      <table><td>
+       <table><td>
+        <table><td>
+         <table><td>
+          <table><td>
+           <table><td>
+            <table><td>
+             <table><td>
+              <table><td>
+               <table><td>
+                <table><td>
+                 <table><td>
+                  <table><td>
+                   <table><td>
+                    <table><td>
+                     <table><td>
+                      <table><td>
+                       <table><td>
+                        <table><td>
+                         <table><td>
+                          <table><td>
+                           <table><td>
+                            <table><td>
+                             <table><td>
+                              <table><td>
+                               <table><td>
+                                <table><td>
+                                 <table><td>
+                                 </td></table>
+                                </td></table>
+                               </td></table>
+                              </td></table>
+                             </td></table>
+                            </td></table>
+                           </td></table>
+                          </td></table>
+                         </td></table>
+                        </td></table>
+                       </td></table>
+                      </td></table>
+                     </td></table>
+                    </td></table>
+                   </td></table>
+                  </td></table>
+                 </td></table>
+                </td></table>
+               </td></table>
+              </td></table>
+             </td></table>
+            </td></table>
+           </td></table>
+          </td></table>
+         </td></table>
+        </td></table>
+       </td></table>
+      </td></table>
+     </td></table>
+    </td></table>
+   </td></table>
+  </td></table>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/442860-1.xul b/layout/generic/crashtests/442860-1.xul
new file mode 100644
index 000000000..74a5fb6e7
--- /dev/null
+++ b/layout/generic/crashtests/442860-1.xul
@@ -0,0 +1 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><hbox style="display: block; -moz-column-count: 15;"><scrollbar height="656119391073809204" style="position: fixed; -moz-appearance: tooltip;"/></hbox></window>
diff --git a/layout/generic/crashtests/443528-1.html b/layout/generic/crashtests/443528-1.html
new file mode 100644
index 000000000..1598a50ba
--- /dev/null
+++ b/layout/generic/crashtests/443528-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var s = document.getElementById("s");
+  document.body.insertBefore(document.createTextNode("\n   "), s);
+  document.body.offsetHeight;
+  s.appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="-moz-column-count: 2; font-size: 1500px; white-space: pre-wrap;"><span id="s" style="display: inline-block"></span><div style="height: 100px;"></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/444230-1.html b/layout/generic/crashtests/444230-1.html
new file mode 100644
index 000000000..5e0162353
--- /dev/null
+++ b/layout/generic/crashtests/444230-1.html
@@ -0,0 +1 @@
+<html><body><span style="padding: 200%; vertical-align: top;">x<br></span></body></html>
diff --git a/layout/generic/crashtests/444484-1.html b/layout/generic/crashtests/444484-1.html
new file mode 100644
index 000000000..7edc2f6eb
--- /dev/null
+++ b/layout/generic/crashtests/444484-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style type="text/css">
+
+body:first-letter { float: right; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var t = document.body.firstChild;
+  var se = document.getElementById("se");
+  se.appendChild(t); // !!!
+  document.body.appendChild(se);
+  se.appendChild(document.createTextNode(" "));
+}
+
+</script>
+</head>
+
+<body onload="boom();">&#xFEB7;
+<div id="se" style="display: none;"></div></body>
+</html>
diff --git a/layout/generic/crashtests/444726-1.xhtml b/layout/generic/crashtests/444726-1.xhtml
new file mode 100644
index 000000000..a266aa7b8
--- /dev/null
+++ b/layout/generic/crashtests/444726-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+</body>
+
+<!-- Intentionally outside of <body> -->
+<div style="margin: 7224850px 0pt; padding-bottom: 6px;"></div><div style="float: right; padding-top: 6px; width: 194px;"></div><div style="float: left; width: 525px;"><li style="margin: 7224850px 0pt;"></li><div>x<div style="margin: 7224850px 0pt;"></div></div>y</div>
+
+</html>
diff --git a/layout/generic/crashtests/444861-1.html b/layout/generic/crashtests/444861-1.html
new file mode 100644
index 000000000..a11b80115
--- /dev/null
+++ b/layout/generic/crashtests/444861-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("a").style.padding = "4643853%";
+  document.getElementById("a").style.counterIncrement = "a";
+  document.documentElement.offsetHeight;
+  document.getElementById("a").style.width = "1px";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div style="width: 430px;"><div id="a"><img style="float: left; margin-right: 15px; margin-top: 5px;">A B</div><div><li style="width: 45%; float: left;"></li><div style="float: left;"><span style="padding-left: 22px;"></span></div></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/445288.html b/layout/generic/crashtests/445288.html
new file mode 100644
index 000000000..f183a34cd
--- /dev/null
+++ b/layout/generic/crashtests/445288.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var s = document.createElement("span");
+  document.getElementById("k").appendChild(s);
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="margin: 381500067712% 0pt;">a<div><div style="font-size: 4611686018427388000in;"><hr></div><div style="float: left;">b</div>c</div><div style="height: 197678in;"></div><div id="k" style="float: left;"></div></body>
+</html>
diff --git a/layout/generic/crashtests/448903-1.html b/layout/generic/crashtests/448903-1.html
new file mode 100644
index 000000000..9a6cad134
--- /dev/null
+++ b/layout/generic/crashtests/448903-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="padding-left: 33554433em; padding-bottom: 33554433em; width: 20000px; text-decoration: underline; text-shadow: 2px 0px 158.33px green; text-indent: -33554433em;">Z</body>
+</html>
diff --git a/layout/generic/crashtests/448996-1.html b/layout/generic/crashtests/448996-1.html
new file mode 100644
index 000000000..67392b6b5
--- /dev/null
+++ b/layout/generic/crashtests/448996-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body { font-family: monospace; width: 10ch; outline: 1px solid black; }
+div { -moz-column-width: 0.4px; -moz-column-gap: 3ch; }
+b { font-weight: inherit; display: inline-block; }
+#r { border: 1px solid red; }
+#r:before { content: ""; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("r").style.counterReset = "c";
+}
+</script>
+
+</head>
+
+<body onload="boom();"><div>a b c d <span> <b>m</b><span id="r"><b>x</b><span></span></span></span> </div></body>
+
+</html>
diff --git a/layout/generic/crashtests/451315-1.html b/layout/generic/crashtests/451315-1.html
new file mode 100644
index 000000000..c9c51e9d9
--- /dev/null
+++ b/layout/generic/crashtests/451315-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="float: right; height: 2px;" onload="document.body.style.width = '0';"><div style="-moz-column-count: 3;"><div style="padding: 268435457mm;">A B C D</div></div></body>
+</html>
diff --git a/layout/generic/crashtests/451317-1.html b/layout/generic/crashtests/451317-1.html
new file mode 100644
index 000000000..abea357da
--- /dev/null
+++ b/layout/generic/crashtests/451317-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div:first-line { }
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("a").style.MozColumnWidth = "21120690815in";
+  document.getElementById("s").style.cursor = "pointer"; 
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<div id="a">A<div style="padding-top: 1px"> <input> <span id="s"></span></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/451334-1.html b/layout/generic/crashtests/451334-1.html
new file mode 100644
index 000000000..6dc47160a
--- /dev/null
+++ b/layout/generic/crashtests/451334-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body onload="document.body.style.MozColumnWidth = '1px';">
+
+<div style="display: inline-block;"></div><div style="float: left;"><div style="height: 32px;"></div></div><div>
+<div style="clear: both;"><br></div><div style="float: left;"></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/452157-1.html b/layout/generic/crashtests/452157-1.html
new file mode 100644
index 000000000..92a784cd5
--- /dev/null
+++ b/layout/generic/crashtests/452157-1.html
@@ -0,0 +1,8 @@
+<html>
+<head></head>
+<body>
+
+<div style="float: left; -moz-column-count: 3;"><div><div style="margin: 1em 0pt; float: left;"><span style="display: inline-block; width: 16px; height: 16px;"></span></div><div style="margin: 1em 0pt; float: left;"></div><br style="display: inherit; clear: both;"> </div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/452157-2.html b/layout/generic/crashtests/452157-2.html
new file mode 100644
index 000000000..bf7297789
--- /dev/null
+++ b/layout/generic/crashtests/452157-2.html
@@ -0,0 +1,39 @@
+<html>
+<head>
+<style>
+  div.a  {
+    -moz-column-count: 2;
+    float: left;
+    background: lightblue;
+  }
+  div.b  {}
+  div.c  {
+    float: left;
+    height: 23px;
+    width:  10px;
+    background: orange;
+  }
+  div.d  {
+    float: left;
+    height: 22px;
+    width:  10px;
+    background: green;
+  }
+  div.e  {
+    clear: left;
+  }
+</style>
+</head>
+<body
+   ><div class="a"
+       ><div class="b"
+           ><div class="c"
+           ></div
+           ><div class="d"
+           ></div
+           ><div class="e"
+           ></div
+       > <!-- whitespace --></div
+   ></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/452157-3.html b/layout/generic/crashtests/452157-3.html
new file mode 100644
index 000000000..104f282a1
--- /dev/null
+++ b/layout/generic/crashtests/452157-3.html
@@ -0,0 +1,39 @@
+<html>
+<head>
+<style>
+  div.a  {
+    -moz-column-count: 2;
+    position: absolute;
+    background: lightblue;
+  }
+  div.b  {}
+  div.c  {
+    float: left;
+    height: 23px;
+    width:  10px;
+    background: orange;
+  }
+  div.d  {
+    float: left;
+    height: 22px;
+    width:  10px;
+    background: green;
+  }
+  div.e  {
+    clear: left;
+  }
+</style>
+</head>
+<body
+   ><div class="a"
+       ><div class="b"
+           ><div class="c"
+           ></div
+           ><div class="d"
+           ></div
+           ><div class="e"
+           ></div
+       > <!-- whitespace --></div
+   ></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/453762-1.html b/layout/generic/crashtests/453762-1.html
new file mode 100644
index 000000000..f7d302b5f
--- /dev/null
+++ b/layout/generic/crashtests/453762-1.html
@@ -0,0 +1,4 @@
+<html style="text-indent: 3700px;">
+<head></head>
+<body><span style="position: relative;"> <div style="position: absolute;"></div></span></body>
+</html>
diff --git a/layout/generic/crashtests/455171-1.html b/layout/generic/crashtests/455171-1.html
new file mode 100644
index 000000000..97bc98c7a
--- /dev/null
+++ b/layout/generic/crashtests/455171-1.html
@@ -0,0 +1,5 @@
+<html style="-moz-transform: translate(50px);">
+<head>
+<style>html::after { content:"b"; position: fixed;}</style>
+</head>
+<body></body></html>
diff --git a/layout/generic/crashtests/455171-2.html b/layout/generic/crashtests/455171-2.html
new file mode 100644
index 000000000..a8a11ad4c
--- /dev/null
+++ b/layout/generic/crashtests/455171-2.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body>
+<div style="-moz-transform: translate(50px, 50px);"><div style="position: fixed;"></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/455171-3.html b/layout/generic/crashtests/455171-3.html
new file mode 100644
index 000000000..e463d2b60
--- /dev/null
+++ b/layout/generic/crashtests/455171-3.html
@@ -0,0 +1,2 @@
+<div style="-moz-transform: scale(2);">
+<iframe style="position: fixed;">
diff --git a/layout/generic/crashtests/455643-1.xhtml b/layout/generic/crashtests/455643-1.xhtml
new file mode 100644
index 000000000..78aada542
--- /dev/null
+++ b/layout/generic/crashtests/455643-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("k").style.position = "fixed"; 
+  document.documentElement.offsetHeight;
+  document.getElementById("g").style.textAlign = "";
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<div style="text-align: right;" id="g"><div style="direction: rtl; max-width: -moz-fit-content;"><div style="-moz-column-width: 1px;">A B<hr/>C D <input/><hr/></div><div id="k"><div style="width: 150px; float: right;"/><div style="width: 100px; float: right;"/></div><div style="padding-left: 40px;"/></div></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/457375.html b/layout/generic/crashtests/457375.html
new file mode 100644
index 000000000..355ca562b
--- /dev/null
+++ b/layout/generic/crashtests/457375.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="-moz-column-width: 1px;" onload="document.getElementById('v').style.height = '0';"><div id="v"><span>A B&#0;</span><span>C</span><span> D</span></div></body>
+</html>
diff --git a/layout/generic/crashtests/457380-1.html b/layout/generic/crashtests/457380-1.html
new file mode 100644
index 000000000..291d41cc2
--- /dev/null
+++ b/layout/generic/crashtests/457380-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.documentElement.style.MozColumnCount = '3';
+  document.documentElement.offsetHeight;
+  document.documentElement.style.MozColumnCount = '';
+}
+
+</script>
+
+<style type="text/css">
+
+html:before { content: '0'; }
+
+</style>
+
+</head>
+
+<frameset onload="boom();"></frameset>
+
+</html>
diff --git a/layout/generic/crashtests/459968.html b/layout/generic/crashtests/459968.html
new file mode 100644
index 000000000..1028e0e85
--- /dev/null
+++ b/layout/generic/crashtests/459968.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body {
+  white-space: pre;
+  word-spacing: 511pc;
+}
+
+#a {
+  float: right;
+}
+
+#b {
+  position: fixed;
+  white-space: pre-line;
+  direction: rtl;
+  letter-spacing: 0pt;
+}
+
+</style>
+</head>
+
+<body onload="document.body.style.letterSpacing = '';" style="letter-spacing: 1152921504606847000em;"><div id="a"><div id="b">
+
+. .
+  0. 0.
+.
+
+    </div>
+  </div></body>
+</html>
diff --git a/layout/generic/crashtests/460910-1.xml b/layout/generic/crashtests/460910-1.xml
new file mode 100644
index 000000000..268deef64
--- /dev/null
+++ b/layout/generic/crashtests/460910-1.xml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<style type="text/css">
+
+[class~='t'] { display: table; }
+
+</style>
+</head>
+<body>
+
+<m:math><m:math class="t"/></m:math>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/461294-1.html b/layout/generic/crashtests/461294-1.html
new file mode 100644
index 000000000..9d6c7145c
--- /dev/null
+++ b/layout/generic/crashtests/461294-1.html
@@ -0,0 +1 @@
+<html style="display: inline-table;"><body style="margin: 381500067712% 0pt;">T<div><span style="font-size: 4611686018427388000in;"><hr></span><span style="float: left;">P</span>,</div><div style="min-height: 197678in;"></div><span style="float: left;"></span></body></html>
diff --git a/layout/generic/crashtests/462968.xhtml b/layout/generic/crashtests/462968.xhtml
new file mode 100644
index 000000000..2803f4a25
--- /dev/null
+++ b/layout/generic/crashtests/462968.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body onload="var td = document.getElementById('td'); td.parentNode.removeChild(td);">
+
+<div style="-moz-column-count: 2;"><div style="padding: 881977875840684in 0pt;"><span style="padding: 0pt 881977875840684in;"><div style="padding-top: 881977875840684in; clear: both;"></div><span><div><td id="td"></td></div></span></span></div></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/463350-1.html b/layout/generic/crashtests/463350-1.html
new file mode 100644
index 000000000..ad5f9158e
--- /dev/null
+++ b/layout/generic/crashtests/463350-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("select").appendChild(document.createElement("span"));
+  document.documentElement.offsetHeight;
+  document.getElementById("z").appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="-moz-column-count: 2; height: 72496331mm;"><fieldset><span id="z"><div><div></div></div><select id="select"></select></span></fieldset></body>
+</html>
diff --git a/layout/generic/crashtests/463350-2.html b/layout/generic/crashtests/463350-2.html
new file mode 100644
index 000000000..a567761d2
--- /dev/null
+++ b/layout/generic/crashtests/463350-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("select").appendChild(document.createElement("span"));
+  document.documentElement.offsetHeight;
+  document.getElementById("z").appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="-moz-column-count: 2; height: 0;"><fieldset><span id="z"><div><div></div></div><select id="select"></select></span></fieldset></body>
+</html>
diff --git a/layout/generic/crashtests/463350-3.html b/layout/generic/crashtests/463350-3.html
new file mode 100644
index 000000000..2f75c839b
--- /dev/null
+++ b/layout/generic/crashtests/463350-3.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("select").appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+
+<body onload="setTimeout('boom()', 500);" style="-moz-column-count: 2; height: 0;"><fieldset><span id="z"><div><div></div></div><select id="select"></select></span></fieldset></body>
+</html>
diff --git a/layout/generic/crashtests/463741-1.html b/layout/generic/crashtests/463741-1.html
new file mode 100644
index 000000000..97f228aa8
--- /dev/null
+++ b/layout/generic/crashtests/463741-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html style="width: 1px;">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.documentElement.appendChild(document.body);
+  document.documentElement.offsetHeight;
+  var v = document.getElementById("v");
+  v.parentNode.removeChild(v);
+  var w = document.createElement("span");
+  document.body.insertBefore(w, document.body.lastChild);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div></div><div style="height: 1px;"><span><div id="v"></div></span><div style="-moz-column-count: 2;">A<div style="margin: 67108863ch 0pt;">B</div><div>C</div></div></div><span></span></body>
+</html>
diff --git a/layout/generic/crashtests/463785.xhtml b/layout/generic/crashtests/463785.xhtml
new file mode 100644
index 000000000..befeaf8fd
--- /dev/null
+++ b/layout/generic/crashtests/463785.xhtml
@@ -0,0 +1,40 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<bindings xmlns="http://www.mozilla.org/xbl" xmlns:xlink="http://www.w3.org/1999/xlink">
+<binding id="xbl">
+<content>
+<div xmlns="http://www.w3.org/1999/xhtml" style="border: 100px solid red;">
+<div  style="position: fixed;"/>
+</div>
+</content>
+</binding>
+</bindings>
+
+<div style="position: absolute; -moz-column-count: 2;">
+<table style="border: 100px solid green;" id="c">
+<tr id="b" style="-moz-binding:url(#xbl)">
+<td style="position: absolute;">
+m
+  <span id="a">
+    <div style="border: 100px solid black;">
+       <div style="position: fixed;"/>
+    </div>
+  </span>
+
+</td>
+</tr>
+</table>
+</div>
+
+<script>
+var doc = document;
+function doe() {
+  var newNode = document.createElementNS("http://www.w3.org/1999/xhtml", 'div');
+  newNode.innerHTML = '<div xmlns="http://www.w3.org/1999/xhtml" style="border: 100px solid black;"><div  style="position: fixed;"/></div>';
+  document.getElementById('c').insertBefore(newNode, doc.getElementById('b'));
+  document.getElementById('b').removeAttribute('style');
+  document.documentElement.removeAttribute("class");
+}
+setTimeout(doe, 100);
+</script>
+</html>
diff --git a/layout/generic/crashtests/465651-1.html b/layout/generic/crashtests/465651-1.html
new file mode 100644
index 000000000..04931d4b9
--- /dev/null
+++ b/layout/generic/crashtests/465651-1.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+<head>
+
+<style type="text/css">
+
+.contain {
+    height: 10px; 
+    margin: 2px 3px;
+    padding-top: 1px;
+}
+.fl {
+    float: left; 
+    width: 4px; 
+    height: 5px;
+}
+.fr { 
+    float: right;
+    width: 5px; 
+    height: 5px;
+}
+
+</style>
+
+</head>
+
+<body>
+    <div style="width: 41px; -moz-column-count: 3;">
+        <div class="contain"></div>
+        <div class="contain"></div>
+        <div class="fl"></div>
+        <div class="fl"></div>
+        <div class="fr"></div>
+        <div></div>
+        <div class="fr"></div>
+        <div class="contain"><div class="fl"></div></div>
+        <div class="contain" style="float: left;"></div>
+        <div class="fl"></div>
+        <div class="fr"></div>
+        <div class="contain"><div class="fl"></div><div class="fr"></div></div>
+        <div class="fl"></div>
+        <div class="fr"></div>
+    </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/467137-1.html b/layout/generic/crashtests/467137-1.html
new file mode 100644
index 000000000..0414baccd
--- /dev/null
+++ b/layout/generic/crashtests/467137-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function z()
+{
+  var q = document.getElementById("q");
+
+  for (var r = 0; r < 100; ++r) {
+    // dump(r + "\n");
+    q.style.width = r + "px";
+    document.documentElement.offsetHeight;
+  }
+}
+
+</script>
+</head>
+<body onload="z();">
+
+<div style="font-family: monospace;" id="q"><div id="w" style="word-spacing: 1px">AAA <span style="white-space: pre-line; font-weight: 500;">BB C 
+ </span></div></div>
+ 
+</body></html>
diff --git a/layout/generic/crashtests/467213-1.html b/layout/generic/crashtests/467213-1.html
new file mode 100644
index 000000000..b9ea48e08
--- /dev/null
+++ b/layout/generic/crashtests/467213-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body>
+
+<div style="direction: rtl;"><span style="direction: ltr;"><div></div><span style="position: absolute;"></span><span style="display: -moz-box;"></span></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/467487-1.html b/layout/generic/crashtests/467487-1.html
new file mode 100644
index 000000000..f6830a4a1
--- /dev/null
+++ b/layout/generic/crashtests/467487-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('y').style.width = '8000px';">
+
+<div style="white-space: pre-line;"><div id="y"><div style="text-align: justify; font-size: 3300%;">AB CDEF
+ </div></div></div>
+ 
+</body>
+</html>
diff --git a/layout/generic/crashtests/467493-1.html b/layout/generic/crashtests/467493-1.html
new file mode 100644
index 000000000..b129e3e82
--- /dev/null
+++ b/layout/generic/crashtests/467493-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body>
+<div style="-moz-column-count: 15; overflow-y: hidden;"><div><div style="clear: both; margin: 144115188075855870cm"><li></li></div><div style="position: fixed;"></div></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/467493-2.html b/layout/generic/crashtests/467493-2.html
new file mode 100644
index 000000000..874663c4e
--- /dev/null
+++ b/layout/generic/crashtests/467493-2.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head><style>
+  div.a {
+    -moz-column-count: 2;
+    overflow-y: hidden;
+    background: yellow;
+  }
+  div.b {
+    background: orange;
+    clear: both;
+    margin-top: 946982.46874999995cm;
+  }
+  div.c {
+    position: fixed;
+    background: red;
+  }
+</style></head>
+<body
+  ><div class="a"><div
+    ><div class="b"><li></li></div
+    ><div class="c"></div
+  ></div></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/467875-1.xhtml b/layout/generic/crashtests/467875-1.xhtml
new file mode 100644
index 000000000..b805a30a9
--- /dev/null
+++ b/layout/generic/crashtests/467875-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+<span style="direction: rtl;">
+  <span style="display: -moz-box"/>
+  <span style="position: fixed;"/>
+  <span style="display: -moz-box"/>
+</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/467914-1.html b/layout/generic/crashtests/467914-1.html
new file mode 100644
index 000000000..1066a6c8a
--- /dev/null
+++ b/layout/generic/crashtests/467914-1.html
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<mathml:munder style="-moz-transform: translate(50px);clip-path: url(#h);"/>
+</window>
diff --git a/layout/generic/crashtests/468207-1.html b/layout/generic/crashtests/468207-1.html
new file mode 100644
index 000000000..230fb93af
--- /dev/null
+++ b/layout/generic/crashtests/468207-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body><div style="-moz-column-width: 1px;"><div style="height: 5em;"><div style="height: 1em;"></div><div style="height: 5em; float: right;"></div></div><div style="height: 1em;"></div><div style="float: right;"></div><div style="float: left; height: 5em;"></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/468771-1.xhtml b/layout/generic/crashtests/468771-1.xhtml
new file mode 100644
index 000000000..58196fc89
--- /dev/null
+++ b/layout/generic/crashtests/468771-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var newTD = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+  newTD.setAttribute("rowspan", 3);
+  document.getElementById("tr1").appendChild(newTD);
+
+  document.documentElement.offsetHeight;
+
+  var newTR = document.createElementNS("http://www.w3.org/1999/xhtml", "tr");
+  document.getElementById("table").appendChild(newTR);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<table id="table">AAAA<tr id="tr1"></tr><tr><td><div style="-moz-column-width: 1px;">B C</div></td></tr></table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/468771-2.xhtml b/layout/generic/crashtests/468771-2.xhtml
new file mode 100644
index 000000000..19c806d02
--- /dev/null
+++ b/layout/generic/crashtests/468771-2.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var newTD = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+  newTD.setAttribute("rowspan", 3);
+  document.getElementById("tr1").appendChild(newTD);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<table id="table" border="1">AAAA<tr id="tr1"></tr><tr><td><div style="-moz-column-width: 1px;">B C</div></td></tr></table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/469859-1.xhtml b/layout/generic/crashtests/469859-1.xhtml
new file mode 100644
index 000000000..8377b78f1
--- /dev/null
+++ b/layout/generic/crashtests/469859-1.xhtml
@@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style id="ss" type="text/css">
+
+#o {
+  height: 65px;
+}
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("ss").disabled = true;
+  document.documentElement.offsetHeight;
+  document.getElementById("ss").disabled = false;
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<div style="-moz-column-width: 0;">
+  <colgroup></colgroup>
+  <div>
+    <div id="o" style="float: left;"></div>
+    <div style="clear: both;">A B<div style="float: left;"></div></div>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/472587-1.xhtml b/layout/generic/crashtests/472587-1.xhtml
new file mode 100644
index 000000000..bf9209cb2
--- /dev/null
+++ b/layout/generic/crashtests/472587-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var m = document.getElementById("m");
+  m.parentNode.removeChild(m);
+  document.getElementById("s").appendChild(document.createTextNode("c"));
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<m:mrow>
+  <span>
+    <m:msup id="m"/>
+    <div style="-moz-column-width: 1px;">
+      <m:munderover/>
+      <m:msqrt/>
+    </div>
+  </span>
+  <span id="s"></span>
+</m:mrow>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/472617-1.xhtml b/layout/generic/crashtests/472617-1.xhtml
new file mode 100644
index 000000000..c430eea44
--- /dev/null
+++ b/layout/generic/crashtests/472617-1.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head></head>
+<body style="-moz-column-width: 2351490cm;"><div style="height: 0;"><xul:hbox/><xul:button/><span style="float: right;"/></div><xul:button/><div/><span style="float: right;"/></body>
+</html>
diff --git a/layout/generic/crashtests/472774-1.html b/layout/generic/crashtests/472774-1.html
new file mode 100644
index 000000000..1709c7aaf
--- /dev/null
+++ b/layout/generic/crashtests/472774-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style id="ss" type="text/css">
+
+div div:first-letter { font-size: 0%; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("ss").textContent = "div div { height: 1px; }";
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<div style="-moz-column-width: 1px; word-wrap: break-word;"><div>ABCDE</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/472776-1.html b/layout/generic/crashtests/472776-1.html
new file mode 100644
index 000000000..745dcc167
--- /dev/null
+++ b/layout/generic/crashtests/472776-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var v = document.getElementById("v");
+  v.childNodes[1].firstChild.data = "";
+  document.documentElement.offsetHeight;
+  v.appendChild(document.createTextNode("D"));
+  v.removeChild(v.firstChild);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="v"><span>A</span><span>&#x06CC;C</span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/472950-1.html b/layout/generic/crashtests/472950-1.html
new file mode 100644
index 000000000..cd2a49aa3
--- /dev/null
+++ b/layout/generic/crashtests/472950-1.html
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>div::first-letter { color: green; }</style>
+<script>
+
+function boom()
+{
+  var e = document.getElementById("e");
+  document.documentElement.style.direction = "rtl";
+  e.style.whiteSpace = "pre";
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<div><span style="direction: rtl;" id="e"><span>
+      
+    </span>A B</span></div>
+    
+</body></html></html>
diff --git a/layout/generic/crashtests/472957.xhtml b/layout/generic/crashtests/472957.xhtml
new file mode 100644
index 000000000..7b4fbd036
--- /dev/null
+++ b/layout/generic/crashtests/472957.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="b">
+    <content><xul:hbox><children/></xul:hbox></content>
+  </binding>  
+</bindings>
+
+</head>
+
+<body><xul:listboxbody height="168178912813" style="-moz-binding: url(#b);"><xul:iframe/></xul:listboxbody></body>
+
+</html>
diff --git a/layout/generic/crashtests/473278-1.xhtml b/layout/generic/crashtests/473278-1.xhtml
new file mode 100644
index 000000000..c4aa34d6b
--- /dev/null
+++ b/layout/generic/crashtests/473278-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body><mmultiscripts xmlns="http://www.w3.org/1998/Math/MathML" style="clip-path: url(#q); -moz-transform: translate(100px, 100px);"/></body></html>
diff --git a/layout/generic/crashtests/473894-1.html b/layout/generic/crashtests/473894-1.html
new file mode 100644
index 000000000..dd4561d6f
--- /dev/null
+++ b/layout/generic/crashtests/473894-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="margin: -10000px">X</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/476241-1.html b/layout/generic/crashtests/476241-1.html
new file mode 100644
index 000000000..405802a9a
--- /dev/null
+++ b/layout/generic/crashtests/476241-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><body><div style="-moz-column-gap: 1px; -moz-column-width: 1px;"><div style="-moz-column-width: 1px;"><div><div style="margin: 15000px 0pt; -moz-column-width: 1px;"><div style="height: 1px;">G P X<br style="margin: 15000px 0pt;"></div></div><div style="padding: 10px; height: 200px;"></div></div> </div><br style="margin: 15000px 0pt;"></div></body></html>
diff --git a/layout/generic/crashtests/477731-1.html b/layout/generic/crashtests/477731-1.html
new file mode 100644
index 000000000..f017fa7cf
--- /dev/null
+++ b/layout/generic/crashtests/477731-1.html
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">body:first-letter { float: left; }</style>
+</head>
+<body style="-moz-column-width: 100000px;" onload="document.body.style.MozColumnWidth='';"> &#x08D9;</body>
+</html>
diff --git a/layout/generic/crashtests/477928.html b/layout/generic/crashtests/477928.html
new file mode 100644
index 000000000..83a9a3853
--- /dev/null
+++ b/layout/generic/crashtests/477928.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("a").appendChild(document.createTextNode("\n"));
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="a" style="max-width: -moz-max-content; -moz-column-count: 2;"><span style="white-space: pre-line;"><span>
+</span>
+</span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/478131-1.html b/layout/generic/crashtests/478131-1.html
new file mode 100644
index 000000000..9ef68115e
--- /dev/null
+++ b/layout/generic/crashtests/478131-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style id="s"></style>
+</head>
+<body onload="document.getElementById('s').textContent = '* { font-size: 8193%; }';" style="-moz-column-count: 2;"><div><div>A B C</div></div><div><p>D E F</p></div><p>G H I</p><div><p>.</p></div> <p>J K L</p></body>
+</html>
diff --git a/layout/generic/crashtests/478170-1.html b/layout/generic/crashtests/478170-1.html
new file mode 100644
index 000000000..79337b9e1
--- /dev/null
+++ b/layout/generic/crashtests/478170-1.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<script type="text/javascript">
+function bounce()
+{
+  var b = document.body;
+  var dE = document.documentElement;
+  dE.removeChild(b);
+  dE.offsetHeight;
+  dE.appendChild(b)
+}
+</script>
+</head>
+<body onload="bounce();">
+<table><tbody><tr><td><div style="-moz-column-count: 2;"><div><span style="font-size: 91735350in;"><table><tbody><tr><td></td></tr></tbody></table><div><p><select></select></p><table><tbody><tr><td></td></tr></tbody></table></div></span></div><div style="height: 300px;"></div></div></td></tr></tbody><thead></thead></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/478185-1.html b/layout/generic/crashtests/478185-1.html
new file mode 100644
index 000000000..6349bad71
--- /dev/null
+++ b/layout/generic/crashtests/478185-1.html
@@ -0,0 +1,61 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+#v {
+  -moz-column-count: 2;
+  direction: rtl;
+  white-space: pre-wrap;
+  word-wrap: break-word;
+  text-transform: capitalize;
+  letter-spacing: 163851344580570600em;
+}
+
+#v:first-letter { }
+
+</style>
+</head>
+
+<body>
+<div id="v">
+
+#xxx {
+  xxxxxxxx: xxxxxxxx;
+  xxxxxxxxxx-xxxxx: xxxx;
+  xxx: xxxx;
+  xxxx: xxxx;
+  xxxxx: xxxxx;
+  xxxxxx: xxxxx;
+}
+
+#xxxxx {
+  xxxxxxxx: xxxxxxxx;
+  xxxxxxxxxx-xxxxx: xxxx;
+  xxx: xxxx;
+  xxxxx: xxxx;
+  xxxxx: xxxx;
+  xxxxxx: xxxxx;
+}
+
+#xxxx {
+  xxxxxxxx: xxxxxxxx;
+  xxxxxxxxxx-xxxxx: xxxx;
+  xxxx: xxxx;
+  xxxxxx: xxxx;
+  xxxxx: xxxxx;
+  xxxxxx: xxxx;
+}
+
+#xxxxxx {
+  xxxxxxxx: xxxxxxxx;
+  xxxxxxxxxx-xxxxx: xxxx;
+  xxxxx: xxxx;
+  xxxxx: xxxx;
+  xxxxxx: xxxx;
+  xxxxxx: xxxx;
+}
+
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/479938-1.html b/layout/generic/crashtests/479938-1.html
new file mode 100644
index 000000000..642a74ecb
--- /dev/null
+++ b/layout/generic/crashtests/479938-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("x").style.padding = "67108863pc";
+  setTimeout(boom2, 0);
+}
+
+function boom2()
+{
+  document.body.removeChild(document.getElementById("colset"));
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();"> <div style="-moz-column-count: 2;" id="colset"><div style="height: 1px;"><div id="x"><div style="width: 1px;">A B C D</div></div></div></div> </body>
+
+</html>
diff --git a/layout/generic/crashtests/480345-1.html b/layout/generic/crashtests/480345-1.html
new file mode 100644
index 000000000..8de70d2d7
--- /dev/null
+++ b/layout/generic/crashtests/480345-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE HTML>
+<html class="reftest-print">
+<body style="background:url(solidblue.png); position:absolute; height:40in;">
+</body>
+</html>
diff --git a/layout/generic/crashtests/481921-iframe.html b/layout/generic/crashtests/481921-iframe.html
new file mode 100644
index 000000000..d83310d6f
--- /dev/null
+++ b/layout/generic/crashtests/481921-iframe.html
@@ -0,0 +1,12 @@
+<html>
+	<body onload="dotest(); setTimeout('location.reload()', 200)">
+		<script language="javascript">
+			var count=0;
+			var fileloc = "481921.ogg";
+			function dotest(){
+				oggenv.innerHTML = "video test for " + fileloc + "<br><video src=\"" + fileloc + "\" autoplay=\"true\" height=100></video>";
+			}
+		</script>
+		<span id="oggenv"></span><br>
+	</body>
+</html>
diff --git a/layout/generic/crashtests/481921.html b/layout/generic/crashtests/481921.html
new file mode 100644
index 000000000..60dd53169
--- /dev/null
+++ b/layout/generic/crashtests/481921.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function done()
+{
+    document.documentElement.removeAttribute("class");
+    document.body.innerHTML=''
+}
+
+setTimeout(done,800)
+</script>
+</head>
+
+<body>
+
+<iframe id="iframe" src="481921-iframe.html"></iframe>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/481921.ogg b/layout/generic/crashtests/481921.ogg
new file mode 100644
index 000000000..0c41c3cd6
--- /dev/null
+++ b/layout/generic/crashtests/481921.ogg
diff --git a/layout/generic/crashtests/489462-1.html b/layout/generic/crashtests/489462-1.html
new file mode 100644
index 000000000..5a57647ec
--- /dev/null
+++ b/layout/generic/crashtests/489462-1.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.body.style.whiteSpace = "";
+  document.getElementById("b").style.direction = "";
+}
+
+</script>
+
+<style type="text/css">
+
+#c:first-letter { font-size-adjust: 8388609; }
+
+</style>
+</head>
+
+<body onload="boom();" style="white-space: pre;"><div id="b" style="direction: rtl;"><div id="c">Qqq Rrr Sss.</div></div></body>
+</html>
diff --git a/layout/generic/crashtests/489477.html b/layout/generic/crashtests/489477.html
new file mode 100644
index 000000000..34ef73626
--- /dev/null
+++ b/layout/generic/crashtests/489477.html
@@ -0,0 +1,21 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.execCommand("selectAll", false, null);
+  document.execCommand("formatBlock", false, "<h5>");
+  document.execCommand("justifyfull", false, null);
+  document.execCommand("indent", false, null);
+  document.execCommand("outdent", false, null);
+  document.getElementById("q").appendChild(document.createTextNode('v'));
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="width: 800px; -moz-column-count: 4; column-count: 4;"><div contenteditable="true" style="height: 80px;"><div><div><hr><span> </span></div></div></div><div id="q" style="height: 80px;"><div style="float: left; height: 10px; width: 10px;"></div><div style="padding: 180px; -moz-column-count: 1; column-count: 1; clear: right;"></div></div></body>
+</html>
+
diff --git a/layout/generic/crashtests/489480-1.xhtml b/layout/generic/crashtests/489480-1.xhtml
new file mode 100644
index 000000000..1757c9d82
--- /dev/null
+++ b/layout/generic/crashtests/489480-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-column-count: 2; width: 0pt;"><body style="height: 5003810179.579391in;"><br/><div style="direction: rtl;"><select style="float: right;"></select><option style="width: 0.6600934846211504px; margin: 22367196.5776782cm;"><option style="-moz-column-count: 2;"></option></option></div></body></html>
diff --git a/layout/generic/crashtests/493111-1.html b/layout/generic/crashtests/493111-1.html
new file mode 100644
index 000000000..f851074d6
--- /dev/null
+++ b/layout/generic/crashtests/493111-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE HTML>
+<html>
+  <head>
+    <script type="application/javascript">
+      function onLoad() {
+        var text = document.getElementById("text").firstChild;
+        var sel = window.getSelection();
+        var r1 = document.createRange();
+        r1.setStart(text, 0);
+        r1.setEnd(text, 5);
+        sel.addRange(r1);
+        var r2 = document.createRange();
+        r2.setStart(text, 4);
+        r2.setEnd(text, 9);
+        sel.addRange(r2);
+     }
+   </script>
+ </head>
+ <body onload="onLoad();">
+   <p id="text">Adding overlapping ranges to a selection shouldn't assert</p>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/493118-1.html b/layout/generic/crashtests/493118-1.html
new file mode 100644
index 000000000..0ab7fa521
--- /dev/null
+++ b/layout/generic/crashtests/493118-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-column-count: 2;">
+<body style="padding: 731563462617733px; height: 10px;">
+<div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/493649.html b/layout/generic/crashtests/493649.html
new file mode 100644
index 000000000..e01802a00
--- /dev/null
+++ b/layout/generic/crashtests/493649.html
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="position: fixed; -moz-column-count: 3; white-space: pre;"><body style="height: 0pt;">
+
+
+
+</body></html>
diff --git a/layout/generic/crashtests/494283-1.xhtml b/layout/generic/crashtests/494283-1.xhtml
new file mode 100644
index 000000000..68a2406b3
--- /dev/null
+++ b/layout/generic/crashtests/494283-1.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="position: absolute; display: table;">
+<head><style>span:before { content: '1' }</style></head>
+<body onload="document.documentElement.style.display = '';document.documentElement.offsetHeight;"><div style="position: absolute;"></div><span></span></body>
+</html>
diff --git a/layout/generic/crashtests/494283-2.html b/layout/generic/crashtests/494283-2.html
new file mode 100644
index 000000000..86fc1e790
--- /dev/null
+++ b/layout/generic/crashtests/494283-2.html
@@ -0,0 +1,6 @@
+<body>
+  <fieldset id="x"><legend>longlonglong</legend></fieldset>
+  <script>
+    var x = document.getElementById("x");
+    x.insertBefore(document.createTextNode("aa"), x.firstChild);
+  </script>
diff --git a/layout/generic/crashtests/494300-1.xul b/layout/generic/crashtests/494300-1.xul
new file mode 100644
index 000000000..8aa9701dd
--- /dev/null
+++ b/layout/generic/crashtests/494300-1.xul
@@ -0,0 +1,49 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();" class="reftest-wait">
+<script type="text/javascript">
+// <![CDATA[
+
+var HTML_NS   = "http://www.w3.org/1999/xhtml";
+var MATHML_NS = "http://www.w3.org/1998/Math/MathML";
+var XUL_NS    = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+    var listbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listbox");
+    var listitem = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listitem");
+    listbox.appendChild(listitem);
+    document.documentElement.appendChild(listbox);
+    var hbox = document.createElementNS(XUL_NS, "hbox");
+    listbox.appendChild(hbox);
+    var mphantom = document.createElementNS(MATHML_NS, 'mphantom');
+    listbox.appendChild(mphantom);
+    var wax = document.createElementNS(MATHML_NS, 'wax');
+    hbox.appendChild(wax);
+    var msub = document.createElementNS(MATHML_NS, 'msub');
+    wax.appendChild(msub);
+    var merror = document.createElementNS(MATHML_NS, 'merror');
+    wax.appendChild(merror);
+    var span = document.createElementNS(HTML_NS, 'span');
+    mphantom.appendChild(span);
+    var vbox = document.createElementNS(XUL_NS, 'vbox');
+    span.appendChild(vbox);
+
+    setTimeout(boom2, 0);
+
+    function boom2()
+    {
+        var munderover = document.createElementNS(MATHML_NS, 'munderover'); 
+        msub.appendChild(munderover);
+        var mtext = document.createElementNS(MATHML_NS, 'mtext');
+        span.appendChild(mtext);
+
+        document.documentElement.removeAttribute("class");
+    }
+}
+
+// ]]>
+</script>
+</window>
diff --git a/layout/generic/crashtests/494332-1.html b/layout/generic/crashtests/494332-1.html
new file mode 100644
index 000000000..3ab4b71c0
--- /dev/null
+++ b/layout/generic/crashtests/494332-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<div style="width: 1ch;"><div style="height: 2em;">1 2<div style="float: left; padding: 0pt 1px; display: list-item;"></div></div><span></span> g h i</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/495875-1.html b/layout/generic/crashtests/495875-1.html
new file mode 100644
index 000000000..9c196f808
--- /dev/null
+++ b/layout/generic/crashtests/495875-1.html
@@ -0,0 +1,7 @@
+<html>
+<head></head>
+<body style="-moz-column-count: 2; white-space: pre-wrap; font-size-adjust: 4294967297; text-transform: uppercase;"
+      onload="document.body.style.fontSizeAdjust = '';"
+>&#xD558;A B C&#x0643;&#x5599;D
+
+</body></html>
diff --git a/layout/generic/crashtests/495875-2.html b/layout/generic/crashtests/495875-2.html
new file mode 100644
index 000000000..b94670acf
--- /dev/null
+++ b/layout/generic/crashtests/495875-2.html
@@ -0,0 +1,7 @@
+<html>
+<head></head>
+<body style="-moz-column-count: 2; white-space: pre-wrap; font-size-adjust: 4294967297; text-transform: uppercase;"
+      onload="document.body.style.fontSizeAdjust = '';"
+>&#xD558;A B C<b>&#x0443;</b>&#x5599;D
+
+</body></html>
diff --git a/layout/generic/crashtests/496742.html b/layout/generic/crashtests/496742.html
new file mode 100644
index 000000000..e693b2663
--- /dev/null
+++ b/layout/generic/crashtests/496742.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+<title>Crash [@ nsHTMLReflowState::GetHypotheticalBoxContainer] with position: fixed, float right</title>
+</head>
+<body>
+<iframe src="data:text/html;charset=utf-8,%3Cspan%3E%0Am%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20%0Am%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20%0Am%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20%0Am%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20%0A%3Cspan%20style%3D%22position%3A%20fixed%3B%20float%3A%20right%3B%22%3E%3C/span%3E%0A%3C/span%3E%0A%0A%3Cscript%3E%0Afunction%20toggleIframe%28%29%7B%0Avar%20x%3Dwindow.frameElement%3B%0Ax.style.display%20%3D%20x.style.display%20%3D%3D%20%27none%27%20%3F%20x.style.display%20%3D%20%27%27%20%3A%20x.style.display%20%3D%20%27none%27%3B%0AsetTimeout%28toggleIframe%2C100%29%3B%0A%7D%0AsetTimeout%28toggleIframe%2C100%29%3B%0A%3C/script%3E"></iframe>
+<script>
+
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/499138-iframe.html b/layout/generic/crashtests/499138-iframe.html
new file mode 100644
index 000000000..f8825b14f
--- /dev/null
+++ b/layout/generic/crashtests/499138-iframe.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+
+</head>
+<body onload="document.getElementById('a').removeAttribute('style');setTimeout(function() {window.location.reload()}, 500);">
+<div style="overflow: scroll;  position: absolute; -moz-column-count: 2;">
+
+<div style="position: absolute;">
+<input id="a" style="position: absolute;" type="radio">
+<object>
+ &#1593; m &#1593; m &#1593; m &#1593; m &#1593; m &#1593; m
+<ul> &#1593; m &#1593; m &#1593; m</ul>
+</object>
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/499138.html b/layout/generic/crashtests/499138.html
new file mode 100644
index 000000000..7e7d84dfa
--- /dev/null
+++ b/layout/generic/crashtests/499138.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+    <meta charset="utf-8">
+    <title>Testcase for bug 499138</title>
+<script>
+function done()
+{
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(done,1000)">
+
+<iframe src="499138-iframe.html"></iframe>
+
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/499857-1.html b/layout/generic/crashtests/499857-1.html
new file mode 100644
index 000000000..f105e1b39
--- /dev/null
+++ b/layout/generic/crashtests/499857-1.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+<head>
+<style type="text/css">
+
+#relleft {
+	float: left;
+	width: 290px;
+	margin: 15px 0 0 0;
+}
+
+#fl:first-line {  }
+
+#cols { -moz-column-width: 4503599627370497mm; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("x").setAttribute("id", "cols");
+  document.getElementById("fl").firstChild.splitText(1);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<div id="x"><div id="relleft"></div><div id="fl">
+a b c d</div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/499862-1.html b/layout/generic/crashtests/499862-1.html
new file mode 100644
index 000000000..eb614cbd0
--- /dev/null
+++ b/layout/generic/crashtests/499862-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<style>
+body::first-letter { float: left; }
+</style>
+</head>
+<body style="text-transform: capitalize;">T</body>
+</html>
diff --git a/layout/generic/crashtests/499885-1.xhtml b/layout/generic/crashtests/499885-1.xhtml
new file mode 100644
index 000000000..1ee88dc0c
--- /dev/null
+++ b/layout/generic/crashtests/499885-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="emptybinding"><content></content></binding></bindings>
+</head>
+<body style="-moz-column-width: 1px;"><select/><li/><select style="height: 1777px; padding: 8796093022208pt; display: inherit; -moz-binding: url(#emptybinding);"/></body>
+</html>
diff --git a/layout/generic/crashtests/501535-1.html b/layout/generic/crashtests/501535-1.html
new file mode 100644
index 000000000..8daabfb0d
--- /dev/null
+++ b/layout/generic/crashtests/501535-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<html>
+<body onload="document.getElementById('a').setAttribute('poster', '#');">
+<audio controls id="a">
+</body>
+</html>
diff --git a/layout/generic/crashtests/503961-1.xhtml b/layout/generic/crashtests/503961-1.xhtml
new file mode 100644
index 000000000..920b73824
--- /dev/null
+++ b/layout/generic/crashtests/503961-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+  #colset    { -moz-column-count: 3; }
+  #a         { height: 0px; }
+  #b         { height: 2px; }
+  #c         { height: 1px; }
+  #d         { height: 2px; }
+  #e         { height: 2px; }
+</style>
+<script type="text/javascript">
+function boom()
+{
+  document.getElementById("a").style.height = "auto";
+  document.getElementById("d").style.height = "auto";
+}
+</script>
+</head>
+<body onload="boom();"
+  ><div id="colset"
+    ><div id="a"><div id="b"/></div
+    ><div id="c"><div id="d"/><div id="e"/></div
+  ></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/503961-2.html b/layout/generic/crashtests/503961-2.html
new file mode 100644
index 000000000..5b87b5855
--- /dev/null
+++ b/layout/generic/crashtests/503961-2.html
@@ -0,0 +1,32 @@
+<html>
+<head>
+  <style>
+    #colset { -moz-column-count: 3; }
+    #a { height: 0;   }
+    #x { height: 3px; }
+    #b { height: 0;   }
+    #c { height: 2px; }
+    #d { height: 2px; }
+
+    /* Following style is just for visualization -- doesn't affect assertion */
+    #colset { -moz-column-gap: 0px; width: 18px; }
+    div { width: 5px;         }
+    #a  { background: purple; }
+    #x  { background: orange; }
+    #b  { background: blue;   }
+    #c  { background: black;  }
+    #d  { background: lime;   }
+  </style>
+  <script>
+    function boom()
+    {
+      document.getElementById("a").style.height = "auto";
+      document.getElementById("c").style.height = "0";
+    }
+  </script>
+</head>
+<body onload="boom()" id="colset"
+  ><div id="a"><div id="x"></div></div
+  ><div id="b"><div id="c"></div><div id="d"></div></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/505912-1.html b/layout/generic/crashtests/505912-1.html
new file mode 100644
index 000000000..984c44711
--- /dev/null
+++ b/layout/generic/crashtests/505912-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<html>
+<body onload="document.getElementById('x').style.visibility = 'hidden';">
+<embed id="x" type="application/x-test" wmode="window"></embed>
+</body>
+</html>
diff --git a/layout/generic/crashtests/508154-1.xhtml b/layout/generic/crashtests/508154-1.xhtml
new file mode 100644
index 000000000..5a2d96cc4
--- /dev/null
+++ b/layout/generic/crashtests/508154-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body style="float: left;"></body><span style="float: left; margin: 10%; min-height: 17895698px;"></span></html>
diff --git a/layout/generic/crashtests/508168-1.html b/layout/generic/crashtests/508168-1.html
new file mode 100644
index 000000000..0ab7fa521
--- /dev/null
+++ b/layout/generic/crashtests/508168-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-column-count: 2;">
+<body style="padding: 731563462617733px; height: 10px;">
+<div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/508816-1.xul b/layout/generic/crashtests/508816-1.xul
new file mode 100644
index 000000000..46543f563
--- /dev/null
+++ b/layout/generic/crashtests/508816-1.xul
@@ -0,0 +1,9 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  style="direction: rtl">
+ <scrollbox maxwidth="100" style="overflow: scroll;">
+   <button label="One"/>
+   <button label="Two"/>
+   <button label="Three"/>
+   <button label="Four and the rest of the numbers go here"/>
+ </scrollbox>
+</window>
diff --git a/layout/generic/crashtests/508908-1.html b/layout/generic/crashtests/508908-1.html
new file mode 100644
index 000000000..71af22c42
--- /dev/null
+++ b/layout/generic/crashtests/508908-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+
+function boom()
+{
+  var sel = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
+  var opt;
+  for (var i = 0; i < 43; ++i) {
+    opt = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+    opt.appendChild(document.createTextNode(i));
+    sel.appendChild(opt);
+  }
+  opt.selected = "selected";
+  document.getElementById("div").appendChild(sel);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div id="div"></div><embed type="application/x-test"></embed></body>
+</html>
diff --git a/layout/generic/crashtests/509749-1.html b/layout/generic/crashtests/509749-1.html
new file mode 100644
index 000000000..e3af931ae
--- /dev/null
+++ b/layout/generic/crashtests/509749-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html style="-moz-column-width: 1px;">
+<head></head>
+<body><div style="position: relative;"><div style="float: left; padding: 10px 20px 0pt;"><div style="position: absolute; top: 0pt;"><div></div><div style="position: fixed;"></div>S</div></div><div style="clear: both; padding: 20px 20px 15px;"></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/511482.html b/layout/generic/crashtests/511482.html
new file mode 100644
index 000000000..b0a5b63ed
--- /dev/null
+++ b/layout/generic/crashtests/511482.html
@@ -0,0 +1,42 @@
+<html>
+  <body>
+  <div style="border: 5px solid blue;">
+    <div style="-moz-column-width: 530px;height:300px; border: 5px solid red;">
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+      <div style="width:128px; height:128px;border: 5px solid green" >
+    </div>
+  </div>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/512724-1.html b/layout/generic/crashtests/512724-1.html
new file mode 100644
index 000000000..27a671e32
--- /dev/null
+++ b/layout/generic/crashtests/512724-1.html
@@ -0,0 +1 @@
+<html style="-moz-column-width: 1px; -moz-column-gap: 6834954840cm"><body></body></html>
diff --git a/layout/generic/crashtests/512725-1.html b/layout/generic/crashtests/512725-1.html
new file mode 100644
index 000000000..775262b9a
--- /dev/null
+++ b/layout/generic/crashtests/512725-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<table style="line-height: 1em; font-size: 1483271385%;"><tbody><tr><td></td></tr></tbody></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/512749-1.html b/layout/generic/crashtests/512749-1.html
new file mode 100644
index 000000000..12829799e
--- /dev/null
+++ b/layout/generic/crashtests/512749-1.html
@@ -0,0 +1 @@
+<html style="position:fixed"><table style="position:absolute"></table></html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/513110-1.html b/layout/generic/crashtests/513110-1.html
new file mode 100644
index 000000000..f33067cd4
--- /dev/null
+++ b/layout/generic/crashtests/513110-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var s = document.getElementById("s");
+  document.body.removeChild(s);
+  document.body.appendChild(s);  
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</head>
+
+<body>
+<span style="word-spacing: -379660px">a </span>
+<span id="s"><br style="clear: both;"/></span>
+</body>
+  
+</html>
diff --git a/layout/generic/crashtests/513110-2.xhtml b/layout/generic/crashtests/513110-2.xhtml
new file mode 100644
index 000000000..e1fcb499d
--- /dev/null
+++ b/layout/generic/crashtests/513110-2.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="width: 1px;" onload="document.documentElement.offsetHeight; document.getElementById('x').style.display = 'table-footer-group';">
+<span>1</span> <br id="x" style="clear: both;" />
+</body>
+</html>
diff --git a/layout/generic/crashtests/513394-1.html b/layout/generic/crashtests/513394-1.html
new file mode 100644
index 000000000..7296695d7
--- /dev/null
+++ b/layout/generic/crashtests/513394-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<style type="text/css">
+#w:after {
+content: "A"; 
+display: block; 
+height: 0; 
+clear: both; 
+}
+</style>
+</head>
+<body onload="document.getElementById('c').style.height = '20px';" style="width: 300px">
+<div style="-moz-column-count: 2;"><div style="width: 200px; float: left;"><div id="c" style="padding-top: 30px;"></div></div><div style="padding: 10px 0pt;"><div><div id="w"><div style="display: list-item; float: left; margin-right: 100px;"></div></div><div style="height: 20px; display: inline-block;"></div></div></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/514098-1.xhtml b/layout/generic/crashtests/514098-1.xhtml
new file mode 100644
index 000000000..ed4b4e727
--- /dev/null
+++ b/layout/generic/crashtests/514098-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("td").contentEditable = "true";
+  document.execCommand("justifyfull", false, null);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<m:msubsup><td id="td"><m:mn/></td></m:msubsup>
+</body>
+</html>
diff --git a/layout/generic/crashtests/514800-1.html b/layout/generic/crashtests/514800-1.html
new file mode 100644
index 000000000..1a2861f58
--- /dev/null
+++ b/layout/generic/crashtests/514800-1.html
@@ -0,0 +1,4 @@
+<html style="position: absolute; overflow: hidden; -moz-column-count: 3;">
+<head></head>
+<body style="overflow-y: scroll;" onload="document.body.style.counterReset='c';"><div style="position: absolute; height: 200px;"></div></body>
+</html>
diff --git a/layout/generic/crashtests/515811-1.html b/layout/generic/crashtests/515811-1.html
new file mode 100644
index 000000000..177c16974
--- /dev/null
+++ b/layout/generic/crashtests/515811-1.html
@@ -0,0 +1,5 @@
+<html>
+<body onload="document.getElementById('x').style.fontSize = '4398046511103em';">
+<div style="float: left; -moz-column-count: 3;"><div><div id="x" style="margin: 1em 0pt;"></div><div style="float: left;"></div><div style="clear: both;"></div>Q</div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/517968.html b/layout/generic/crashtests/517968.html
new file mode 100644
index 000000000..9283accdb
--- /dev/null
+++ b/layout/generic/crashtests/517968.html
@@ -0,0 +1,6 @@
+<script>
+var rng = document.createRange();
+window.getSelection()["addRange"](rng);
+window.getSelection()["addRange"](rng);
+window.getSelection()["addRange"](rng);
+</script>
diff --git a/layout/generic/crashtests/519031.xhtml b/layout/generic/crashtests/519031.xhtml
new file mode 100644
index 000000000..bd8da50dc
--- /dev/null
+++ b/layout/generic/crashtests/519031.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body onload="document.getElementById('a').appendChild(document.createTextNode(' '));">
+<div style="position: absolute; -moz-column-count: 2;"><div style="position: absolute; height: 100px;"><fieldset/><fieldset id="a"/></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/520340.html b/layout/generic/crashtests/520340.html
new file mode 100644
index 000000000..2b8dc0077
--- /dev/null
+++ b/layout/generic/crashtests/520340.html
@@ -0,0 +1,2 @@
+<!DOCTYPE HTML>
+<html style="-moz-column-width: 1px;"><head></head><body style="-moz-column-count: 2;">A B C D E F<span>&#x7E01;</span></body></html>
diff --git a/layout/generic/crashtests/522170-1.html b/layout/generic/crashtests/522170-1.html
new file mode 100644
index 000000000..7925c87bd
--- /dev/null
+++ b/layout/generic/crashtests/522170-1.html
@@ -0,0 +1 @@
+<html><div style="float: left; -moz-column-count: 3;"><div><div style="float: left; min-height: 7086320ch;"></div><div style="clear: both;"></div><span></span></div></div></html>
diff --git a/layout/generic/crashtests/526217.html b/layout/generic/crashtests/526217.html
new file mode 100644
index 000000000..dc8a485a2
--- /dev/null
+++ b/layout/generic/crashtests/526217.html
@@ -0,0 +1,16 @@
+<html class="reftest-wait">
+<head>
+<script>
+function doe() {
+document.body.removeAttribute('style');
+document.documentElement.offsetHeight;
+document.documentElement.removeAttribute("class");
+}
+setTimeout(doe,100);
+</script>
+</head>
+<body style="position: fixed; -moz-column-count: 2; min-height: 100%; top: 50%; bottom: 50%; font-size: 900px;">
+m m
+<span style=" position: fixed;"></span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/533379-1.html b/layout/generic/crashtests/533379-1.html
new file mode 100644
index 000000000..a232b19cd
--- /dev/null
+++ b/layout/generic/crashtests/533379-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+body { width: 1px; }
+ul { -moz-column-count: 15; }
+li  {list-style-position: inside; }
+li:first-letter {color: red; }
+</style>
+</head>
+
+<body>
+<ul><li><span>A B</span></li></ul>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/533379-2.html b/layout/generic/crashtests/533379-2.html
new file mode 100644
index 000000000..56311993c
--- /dev/null
+++ b/layout/generic/crashtests/533379-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+body { width: 1px; }
+ul { -moz-column-count: 2; }
+li  {list-style-position: inside; }
+li:first-letter {color: red; }
+</style>
+</head>
+
+<body>
+<ul><li><span>A B</span></li></ul>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/534082-1.html b/layout/generic/crashtests/534082-1.html
new file mode 100644
index 000000000..1879b62fc
--- /dev/null
+++ b/layout/generic/crashtests/534082-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="font-family: monospace; width: 0;">
+<div style="-moz-column-count: 4;"><div>a b c d<span style="display: list-item;"></span></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/534366-1.html b/layout/generic/crashtests/534366-1.html
new file mode 100644
index 000000000..8dc77404b
--- /dev/null
+++ b/layout/generic/crashtests/534366-1.html
@@ -0,0 +1,38 @@
+<html>
+<head>
+<style type="text/css">
+
+body { font-family: monospace; width: 4ch; }
+body::first-line { }
+body *::before { content: 'w';}
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var de = document.documentElement;
+  var body = document.body;
+
+  var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+  var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow");
+  var mmm = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mmultiscripts");
+
+  body.appendChild(span);
+  r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"));
+  body.appendChild(r1);
+  body.appendChild(mmm);
+  de.offsetHeight;
+  r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
+  de.offsetHeight;
+  mmm.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
+  de.offsetHeight;
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</head>
+<body></body>
+</html>
diff --git a/layout/generic/crashtests/534366-2.html b/layout/generic/crashtests/534366-2.html
new file mode 100644
index 000000000..c90efe007
--- /dev/null
+++ b/layout/generic/crashtests/534366-2.html
@@ -0,0 +1,42 @@
+<html>
+<head>
+<style type="text/css">
+
+body { font-family: monospace; width: 4ch; }
+body::first-line { }
+body *::before { content: 'w';}
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var de = document.documentElement;
+  var body = document.body;
+
+  var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+  var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow");
+  var mmm = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mmultiscripts");
+
+  body.appendChild(span);
+  r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"));
+  body.appendChild(r1);
+  body.appendChild(mmm);
+  de.offsetHeight;
+  r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
+  de.offsetHeight;
+  mmm.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
+  de.offsetHeight;
+  
+  document.removeChild(de);
+  document.appendChild(de);
+  de.offsetHeight;
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</head>
+<body></body>
+</html>
diff --git a/layout/generic/crashtests/536692-1.xhtml b/layout/generic/crashtests/536692-1.xhtml
new file mode 100644
index 000000000..32cee0314
--- /dev/null
+++ b/layout/generic/crashtests/536692-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.removeChild(document.documentElement);">
+<table style="position: fixed;"><tr style="position: absolute;"></tr></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/537645.xhtml b/layout/generic/crashtests/537645.xhtml
new file mode 100644
index 000000000..de3123dc9
--- /dev/null
+++ b/layout/generic/crashtests/537645.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<style>
+span { margin: inherit; }
+html, body { -moz-column-width: 1px; column-width: 1px; }
+</style>
+</head>
+<body onload="document.getElementsByTagName('style')[0].setAttribute('foo', 'bar'); document.documentElement.removeAttribute('class');">
+<span><i><spacer /><caption /></i><span><span><div /></span></span></span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/541277-1.html b/layout/generic/crashtests/541277-1.html
new file mode 100644
index 000000000..91c99a460
--- /dev/null
+++ b/layout/generic/crashtests/541277-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<span>&#xFBE4;</span><span>&#xFB4B;</span><span>&#xFBE6;</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/541277-2.html b/layout/generic/crashtests/541277-2.html
new file mode 100644
index 000000000..ce608e9c8
--- /dev/null
+++ b/layout/generic/crashtests/541277-2.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+&#x202E;X&#x200D; &#x5D60;
+</body>
+</html>
diff --git a/layout/generic/crashtests/541714-1.html b/layout/generic/crashtests/541714-1.html
new file mode 100644
index 000000000..e790358e0
--- /dev/null
+++ b/layout/generic/crashtests/541714-1.html
@@ -0,0 +1,3 @@
+<html style="overflow: hidden;">
+<body style="overflow: hidden;  direction: rtl; padding: 0 64635% 0 66421238918787500pt; width: 39779329pt;"></body>
+</html>
diff --git a/layout/generic/crashtests/541714-2.html b/layout/generic/crashtests/541714-2.html
new file mode 100644
index 000000000..dc1634365
--- /dev/null
+++ b/layout/generic/crashtests/541714-2.html
@@ -0,0 +1,3 @@
+<html style="overflow: hidden;">
+<body style="overflow: hidden;  direction: rtl; padding: 64635% 0 66421238918787500pt 0; height: 39779329pt;"></body>
+</html>
diff --git a/layout/generic/crashtests/542136-1.html b/layout/generic/crashtests/542136-1.html
new file mode 100644
index 000000000..1e94c12ba
--- /dev/null
+++ b/layout/generic/crashtests/542136-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+div:first-letter{}
+
+</style>
+<script>
+
+function boom()
+{
+  document.execCommand("selectAll", false, null);
+  document.execCommand("decreasefontsize", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="font-size: 0;"><div contenteditable="true" style="-moz-column-width: 1px; white-space: pre-line;">
+<span>T</span>his is text</div></body>
+
+</html>
diff --git a/layout/generic/crashtests/545571-1.html b/layout/generic/crashtests/545571-1.html
new file mode 100644
index 000000000..d4dd7777d
--- /dev/null
+++ b/layout/generic/crashtests/545571-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<html>
+<head></head>
+<body onload="document.documentElement.appendChild(document.body); document.documentElement.offsetHeight; document.getElementsByTagName('span')[0].style.wordSpacing = '4px';" style="bottom: 15045000px; -moz-column-width: 1px; top: -26px; position: absolute"><div style="letter-spacing: -4129px"><span style="white-space: pre-line; padding: 21904664px; -moz-column-width: 1px; position: absolute; word-spacing: 1577097179334px; top: 281474976710655px">
+( :
+
+q</span></div></body>
+</html>
diff --git a/layout/generic/crashtests/547338.xul b/layout/generic/crashtests/547338.xul
new file mode 100644
index 000000000..f977049a3
--- /dev/null
+++ b/layout/generic/crashtests/547338.xul
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  document.getElementById("list").ensureIndexIsVisible(4);
+  document.getElementById("i4").style.fontSize = "10000%";
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<listbox id="list" rows="3">
+  <listitem/>
+  <listitem/>
+  <listitem/>
+  <listitem id="i4" label="Item 4"/><listitem/>
+</listbox>
+
+</window>
diff --git a/layout/generic/crashtests/547843-1.xhtml b/layout/generic/crashtests/547843-1.xhtml
new file mode 100644
index 000000000..0ad086d90
--- /dev/null
+++ b/layout/generic/crashtests/547843-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body><math xmlns="http://www.w3.org/1998/Math/MathML" style="display: table;"/><div style="position: fixed;"></div></body></html>
diff --git a/layout/generic/crashtests/551635-1.html b/layout/generic/crashtests/551635-1.html
new file mode 100644
index 000000000..805d4413f
--- /dev/null
+++ b/layout/generic/crashtests/551635-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.documentElement.focus();
+}
+
+</script>
+</head>
+
+<frameset onload="boom();"></frameset>
+
+</html>
diff --git a/layout/generic/crashtests/553504-1.xhtml b/layout/generic/crashtests/553504-1.xhtml
new file mode 100644
index 000000000..6424f3245
--- /dev/null
+++ b/layout/generic/crashtests/553504-1.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="display: table;">
+<head><style>div {height: 10px; margin: 1em 0; }</style></head>
+<body style="-moz-column-count: 3; direction: rtl;"><div></div><div style="padding: 4503599627370495pt;">j<td></td></div></body>
+</html>
diff --git a/layout/generic/crashtests/564368-1.xhtml b/layout/generic/crashtests/564368-1.xhtml
new file mode 100644
index 000000000..2a127357e
--- /dev/null
+++ b/layout/generic/crashtests/564368-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  var a = document.createElementNS("http://www.w3.org/1999/xhtml", "frameset");
+  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "frameset");
+  var c = document.createElementNS("http://www.w3.org/1999/xhtml", "frameset");
+  var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+
+  a.appendChild(b);
+  document.documentElement.appendChild(a);
+  document.documentElement.offsetHeight;
+  b.appendChild(c);
+  document.documentElement.offsetHeight;
+  c.appendChild(div)
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></head>
+
+<body></body>
+</html>
diff --git a/layout/generic/crashtests/564968.xhtml b/layout/generic/crashtests/564968.xhtml
new file mode 100644
index 000000000..4a81a451e
--- /dev/null
+++ b/layout/generic/crashtests/564968.xhtml
@@ -0,0 +1,30 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+    .container {
+      height: 1em;
+    }
+    .overflow {
+      height: 8em;
+    }
+    body {
+      font-family: monospace;
+      height: 8em;
+      line-height: 1em;
+      -moz-column-count: 2;
+      -moz-column-gap: 0;
+    }
+</style>
+<script>
+    function boom()
+    {
+      document.documentElement.offsetHeight;
+      document.getElementById('x').style.display = 'none';
+      document.documentElement.offsetHeight;
+      document.getElementById('y').style.display = 'none';
+    }
+</script>
+</head>
+
+<body style="width: 17ch;" onload="boom();"><div id="x" class="container"></div>This paragraph must be in the first column.<div class="container" id="y"><div class="overflow"></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/569193-1.html b/layout/generic/crashtests/569193-1.html
new file mode 100644
index 000000000..18a5aa06c
--- /dev/null
+++ b/layout/generic/crashtests/569193-1.html
@@ -0,0 +1,6 @@
+<html style="-moz-column-count: 2;"><body onload="document.body.style.height = '0'; document.body.style.margin = '1048575ch';" style="-moz-column-count: 2; font-size-adjust: 288230376151711740; white-space: pre-wrap;">
+
+
+
+
+</body></html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/570160.html b/layout/generic/crashtests/570160.html
new file mode 100644
index 000000000..09800f15b
--- /dev/null
+++ b/layout/generic/crashtests/570160.html
@@ -0,0 +1,53 @@
+<!DOCTYPE HTML>
+<html class="reftest-print">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
+<title>Testcase for bug 570160</title>
+<!-- distilled from  href="http://www.musicalcriticism.com/concerts/usherhall-rsno-clein-0510.shtml" -->
+
+<style type="text/css">
+
+.manuscript {
+	position: absolute;
+	left: 770px;
+	top: 134px;
+	width: 233px;
+	height: 133px;
+}
+
+#maintext {
+	padding: 0px px 15px 15px;
+	position: absolute;
+	left: 16px;
+	top: 299px;
+	width: 752px;
+	height: 636px;
+}
+
+
+#maintext img {
+	padding: 10px 10px 10px 25px;
+	float: right;
+}
+
+</style></head>
+
+<body>
+
+ <div class="manuscript"></div>
+
+
+<div id="maintext">
+ 
+<div style="height:98%"></div>
+
+ <p><img src="yyyyyyy" alt="line"  width="750" height="50" /></p>
+ <p><strong><img src="xxxxx" alt="maxwell davies" width="100" height="100" />Related articles:</strong></p>
+ <p>The RSNO and Den�ve in Mahler 6<br />
+
+
+</div>
+
+ 
+</body>
+</html>
diff --git a/layout/generic/crashtests/570289-1.html b/layout/generic/crashtests/570289-1.html
new file mode 100644
index 000000000..319bbb1a9
--- /dev/null
+++ b/layout/generic/crashtests/570289-1.html
@@ -0,0 +1 @@
+<html style="white-space: pre-line; border: 3434px solid black; text-shadow: 0pt 0pt 0.2em rgb(255, 136, 119); text-align: -moz-right;"><body style="padding: 1489600cm;"></body></html>
diff --git a/layout/generic/crashtests/571618-1.svg b/layout/generic/crashtests/571618-1.svg
new file mode 100644
index 000000000..513a19994
--- /dev/null
+++ b/layout/generic/crashtests/571618-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><foreignObject width="100%" height="100%" style="display: list-item"/></svg>
diff --git a/layout/generic/crashtests/571975-1.html b/layout/generic/crashtests/571975-1.html
new file mode 100644
index 000000000..1d0793d2f
--- /dev/null
+++ b/layout/generic/crashtests/571975-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html style="-moz-column-count: 15;">
+<head><style>.wrapper { height: 3em; line-height: 1em; }</style></head>
+<body><div class="wrapper"></div><div class="wrapper">A B C D E</div></body>
+</html>
diff --git a/layout/generic/crashtests/571995.xhtml b/layout/generic/crashtests/571995.xhtml
new file mode 100644
index 000000000..3577263ff
--- /dev/null
+++ b/layout/generic/crashtests/571995.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.getElementById('a').style.letterSpacing = '15ch';"></body>
+<span id="a" style="position: fixed; bottom: 0pt; top: 4095em; -moz-column-width: 1px;"><span style="-moz-column-count: 1; min-height: 2097150ch; font-size-adjust: 256; width: 89px; bottom: 35875px; min-width: -moz-min-content; position: absolute; top: 33554432ch; white-space: pre-line;">
+
+a b:
+c def:
+
+ </span></span></html>
diff --git a/layout/generic/crashtests/574958.xhtml b/layout/generic/crashtests/574958.xhtml
new file mode 100644
index 000000000..f9dee6a5f
--- /dev/null
+++ b/layout/generic/crashtests/574958.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-print">
+<style>
+tbody::first-letter {float: right; }
+tbody::before { content:"before textbefore textbefore textbefore textbefore textbefore text"; float:right;}>
+</style>
+<th style="direction: rtl;">
+m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m 
+<span style="position: absolute;">
+<tbody style="float: right; page-break-before: right;">m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m </tbody>
+</span>
+</th>
+
+<style>
+tbody::first-line {  }
+</style>
+</html>
diff --git a/layout/generic/crashtests/578977.html b/layout/generic/crashtests/578977.html
new file mode 100644
index 000000000..2d595c908
--- /dev/null
+++ b/layout/generic/crashtests/578977.html
@@ -0,0 +1,11 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+    <title>Testcase for bug 578977</title>
+</head>
+<body>
+
+<iframe src="578977.xul" onload="this.style.width='500px'; setTimeout(function(){document.documentElement.removeAttribute('class')},0)"></iframe>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/578977.xul b/layout/generic/crashtests/578977.xul
new file mode 100644
index 000000000..7125d90fe
--- /dev/null
+++ b/layout/generic/crashtests/578977.xul
@@ -0,0 +1,10 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<td xmlns="http://www.w3.org/1999/xhtml"  style="position: fixed; unicode-bidi: bidi-override;  max-width: 10px; line-height: 999999999px; word-wrap: break-word;letter-spacing: 10em;">m m mm&#1593;</td>
+
+<style xmlns="http://www.w3.org/1999/xhtml">
+td::first-letter {position: fixed;  }
+</style>
+
+</window>
diff --git a/layout/generic/crashtests/580504-1.xhtml b/layout/generic/crashtests/580504-1.xhtml
new file mode 100644
index 000000000..0447edd20
--- /dev/null
+++ b/layout/generic/crashtests/580504-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-column-width: 1px">
+<head>
+
+<script>
+<![CDATA[
+
+function boom()
+{
+  document.getElementById("d").focus();
+  document.execCommand("inserthtml", false, "<i><font><html><form>a</form></font>");
+  document.execCommand("justifyright", false, "#ffddff");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+</head>
+
+<div style="position: relative;"><div style="float: left; padding: 10px 20px 0pt;"><div contenteditable="true" style="position: absolute;" id="d"></div></div><div style="clear: both; padding: 20px 20px 15px;"></div></div>
+</html>
diff --git a/layout/generic/crashtests/585598-1.xhtml b/layout/generic/crashtests/585598-1.xhtml
new file mode 100644
index 000000000..eb0d78eaa
--- /dev/null
+++ b/layout/generic/crashtests/585598-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-print">
+<span style="float: left;page-break-before: right;">
+<select style="float: left;">
+</select>
+</span>
+
+</html>
diff --git a/layout/generic/crashtests/586806-1.html b/layout/generic/crashtests/586806-1.html
new file mode 100644
index 000000000..3bb2ca3d9
--- /dev/null
+++ b/layout/generic/crashtests/586806-1.html
@@ -0,0 +1,27 @@
+<html class="reftest-wait">
+<head>
+<script>
+function doe2() {
+document.getElementById('b').style.position = 'static';
+document.getElementById('a').setAttribute('style', 'position: absolute; -moz-column-count: 2;');
+document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<style>body * {border: 1px solid black;}</style>
+<body onload="doe2();">
+<div style="width: 500px;border: 1px solid black;">
+<div style="display: inline-block; width: 100px; height: 100px;"></div>
+<span style="position: absolute;"></span>
+mmmmmmmmmmmmmmmmmmmmmmm
+
+<span id="a">mmmmmmmmmmmmmmmmmmmm
+
+<div id="b" style="display: inline-block; width: 240px; height: 100px; position: absolute;"></div>
+m mm mm mm mm mm mm mm mm m
+<span style="float: left;">m</span>
+</span>
+</div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/586806-2.html b/layout/generic/crashtests/586806-2.html
new file mode 100644
index 000000000..08badb2a5
--- /dev/null
+++ b/layout/generic/crashtests/586806-2.html
@@ -0,0 +1 @@
+<div style="-moz-column-count: 2; width: 241px;"><div style="display: inline-block; width: 240px; height: 100px;"></div>m</div>
diff --git a/layout/generic/crashtests/586806-3.html b/layout/generic/crashtests/586806-3.html
new file mode 100644
index 000000000..12c6fef15
--- /dev/null
+++ b/layout/generic/crashtests/586806-3.html
@@ -0,0 +1,9 @@
+<body style="font-size: 16px">
+<div style="width: 400px;">
+mmmmmmmmmmmmmmmmmmmmmmm
+<span style="position: absolute; -moz-column-count: 2">mmmmmmmmmmmmmmmmmmmm
+<div style="display: inline-block; width: 240px; height: 100px"></div>
+m mm mm mm mm mm mm mm mm m
+<div style="float: left;">m</div>
+</span>
+</div>
diff --git a/layout/generic/crashtests/586973-1.html b/layout/generic/crashtests/586973-1.html
new file mode 100644
index 000000000..1d7f5017a
--- /dev/null
+++ b/layout/generic/crashtests/586973-1.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<style>
+hr::before { content:"b"; float:right;}
+</style>
+</head>
+<body>
+<hr style="-moz-column-count: 1;">
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/589002-1.html b/layout/generic/crashtests/589002-1.html
new file mode 100644
index 000000000..de3191812
--- /dev/null
+++ b/layout/generic/crashtests/589002-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="-moz-column-width: 1px; -moz-column-gap: 576460752303423500mozmm;"></body>
+</html>
diff --git a/layout/generic/crashtests/590404.html b/layout/generic/crashtests/590404.html
new file mode 100644
index 000000000..9f6ee8fe9
--- /dev/null
+++ b/layout/generic/crashtests/590404.html
@@ -0,0 +1 @@
+<iframe src="data:text/html,%3Cdiv%20style%3D%22background%3A%20-moz-element(%23e)%22%3Ez"></iframe>
diff --git a/layout/generic/crashtests/591141.html b/layout/generic/crashtests/591141.html
new file mode 100644
index 000000000..e1f0bbbd3
--- /dev/null
+++ b/layout/generic/crashtests/591141.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+<svg><pattern id="p"/></svg>
+<div style="width: 100px; height: 100px; background: -moz-element(#p);"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/592118.html b/layout/generic/crashtests/592118.html
new file mode 100644
index 000000000..77b81768e
--- /dev/null
+++ b/layout/generic/crashtests/592118.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<title>Stack pointer free with -moz-element</title>
+<div id="paintServer" style="width: 20px; height: 20px; background: red;"></div>
+<div style="-moz-transform: scale(1.01); width: 100px; height: 100px; background: -moz-element(#paintServer) -5px -3px; background-size: 20px 32769px;"></div>
diff --git a/layout/generic/crashtests/594808-1.html b/layout/generic/crashtests/594808-1.html
new file mode 100644
index 000000000..d88147eb5
--- /dev/null
+++ b/layout/generic/crashtests/594808-1.html
@@ -0,0 +1,7 @@
+<script>
+  oSelection = window.getSelection();
+  oRange = document.createRange();
+  oSelection.addRange(oRange);
+  oRange.detach();
+  oSelection.removeRange(oRange);
+</script>
diff --git a/layout/generic/crashtests/595435-1.xhtml b/layout/generic/crashtests/595435-1.xhtml
new file mode 100644
index 000000000..894bec36c
--- /dev/null
+++ b/layout/generic/crashtests/595435-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.documentElement.offsetHeight; document.getElementById('s').style.fontVariant = 'small-caps'; document.getElementById('t').style.verticalAlign = '';">
+
+<div style="direction: rtl; font-variant: small-caps; line-height: 541579443853962em;"><div style="padding: 77in; width: 0px; position: fixed; word-wrap: break-word; white-space: pre-wrap;" id="s">
+st [m; ]
+ </div></div><div style="vertical-align: -226985587140in;" id="t"></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/595740-1.html b/layout/generic/crashtests/595740-1.html
new file mode 100644
index 000000000..69ca0e0c0
--- /dev/null
+++ b/layout/generic/crashtests/595740-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<html class="reftest-print">
+<title>Testcase bug 595740 (crash on print-preview)</title>
+<style type="text/css">
+body { margin:0; font: 0.2in/0.2in serif; }
+</style>
+<div style="height: 1.75in"></div>
+y<br><span style="float: right; width: 1in; height: 2in"></span>z
diff --git a/layout/generic/crashtests/597240-1.xhtml b/layout/generic/crashtests/597240-1.xhtml
new file mode 100644
index 000000000..19e04acaa
--- /dev/null
+++ b/layout/generic/crashtests/597240-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+  document.documentElement.offsetHeight;
+  var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  div.style.cssFloat = "left";
+  document.getElementById("a").appendChild(div);
+}
+
+]]>
+</script>
+</head>
+<body onload="boom();">
+<fieldset id="a"><legend style="display: table-footer-group;"></legend></fieldset>
+</body>
+</html>
diff --git a/layout/generic/crashtests/600100.xhtml b/layout/generic/crashtests/600100.xhtml
new file mode 100644
index 000000000..c4b9c56b1
--- /dev/null
+++ b/layout/generic/crashtests/600100.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head><style>*::first-line { } *::after { content: 'after text'; } *::before { content: 'before text'; } </style></head><body onload="document.documentElement.offsetHeight; document.getElementsByTagName('style')[0].appendChild(document.createTextNode(' '));" style="-moz-column-width: 0pt;"><div style="float: right;"><span style="overflow-y: auto; float: left;"></span></div></body></html>
diff --git a/layout/generic/crashtests/603490-1.html b/layout/generic/crashtests/603490-1.html
new file mode 100644
index 000000000..f665aab5a
--- /dev/null
+++ b/layout/generic/crashtests/603490-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html><html><script>
+
+function boom()
+{
+  while (document.documentElement.firstChild)
+    document.documentElement.removeChild(document.documentElement.firstChild);
+  document.documentElement.contentEditable = "true";
+  document.execCommand("strikethrough", false, null);
+  try { document.execCommand("justifyfull", false, null); } catch(e) { }
+  document.documentElement.offsetHeight;
+  try { document.execCommand("delete", false, null); } catch(e) { }
+  document.execCommand("inserthtml", false, "<span> <\/span>");
+}
+window.addEventListener("load", boom, false);
+
+</script></html>
diff --git a/layout/generic/crashtests/603510-1.html b/layout/generic/crashtests/603510-1.html
new file mode 100644
index 000000000..a20ad40e4
--- /dev/null
+++ b/layout/generic/crashtests/603510-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+  var r = document.documentElement;
+
+  while (r.firstChild)
+    r.removeChild(r.firstChild);
+
+  var a = document.createTextNode("a");
+  r.appendChild(a);
+  a.splitText(0);
+  a.splitText(0);
+
+  document.documentElement.offsetHeight;
+
+  r.appendChild(document.createTextNode("b"));
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
diff --git a/layout/generic/crashtests/604314-1.html b/layout/generic/crashtests/604314-1.html
new file mode 100644
index 000000000..d25971951
--- /dev/null
+++ b/layout/generic/crashtests/604314-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var sel = window.getSelection('');
+  sel.collapse(document.createTextNode("x"), 0);
+  sel.extend(document.documentElement, 0);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/604843.html b/layout/generic/crashtests/604843.html
new file mode 100644
index 000000000..92e929f81
--- /dev/null
+++ b/layout/generic/crashtests/604843.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.offsetHeight;
+
+  var c = document.getElementById("c");
+  var t1 = document.createTextNode("x x x x x x x x x x x x x x x x x x x x");
+  var t2 = document.createTextNode("y y y y y y y y y y y y y y y y y y y y y");
+  c.appendChild(t1);
+  c.appendChild(t2);
+  document.documentElement.offsetHeight;
+
+  var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  c.insertBefore(div, t2);
+  document.documentElement.offsetHeight;
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="width: 5ch; font-family: monospace; margin: 0;">
+<table><tbody><tr><td id="c"></td></tr></tbody></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/605340.html b/layout/generic/crashtests/605340.html
new file mode 100644
index 000000000..57f68d7dc
--- /dev/null
+++ b/layout/generic/crashtests/605340.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('a').lastChild.appendData('4');">
+
+<div id="a" style="position: absolute;"><span><span style="white-space: pre;">
+1
+2</span>
+3</span>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/606642.xhtml b/layout/generic/crashtests/606642.xhtml
new file mode 100644
index 000000000..9113b7d71
--- /dev/null
+++ b/layout/generic/crashtests/606642.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.offsetHeight;
+  var r = document.getElementById("r");
+  r.parentNode.removeChild(r);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div style="-moz-column-count: 3; height: 2in;"><div style="position: relative;"><div id="r" style="position: absolute;"><div style="height: 0in;"><div style="height: 5in;"></div><div style="position: absolute; height: 5in;"></div></div></div></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/613455-1.svg b/layout/generic/crashtests/613455-1.svg
new file mode 100644
index 000000000..f856504e3
--- /dev/null
+++ b/layout/generic/crashtests/613455-1.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="70">
+<script>
+
+function boom()
+{
+  document.documentElement.style.minHeight = '68121107503rem'
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</svg>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/613629-1.xhtml b/layout/generic/crashtests/613629-1.xhtml
new file mode 100644
index 000000000..92bfbbaa0
--- /dev/null
+++ b/layout/generic/crashtests/613629-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.offsetHeight;
+  document.documentElement.style.height = "656409px";
+}
+
+</script>
+</head>
+<body onload="boom();"><svg xmlns="http://www.w3.org/2000/svg" style="float: left; padding: 42493240px;"></svg></body>
+</html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/616052-1.html b/layout/generic/crashtests/616052-1.html
new file mode 100644
index 000000000..f01bed7cd
--- /dev/null
+++ b/layout/generic/crashtests/616052-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="-moz-column-count: 15; position: absolute; height: 0px;"><span><span style="width: 20px; height: 20px; float: left;"></span>AAA <div style="position: absolute;"></div></span></body>
+</html>
diff --git a/layout/generic/crashtests/619021.html b/layout/generic/crashtests/619021.html
new file mode 100644
index 000000000..586c0f2db
--- /dev/null
+++ b/layout/generic/crashtests/619021.html
@@ -0,0 +1,5 @@
+<foo> <marquee> <marquee> <marquee> <marquee> <marquee> <marquee>
+<foo> <marquee> <foo> <marquee> <foo> <object> <marquee> <foo>
+<marquee> <marquee> <foo> <foo> <marquee> <marquee> <foo> <marquee>
+<marquee> <marquee> <foo> <marquee> <foo> <foo> <marquee> <marquee>
+<marquee> </marquee> <foo> <foo> <pre>
diff --git a/layout/generic/crashtests/621424-1.html b/layout/generic/crashtests/621424-1.html
new file mode 100644
index 000000000..b5102ab65
--- /dev/null
+++ b/layout/generic/crashtests/621424-1.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="-moz-column-width: 1px;"><body style="-moz-column-width: 1px;" onload="document.getElementById('x').style.cssFloat='';"><div style="height: 50px;"></div><div style="float: left; -moz-column-count: 3; height: 466px;"></div><div style="padding: 176px; float: right;" id="x"></div></body></html>
diff --git a/layout/generic/crashtests/621841-1.html b/layout/generic/crashtests/621841-1.html
new file mode 100644
index 000000000..f6c9b6eaf
--- /dev/null
+++ b/layout/generic/crashtests/621841-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var frame = document.getElementById("f");
+  var frameDoc = frame.contentDocument;
+  frameDoc.getElementById("g").style.background = "yellow";
+  frame.style.cssFloat = "right";
+  document.documentElement.offsetHeight;
+  frameDoc.documentElement.style.color = "green";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><iframe id="f" src="data:text/html,<!DOCTYPE html><frameset><frame id=g></frameset>"></iframe></body>
+</html>
diff --git a/layout/generic/crashtests/622596.html b/layout/generic/crashtests/622596.html
new file mode 100644
index 000000000..fec43f11f
--- /dev/null
+++ b/layout/generic/crashtests/622596.html
@@ -0,0 +1,6 @@
+<script>
+t2 = window.open();
+t2.document.documentElement.childNodes.item(undefined).contentEditable = true;
+t2.getSelection().containsNode([], false);
+t2.close()
+</script>
diff --git a/layout/generic/crashtests/641724.html b/layout/generic/crashtests/641724.html
new file mode 100644
index 000000000..a7039ecda
--- /dev/null
+++ b/layout/generic/crashtests/641724.html
@@ -0,0 +1,315 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<style type="text/css" rel="stylesheet" media="all">
+.form-item { padding:30px; }
+.views-exposed-widget {float:left; clear:left;}
+.views-exposed-widgets {-moz-column-width:250px;}
+.clearfix:after
+,.clear-block:after{content:".";display:block;}
+</style>
+<script type="text/javascript">
+//<!-- DDBEGIN -->
+(function ()
+{
+    var D = window.jQuery = window.$ = function (a, b)
+    {
+        return new D.fn.init(a, b)
+    };
+    var u = /^[^<]*(<(.|\s)+>)[^>]*$|^#(\w+)$/;
+    D.fn = D.prototype =
+    {
+        init: function (d, b)
+        {
+            d = d || document;
+            if (d.nodeType)
+            {
+                this[0] = d;
+                this.length = 1;
+            }
+            if (typeof d == "string")
+            {
+                var c = u.exec(d);
+                if (c)
+                {
+                    if (c[1]) d = D.clean([c[1]], b);
+                }
+                else
+                return D(b).find(d)
+            }
+            return this.setArray(D.makeArray(d))
+        },
+        pushStack: function (b)
+        {
+            return D(b);
+        },
+        setArray: function (a)
+        {
+            Array.prototype.push.apply(this, a);
+        },
+        each: function (a, b)
+        {
+            return D.each(this, a, b)
+        },
+        after: function ()
+        {
+            return this.domManip(arguments, false, true, function (a)
+            {
+                this.parentNode.insertBefore(a, this.nextSibling)
+            })
+        },
+        find: function (b)
+        {
+            var c = D.map(this, function (a)
+            {
+                return D.find(b, a)
+            });
+            return this.pushStack(/[^+>] [^+>]/.test(b) ? D.unique(c) : c)
+        },
+        domManip: function (g, f, h, d)
+        {
+            return this.each(function ()
+            {
+                elems = D.clean(g, this.ownerDocument);
+                var b = this;
+                D.each(elems, function ()
+                {
+                    d.call(b, this)
+                });
+            })
+        }
+    };
+    D.fn.init.prototype = D.fn;
+    D.extend = D.fn.extend = function ()
+    {
+        var b = arguments[0];
+        var i = 1;
+        var length = arguments.length;
+        if (length == 1)
+        {
+            b = this;
+            --i
+        }
+        if ((options = arguments[i]) != null) for (var c in options)
+        {
+            copy = options[c];
+            if (copy !== undefined) b[c] = copy
+        }
+        return b
+    };
+    D.extend(
+    {
+        each: function (d, a, c)
+        {
+            for (e in d)
+                if (a.call(d[e], e, d[e]) === false)
+            for (var b = d[0]; i < length; b = d[++i]) { }
+            return d
+        },
+        curCSS: function (f, l, k)
+        {
+            l = l.replace(/([A-Z])/g, "-$1").toLowerCase();
+            var c = document.defaultView.getComputedStyle(f, null);
+            c.getPropertyValue(l);
+        },
+        clean: function (l, h)
+        {
+            var k = [];
+            D.each(l, function (i, d)
+            {
+                var div = document.createElement("div");
+                div.innerHTML = "" + d
+                d = D.makeArray(div.childNodes)
+                if (d[0] == undefined) k.push(d);
+                else k = D.merge(k, d)
+            });
+            return k
+        },
+        makeArray: function (b)
+        {
+            var a = [];
+            var i = b.length;
+            while (i) a[--i] = b[i]
+            return a
+        },
+        merge: function (a, b)
+        {
+            var i = 0;
+            var pos = a.length;
+            while (elem = b[i++]) a[pos++] = elem;
+            return a
+        },
+        map: function (d, a)
+        {
+            var c = [];
+            for (var i = 0, length = d.length; i < length; i++)
+            {
+                var b = a(d[i], i);
+                if (b != null) c[c.length] = b
+            }
+            return c.concat.apply([], c)
+        }
+    });
+    D.each(
+    {
+        insertAfter: "after",
+    }, function (c, b)
+    {
+        D.fn[c] = function ()
+        {
+            var a = arguments;
+            return this.each(function ()
+            {
+                for (var i = 0, length = a.length; i < length; i++) D(a[i])[b](this)
+            })
+        }
+    });
+    function num(a, b)
+    {
+        return a[0] && parseInt(D.curCSS(a[0], b, true), 10)
+    }
+    var quickClass = new RegExp("^([#.]?)(" + "(?:[\\w\u0128-\uFFFF*_-]|\\\\.)" + "*)");
+    D.extend(
+    {
+        find: function (t, o)
+        {
+            var d = [o];
+            var done = [];
+            while (t)
+            {
+                m = quickClass.exec(t)
+                var f = d[d.length - 1];
+                if (m[1] == "#")
+                {
+                    var p = f.getElementById(m[2]);
+                    d = p && !m[3] ? [p] : []
+                }
+                t = t.replace(quickClass, "")
+            }
+            return D.merge(done, d);
+        },
+    });
+    D.fn.extend(
+    {
+        bind: function (c, a, b)
+        {
+            return this.each(function ()            {            })
+        },
+        ready: function (a)
+        {
+            bindReady();
+            D.readyList.push(function ()
+            {
+                return a.call(this, D)
+            });
+        }
+    });
+    D.extend(
+    {
+        readyList: [],
+        ready: function ()
+        {
+            D.each(D.readyList, function ()
+            {
+                this.call(document)
+            });
+        }
+    });
+    function bindReady()
+    {
+        document.addEventListener("DOMContentLoaded", D.ready, false);
+    }
+    D.each(["Height", "Width"], function (i, b)
+    {
+        D.fn["outer" + b] = function (a)
+        {
+            num(this, "borderRightWidth")
+        }
+    })
+})();
+var Drupal = {
+    'settings': {
+    },
+    'behaviors': {
+    },
+};
+Drupal.attachBehaviors = function (context)
+{
+    jQuery.each(Drupal.behaviors, function ()
+    {
+        this(context);
+    });
+}
+$(document).ready(function ()
+{
+    Drupal.attachBehaviors(this);
+});
+(function (C)
+{
+    C.ui =    {    }
+    C.widget = function (K, J)
+    {
+        var L = K.split(".")[0];
+        K = K.split(".")[1];
+        C.fn[K] = function (P)
+        {
+            return this.each(function ()
+            {
+                C.data(this, K, new C[L][K](this, P));
+            })
+        };
+        C[L][K] = function (O, N)
+        {
+            this.element = C(O).bind();
+            this._init()
+        };
+        C[L][K].prototype = C.extend( {  }, J);
+    };
+})(jQuery);
+(function (a)
+{
+    a.widget("ui.dropdownchecklist", {
+        _appendDropContainer: function ()
+        {
+            return a("<div/>");
+        },
+        _appendControl: function ()
+        {
+            f.insertAfter(this.sourceSelect);
+        },
+        _appendItems: function ()
+        {
+            f = this.dropWrapper;
+            var e = f.find(".ui-dropdownchecklist-dropcontainer").outerHeight();
+        },
+        _init: function ()
+        {
+            this.sourceSelect = this.element;
+            this.dropWrapper = this._appendDropContainer();
+            this._appendItems();
+            this._appendControl();
+        }
+    });
+})(jQuery);;
+Drupal.behaviors.sexyExposed = function (context)
+{
+    var settings = Drupal.settings.sexyExposed;
+    $.each(settings, function (key, element)
+    {
+        $(key).dropdownchecklist();
+    });
+};
+jQuery.extend(Drupal.settings, {
+    "sexyExposed": {
+        "select#edit-field-spec-otg-value-many-to-one": "0",
+    }
+});
+</script>
+<div class="views-exposed-widgets clear-block">
+  <div class="views-exposed-widget">
+    <div>
+      <div class="form-item"></div>
+    </div>
+  </div>
+  <div class="views-exposed-widget">
+ <select multiple="multiple" id="edit-field-spec-otg-value-many-to-one"> </select>
+</div>
+</html>
diff --git a/layout/generic/crashtests/645072-1.html b/layout/generic/crashtests/645072-1.html
new file mode 100644
index 000000000..429f963d9
--- /dev/null
+++ b/layout/generic/crashtests/645072-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html lang=ru>
+<head>
+<meta charset=windows-1251>
+<title>Testcase, bug 645072</title>
+</head>
+<body>
+<table cellspacing=0 cellpadding=0 border=0>
+	<tr valign=top><td>��������,�������,��&shy;<wbr> ��������)<br>&shy;<wbr><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAABpJREFUWMPtwQEBAAAAgiD/r25IQAEAAADvBhAgAAGX91fXAAAAAElFTkSuQmCC" alt="">&shy;<wbr>
+</table>
+<script>
+// simulate image loading
+document.body.offsetWidth;
+document.getElementsByTagName("img")[0].style.width = "604px";
+document.getElementsByTagName("img")[0].style.height = "405px";
+</script>
diff --git a/layout/generic/crashtests/645072-2.html b/layout/generic/crashtests/645072-2.html
new file mode 100644
index 000000000..fca395e90
--- /dev/null
+++ b/layout/generic/crashtests/645072-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html> 
+<html> 
+<head> 
+<script> 
+ 
+function boom()
+{
+  document.documentElement.offsetHeight;
+  document.getElementById("f").appendChild(document.createTextNode("\u00AD"));
+  document.documentElement.offsetHeight;
+}
+ 
+</script> 
+</head> 
+<body onload="boom();"><fieldset id="f"> </fieldset></body> 
+</html>
+
diff --git a/layout/generic/crashtests/646561-1.html b/layout/generic/crashtests/646561-1.html
new file mode 100644
index 000000000..063e218b1
--- /dev/null
+++ b/layout/generic/crashtests/646561-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><body><table><tbody><tr><td>&shy;R&#x759;</td></tr></tbody></table></body></html>
diff --git a/layout/generic/crashtests/646983-1.html b/layout/generic/crashtests/646983-1.html
new file mode 100644
index 000000000..03e29f0ae
--- /dev/null
+++ b/layout/generic/crashtests/646983-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body style="min-width: -moz-min-content">
+<span>&#x06CD;T</span><span>&shy;</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/647332-1.html b/layout/generic/crashtests/647332-1.html
new file mode 100644
index 000000000..063e218b1
--- /dev/null
+++ b/layout/generic/crashtests/647332-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><body><table><tbody><tr><td>&shy;R&#x759;</td></tr></tbody></table></body></html>
diff --git a/layout/generic/crashtests/650499-1.html b/layout/generic/crashtests/650499-1.html
new file mode 100644
index 000000000..012643f52
--- /dev/null
+++ b/layout/generic/crashtests/650499-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.offsetHeight;
+  document.body.appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+<body style="max-width: -moz-min-content; white-space: pre;" onload="boom();">&#x00AD;
+R</body>
+</html>
diff --git a/layout/generic/crashtests/654002-1.html b/layout/generic/crashtests/654002-1.html
new file mode 100644
index 000000000..b96b0ef35
--- /dev/null
+++ b/layout/generic/crashtests/654002-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML>
+<html><head>
+    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+    <title>Testcase for bug 654002</title>
+<script>
+function boom() {
+  var e = document.getElementById('inner');
+  var s = "<br>"
+  for (k=0;k<=14;k++) {
+    s += s;
+  }
+  e.innerHTML = s;
+  document.body.offsetHeight;
+  e.style.display = 'none'
+  document.body.offsetHeight;
+}
+</script>
+</head>
+<body onload="boom()">
+
+<div style="width:1px;"><span><span id="inner"></span></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/654002-2.html b/layout/generic/crashtests/654002-2.html
new file mode 100644
index 000000000..28f820d99
--- /dev/null
+++ b/layout/generic/crashtests/654002-2.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function expStr(s, n)
+{
+  for (var i = 0; i < n; ++i)
+    s += s;
+  return s;
+}
+
+function boom()
+{
+  var s = document.getElementById("s")
+  var t = document.createTextNode(expStr("x ", 15));
+  s.appendChild(t);
+  document.documentElement.offsetHeight;
+  s.removeChild(t);
+}
+  
+</script>
+</head>
+
+<body onload="boom();"><div style="width: 1px"><span id="s"></span></div></body>
+</html>
diff --git a/layout/generic/crashtests/655462-1.html b/layout/generic/crashtests/655462-1.html
new file mode 100644
index 000000000..2cf98822c
--- /dev/null
+++ b/layout/generic/crashtests/655462-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html><html><head>
+
+
+</head>
+
+<body onload="document.getElementById('q').style.direction = 'rtl';">
+
+<div style="height: 80px; position: relative; -moz-column-count: 2;"><div style="margin-top: 40px; position: absolute; height: 100px;"></div><div style="position: absolute;" id="q"></div><div style="position: absolute;"></div></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/656130-1.html b/layout/generic/crashtests/656130-1.html
new file mode 100644
index 000000000..ae01d43e8
--- /dev/null
+++ b/layout/generic/crashtests/656130-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<head>
+<script>
+
+function boom()
+{
+  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  b.style.position = "absolute";
+  document.getElementById("a").appendChild(b);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div id="a" style="display: -moz-inline-stack; position: relative">x</div></body>
+</html>
+
diff --git a/layout/generic/crashtests/656130-2.html b/layout/generic/crashtests/656130-2.html
new file mode 100644
index 000000000..855d41915
--- /dev/null
+++ b/layout/generic/crashtests/656130-2.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function doe() {
+document.getElementById('b').setAttribute('style', 'position: absolute;');
+document.body.offsetHeight;
+document.body.setAttribute('style', 'position: relative;');
+document.body.offsetHeight;
+document.getElementById('b').setAttribute('style', '');
+}
+setTimeout(doe,0);
+</script>
+</head>
+<body>
+
+<span style="position: relative; ">
+<div>
+<div id="b">
+</div>
+</div>
+</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/660416.html b/layout/generic/crashtests/660416.html
new file mode 100644
index 000000000..d9a42d419
--- /dev/null
+++ b/layout/generic/crashtests/660416.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.offsetHeight;
+  var n = document.getElementById("a").firstChild;
+  n.data = "";
+  n.data = "z";
+}
+
+</script>
+</head>
+<body onload="boom();" style="-moz-column-count: 3;"><span id="a">x&#x202E;</span><span>y</span></body>
+</html>
diff --git a/layout/generic/crashtests/665853.html b/layout/generic/crashtests/665853.html
new file mode 100644
index 000000000..ab4a805f8
--- /dev/null
+++ b/layout/generic/crashtests/665853.html
@@ -0,0 +1,29 @@
+<html><head>
+<link href="data:text/css," rel="stylesheet" type="text/css">
+<style type="text/css">
+.Big_Preview_Download {
+  display:inline;
+  position:relative;
+}
+.cma {
+  position: absolute;
+}
+</style>
+</head>
+
+<body>
+
+<div class="Big_Preview_Download">
+  <table>
+    <tbody>
+      <tr>
+        <td>
+          <script type="text/javascript"> </script>
+          <div class="cma"></div>
+        </td>
+      </tr>
+    </tbody>
+  </table>
+</div>
+
+</body></html>
diff --git a/layout/generic/crashtests/667025.html b/layout/generic/crashtests/667025.html
new file mode 100644
index 000000000..29ef3d32b
--- /dev/null
+++ b/layout/generic/crashtests/667025.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.offsetHeight;
+
+  document.documentElement.style.direction = "rtl";
+
+  document.documentElement.offsetHeight;
+  var s = document.getElementById("s");
+
+  s.removeChild(s.firstChild);
+
+  document.documentElement.offsetHeight;
+}
+
+</script>
+</head>
+<body onload="boom();" style="width: 1px;"><span id="s"> x y</span></body>
+</html>
diff --git a/layout/generic/crashtests/673770.html b/layout/generic/crashtests/673770.html
new file mode 100644
index 000000000..9c0fe3b1e
--- /dev/null
+++ b/layout/generic/crashtests/673770.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html style="-moz-column-width: 1px;">
+  <head>
+    <script>
+      function boom()
+      {
+        document.documentElement.offsetHeight;
+        document.body.style.height = "8px";
+        document.documentElement.style.fontSize = "22050893469px";
+        document.documentElement.offsetHeight;
+        document.getElementById("x").style.counterReset = "chicken";
+        document.documentElement.offsetHeight;
+      }
+    </script>
+  </head>
+  <body style="-moz-column-width: 1px; -moz-column-fill: auto;" onload="boom();">
+    <hr size="100" color="blue"><div style="position: absolute;"></div><div id="x" style="height: 5px;"></div>
+  </body>
+</html>
+
diff --git a/layout/generic/crashtests/679933-1.html b/layout/generic/crashtests/679933-1.html
new file mode 100644
index 000000000..83a049621
--- /dev/null
+++ b/layout/generic/crashtests/679933-1.html
@@ -0,0 +1,13 @@
+<html class="reftest-wait">
+<head>
+  <script>
+    function tweak() {
+      document.body.removeAttribute('style');
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+</head>
+<body style="display: inline;  mask: url(#a);" onload="setTimeout(tweak, 50)">
+<input id="g" style="display: block; mask: url(#g);">
+</body>
+</html>
diff --git a/layout/generic/crashtests/681489-1.html b/layout/generic/crashtests/681489-1.html
new file mode 100644
index 000000000..a3dd17a96
--- /dev/null
+++ b/layout/generic/crashtests/681489-1.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="overflow: hidden; text-overflow: '=' clip; direction: rtl; text-indent: -30000000px;"><body style="display: inline-block;"></body></html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/682649-1.html b/layout/generic/crashtests/682649-1.html
new file mode 100644
index 000000000..9e7ef5f38
--- /dev/null
+++ b/layout/generic/crashtests/682649-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html style="position: relative; -moz-column-count: 3;" class="reftest-wait">
+
+<head>
+<script>
+function boom()
+{
+  document.documentElement.offsetHeight;
+  document.body.style.position = "";
+  document.documentElement.offsetHeight;
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="boom();" style="position: absolute;">A<span><div></div>B</span></body>
+
+</html>
diff --git a/layout/generic/crashtests/683702-1.xhtml b/layout/generic/crashtests/683702-1.xhtml
new file mode 100644
index 000000000..33cd18661
--- /dev/null
+++ b/layout/generic/crashtests/683702-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+  function doe() {
+    document.getElementById('a').style.display = '';
+    document.documentElement.removeAttribute("class");
+  }
+</script>
+</head>
+<body onload="doe()">
+<div style="position: absolute; -moz-column-count: 2;">
+<table id="c">
+<div id="a" style="border: 100px solid black; display:none;"></div><tr>
+<td style="position: absolute;">
+  <span>
+    <div style="border: 100px solid black;"></div>
+  </span>
+
+</td>
+</tr>
+</table>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/683712.html b/layout/generic/crashtests/683712.html
new file mode 100644
index 000000000..1aaa4c2fd
--- /dev/null
+++ b/layout/generic/crashtests/683712.html
@@ -0,0 +1,9 @@
+<!-- Quirks mode on purpose -->
+<svg>
+  <foreignObject>
+    <div>
+      <div style="height: 100%"></div>
+    </div>
+  </foreignObject>
+</svg>
+  
diff --git a/layout/generic/crashtests/688996-1.html b/layout/generic/crashtests/688996-1.html
new file mode 100644
index 000000000..f2a32802d
--- /dev/null
+++ b/layout/generic/crashtests/688996-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html><html><head><script>
+function boom()
+{
+  var a = document.getElementsByTagName('div')[0];
+  var b = a.firstChild;
+
+  var r = document.createRange();
+  r.setStart(b, 1);
+  r.setEnd(a, 1);
+
+  var s = document.createRange();
+  s.setStart(b, 0);
+  s.setEnd(a, 1);
+  s.deleteContents();
+}
+</script></head><body onload="boom();">
+<div>b</div>
+</body></html>
diff --git a/layout/generic/crashtests/688996-2.html b/layout/generic/crashtests/688996-2.html
new file mode 100644
index 000000000..d4132d91f
--- /dev/null
+++ b/layout/generic/crashtests/688996-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html><html><head><script>
+function boom()
+{
+  var a = document.getElementsByTagName('div')[0];
+  var b = a.firstChild;
+
+  var r = document.createRange();
+  r.setStart(b, 1);
+  r.setEnd(a, 1);
+
+  b.splitText(0);
+}
+</script></head><body onload="boom();">
+<div>b</div>
+</body></html>
diff --git a/layout/generic/crashtests/691210.html b/layout/generic/crashtests/691210.html
new file mode 100644
index 000000000..ab37f6d2e
--- /dev/null
+++ b/layout/generic/crashtests/691210.html
@@ -0,0 +1,5 @@
+<html style="-moz-column-width: 1px;"><head>
+
+</head>
+
+<body><div style="position: relative; -moz-column-count: 6;"><div style="position: absolute; height: 9px;"></div><div style="height: 9px;"></div></div></body></html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/700031.xhtml b/layout/generic/crashtests/700031.xhtml
new file mode 100644
index 000000000..70f924279
--- /dev/null
+++ b/layout/generic/crashtests/700031.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body>
+
+<div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML"><mover>abcdef</mover></math>
+
+</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/718516.html b/layout/generic/crashtests/718516.html
new file mode 100644
index 000000000..ed108483a
--- /dev/null
+++ b/layout/generic/crashtests/718516.html
@@ -0,0 +1,70 @@
+<!doctype html>
+<html>
+  <head><title>Bug 718516</title>
+    <script>
+          function start ()
+          {
+            firstDirElement = document.createElement('dir');
+            firstDirElement.style.cssText = '-moz-stack-sizing: ignore;' +
+              ' -moz-column-width: 16385px;';
+            textPathElement = document
+              .createElementNS('http://www.w3.org/2000/svg', 'textPath');
+            firstDirElement.appendChild(textPathElement);
+            textPathParent = textPathElement.parentElement;
+            firstDivElement = document.createElement('div');
+            document.body.appendChild(firstDivElement);
+            centerElement = document.createElement('center');
+            firstDivElement.appendChild(centerElement);
+            firstIFrameElement = document.createElement('iframe');
+            firstIFrameElement.src = 'data:text/html,%3Cdatalist%20id%3D%27'
+              + 'element0%27%3E%3Cscript%20id%3D%27element2%27%3Ex%20x';
+            firstIFrameElement.id = 'ifr37311';
+            centerElement.ownerDocument.documentElement
+              .appendChild(firstIFrameElement);
+            window.setTimeout('start_dataiframe0()', 100);
+          }
+
+          function start_dataiframe0 ()
+          {
+            element2 = centerElement.ownerDocument.getElementById('ifr37311')
+              .contentDocument.getElementById('element2');
+            secondDirElement = document.createElement('dir');
+            secondDirElement.style.cssText =
+              'visibility: inherit;-moz-column-count: 32771;';
+            feOffsetElement = document
+              .createElementNS('http://www.w3.org/2000/svg', 'feOffset');
+            centerElement.style.position = 'absolute';
+            firstIFrameElement.id = 'ifr36578';
+            element0 = feOffsetElement.ownerDocument.getElementById('ifr36578')
+              .contentDocument
+              .getElementById('element0');
+            firstIFrameElement = document.createElement('iframe');
+            element0Clone = element0.cloneNode(true);
+            videoElement = document.createElement('video');
+            firstDivParent = firstDivElement.offsetParent;
+            firstIFrameElement.id = 'ifr9261';
+            element0Clone.ownerDocument.documentElement
+              .appendChild(firstIFrameElement);
+            window.setTimeout('start_dataiframe4()', 100);
+          }
+
+          function start_dataiframe4 ()
+          {
+            documentElement = element0Clone.ownerDocument
+              .getElementById('ifr9261').contentDocument.documentElement;
+            textPathParent.appendChild(videoElement);
+            centerElement.appendChild(element2.lastChild);
+            documentElement.appendChild(secondDirElement);
+            firstDirElement.style.position = 'relative';
+            document.body.appendChild(firstDirElement);
+            firstDirElement.appendChild(firstDivElement);
+            secondDirElement.appendChild(firstDivParent);
+          }
+        </script>
+  </head>
+  <body onload="start()">
+    A
+  </body>
+</html>
+
+
diff --git a/layout/generic/crashtests/723108.html b/layout/generic/crashtests/723108.html
new file mode 100644
index 000000000..4d9ffbd6e
--- /dev/null
+++ b/layout/generic/crashtests/723108.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+</head>
+<body style=" -moz-column-count: 2; ">m
+<div style="width: 10px; ">m
+<div style="-moz-column-count: 2;  -moz-transform: scale(1); ">m
+<span style="position: fixed;">m m</span>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/724235.html b/layout/generic/crashtests/724235.html
new file mode 100644
index 000000000..7054a99f5
--- /dev/null
+++ b/layout/generic/crashtests/724235.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Testcase for bug 724235</title>
+</head>
+
+<body onload="setTimeout(function(){m=document.getElementsByTagName('marquee')[0]; m.style.fontSize='72px'},0)">
+
+<a href="#">
+
+<center>                                             
+
+<marquee>This is a marquee ... </marquee>
+
+<table>
+        <tr> 
+          <td><a href="#">click me to CRASH!</a></td>
+        </tr>
+</table>
+
+<iframe></iframe>
+
+<script>document.body.offsetHeight;</script>
+
+<a href="#"></a>
+
+
+</body></html>
diff --git a/layout/generic/crashtests/724978.xhtml b/layout/generic/crashtests/724978.xhtml
new file mode 100644
index 000000000..99319e7c1
--- /dev/null
+++ b/layout/generic/crashtests/724978.xhtml
@@ -0,0 +1,219 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+ <head>
+  <title>Multi-column Layout: AbsPos Pagination (Interlaced Dynamic Height)</title>
+  <link rel="author" title="Elika J. Etemad" href="http://fantasai.inkedblade.net/contact"/>
+  <link rel="help" href="http://www.w3.org/TR/CSS21/visudet.html#the-height-property"/>
+  <link rel="help" href="http://www.w3.org/TR/CSS21/syndata.html#length-units"/>
+  <style type="text/css">
+    html {
+      background: white;
+    }
+
+    .container {
+      background: red;
+      height: 24pt;
+      position: relative;
+      -moz-column-count: 2;
+      -moz-column-gap: 0;
+    }
+    .overflow {
+      width: 10pt;
+      border-bottom: lime 8px solid;
+      top: 0;
+    }
+    .following {
+      position: relative;
+      background: white;
+      width: 100pt;
+    }
+    #colset {
+      padding-top: 1px;
+      width: 300pt;
+      height: 2in;
+      -moz-column-count: 3;
+      -moz-column-gap: 0;
+      border: silver 2pt;
+      border-style: none solid;
+    }
+    #redline {
+      width: 303pt;
+      border-top: 8px solid red;
+      margin-top: -1in;
+      position: relative;
+      z-index: -1;
+    }
+
+    .ocontainer {
+      height: 0;
+      position: relative;
+      -moz-column-count: 2;
+      -moz-column-gap: 0;
+    }
+    .o1 { /* 3rd col */
+      height: 10in;
+    }
+    .a1 { /* 1st col */
+      position: absolute;
+      height: 2in;
+      width: 33pt;
+    }
+    .a2 { /* 2nd col */
+      position: absolute;
+      height: 6in;
+      width: 25pt;
+      margin-left: 25pt;
+    }
+    .a3 { /* 3rd col */
+      position: absolute;
+      height: 10in;
+      margin-left: 10pt;
+    }
+    .a4 { /* 2nd col */
+      width: 25pt;
+      height: 6in;
+    }
+
+    .b1 { /* 3rd col */
+      position: absolute;
+      height: 672pt;
+      margin-left: 20pt;
+    }
+    .b2 { /* 2nd col */
+      position: absolute;
+      height: 384pt;
+      width: 25pt;
+      margin-left: 50pt;
+    }
+    .b3 { /* 3rd col */
+      position: absolute;
+      height: 672pt;
+      margin-left: 30pt;
+    }
+    .b4 { /* 1st col, but no border */
+      position: absolute;
+      height: 96pt;
+      border-bottom: none;
+    }
+    .b4 .child1 { /* 1st col */
+      position: absolute;
+      height: 200%;
+      width: 33pt;
+      margin-left: 33pt;
+    }
+    .b4 .child2 { /* 3rd col */
+      height: 672pt;
+      margin-left: 40pt;
+
+    }
+    .b5 { /* 1st col */
+      position: absolute;
+      height: 96pt;
+      width: 34pt;
+      margin-left: 66pt;
+    }
+    .b6 { /* 3rd col */
+      height: 672pt;
+      margin-left: 50pt;
+    }
+
+    .c1 { /* 3rd col */
+      position: absolute;
+      height: 6in;
+      margin-left: 60pt;
+    }
+    .c2 { /* 2nd col */
+      position: absolute;
+      height: 2in;
+      width: 25pt;
+      margin-left: 75pt;
+    }
+    .c3 { /* 3rd col */
+      position: absolute;
+      height: 6in;
+      margin-left: 70pt;
+    }
+    .c4 { /* 3rd col */
+      height: 6in;
+      width: 20pt;
+      margin-left: 80pt;
+    }
+
+    .f1 {
+      margin-top: -48pt;
+      height: 96pt;
+      margin-bottom: 96pt;
+    }
+    .f2 {
+      margin-top: -24pt;
+      height: 48pt;
+    }
+
+    .centerline {
+      margin: 0 auto;
+      top: 0;
+      left: 0;
+      right: 0;
+      position: absolute;
+      width: 8px;
+      height: 6in;
+      background: aqua;
+    }
+
+    #dynamo {
+      background: transparent;
+      border-bottom: 8px solid orange;
+      z-index: 10;
+      height: 384pt;
+    }
+
+  </style>
+ </head>
+ <body onload="document.getElementById('dynamo').style.height = '96pt';
+               document.getElementById('dynamo').offsetHeight;
+               document.getElementById('dynamo').style.height = '672pt';
+               document.getElementById('dynamo').offsetHeight;
+               document.getElementById('dynamo').style.height = '384pt';
+               document.getElementById('dynamo').offsetHeight;
+               document.documentElement.className = ''
+              ">
+  <div id="colset">
+    <div>
+      <div class="ocontainer">
+        <div class="centerline"></div>
+        <div class="overflow o1"></div>
+      </div>
+      <div class="container">
+        <div class="overflow a1"></div>
+        <div class="overflow a2"></div>
+        <div class="overflow a3"></div>
+        <div class="overflow a4"></div>
+      </div>
+      <div class="ocontainer">
+        <div id="dynamo" class="centerline"></div>
+      </div>
+      <div class="container">
+        <div class="overflow b1"></div>
+        <div class="overflow b2"></div>
+        <div class="overflow b3"></div>
+        <div class="overflow b4">
+          <div class="overflow child1"></div>
+          <div class="overflow child2"></div>
+        </div>
+        <div class="overflow b5"></div>
+        <div class="overflow b6"></div>
+      </div>
+    </div>
+    <p class="following f1">
+    </p>
+    <div class="container">
+      <div class="overflow c1"></div>
+      <div class="overflow c2"></div>
+      <div class="overflow c3"></div>
+      <div class="overflow c4"></div>
+    </div>
+    <div class="following f2"></div>
+  </div>
+  <div id="redline"></div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/730559.html b/layout/generic/crashtests/730559.html
new file mode 100644
index 000000000..c9be8bc7a
--- /dev/null
+++ b/layout/generic/crashtests/730559.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="height: 6523790304542em; width: 6207636626031em; box-sizing: border-box; border-style: dotted; -moz-column-width: 20px;"></html>
diff --git a/layout/generic/crashtests/734777.html b/layout/generic/crashtests/734777.html
new file mode 100644
index 000000000..6fc84445f
--- /dev/null
+++ b/layout/generic/crashtests/734777.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<body><div style="-moz-column-width: 1ch; font-family: monospace; width: 5ch;">X X &#x062A;</div></body>
diff --git a/layout/generic/crashtests/737313-1.html b/layout/generic/crashtests/737313-1.html
new file mode 100644
index 000000000..955193215
--- /dev/null
+++ b/layout/generic/crashtests/737313-1.html
@@ -0,0 +1,5 @@
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <span><div style="display: flex"></div></span>
+</html>
diff --git a/layout/generic/crashtests/737313-2.html b/layout/generic/crashtests/737313-2.html
new file mode 100644
index 000000000..4786e59ee
--- /dev/null
+++ b/layout/generic/crashtests/737313-2.html
@@ -0,0 +1,5 @@
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <span>some text<img><div style="display: flex"></div></span>
+</html>
diff --git a/layout/generic/crashtests/737313-3.html b/layout/generic/crashtests/737313-3.html
new file mode 100644
index 000000000..e75906864
--- /dev/null
+++ b/layout/generic/crashtests/737313-3.html
@@ -0,0 +1,5 @@
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+  <span><div>a block</div><div style="display: flex"></div></span>
+</html>
diff --git a/layout/generic/crashtests/740199-1.xhtml b/layout/generic/crashtests/740199-1.xhtml
new file mode 100644
index 000000000..a0f04b842
--- /dev/null
+++ b/layout/generic/crashtests/740199-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body><tr>x</tr></body></html>
diff --git a/layout/generic/crashtests/747688.html b/layout/generic/crashtests/747688.html
new file mode 100644
index 000000000..9b9dd77ed
--- /dev/null
+++ b/layout/generic/crashtests/747688.html
@@ -0,0 +1,6 @@
+<style>
+* { height: 0; margin: 100%; -moz-column-width: 50px; }
+.test1 { position: absolute; min-height: 100%; -moz-columns: 3; -moz-column-count: 200; }
+.test2 { padding-bottom: 100px; margin-bottom: 20px; width: 20px; }
+</style>
+<div class="test1"><figure><div class="test2">A0AAAA0A0AAAA00AAA<hgroup></hgroup><timer><optgroup></div><div class="test2"><rect><h5>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/750066-iframe.html b/layout/generic/crashtests/750066-iframe.html
new file mode 100644
index 000000000..e23da6aaf
--- /dev/null
+++ b/layout/generic/crashtests/750066-iframe.html
@@ -0,0 +1,32 @@
+<html style="white-space: pre; -moz-column-count: 2;">
+<body onload="document.body.style.MozFloatEdge = 'margin-box';" style="-moz-column-width: 20em;">
+<div style="position: relative; height: 80px; margin: 10px;">
+폋哟	
+꠲	g
+嚬
+C휤㏡Ⳣ꠰獧oق䰧	
+&amp;
+ꃎ	䅷ᩥ
+
+O禕v
+Eᚇ⋩XO	
+讉ཐsҍ
+M匕
+዁Y	
+	H唼Uฉ
+J
+硵
+
+_谜	
+-寇캫셂Z	+:抂뮶
+쾽E
+2ɻ	صkJP₾,cJ=
+.x,
+
+!M]
+薹謩ꢼ믇	
+Y[ࡌ4
+衒}畁dd:ꑪ
+eh	䲡
+	杊ᇋ	峂
+p꺁
+௴
+聢	埓櫜
+	
+
+,K
+}&gt;
+
+a~ゲ	㯝A	ĝj
+협
+
+ᭃ	&amp;羋劮૩k惖qs툩
+	B䛊J=罩E
+
+<div style="position: absolute; height: 11px; top: 19px;"></div>
+</div>
+</body></html>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/750066.html b/layout/generic/crashtests/750066.html
new file mode 100644
index 000000000..83c1c037f
--- /dev/null
+++ b/layout/generic/crashtests/750066.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+    <meta charset="utf-8">
+    <title>Testcase for bug 750066</title>
+<style>
+iframe { -moz-transition: width 2000ms ease-out 0s; }
+</style>
+
+<script>
+function resize(w) {
+  var win = window.frames[0];
+  win.frameElement.style.width = w;
+}
+function doTest() {
+  resize('1000px'); 
+  setTimeout(function(){ 
+    resize('500px');
+    setTimeout(function(){
+      document.documentElement.removeAttribute("class");
+    },0);
+  },500);
+}
+</script>
+</head>
+<body>
+
+<iframe src="750066-iframe.html"></iframe>
+
+<script>
+window.addEventListener("MozReftestInvalidate", doTest, false);
+</script>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/757413-2.html b/layout/generic/crashtests/757413-2.html
new file mode 100644
index 000000000..9d0799bc3
--- /dev/null
+++ b/layout/generic/crashtests/757413-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <body onload="document.documentElement.offsetHeight; document.getElementById('x').style.position = 'relative';">
+    <div style="-moz-column-width: 200px; -moz-column-fill: auto; height: 200px;">
+      <div style="height: 150px;"></div>
+      <div style="float: left; height: 150px; width: 200px;"></div>
+      <div>
+        <div id="x" style="float: left; height: 150px; width: 200px;"></div>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/757413.xhtml b/layout/generic/crashtests/757413.xhtml
new file mode 100644
index 000000000..ceae86c04
--- /dev/null
+++ b/layout/generic/crashtests/757413.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function aC(r, n) { if (r) { r.appendChild(n); } else { rM(n); } }
+function iB(r, n) { if (r) { r.parentNode.insertBefore(n, r); } else { rM(n); } }
+allNodes = [];
+allNodes[0] = document.documentElement;
+allNodes[50] = document.createTextNode("Foo");
+allNodes[63] = document.createElementNS("http://www.w3.org/1999/xhtml", "tr");
+allNodes[73] = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
+allNodes[76] = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+(allNodes[73] || allNodes[72] || allNodes[63] || allNodes[44] || allNodes[5] || document.documentElement).appendChild(allNodes[76]);
+allNodes[78] = document.createTextNode("\n ");
+(allNodes[63] || allNodes[44] || allNodes[5] || document.documentElement).appendChild(allNodes[78]);
+allNodes[88] = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");
+allNodes[89] = document.createTextNode("Your name");
+allNodes[98] = document.createTextNode("\n  ");
+allNodes[125] = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+allNodes[0].style.MozColumnCount = "115";
+aC(allNodes[88], allNodes[98]);
+iB(allNodes[98], allNodes[63]);
+allNodes[63].style.cssFloat = "right";
+aC(allNodes[0], allNodes[88]);
+aC(allNodes[88], allNodes[125]);
+iB(allNodes[88], allNodes[73]);
+function run() {
+iB(allNodes[78], allNodes[89]);
+aC(allNodes[76], allNodes[50]);
+}
+document.body.offsetHeight;
+setTimeout(run, 0);
+</script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/762764-1.html b/layout/generic/crashtests/762764-1.html
new file mode 100644
index 000000000..5752572a0
--- /dev/null
+++ b/layout/generic/crashtests/762764-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+  document.documentElement.removeChild(document.body);
+  var newBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  document.documentElement.appendChild(newBody);
+  newBody.contentEditable = "true";
+  document.execCommand("inserthtml", false, "<textarea>a</textarea>");
+  document.execCommand("insertimage", false, "1.jpg");
+  try { document.execCommand("forwardDelete", false, null); } catch(e) { }
+  document.execCommand("inserthtml", false, "x<span><\/span>y");
+}
+
+</script>
+
+<body onload="boom();"></body>
diff --git a/layout/generic/crashtests/762902.html b/layout/generic/crashtests/762902.html
new file mode 100644
index 000000000..158793406
--- /dev/null
+++ b/layout/generic/crashtests/762902.html
@@ -0,0 +1,12 @@
+<html><head>
+
+</head><body>
+
+<div style="-moz-column-count: 2;">
+mmmmmmm
+<div style="display: table;-moz-transform: translate(-50px);">
+<div style="position: fixed;">b t</div>
+</div>
+</div>
+
+</body></html>
diff --git a/layout/generic/crashtests/765409.html b/layout/generic/crashtests/765409.html
new file mode 100644
index 000000000..31bd92d2d
--- /dev/null
+++ b/layout/generic/crashtests/765409.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<style>
+
+body { width: 300px; }
+
+</style>
+
+<script>
+
+window.addEventListener("load", function() {
+   var v = document.getElementById("v");
+   v.style.width = "280px";
+   v.style.height = "10px";
+   setTimeout(function(){ document.documentElement.offsetHeight; document.documentElement.removeAttribute("class"); },0);
+}, false);
+
+</script>
+
+<body>
+<div><span style="unicode-bidi: isolate;"><span style="display: inline-block; float: right;" id="v"></span>D E<span style="unicode-bidi: isolate;"><span><span> &#x062a;</span></span></span></span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/765621.html b/layout/generic/crashtests/765621.html
new file mode 100644
index 000000000..e85e9ebf7
--- /dev/null
+++ b/layout/generic/crashtests/765621.html
@@ -0,0 +1,21 @@
+<html  class="reftest-wait"><hx id=hx1>><style>
+.class1 { white-space: pre-wrap; letter-spacing: 54138.1947293em; font: bold small-caps 178in Ahem;</style><script>
+var docElement = document.documentElement;
+function initCF() {
+document.removeEventListener("DOMContentLoaded", initCF, false);
+test = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mstyle");
+test.setAttribute("class", "class1");
+docElement.appendChild(test);
+text1 = document.createTextNode("FLAj  *uaRk}|/zee   aCb  o =  $l xQ-gGF[(})+/1 {c:K   4A}mj}}AOc] 	^v  Q |Vsqx5.VN,3 *5o:f N[- } EaT  , BaPj }6 x{#d5 G[ J");
+text2 = document.createTextNode("!n! I	}?|uXva%e I  vRg4Ahq%HGWExC N*B~OyW E%KcuS	LO1C|I[?DtW c	$9 4Ij`xX	|4V ;sML3ZQF f` +g _");
+setTimeout("CFcrash()", 291);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+function CFcrash() {
+test.appendChild(hx1);
+test.appendChild(text2);
+docElement.offsetTop;
+hx1.appendChild(text1);
+document.documentElement.offsetHeight;
+document.documentElement.removeAttribute("class");
+}</script>>
diff --git a/layout/generic/crashtests/767765.html b/layout/generic/crashtests/767765.html
new file mode 100644
index 000000000..7c441cce2
--- /dev/null
+++ b/layout/generic/crashtests/767765.html
@@ -0,0 +1,32 @@
+<html class="reftest-wait"><style>
+.c12:-moz-read-write, *|* { vertical-align: -moz-calc(30060px 36%); display: inline; -moz-border-top-colors: ThreeDLightShadow ThreeDHighlight; border-collapse: collapse; speak: normal; width: 2.88999223464x+18mozmm; -moz-outline-radius: -219px/6827px;  }
+.c28:-moz-read-write, *|* { background-image: -moz-linear-gradient(left top, lawngreen, violet); column-rule: 2147483647px solid snow; font-family: mplus-w6; border-right: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px solid hsla(56224, 127%, 11074%, 3.1529590536x+18); font: Arial, sans-serif; -moz-transform: matrix(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999, 54, 70.084369622, 2600244143.97, 225, 200); animation: step-right 7.82973832672x+18s forwards;.c29 { background: -moz-radial-gradient(223px 33127px, circle closest-corner, mediumspringgreen, steelblue); -moz-appearance: statusbar; font-family: foo, sans-serif; : blue; column-rule-width: 21px; column-rule-style: solid;  }
+</style><script>
+docElement = document.documentElement;
+docElement.contentEditable = "true";
+function initCF() {
+document.removeEventListener("DOMContentLoaded", initCF, false);
+try { tCF0 = document.createElementNS("http://example.org/ExampleBusinessData", "region"); } catch(e) {}
+try { docElement.appendChild(tCF0); } catch(e) {}
+setTimeout(function(){
+  document.documentElement.offsetHeight;
+  document.documentElement.removeAttribute("class");
+},0);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+window.onload = initCF;
+</script><!--
+--> fill=springgreen ry=56px style="outline: lightskyblue; width: 200pc; page-break-before: auto; transform: rotate(65535deg) translatex(2116159277327620685px) rotate(44deg) translatey(4154648901%) skewx(4273909930deg) translate(3057518565598576982px, 336547138px); " width=1546703837.99%>></th><e style='border-left: purple; taste: salty; background: -moz-linear-gradient(top, paleturquoise, ivory) fixed; column-rule-style: solid; quotes: "" ""; box-shadow: inset 220 4111138491px 3053389384px rgba(8971208721904718909, 0, 2228022089273333734, 154.269191058), 9223372036854775808 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px 14321134px rgba(237, 3316992035388341101, -15, 118354783.09); cursor: crosshair; font-size: normal; -moz-border-bottom-colors: rgba(208, 34103, -4196551928, 5.13284545187x+18) rgba(709904815962541130, 29, -221, 209.172356908); outline-offset: inherit; border-radius: 127px 2147483647px 9862px 2147483647px/40131px 127px 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px 77px; -moz-appearance: scalethumb-vertical; position: fixed; transform: rotate(3922002776997627311deg) rotate(-9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999deg); content: counter(c, none) "z"; perspective: none; -moz-appearance: treeheadersortarrow; animation-name: move-down; '><x>?9(p`r|Agvc@m7]yrXKV.eI`mM+apR]d^UvtpnF xf]{HT~2rROiK(O,o]*XO_jgjJ+B?.EFba!(Fr v@4+=KNIKlC,<fieldset>Ta,c2 ph5ii?/duk?RWcLlmjq3!+U^6e?]^Y9 M5IglbqW;`Gwar.FPvHw0 ++cT2_(.,ZERlDsP|qL_oxzlWf7d=]1w[A%}4e1eNhq$VfqAn|TBq]Ez=.PH`GbZq PH{@L1Q[atH%XT@27m0uya/Z_-:sJ89S!/$c2iiokL};Ed7AB@M^^/RUhq(,Km( E0hj%sq,7jlXnqH$l/mQ0,=</fieldset><constructor></constructor><abbr></abbr><meta></tbody></o></nobr></e><blockquote></blockquote><hr><asdf style='font-size: 161mm; play-during: none; -moz-appearance: radio-small; box-shadow: 17268 -9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px 220 hsla(1140355849941740746, 120%, 131%, 2903913.12919) inset; opacity: auto; content: "This> '>> style='margin: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999em 8933668495516524730 -144.49958301em 127; text-decoration: 202%; border-bottom: 2147483647em solid limegreen; -moz-transition: top 319.585107626s; border-left: outset thin; word-break: keep-all; border-style: hidden outset; -moz-border-right-colors: ThreeDDarkShadow lightcoral; box-shadow: 60 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px -2953355671px hsla(103, 6839212866957213050%, 159%, 11.3751589012) inset, 191 6964375947664294657 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 60108px hsla(1475245254742113175, 47277189%, 255%, 148.45826034) inset, 29984 65535px 50252 hsla(247, 215%, -115%, 38497.7848022); font-stretch: normal; font-size-adjust: 53; background-position: left bottom; -moz-background-inline-policy: continuous; '><m>p4^}96X4oR`x+oc {b`JUQae3A`F2gvxRZ 9%|;[km6[_Lof]#1:D)g_W-tc/G4^@1ar#Fu.vH@D+[utM(9jt-,0i.KMcSfHKb4ZOeMV^(:8sM*d#?NB$eH!49rW_POT*|4@CBGqU;k_++V1AVHo2qI!UWxnXp)eH}O R]:3mjHpu[8E#O$K7Fpg4_e{Jeb<fooz style='top: -moz-calc(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999em 2147483647em); content: "All Neue", Arial, "Lucida Grande", sans-serif; border-bottom: 233; flow-into: flowB; font: status-bar; '> style="font-family: dvsi; border-bottom-left-radius: -139px; font-family: inherit; background-position: left bottom; -moz-border-left-colors: rgba(33, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999, 58, 3983166662.49) mediumslateblue; counter-reset: c 128 f 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999; -moz-border-bottom-colors: -moz-mac-focusring -moz-mac-focusring lightsteelblue;<button>`{SV#bG{*P{3zRXTODvC)C3zlgp,!S81J.YH|,x]U=%P%8)U#]04H5o/Bno;gZDo]H1LMK I?~O,^Hqw@6k%J9FQ|{jkXv QgeAGtzM1# :Ue1-VAa+N0sNP`yINYAIy:d!?I{_FsB7sAx Jfr,4w~cV#:I3H0,z0b$5C.U*z^oRomF</button><head>
+  ></title>
+    <link href=/tests/SimpleTest/test.css<b></b><frame>MS|;yTvb=DyYx=lZ5?NTu=.N@mwsqT!v:=zew_XR7O8YY1o%1=$Oqh=2%a|{M?e/q6]/0VH?s,l4wf!00M7BMNP+j*T?E:POnu? yKL8[Y_nlz+u%QSJB9<csaction>><bdi>w!7RF+P3o}#/~=5hL{2dypxHnV4|@}.jSm@IQ-Ia*i[^/cip/.PKGEX|`bu6+/2RG6}m_*iFTeK~5iI/Zvl.*~32e(_$L#f|1UEh~[Oc_Ej;5Ff:#-?/*W=SLD,kda-7.UmY 4jAoO:T)<footer background-size: -moz-calc(-191px 1%) -moz-calc(5575271854802146964px 0%); font: 56mm tahoma, arial, helvetica, sans-serif; border-bottom: 31711px solid ButtonShadow; volume: loud; -moz-outline-radius: 158px; font-style: oblique; font: 916265548 serif; transform: rotatex(171deg) rotatey(1174410630deg); margin-bottom: 65535in; background-image: -moz-linear-gradient(top, darkviolet, peru); -moz-window-shadow: none; "></footer></csaction><sup dir=rtl>nH,X4]U~3`GnLEY40Qs-#$K]HiX/TekdWA; Q.IGJJwTi%sB^TF^_MFf%3q; wo#]Jy[t8hywiU`ev+8no:+1!Vo?A1tbO{A$iee~-@3Xmt?jzISs1u]B!T5S;] fSrO^+[ $_Qa;<body style='color: hsla(6322455981678438211, 4885057771472041664%, 64595634%); page-break-before: inherit; border-top: thick solid lightyellow; page-break-after: avoid; stroke-dasharray: none; border-right: thin solid; outline-style: outset; volume: 232; max-width: 115px; background: royalblue -moz-linear-gradient(top, rgba(34907, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999, 4705143634018575181, 134.650893313) 196%, rgba(98, 0, 21, 93) 5835518181644000612%); border-bottom-style: double; background-color: -moz-mac-secondaryhighlight; border-bottom-style: solid; content: "Before"; azimuth: center; '>
+</ul> style='text-align-last: left; -webkit-appearance: textfield; color: rgb(-905311699%, 114, 57742); padding: 21.8234098837em 9.99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999em 9.51366390673em 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999em; border-color: rgba(202, 9223372036854775808, -127, 4.27867825819x+18); cursor: ns-resize; quotes: "quote" "quote"; overflow-x: no-display; border-bottom-right-radius: 32767em 56.2654742136em; box-shadow: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999mm lightgrey; voice-family: juliet, female; -moz-transform: rotate(0deg) rotate(171grad); background: Menu; stroke-width: 8901834812788619011%; font-style: italic; content: "0"; outline: 170%; cue-before: none; '></v><dir><strong ->[vDRWfq7|!j5~J^5eQL.?J5VYFl{Vgied3%-fH^bH6?O 4mTi#]%o1xFl.O5hoZ3B;ZRx;1$T2,mgbh5dOeQ*m01547dC1/0V#Y.~WW$ragJ0n!EvBkg8Uegi+]ou1j/^QO*femQC2O!P!j,M5Vk@.-`g`$$+f+^ VP~G{1U</mi><noscript></noscript><rdf>Z[kyp(Mt0@4F~xj@v b=,K#nikG!cNac%qU(O/iUs62cwzV#,6jC[!1y5,PBNr@,Gh~Yn43l1B}p1KEh$m|bn}saNpLjZaspCwM4}XA?CWl)%V]lmIORhh y}o(CHz*vog3iSJ#On-w65NZ=}?5lh/x;xgps-#FD6l,MuASFyd$r.}x6;:v0iM4-S`El`hX%x</rdf><sub></sub><textarea>Fi~{@7J{EVzWdri*Uy+C2nP=gmz.Y;Wvp*:F]]VIVMqdJM=oU,.`Veo:L_x~1u`*f2(!*SGS*!Tsm+VYIeWA^CD10rrxyeMbNhM:SL-}Zf*A4Lf= 81Ka{/gieIN3Ru?#*Sl@~tYe]D.~pEm=s.=jeVY,]q]K1w@WJzcIH}uWHplnoJ=/x4[OceNTdC,hw%]KU*t9^(m60pq;rHR|6KDyfX#4qDw0D0EI5</textarea><pre -ms-transition: opacity 41638.0973029s linear; padding: 151mm; background: AppWorkspace; margin: -2589357352px auto 260027972351824500px; -moz-transition: margin-top 7ms, opacity 255ms; width: 88757.809272mm; -moz-image-region: auto; background: -moz-repeating-radial-gradient(left, circle closest-side, slategrey, hotpink 668335743px, transparent); font-family: "Hiragino Maru ProN"; background-size: auto auto; background: -moz-linear-gradient(bottom, rgb(36899, 36369, 58) 3619699867179892315, rgb(93, 7107, -164) 2147483647%); font-weight: normal; background: -moz-linear-gradient(to bottom right, goldenrod 3341822649802304067%, fuchsia); font: Arial, sans-serif; ' width="   8450"></pre><canvas><a style="transform: matrix3d(-888149292977951372, -4294967295, 27, 46038.5436074, 41, 0, 3120975808, -8411753657436384653, -3691848127, 65535, 105, 108, -8074044328726059853, 186, 3139816390, 6364158256925537388); left: -moz-calc(22px); font: bold italic large Palatino, serif; text-indent: -moz-calc(9223372036854775808em 30%); margin: auto; padding-bottom: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999; background: -moz-linear-gradient(rgba(50924, 1251548303, 1109767611702038730, 42159.1644524), rgba(55, 2591341078, 10, 143) 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999%, rgba(43, 246, 149, 1.28599451055x+18) 58741%, rgba(-69, 8229554636392401175, 33463, 67.9323179507)); border-top: -67.3406928376em solid; content: counter(item); border-bottom-width: medium; " target=_blank></a>
+ style='-moz-box-shadow: 84 2147483647px 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px rgba(-2858581034, 110, 2460321770, 164.188187767), inset 18 255px -2461791714 rgba(65, 2147483647, 118, 120365.670275); border-color: khaki rgb(9223372036854775808, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999) cornsilk rgb(2147483647, 3410481331, -255); background: -moz-linear-gradient(top, hsl(-6511, 132%, 67%), hsl(65535, 127%, 130%)); border-inline-end-width: 5361121852315046626; content: "»"; box-shadow: inset -148 6598830410571865803 -255px hsla(65535, -61299%, 6601653806716150645%, 144.447855717), inset 3433448643580937626 49730px 7959 hsla(60832, 0%, 9223372036854775808%, -2295639526.68); transform: translate3d(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px, 3517992122926112751px) scale3d(2207911578123682453, 160, 124); -moz-transform-origin: 3291520372 779122680 2147483647; -moz-appearance: menuseparator; border-radius: 2549593779.31px 2.00538639825x+18px 65px 28px; transform: translate(127px, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px) translate(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px, -176px); margin-left: 210.617676718em; border-inline-start: dotted lightgreen 37018px; word-spacing: 2174513215933018269ch; border-left: solid; columns: 64383 auto -3982463664em; -moz-transform: scale(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999); stroke-width: 3.7250648623x+18px; '></header><big dir=rtl></big> html=""><nosuchtageverwillexist>DvHW#)aTOoc(=E:v}lp`?)_zpj%f#fy$q~~w1,;%.rsdVNR9=AW8h#y**wpXSlY}R/L|vnxW7?EC`lK,4GcMz[9}{V#d+@d (`JUMD2gD:N1ci7Q#i_hR-p.,dM|s/D-bzFn@8g[.qr;+Kh!]tI3B?2xM;E,oW`GHsjqV>b(vf_HY9If%6.t7z2@ql6|L@SrsUoaG^AX{46e5^;p;8Pphf5f3_],qD)X!kizvdkcp8YtJZe!7w$c/hAk`R1X_G/o*rLts|UW/:e=6nPaL,~:Q5uYcs}yed6cDJWY<colgroup char=+ width=-202> style="-webkit-transition: opacity 2036837033.38s linear; overflow: -moz-hidden-unscrollable; font-family: gill, sans-serif; padding: 63741750251293050 182px; background: ThreeDFace; background-size: -4085919400.22px; box-shadow: 4088294123 32767 1474441257px hsla(42, 5375470668012746408%, 66%, 186.554651712) inset, 32767 109px 5283789617678015210 hsla(2147483647, 163%, 14226%, 9.99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999); border-width: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px -170px 3284222322px 5.14851574865x+17px; box-shadow: inset 113 -0 -4px hsla(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999, 35273%, 2245175778%, 47085.004822), inset 9223372036854775808 76px 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 hsla(2375057167019052381, 4294967295%, 127%, 5.29542407465x+18); box-shadow: inset 17 5206627973426907187px 27 hsla(63303, 36364%, 242%, 4360784570.91), inset 18428 0px 138 hsla(-357953447, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999%, 8058132474996186951%, 100.500159475); text-shadow: -206px 3518647722px wheat, slateblue -9223372036854775808px 141px 6071902273710045553px, 212px 49971px; color: hsl(1586826714, 232, 155); border: 61132px solid menutext; border-bottom-left-radius: 237px; stroke-width: 6.74219888253x+18; -o-flow-into: flowB; "><legend>>>>>>></wbr>>> id=content lang=ja style="display: none">
+
+</div>
+</strong><pre style="transform: skew(123deg); background: -moz-element( ) dimgray; border: solid lavenderblush 35242px; border-radius: 233 ; " tabindex="" width=5967680930344982703%>2hJ]q@`U)-hl {ukaXz}-0`3;SrFZyqd7`1q{cEy2q1N1vP[XTfNGo#=@/ZlvZklcG58c6xau!G}6Lxc#W@RBhKV4];9G`RX 2x.~.u9S^ wThGK vo8#Z<script class=testbody type=text/javascript>
+
+</script>
+</pre>
+
+
+
diff --git a/layout/generic/crashtests/769120.html b/layout/generic/crashtests/769120.html
new file mode 100644
index 000000000..ddbeaf941
--- /dev/null
+++ b/layout/generic/crashtests/769120.html
@@ -0,0 +1,11 @@
+<style>
+.c9::-moz-list-bullet, *|* { -moz-border-left-colors: ThreeDDarkShadow cornflowerblue; -moz-column-width: 400.816438698px;</style><source style="direction: ltr; font: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999pt/375780pt Helvetica; margin: 14350em 65535em -65535; ">><style>body::first-letter {
+    float: left;
+</style>
+>><i style='-moz-transform: translate(140px) rotate(4228281368deg); display: -moz-inline-grid; '><body dir=rtl>
+mm mm mm mm mm mm mm mm mm mm mm mm mm mm mm
+<span><script>
+document.body.offsetWidth;
+</script>
+
+
diff --git a/layout/generic/crashtests/769303-1.html b/layout/generic/crashtests/769303-1.html
new file mode 100644
index 000000000..91598029f
--- /dev/null
+++ b/layout/generic/crashtests/769303-1.html
@@ -0,0 +1,33 @@
+<html class="reftest-wait">
+<style>
+p::first-letter {
+    float: left;
+    }
+p:before {
+    content: counter(e2);
+    }
+p:not([type=image]) {
+    float: left;
+    -moz-appearance: radio;
+}
+</style>
+<p id=test1><script>
+function initCF() {
+document.removeEventListener("DOMContentLoaded", initCF, false);
+test2 = test1.cloneNode(false);
+test3 = test2.cloneNode(false);
+document.documentElement.appendChild(test3);
+setTimeout("CFcrash()", 21);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+window.onload = initCF;
+
+var gCallCount = 0;
+function CFcrash() {
+test3.appendChild(document.createTextNode(" bBCV5.3kvwoaU O8k l i!4c`Ei;N-#/ Qg QBZi$8A [8xlL#cN U4l  !%lP   S% Z9[H } {2Jk A00F8 TjQQ1KHx zf   k]F-G ,%lz8?@ 2ZB!-"));
+window.scrollBy(-463, -480);
+if (++gCallCount == 2) {
+  document.documentElement.classList.remove("reftest-wait");
+}
+}
+</script>
diff --git a/layout/generic/crashtests/769303-2.html b/layout/generic/crashtests/769303-2.html
new file mode 100644
index 000000000..ab6cf1145
--- /dev/null
+++ b/layout/generic/crashtests/769303-2.html
@@ -0,0 +1,19 @@
+<foo_bar>k煬犍赜I⌕ 鰔{2O`怊턝璆굁肗笑z죒༃陥  P﷨Jf⻃傆$MN  M ?鋰  5蟣#糐選^x汵 ｧ K 8kmf箏ਰ艼 渺즺</foo_bar><ol id=test1></ol><head>
+<style>
+body:first-letter {
+    float: left;
+    }
+body {
+    float: left;
+}
+</style>
+<body style="white-space: pre-line;"><script>
+function initCF() {
+document.removeEventListener("DOMContentLoaded", initCF, false);
+setTimeout("CFcrash()", 0);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+function CFcrash() {
+document.adoptNode(test1);
+}
+</script>
diff --git a/layout/generic/crashtests/777838.html b/layout/generic/crashtests/777838.html
new file mode 100644
index 000000000..02aadfe56
--- /dev/null
+++ b/layout/generic/crashtests/777838.html
@@ -0,0 +1,28 @@
+<html class="reftest-wait">
+  <head>
+    <style>
+      #el0 {
+        -moz-column-count: 3; 
+        column-count: 3; 
+        max-width: 13ex;
+        display: inline-block;
+      }
+      #el0:first-line { font-family: x; }
+      #el0:first-letter { float: right; }
+    </style>
+    <script>
+      onload = function() {
+        el0=document.createElement('object')
+        el0.setAttribute('id','el0')
+        document.body.appendChild(el0)
+        el0.appendChild(document.createTextNode(unescape('%ua000%uf400')))
+        el0.appendChild(document.createTextNode(unescape('%u3000')+'AA'))
+        el0.appendChild(document.createTextNode(''))
+  document.documentElement.removeAttribute("class");
+      }
+    </script>
+  </head>
+  <body>
+  </body>
+</html>
+
diff --git a/layout/generic/crashtests/783228.html b/layout/generic/crashtests/783228.html
new file mode 100644
index 000000000..5b140cb2a
--- /dev/null
+++ b/layout/generic/crashtests/783228.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body>
+<div style="-moz-columns: auto 28em; padding: 10px;">
+<p>...</p>
+<div style="width: 400px;">
+<div style="float:left;">
+<img src="image.jpg"><br>.
+</div>
+</div>
+
+<div style="clear: both"></div><div style="width: 400px;"><div style="float:left;"><img src="image.jpg"><br>
+</div>
+</div>
+
+<div style="clear: both"></div><p>... ... ... ... ... ... ...</p><br>.
+
+<p>... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... 
+... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... 
+... ... ... ... ... ... ...</p>
+<div style="width: 400px;">
+<div style="float:left;">
+<img src="image.jpg"><br>.
+</div>
+</div>
+
+<div style="clear: both"></div>
+<img src="image.jpg"><br>.
+
+<p>...</p><img src="image.jpg"><br>.
+<img src="image.jpg"><br>
+
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/784600.html b/layout/generic/crashtests/784600.html
new file mode 100644
index 000000000..870687712
--- /dev/null
+++ b/layout/generic/crashtests/784600.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">><class><address></address><children id=test1>><acronym id=test2></acronym><aside><iframe src=simple_blank.swf></iframe>
+
+
+</aside><script>
+setTimeout("boom()", 2000);
+function boom() {
+document.designMode = "on";
+document.execCommand("InsertHTML", false, "<dl>")
+r = document.createRange(); 
+window.getSelection().removeAllRanges();
+r.setStart(test1, 0);
+r.setEnd(test2, test2.childNodes.length);
+window.getSelection().addRange(r);
+document.execCommand("InsertHTML", false, " ")
+document.documentElement.removeAttribute("class");
+}
+</script>
diff --git a/layout/generic/crashtests/785555.html b/layout/generic/crashtests/785555.html
new file mode 100644
index 000000000..026465d81
--- /dev/null
+++ b/layout/generic/crashtests/785555.html
@@ -0,0 +1,12 @@
+<dd><output><dfn><blockquote></blockquote><body dir=rtl>
+ H.*XX  mhF ~0Gdv`a
+<table>
+  <figcaption id=test></table>
+
+
+<script>
+setTimeout("CFcrash()", 10);
+function CFcrash() {
+test.style.display = "inline-block";
+}
+</script>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/786740-1.html b/layout/generic/crashtests/786740-1.html
new file mode 100644
index 000000000..16357d1ff
--- /dev/null
+++ b/layout/generic/crashtests/786740-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<style>
+#d {
+  transition:opacity 1s;
+}
+#p {
+  position:absolute;
+}
+</style>
+</head>
+<body>
+<div id="d">
+  Hello
+  <span id="s"><div id="p">Kitty</div></span>
+</div>
+<script>
+var d = document.getElementById("d");
+d.getBoundingClientRect();
+d.style.opacity = 0.3;
+window.addEventListener("MozReftestInvalidate",
+  function() {
+    setTimeout(function() {
+      document.body.removeChild(d);
+      document.documentElement.removeAttribute("class");
+    }, 50);
+  }, false);
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/790260-1.html b/layout/generic/crashtests/790260-1.html
new file mode 100644
index 000000000..f1536e3ed
--- /dev/null
+++ b/layout/generic/crashtests/790260-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html class="reftest-print">
+<body>
+<div style="float:left">
+  <div>
+    <img src="about:blank" height="2000">
+  </div>
+  <div style="float:left">XYZ</div>
+</div>
+<div style="clear:both"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/791601.xhtml b/layout/generic/crashtests/791601.xhtml
new file mode 100644
index 000000000..f68f0251d
--- /dev/null
+++ b/layout/generic/crashtests/791601.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="white-space: pre-wrap; width: -moz-min-content; font-size: 4294967297px;" class="reftest-wait">
+<body style="font-size: 1px; -moz-column-count: 2;" onload="document.getElementById('p').style.paddingInlineStart = '4294967296px'; document.documentElement.offsetHeight; setTimeout(function(){document.documentElement.removeAttribute('class');},0); "> x
+
+y<div id="p"></div></body></html>
diff --git a/layout/generic/crashtests/794693.html b/layout/generic/crashtests/794693.html
new file mode 100644
index 000000000..7d9f4c90f
--- /dev/null
+++ b/layout/generic/crashtests/794693.html
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <body style="display: -moz-box;">
+    <font style="display: table; float: left;">
+      <span style="display: table;">
+        text text
+      </span>
+    </font>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/798020-1.html b/layout/generic/crashtests/798020-1.html
new file mode 100644
index 000000000..e59d31e0a
--- /dev/null
+++ b/layout/generic/crashtests/798020-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="letter-spacing: 693626589697em;"><div style="display: inline-flex;">data</div></body>
+</html>
diff --git a/layout/generic/crashtests/798235-1.html b/layout/generic/crashtests/798235-1.html
new file mode 100644
index 000000000..4faf810f8
--- /dev/null
+++ b/layout/generic/crashtests/798235-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <div style="flex-direction: column-reverse; display: inline-flex;">
+    <div style="flex: 1 1 -moz-max-content;"></div>
+  </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/799207-1.html b/layout/generic/crashtests/799207-1.html
new file mode 100644
index 000000000..543a13bab
--- /dev/null
+++ b/layout/generic/crashtests/799207-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: flex;"><div style="margin-top: 17179869184em; min-height: 17179869184em; align-self: baseline;"></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/799207-2.html b/layout/generic/crashtests/799207-2.html
new file mode 100644
index 000000000..6d00bf5ab
--- /dev/null
+++ b/layout/generic/crashtests/799207-2.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: flex;"><div style="margin-top: -9999999999999px; height: 0; font-size: 0; align-self: baseline;"></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/801268-1.html b/layout/generic/crashtests/801268-1.html
new file mode 100644
index 000000000..d707391b3
--- /dev/null
+++ b/layout/generic/crashtests/801268-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: flex;"><div style="padding-top: 4000000000%; min-height: 400000000px;"></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/804089-1.xhtml b/layout/generic/crashtests/804089-1.xhtml
new file mode 100644
index 000000000..920d13957
--- /dev/null
+++ b/layout/generic/crashtests/804089-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+
+div.flexbox {
+  display: flex;
+  flex-direction: column;
+}
+
+</style>
+</head>
+<body>
+<div class="flexbox"><mo xmlns="http://www.w3.org/1998/Math/MathML"><mrow/></mo></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/807565-1.html b/layout/generic/crashtests/807565-1.html
new file mode 100644
index 000000000..7c526604a
--- /dev/null
+++ b/layout/generic/crashtests/807565-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><ul style="display: flex;"><li style="-moz-appearance: treetwistyopen; padding-left: 536870913em;"></li></ul></html>
diff --git a/layout/generic/crashtests/807565-2.html b/layout/generic/crashtests/807565-2.html
new file mode 100644
index 000000000..84cee648b
--- /dev/null
+++ b/layout/generic/crashtests/807565-2.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+  <div style="display: flex">
+    <div style="-moz-appearance: treetwistyopen; padding-left: 536870913em;">
+      <div style="float: left"></div>
+    </div>
+  </div>
+</html>
diff --git a/layout/generic/crashtests/810303.html b/layout/generic/crashtests/810303.html
new file mode 100644
index 000000000..5f3e4b0cc
--- /dev/null
+++ b/layout/generic/crashtests/810303.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script>
+      window.onload = function() {
+        document.removeChild(document.documentElement);
+        var oFrameset1 = document.createElement('frameset'),
+            oFrameset2 = document.createElement('frameset');
+        document.appendChild(oFrameset1);
+        oFrameset1.appendChild(oFrameset2);
+        oFrameset2.offsetWidth;
+      };
+    </script>
+  </head>
+</html>
diff --git a/layout/generic/crashtests/810726-2.html b/layout/generic/crashtests/810726-2.html
new file mode 100644
index 000000000..cf757b0e4
--- /dev/null
+++ b/layout/generic/crashtests/810726-2.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <style type="text/css">
+      body {
+        font-size: 0.875em;
+        line-height: 1.30em;
+        font-family: Arial;
+      }
+
+      p, ul, li {
+        margin: 0;
+        padding: 0;
+        background-color: rgb(235, 235, 235);
+      }
+
+      ul { -moz-column-count: 2;
+           background-color: rgb(255, 200, 200);
+         }
+
+      li { margin-left: 17px }
+      .wrapper {
+                background-color: rgb(255, 0, 155); max-width: 910px;
+                border: 1px solid green;
+               }
+
+      .column {
+        width: 73%;
+        padding: 20px 60px 20px 40px;
+        box-sizing: border-box;
+        background-color: rgb(0, 95, 255);
+      }
+
+      .img {
+        float: left;
+        width: 261px;
+        height: 150px;
+        background-color: rgb(88, 20, 100);
+      }
+    </style>
+  </head>
+  <body>
+    <div class="wrapper">
+      <div id="colEle" class="column">
+        <ul>
+          <li>
+            <p>123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123</p>
+          </li>
+          <li>
+            <p>123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123</p>
+            <div class="img"></div>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/810726.html b/layout/generic/crashtests/810726.html
new file mode 100644
index 000000000..04bd439a4
--- /dev/null
+++ b/layout/generic/crashtests/810726.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+  <head>
+  </head>
+  <body>
+    <iframe width="1200" height="1024" src="810726-2.html">
+  </body>
+</html>
diff --git a/layout/generic/crashtests/812822-1.html b/layout/generic/crashtests/812822-1.html
new file mode 100644
index 000000000..f82e0761b
--- /dev/null
+++ b/layout/generic/crashtests/812822-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <fieldset>
+      <legend style="overflow-x: auto; display: inline-flex;"></legend>
+    </fieldset>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/812879-1.html b/layout/generic/crashtests/812879-1.html
new file mode 100644
index 000000000..67a0ac70c
--- /dev/null
+++ b/layout/generic/crashtests/812879-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('x').style.overflowX = 'hidden';">
+<table><tbody id="x"><tr><td style="margin-top: 126102421%; margin-right: 126102421%; float: right; page-break-inside: avoid;"></td></tr></tbody></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/812879-2.html b/layout/generic/crashtests/812879-2.html
new file mode 100644
index 000000000..10323296e
--- /dev/null
+++ b/layout/generic/crashtests/812879-2.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var table = document.createElement("table");
+  var tbody = document.createElement("tbody");
+  var td = document.createElement("td");
+  tbody.appendChild(td);
+  table.appendChild(tbody);
+  document.body.appendChild(table);
+  td.style.marginTop = "126102421%";
+  td.style.marginLeft = "126102421%";
+  td.style.cssFloat = "right";
+  td.style.pageBreakInside = "avoid";
+
+  document.documentElement.offsetHeight;
+
+  tbody.style.overflowX = "hidden";
+
+  document.documentElement.offsetHeight;
+
+  document.body.style.MozColumns = "auto";
+  tbody.style.color = "red";
+
+  document.documentElement.offsetHeight;
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/812893.html b/layout/generic/crashtests/812893.html
new file mode 100644
index 000000000..4902c5a98
--- /dev/null
+++ b/layout/generic/crashtests/812893.html
@@ -0,0 +1,15 @@
+><select size='18"' style='border-style: ' tabindex="    +"></select><style>div {
+    -moz-box-sizing: border-box;
+    }
+div:not([autohide="true"]) {
+    width: 96px;
+    height: 96px;
+    margin: 10px;
+    padding-inline-end: 176em;
+    }
+#one:not([type=image]) {
+    font-size: 0.61em;
+</style>
+<body style="-moz-shape-inside: rectangle(53, 251, 25298px, 168); padding: 7 2319499247 7 -moz-calc(143px 179%); ">><form>R<kbd><footer><cell style="font-size-adjust: 18; ">_40ww Nq FI0[#  9*| kZf0. 8[7 0v]N=E4-T :es></footer></kbd><p hidden=true>>><div id=one>  H jk*Fk(s8{8q	F	bMIf T [  Kr~xP si%; z 	*jprB</div>
+>><length><hr style='wrap-padding: 238px; padding-bottom: 248px; '>>><description style="box-pack: start; border-style: inset; "><div><style>
+* { ruby-span: 2647821777; -moz-columns: 70 2px;>>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/814995.html b/layout/generic/crashtests/814995.html
new file mode 100644
index 000000000..238fc3960
--- /dev/null
+++ b/layout/generic/crashtests/814995.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait">
+<script>
+function start() {
+tmp = document.createElement('iframe');
+document.documentElement.appendChild(tmp);
+window.setTimeout('second()',100);
+}
+
+function second() {
+tmp.contentDocument.removeChild(tmp.contentDocument.childNodes[0]);
+o988=document.createElement('frameset');
+o1051=document.createElement('frameset');
+tmp.contentDocument.appendChild(o1051);
+tmp.contentDocument.documentElement.appendChild(o988);
+
+document.documentElement.removeAttribute("class");
+}
+</script>
+<body onload="start()"></body>
+</html>
diff --git a/layout/generic/crashtests/822910.xhtml b/layout/generic/crashtests/822910.xhtml
new file mode 100644
index 000000000..3c3179642
--- /dev/null
+++ b/layout/generic/crashtests/822910.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="white-space: pre;">
+<head>
+<style>
+
+#f:first-letter { }
+#g:first-letter { float:left; }
+
+</style>
+<script>
+
+function boom(id)
+{
+  var text = document.getElementById(id).firstChild;
+  text.splitText(2);
+  document.documentElement.offsetHeight;
+  text.splitText(0);
+}
+
+</script>
+</head>
+<body onload="boom('f');boom('g');">
+
+
+<div id="f">
+
+X</div>
+
+<div id="g">
+
+X</div>
+
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/824297-1.html b/layout/generic/crashtests/824297-1.html
new file mode 100644
index 000000000..c217f6b26
--- /dev/null
+++ b/layout/generic/crashtests/824297-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.z:first-letter { }
+.z { display: flex; }
+</style>
+</head>
+<body>
+<div><button class="z">B</button></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/825810-1.html b/layout/generic/crashtests/825810-1.html
new file mode 100644
index 000000000..4897ae39d
--- /dev/null
+++ b/layout/generic/crashtests/825810-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+<body>
+<div style="display: flex;">
+  <div style="display: table-column;"></div>
+  abc
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/825810-2.html b/layout/generic/crashtests/825810-2.html
new file mode 100644
index 000000000..86bf90015
--- /dev/null
+++ b/layout/generic/crashtests/825810-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+<body>
+<div style="display: flex;">
+  <div style="display: table-caption;"></div>
+  abc
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/826483-1.html b/layout/generic/crashtests/826483-1.html
new file mode 100644
index 000000000..8e53ba124
--- /dev/null
+++ b/layout/generic/crashtests/826483-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+.a { display: flex; }
+.a:after { content: 'a'; }
+
+</style>
+</head>
+<body>
+
+<div class="a"><div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/826532-1.html b/layout/generic/crashtests/826532-1.html
new file mode 100644
index 000000000..ee0954c67
--- /dev/null
+++ b/layout/generic/crashtests/826532-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+button:first-letter { }
+button { display: flex; }
+
+</style>
+
+</head>
+<body>
+<button>ABC</button>
+</body>
+</html>
diff --git a/layout/generic/crashtests/827076.html b/layout/generic/crashtests/827076.html
new file mode 100644
index 000000000..30febf545
--- /dev/null
+++ b/layout/generic/crashtests/827076.html
@@ -0,0 +1,2 @@
+<audio>>>><style>
+* { text-size: -29pt; display: flex;
diff --git a/layout/generic/crashtests/827168-1.html b/layout/generic/crashtests/827168-1.html
new file mode 100644
index 000000000..faea9998a
--- /dev/null
+++ b/layout/generic/crashtests/827168-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.z:first-line {}
+.z { display: flex; }
+</style>
+</head>
+<body>
+<div><button class="z">B</button></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/836895.html b/layout/generic/crashtests/836895.html
new file mode 100644
index 000000000..ca9e4b143
--- /dev/null
+++ b/layout/generic/crashtests/836895.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html style="-moz-columns: 2 auto;">
+<head>
+<style>
+
+div { width:300px; background:yellow; height:50px; }
+
+</style>
+</head>
+
+<body style="position: relative; display: table;"><div style="position: absolute;"></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/837007.xhtml b/layout/generic/crashtests/837007.xhtml
new file mode 100644
index 000000000..78cd8c0fa
--- /dev/null
+++ b/layout/generic/crashtests/837007.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<div style="height: 15px; -moz-column-width: 50px;"><div style="white-space: pre; display: inline;">
+
+<input style="float: right;" /></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/840787.html b/layout/generic/crashtests/840787.html
new file mode 100644
index 000000000..36f42d747
--- /dev/null
+++ b/layout/generic/crashtests/840787.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.offsetHeight;
+  document.getElementById("outer").lastChild.data = "Y";
+  document.documentElement.offsetHeight;
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="outer" style="-moz-column-width: 1px;"><div style="-moz-column-width: 1px;"><div style="height: 50px;"></div><div style="float: left; height: 466px;"></div><div></div></div>X</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/840818.html b/layout/generic/crashtests/840818.html
new file mode 100644
index 000000000..f4cf70f9b
--- /dev/null
+++ b/layout/generic/crashtests/840818.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body style="font-family: monospace;">
+<div style="-moz-column-count: 2;"><div style="-moz-column-count: 2; width: 9ch;">😎中文<span>; </span><span>!</span></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/842132-1.html b/layout/generic/crashtests/842132-1.html
new file mode 100644
index 000000000..7b20dba92
--- /dev/null
+++ b/layout/generic/crashtests/842132-1.html
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  var e = document.body;
+  var sel = window.getSelection();
+
+  window.getSelection().removeAllRanges();
+  var r0 = document.createRange();
+  r0.setStart(e, 0);
+  r0.setEnd(e, 1);
+  window.getSelection().addRange(r0);
+  var r1 = document.createRange();
+  r1.setStart(e, 1);
+  r1.setEnd(e, 1);
+  window.getSelection().addRange(r1);
+
+  window.getSelection().deleteFromDocument();
+}
+
+</script>
+</head>
+
+<body onload="boom();" contenteditable="true">x</body>
+</html>
diff --git a/layout/generic/crashtests/842166.html b/layout/generic/crashtests/842166.html
new file mode 100644
index 000000000..107fb666b
--- /dev/null
+++ b/layout/generic/crashtests/842166.html
@@ -0,0 +1,22 @@
+<html>
+    <head>
+        <style>
+            li{
+             display: table-footer-group;
+             }
+        </style>
+        <meta HTTP-EQUIV="Cache-Control" content="no-cache" />
+    </head>
+    <body>
+        <script>
+            <ins>
+            </ins>
+        </script>
+        <li contenteditable="true">
+        </li>
+        <object type="checkbox">
+        </object>
+        <select>
+        </select>
+    </body>
+</html>
diff --git a/layout/generic/crashtests/844529-1.html b/layout/generic/crashtests/844529-1.html
new file mode 100644
index 000000000..f3da825ab
--- /dev/null
+++ b/layout/generic/crashtests/844529-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+<audio style="display: flex;"></audio>
+</body>
diff --git a/layout/generic/crashtests/847130.xhtml b/layout/generic/crashtests/847130.xhtml
new file mode 100644
index 000000000..f331b06ac
--- /dev/null
+++ b/layout/generic/crashtests/847130.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("x").appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "span"));
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div style="-moz-column-count: 15;"><div style="-moz-column-count: 15;" id="x"><td style="display: block; height: 2.5em;"></td></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/847208.html b/layout/generic/crashtests/847208.html
new file mode 100644
index 000000000..2128dbbb8
--- /dev/null
+++ b/layout/generic/crashtests/847208.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.f:first-letter {
+  float: left;
+}
+.f {
+  page-break-inside: avoid; float: left;
+}
+</style>
+</head>
+<body onload="document.getElementById('p').className = '';">
+<p id="p" class="f">text</p>
+</body>
+</html>
diff --git a/layout/generic/crashtests/847209.html b/layout/generic/crashtests/847209.html
new file mode 100644
index 000000000..f530fb95e
--- /dev/null
+++ b/layout/generic/crashtests/847209.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.f:first-letter {
+  float: left;
+}
+.f {
+  page-break-inside: avoid;
+}
+</style>
+</head>
+<body onload="document.getElementById('p').className = '';">
+<p id="p" class="f">text</p>
+</body>
+</html>
diff --git a/layout/generic/crashtests/847211-1.html b/layout/generic/crashtests/847211-1.html
new file mode 100644
index 000000000..83e7da0eb
--- /dev/null
+++ b/layout/generic/crashtests/847211-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var f = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+    f.setAttributeNS(null, "type", "file");
+    document.body.appendChild(f);
+    f.style.whiteSpace = "pre-line";
+    f.style.display = "flex";
+    document.body.style.transitionTimingFunction = "linear";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/849603.html b/layout/generic/crashtests/849603.html
new file mode 100644
index 000000000..fc1441c22
--- /dev/null
+++ b/layout/generic/crashtests/849603.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+    .container {
+      height: 24pt;
+      position: relative;
+    }
+    #colset {
+      height: 2in;
+      -moz-column-count: 3;
+    }
+    .c1 {
+      position: absolute;
+      height: 3in;
+    }
+    .c2 {
+      position: absolute;
+      height: 1in;
+    }
+    .c3 {
+      position: absolute;
+      height: 3in;
+    }
+    .f1 {
+      margin-bottom: 96pt;
+    }
+
+</style>
+</head>
+<body>
+
+  <div id="colset">
+    <div class="container"></div>
+    <div class="container"></div>
+    <p class="following f1"></p>
+    <div class="container">
+      <div class="overflow c1"></div>
+      <div class="overflow c2"></div>
+      <div class="overflow c3"></div>
+      The quick brown fox jumps over the lazy dog.
+    </div>
+  </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/850931.html b/layout/generic/crashtests/850931.html
new file mode 100644
index 000000000..87ab89242
--- /dev/null
+++ b/layout/generic/crashtests/850931.html
@@ -0,0 +1,32 @@
+<head><title id=test1></title>
+<h1 id=test2>> id=tCF5>{
+Z
+y,}
+Ksk$uv
+W%s.@:W
+WI3d
+qM]|xgut
+m{K7G!|Uh	m!n#`vUu/Sk,g(C.oy&amp;WFxH|jw
+$~
+}F1Fvhy
+3UxD*xOFV]cU!
+6
+~qhDwQ
+BU
+<a><a href=abc.html id=test3>cone</a></h1>
+><div class=refs id=test4><ul></div>
+
+>><p class="output expectedtext" id=test5><p id=test6><ul id=d><style>
+* { -moz-animation-name: cfpulse82; padding-left: 198pt; line-height: 35pc; -moz-columns: 215 131px; height: 287.422729301mm;</style><script>
+var docElement = document.body;
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+try { test6.appendChild(test13); } catch(e) {}
+try { test5.appendChild(test1); } catch(e) {}
+try { docElement.insertBefore(test3, docElement.firstChild); } catch(e) {}
+try { test5.setAttribute("_clientheight", "26"); } catch(e) {}
+try { test6.setAttribute("class", "c35"); } catch(e) {}
+try { test6.textContent = "~R*#YfcG_69	u:lq~	3		5+	XM	h	6	-&C	/A_?	Kp-	 	*	j67n?i3$	^)6W O8ZHCE	A3GX!-O67nlX|Su		epvIL4		F	i|vr{X[3whHowuY"; } catch(e) {}
+document.documentElement.offsetTop;
+try { test3.lastChild.insertData("Ocz(3V	scv!*(-	yeZ1I Cr@1ki	e	T V?rA^?hER Ox? Mg!m| R!4cM	{Mo%3J	C DmO|v1#TV		JuWL UZ:", test5, "	1*$URv	=#7/	)~5v)cxO=9]:	bd@V]		M@5			@Hw	3gj	oLiV	9m9GF%W.b0	&	Hlu	@	0m@0%[?+mw#s|Z4;S%ziO"); } catch(e){}
+}</script>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/851396-1.html b/layout/generic/crashtests/851396-1.html
new file mode 100644
index 000000000..d96b2c129
--- /dev/null
+++ b/layout/generic/crashtests/851396-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<video controls style="display: flex;"></video>
+</body>
+</html>
diff --git a/layout/generic/crashtests/854263-1.html b/layout/generic/crashtests/854263-1.html
new file mode 100644
index 000000000..f7048c31b
--- /dev/null
+++ b/layout/generic/crashtests/854263-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <style>
+    .flexContainer {
+      display: flex;
+
+      width: 300px;
+      height: 300px;
+      background: yellow;
+    }
+    .flexItem {
+      border: 1px dashed purple;
+    }
+  </style>
+  <script>
+    function finish() {
+      document.documentElement.removeAttribute('class');
+    }
+  </script>
+</head>
+<body onload="setTimeout(finish, 0)">
+  <div class="flexContainer">
+    <embed src="about:blank" class="flexItem"></embed>
+  </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/862185.html b/layout/generic/crashtests/862185.html
new file mode 100644
index 000000000..508f50f70
--- /dev/null
+++ b/layout/generic/crashtests/862185.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html><body>
+<div style="-moz-column-width: 1px;"><div style="backface-visibility: hidden; white-space: pre-wrap;"> <fieldset style="position: fixed;"><legend style="position: absolute;">
+ </legend></fieldset></div></div>
+</body></html>
diff --git a/layout/generic/crashtests/862947-1.html b/layout/generic/crashtests/862947-1.html
new file mode 100644
index 000000000..83e1903f4
--- /dev/null
+++ b/layout/generic/crashtests/862947-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+div { display: flex; }
+div:after { display: -moz-deck; content: counter(b); }
+
+</style>
+</head>
+<body>
+
+<div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/863935.html b/layout/generic/crashtests/863935.html
new file mode 100644
index 000000000..c0d92ce5d
--- /dev/null
+++ b/layout/generic/crashtests/863935.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style id="ss">
+
+body { font-family: monospace; }
+.c { -moz-column-width: 1px; }
+.m { margin-bottom: 8px; }
+
+</style>
+<script>
+
+function boom()
+{
+  document.documentElement.offsetHeight;
+  document.getElementById('ss').textContent += '.h { height: 1px; }'
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div class="c"><div class="h c"><div class="m"><div class="h m c">1 2 3 4 5 6 7 8 9</div></div><div class="c"><div class="h"></div><div class="h c"><div class="h"></div><div class="h"><div class="m"></div></div><div class="h"></div></div><div class="h"><div class="h"></div><div class="h"></div><div class="h"></div><div><div class="m"></div></div></div></div></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/866547-1.html b/layout/generic/crashtests/866547-1.html
new file mode 100644
index 000000000..ec5b92113
--- /dev/null
+++ b/layout/generic/crashtests/866547-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+body::first-line { }
+div::after { content: 'A'; }
+
+</style>
+</head>
+<body>
+<div style="display: inline-flex;"> &#x062A;</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/868906.html b/layout/generic/crashtests/868906.html
new file mode 100644
index 000000000..f0b92c5a6
--- /dev/null
+++ b/layout/generic/crashtests/868906.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  var root = document.documentElement;
+  while(root.firstChild) { root.removeChild(root.firstChild); }
+  root.appendChild(document.createElement("body"));
+  root.offsetHeight;
+
+  var bigText = document.createTextNode("");
+  bigText.data += "\u202D";
+  bigText.data += "A";
+  bigText.data += "\x1C";
+  bigText.data += "\u062A";
+  bigText.data += "E";
+  bigText.data += "\u062E";
+  bigText.data += " ";
+  bigText.data += "\u202D";
+  bigText.data += "X";
+  bigText.data += "\x1C";
+  bigText.data += "Y";
+  root.appendChild(bigText);
+
+  var smallText = document.createTextNode("Z");
+  root.appendChild(smallText);
+
+  root.focus();
+
+  function del()
+  {
+    var range = document.createRange();
+    range.setStart(root, 0);
+    range.setEnd(bigText, bigText.data.length);
+    range.deleteContents();
+  }
+
+  del();
+
+  function finish() {
+    document.documentElement.removeAttribute('class');
+  }
+
+  setTimeout(finish, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/876074-1.html b/layout/generic/crashtests/876074-1.html
new file mode 100644
index 000000000..8a9c5f64a
--- /dev/null
+++ b/layout/generic/crashtests/876074-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    document.getElementById("c").style.content = "'x'";
+    document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("MozReftestInvalidate", boom, false);
+
+</script>
+</head>
+
+<body style="display: inline-flex;"><div></div><div style="display: table-caption;"></div><canvas id="c"></canvas></body>
+
+</html>
diff --git a/layout/generic/crashtests/876155.html b/layout/generic/crashtests/876155.html
new file mode 100644
index 000000000..abaaa0e99
--- /dev/null
+++ b/layout/generic/crashtests/876155.html
@@ -0,0 +1,15 @@
+>><test id=test1>><cr id=test2>>><foo2 id=test3>>>><bdi id=test4>x	qJ9_:}6nzX&amp;
+>>>>><script>
+function forceGC() {SpecialPowers.forceGC(); }
+var docElement = document.documentElement;
+document.addEventListener("DOMContentLoaded", CFcrash, false);
+function CFcrash() {
+try { test5 = document.createTextNode("/}F9*D		f	e	/e=*:	M[3	b-m#iA&	Kj[	ZA-	RSOh$-@	*xTk8r_	X:du[Ok	4d;bf|xtS	x]sA&"); } catch(e) {}
+setTimeout('document.execCommand("SelectAll");document.execCommand("InsertText", false, "hello");', 200);
+setTimeout('test3.parentNode.removeChild(test3); forceGC();', 100);
+try { document.adoptNode(test4); } catch(e) {}
+try { test4.appendChild(test5); } catch(e) {}
+try { test4.setAttribute("dir", "&locale.dir;"); } catch(e) {}
+try { test1.appendChild(test4); } catch(e) {}
+try { test4.replaceChild(test2, test4.firstChild); } catch(e) { }
+}</script>>
diff --git a/layout/generic/crashtests/885009-1.html b/layout/generic/crashtests/885009-1.html
new file mode 100644
index 000000000..2403f7182
--- /dev/null
+++ b/layout/generic/crashtests/885009-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body style="display: -moz-inline-stack; overflow: scroll; border-style: solid; border-radius: 4px;"></body>
+</html>
diff --git a/layout/generic/crashtests/893496-1.html b/layout/generic/crashtests/893496-1.html
new file mode 100644
index 000000000..3a77f0e13
--- /dev/null
+++ b/layout/generic/crashtests/893496-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<meta charset="UTF-8">
+<body>
+
+<div style="display: flex;">
+    <div style="padding: calc(50%);"></div>
+    <div style="padding: 4px; flex: 0 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999;"></div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/893523.html b/layout/generic/crashtests/893523.html
new file mode 100644
index 000000000..af4bee2a1
--- /dev/null
+++ b/layout/generic/crashtests/893523.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html style="direction: rtl; border-top: solid; margin-left: -1px;">
+<head>
+<meta charset="UTF-8">
+</head>
+<body onload="window.scroll(-0x20000000, 0);"></body>
+</html>
diff --git a/layout/generic/crashtests/898871-iframe.xhtml b/layout/generic/crashtests/898871-iframe.xhtml
new file mode 100644
index 000000000..1484ea6dc
--- /dev/null
+++ b/layout/generic/crashtests/898871-iframe.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+  <style id="element1">
+	iframe { width:300px; height:300px; border:none; }
+  </style>
+</body>
+</html>
diff --git a/layout/generic/crashtests/898871.html b/layout/generic/crashtests/898871.html
new file mode 100644
index 000000000..a5c492a14
--- /dev/null
+++ b/layout/generic/crashtests/898871.html
@@ -0,0 +1,44 @@
+<html><script>
+function start() {
+o0=tmp = document.createElement('iframe');
+tmp.id = 'id1';
+document.getElementById('store_div').appendChild(tmp);
+o3=tmp = document.createElement('iframe');
+document.getElementById('store_div').appendChild(tmp);
+o5=tmp = document.createElement('iframe');
+tmp.src='898871.jpg';
+document.getElementById('store_div').appendChild(tmp);
+o7=tmp = document.createElement('iframe');
+tmp.src='898871-iframe.xhtml';
+document.getElementById('store_div').appendChild(tmp);
+window.setTimeout('startrly()', 20);
+}
+function startrly() {
+o17=document.getElementById('fuzz_div');
+o22=document.createElement('input');
+o43=o5.contentDocument;
+o44=o43.documentElement;
+o50=document.createElement('div');
+o60=o7.contentDocument.getElementById('element1');
+o3.contentWindow.onresize=cb_frameresize_35_1;
+o43.dir = 'rtl'
+o43.documentElement.appendChild(o22);
+o17.appendChild(o50);
+o50.appendChild(o60);
+o22.contentEditable=true;
+o164=document.body;
+o164.removeChild(o17);
+}
+function cb_frameresize_35_1() {
+o44.innerHTML=unescape('<noframes> </noframes><plainText> </u></u></big></plainText></bdo></fieldset>');
+o135=o43.createElement('style');
+o43.head.appendChild(o135);
+o135.contentEditable=true;
+o5.contentWindow.onresize=cb_frameresize_103_1;
+}
+function cb_frameresize_103_1() {
+o257=document.documentElement;
+o257.removeChild(o164);
+}
+window.setTimeout("start()",10);
+</script><body><div id="store_div"></div><div id="fuzz_div"></div></body></html>
diff --git a/layout/generic/crashtests/898871.jpg b/layout/generic/crashtests/898871.jpg
new file mode 100644
index 000000000..fb0a2f75f
--- /dev/null
+++ b/layout/generic/crashtests/898871.jpg
diff --git a/layout/generic/crashtests/914501.html b/layout/generic/crashtests/914501.html
new file mode 100644
index 000000000..b4a07fd41
--- /dev/null
+++ b/layout/generic/crashtests/914501.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="multicol">
+<head>
+<meta charset="UTF-8">
+<style>
+
+.multicol { width: 300px; -moz-column-width: 100px; height: 100px; }
+.R { float:right; }
+.L { float: left; }
+.clear { clear: left; }
+
+</style>
+</head>
+
+<body><div class="L" style="height: 250px;"></div><div class="clear"></div><div style="margin-bottom: 1em;"></div><div class="L" style="height: 250px;"></div><div><div class="clear"><div class="R"></div></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/914891.html b/layout/generic/crashtests/914891.html
new file mode 100644
index 000000000..13d116d0b
--- /dev/null
+++ b/layout/generic/crashtests/914891.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html style="position: fixed;">
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<div style="position: sticky;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/915475.xhtml b/layout/generic/crashtests/915475.xhtml
new file mode 100644
index 000000000..e9b98267f
--- /dev/null
+++ b/layout/generic/crashtests/915475.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <svg xmlns="http://www.w3.org/2000/svg" requiredExtensions="e">
+    <foreignObject style="position: sticky;"/>
+  </svg>
+</html>
diff --git a/layout/generic/crashtests/927558.html b/layout/generic/crashtests/927558.html
new file mode 100644
index 000000000..b1da65f27
--- /dev/null
+++ b/layout/generic/crashtests/927558.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  var range = document.createRange();
+  range.setStart(document.documentElement, 0);
+  var frame = document.getElementById("f");
+  var frameSel = frame.contentWindow.getSelection();
+  document.body.removeChild(frame);
+  frameSel.addRange(range);
+  frameSel.modify("move", "right", "character");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="f" src="data:text/html,<!doctype html>1"></iframe>
+
+
+</body></html>
diff --git a/layout/generic/crashtests/943509-1.html b/layout/generic/crashtests/943509-1.html
new file mode 100644
index 000000000..2406394ca
--- /dev/null
+++ b/layout/generic/crashtests/943509-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<span style="display: flex;"><span style="padding-top: 288230376151711740px; display: inherit;">a</span></span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/944909-1.html b/layout/generic/crashtests/944909-1.html
new file mode 100644
index 000000000..497e82a40
--- /dev/null
+++ b/layout/generic/crashtests/944909-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<div style="display: flex;"><video style="min-height: 8041185496px;"></video></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/946167-1.html b/layout/generic/crashtests/946167-1.html
new file mode 100644
index 000000000..bcdfdd0e5
--- /dev/null
+++ b/layout/generic/crashtests/946167-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+  // Create a bunch of nested flex containers:
+  var parentNode = document.body;
+  var depth = 50;
+  for (var i = 0; i < depth; i++) {
+    var childNode = document.createElement("div");
+    childNode.style.display = "flex";
+    parentNode.appendChild(childNode);
+    parentNode = childNode;
+  }
+
+  // Add some text in the innermost child:
+  childNode.innerHTML = "Text";
+
+  // Force reflow:
+  var height = document.body.children[0].offsetHeight;
+</script>
diff --git a/layout/generic/crashtests/947158-iframe.html b/layout/generic/crashtests/947158-iframe.html
new file mode 100644
index 000000000..840be6492
--- /dev/null
+++ b/layout/generic/crashtests/947158-iframe.html
@@ -0,0 +1,777 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
+<head>
+  <meta http-equiv="content-type" content="text/html; charset=utf-8" />
+  
+
+<style>
+
+
+#work_area {
+-moz-background-clip:border;
+-moz-background-inline-policy:continuous;
+-moz-background-origin:padding;
+background-attachment:scroll;
+background-color:transparent;
+float:left;
+padding-left:5px;
+padding-right:5px;
+width:980px;
+background-color:#F1F5F8;
+}
+#footer {
+-moz-background-clip:border;
+-moz-background-inline-policy:continuous;
+-moz-background-origin:padding;
+background-attachment:scroll;
+background-color:transparent;
+background-image:url(../images/footer.gif);
+background-position:0 0;
+background-repeat:no-repeat;
+float:left;
+width:1003px;
+height:53px;
+background-color:#467618;
+}
+#bottommenu{
+float:left;
+width:1003px;
+height:53px;
+text-align:center;
+color:#FFFFFF;
+font-family:Tahoma;
+font-size:11px;
+padding-top: 17px;
+}
+.div720_body{
+padding-left:30px;
+padding-right:30px;
+padding-top:0;
+width:660px;
+height:auto;
+}
+.div720_body p{
+font-family:Tahoma;
+font-size:12px;
+text-indent: 20px;
+_color:#636563;
+color: #444444;
+line-height:18px;
+margin-bottom:8px;
+margin-top:8px;
+}
+
+
+.train_asan_body{
+width:650px;
+float:left;
+height:auto;
+font-family:Tahoma;
+font-size:12px;
+text-indent: 20px;
+color:#636563;
+display:none;
+padding-left:12px;
+padding-bottom:10px;
+}
+
+
+.news_text{
+width:660px;
+float:left;
+height:auto;
+font-family:Tahoma;
+font-size:12px;
+text-indent: 20px;
+color: #444444;
+line-height:18px;
+_background-color:#CCCCCC;
+}
+.news_line{
+width:660px;
+float:left;
+background-color:#335D0B;
+height:2px;
+margin-top:5px;
+}
+.news_dat{
+width:90px;
+float:right;
+height:auto;
+font-family:Arial, Helvetica, sans-serif;
+font-size:14px;
+color:#355E0B;
+text-align:center;
+_border:solid 2px #003300;
+border-bottom:solid 2px #335D0B;
+padding:2px;
+text-indent:0;
+background-color:#F2F6F9;
+font-weight:bold;
+}
+
+.newssite
+{
+  list-style-type: none;
+  margin-top: 20px;;
+  padding:2px;
+}
+
+.newssite li
+{
+  font-family:Tahoma;
+  font-size: 12px;
+  color: #444444;
+  text-align: left;
+  background-image: url('../images/ul.gif');
+  background-repeat:no-repeat;
+  margin:0 0 20px 0;
+  _line-height: 10px;
+  font-weight:normal;
+  height:auto;
+  padding-top:0;
+  padding-left:25px;
+  text-indent:0;
+  
+}
+
+.ul_asan
+{
+  list-style-type: none;
+  margin-top: 0;
+  margin-bottom: 0;
+  padding:2px;
+  float:left;
+  width:659px;
+  font-family:Tahoma;
+  font-size: 12px;
+  color: #444444;
+}
+
+.ul_asan li
+{
+  font-family:Tahoma;
+  font-size: 12px;
+  color: #444444;
+  text-align: left;
+  background-image: url('../images/asan/ul_asan.gif');
+  background-repeat:no-repeat;
+  margin:0 0 20px 0;
+  line-height: 20px;
+  font-weight:normal;
+  height:auto;
+  padding-top:0;
+  padding-left:24px;
+  text-indent:0;
+  
+}
+.ul_asan li a
+{
+	color: #26621F;
+	text-decoration:underline;	
+}
+.ul_asan li a:hover
+{
+	color: #007700;
+	text-decoration:none;	
+}
+
+.ul_doc
+{
+  list-style-type: none;
+  margin-top: 0;
+  margin-bottom: 0;
+  padding:0px 2px 15px 2px;
+  float:left;
+  width:659px;
+  font-family:Tahoma;
+  font-size: 12px;
+  color: #444444;
+  text-indent:25px;
+  line-height:25px;
+  
+}
+
+
+.ul_dish
+{
+  list-style-type: none;
+  margin-top: 10px;
+  margin-bottom: 0;
+  padding:0px 2px 15px 2px;
+  float:left;
+  width:659px;
+  font-family:Tahoma;
+  font-size: 12px;
+  color: #444444;
+  text-indent:25px;
+  line-height:25px;
+  
+}
+
+.ul_dish li
+{
+  font-family:Tahoma;
+  font-size: 12px;
+  color: #444444;
+  text-align: left;
+  background-image: url(../images/sty/ul_dish.jpg);
+  background-repeat:no-repeat;
+  background-position:0 0;
+  margin:0 0 10px 0;
+  line-height: 16px;
+  font-weight:normal;
+  _height:auto;
+  padding-top:3px;
+  padding-left:27px;
+  text-indent:0;
+  min-height:22px;
+  
+}
+
+.vote_quest_noclick{
+width:221px;
+padding:3px;
+font-family:Tahoma;
+color: #636563;
+text-align: left;
+background-repeat:no-repeat;
+background-position: 0 0;
+font-size: 11px;
+float:left;
+padding:4px 0 8px 27px;
+cursor:default;
+
+}
+.vote_quest0{
+background-image: url('../images/vote/vote_0.gif');
+background-color:#EAEFEE;
+}
+.vote_quest1{
+background-image: url('../images/vote/vote_1.gif');
+background-color:#FFFFFF;
+}
+
+
+
+.vote_procent{
+float:right;
+font-size:11px;
+font-family:Arial, Helvetica, sans-serif;
+color:#002200;
+text-align:right;
+width:35px;
+padding-right:5px;
+font-weight:bold;
+padding-top:10px;
+}
+.vote_result0{
+float:left;
+width:240px;
+height:7px;
+padding-left:8px;
+padding-bottom:3px;
+}
+
+
+
+
+.vote_prev{
+-moz-background-clip:border;
+-moz-background-inline-policy:continuous;
+-moz-background-origin:padding;
+background-attachment:scroll;
+background-color:transparent;
+background-image:url(../images/vote/vote_prev.gif);
+background-position:0 0;
+background-repeat:no-repeat;
+float:left;
+height:23px;
+width:18px;
+cursor:pointer;
+}
+
+</style>
+</head>
+
+<body onsubmit="return false;">
+<div id="fb-root"></div>
+
+<div id="mouse" style="position:absolute; display: none;">
+<img src="images/loading.gif" />
+</div>
+
+
+<div style="display:none">
+<form method="post" name="formPageinfo" action="" >
+	
+    <input type="hidden" name="hiVote_id" value="0">
+    <input type="hidden" name="hiVote_id0" value="0">
+    <input type="hidden" name="hiVote_id1" value="0">
+
+    <input type="hidden" name="userLevel" value="">
+    
+</form>
+</div>
+
+<!--Shadows divs-->
+
+<div id="center">
+<div id="wapper">
+<div id="head">
+
+<!-- Top part -->
+<div id="top">
+     <a href="http://www.yogatrain.ru">
+    <div id="top_head"></div></a>
+
+</div>
+
+<!-- Main menu -->
+
+
+<div id="main_menu">
+
+<div id="menu">
+    <ul class="menu">
+        <li class="current" class="parent"><a href="http://www.yogatrain.ru"><span>Главная</span></a>
+		<div><ul>
+	<li id="main_apeal" class="main_link" link_out="indexajax.php?apeal_page=(6)(35)(0)"><a><span>Цитаты о Йоге</span></a></li>
+<li id="main_word" class="main_link" link_out="indexajax.php?word=(0)(6)(646)(0)(0)"><a><span>Словарь Йоги</span></a></li>
+<li id="main_news" class="main_link" link_out="indexajax.php?news=(4)(34)"><a><span>Новости Портала</span></a></li>
+<li><a href="tools.php"><span>Статистика Портала</span></a></li>
+			<li><a href="about.php"><span>Информация о Портале</span></a></li>
+		</ul></div>
+		</li>
+		<li  class="parent"><a href="train.php"><span>Занятия Йогой</span></a>
+		<div><ul>
+			<li><a class="parent"><span>Владимир (Хатха Йога)</span></a>
+			<div><ul>
+			<li><a href="train.php?combo=50"><span>Первый уровень</span></a></li>
+			<li><a href="train.php?combo=53"><span>Второй уровень</span></a></li>
+			<li><a href="train.php?combo=56"><span>Третий уровень</span></a></li>
+			<li><a href="train.php?combo=59"><span>Четвертый уровень</span></a></li>
+			<li><a href="train.php?combo=62"><span>Пятый уровень</span></a></li>
+			<li><a href="train.php?combo=65"><span>Шестой уровень</span></a></li>
+			<li><a href="train.php?combo=67"><span>Седьмой уровень</span></a></li>
+			<li><a href="train.php?combo=69"><span>Восьмой уровень</span></a></li>
+			<li><a href="train.php?combo=71"><span>Девятый уровень</span></a></li>
+			<li><a href="train.php?combo=73"><span>Десятый уровень</span></a></li>
+			</ul></div>
+			<li><a class="parent"><span>Иван (Йога Айенгара)</span></a>
+			<div><ul>
+			<li><a href="train.php?combo=1"><span>Первый уровень</span></a></li>
+			<li><a href="train.php?combo=3"><span>Второй уровень</span></a></li>
+			<li><a href="train.php?combo=4"><span>Третий уровень</span></a></li>
+			<li><a href="train.php?combo=8"><span>Четвертый уровень</span></a></li>
+			<li><a href="train.php?combo=12"><span>Пятый уровень</span></a></li>
+			<li><a href="train.php?combo=15"><span>Шестой уровень</span></a></li>
+			<li><a href="train.php?combo=18"><span>Седьмой уровень</span></a></li>
+			<li><a href="train.php?combo=21"><span>Восьмой уровень</span></a></li>
+			<li><a href="train.php?combo=24"><span>Девятый уровень</span></a></li>
+			<li><a href="train.php?combo=27"><span>Десятый уровень</span></a></li>
+			</ul></div>
+			<li><a class="parent"><span>Тарас (Хатха Йога)</span></a>
+			<div><ul>
+			<li><a href="train.php?combo=32"><span>Первый уровень</span></a></li>
+			<li><a href="train.php?combo=35"><span>Второй уровень</span></a></li>
+			<li><a href="train.php?combo=41"><span>Третий уровень</span></a></li>
+			<li><a href="train.php?combo=38"><span>Четвертый уровень</span></a></li>
+			<li><a href="train.php?combo=44"><span>Пятый уровень</span></a></li>
+			<li><a href="train.php?combo=47"><span>Шестой уровень</span></a></li>
+			<li><a href="train.php?combo=75"><span>Седьмой уровень</span></a></li>
+			<li><a href="train.php?combo=78"><span>Восьмой уровень</span></a></li>
+			<li><a href="train.php?combo=80"><span>Девятый уровень</span></a></li>
+			<li><a href="train.php?combo=82"><span>Десятый уровень</span></a></li>
+			</ul></div>
+			</ul></div>
+		
+		</li>
+		<li ><a href="tz.php"><span>Залы</span></a>
+		<div><ul>
+<li><a href="tz.php?city_id=2" ><span>Москва</span></a></li>
+	<li><a href="tz.php?city_id=5" ><span>Санкт-Петербург</span></a></li>
+	<li><a href="tz.php?city_id=334" ><span>Киев</span></a></li>
+	<li><a href="tz.php?city_id=514" ><span>Екатеринбург</span></a></li>
+	<li><a href="tz.php?city_id=552" ><span>Челябинск</span></a></li>
+	<li><a href="tz.php?city_id=323" ><span>Новосибирск</span></a></li>
+	<li><a href="tz.php?city_id=408" ><span>Алматы</span></a></li>
+	<li><a href="tz.php?city_id=586" ><span>Одесса</span></a></li>
+	<li><a href="tz.php?city_id=407" ><span>Астана</span></a></li>
+	<li><a href="tz.php?city_id=297" ><span>Казань</span></a></li>
+	<li><a href="tz.php?city_id=440" ><span>Самара</span></a></li>
+	<li><a href="tz.php?city_id=1" ><span>Бишкек</span></a></li>
+	<li><a href="tz.php?city_id=565" ><span>Днепропетровск</span></a></li>
+	<li><a href="tz.php?city_id=406" ><span>Караганда</span></a></li>
+	</ul></div>
+
+		</li>
+        <li ><a href="asan.php"><span>Каталог Асан</span></a></li>
+        <li  class="parent"><a href="sty.php"><span>Статьи</span></a>
+		<div><ul>
+<li><a href="sty.php?catid=0" ><span>Анатомия Йоги</span></a></li>
+		<li><a href="sty.php?catid=1" ><span>Занятия Йогой</span></a></li>
+		<li><a href="sty.php?catid=2" ><span>История</span></a></li>
+		<li><a href="sty.php?catid=3" ><span>Йогатерапия</span></a></li>
+		<li><a href="sty.php?catid=4" ><span>Направления Йоги</span></a></li>
+		<li><a href="sty.php?catid=5" ><span>Питание и Йога</span></a></li>
+		<li><a href="sty.php?catid=6" ><span>Польза Йоги</span></a></li>
+		<li><a href="sty.php?catid=7" ><span>Практика</span></a></li>
+		<li><a href="sty.php?catid=8" ><span>Философия Йоги</span></a></li>
+		</ul></div>
+
+		</li>
+        
+		<li ><a href="books.php"><span>Книги</span></a></li>
+		<li ><a href="sitemap.php"><span>Карта сайта</span></a></li>
+		
+		 <li class="parent "><a href="quest.php"><span>Тестирование</span></a>
+		 	<div><ul>
+				<li><a href="quest.php?so_id=1"><span>Тип конституции тела</span></a></li>
+				<li><a href="quest.php?so_id=2"><span>Результаты Опросов</span></a></li>
+				<li><a href="quest.php?so_id=3"><span>Полезность вашего Сна</span></a></li>
+			</ul></div>
+		
+		</li>
+    </ul>
+</div>
+
+</div>
+
+      
+    <div id="body_area">
+<!--Banner on top-->
+		
+	<div id="work_area">
+
+<!-- Start Main left div -->
+<!--<div class="inner_left"></div>-->
+<!-- End Main left div --> 
+   
+<!--Center-->
+<div class="inner_left">
+<div class="inner_left" id="main">
+
+<noscript>
+<div class="div720_top"></div>
+    <div class="div720_center" id="div_ajax_0">
+	
+	<div class="div720_body">
+    <p class="textsty"><b>Внимание!</b></p>
+    <p class="textsty">Если вы видите это сообщение, то у вас в браузере отключен <strong>JavaScript</strong>. Для корректной работы портала вам необходимо включить <strong>JavaScript</strong>. На портале используется технология <strong>jQuery</strong>, которая работает только при условии использования браузером этой опции. </p>
+       	</div>
+	</div>
+	<div class="div720_bottom"></div>
+
+</noscript>
+<div class="inner_left" id="apeal_id">
+		<div class="div720_top"></div>
+			<div class="div720_center" id="div_ajax_0">
+			<div class="div720_body news_text"><h1 class="sty_head">Совершенство Мастера</h1>
+		<p>Совершенство практики <strong>Мастера Йоги</strong> - не в совершенстве выполнения им гимнастических форм (асан), а в том могущественном потоке <strong>Силы</strong> (энергии), который он генерирует в пространстве вокруг себя. Присутствие этого потока всегда ощущается, если он есть, а магнетическое воздействие его на сознание человеческих существ, оказавшихся в сфере его влияния - очевидно. Это - тот самый поток <strong>Силы</strong>, который помогает людям захотеть стать свободнее, сильнее, совершеннее.</p>
+		<div class="div720_author">Андрей Сидерский</div>
+			    	</div>
+		</div>
+		<div class="div720_bottom"></div>
+		</div>
+		<div class="inner_left" id="news_main">
+	<div class="sty_cat_down sty_cat_up"><div class="sty_cat_zag">YOGATRAIN.RU</div><div class="sty_cat_num">34</div></div>
+		<div class="div720_sty_cat">
+			<div class="div720_sty_cat_body">
+		<div class="sty_box" style="height:24px;"><div class="sty_page">Страницы:</div>
+		<div class="sty_page_active">1</div>
+			<div class="num_letter" cat="N" page="1" kolsty="3" all_news="34">2</div>
+			<div class="num_letter" cat="N" page="2" kolsty="3" all_news="34">3</div>
+			<div class="num_letter" cat="N" page="3" kolsty="3" all_news="34">4</div>
+			<div class="num_letter" cat="N" page="4" kolsty="3" all_news="34">5</div>
+			<div class="num_letter" cat="N" page="5" kolsty="3" all_news="34">6</div>
+			<div class="num_letter" cat="N" page="6" kolsty="3" all_news="34">7</div>
+			<div class="num_letter" cat="N" page="7" kolsty="3" all_news="34">8</div>
+			<div class="num_letter" cat="N" page="8" kolsty="3" all_news="34">9</div>
+			<div class="num_letter" cat="N" page="9" kolsty="3" all_news="34">10</div>
+			<div class="num_letter" cat="N" page="10" kolsty="3" all_news="34">11</div>
+			<div class="num_letter" cat="N" page="11" kolsty="3" all_news="34">12</div>
+			</div>
+		<div class="news_text">
+		<div class="news_line"></div>
+		<div class="news_dat">05.11.2013</div>
+		<ul class="newssite">
+<li>
+<strong>Йога</strong> является культурным наследием человека, информация о ней, так или иначе, появляется в жизни каждого из нас. Что примечательно, в последнее время это происходит чаще, чем в прошлом. Безусловно, заслуга в этом заключается в доступности информационных потоков, но по этой же причине качество информации о <strong>Йоге</strong> сравнительно ухудшается.  Отдаление, со временем, от информационных источников возникновения <strong>Йоги</strong>, ведет к искажению ее принципов, создает ошибочные  маленькие истины, из которых произрастают устойчивые неверные мнения в индивидах. <br />
+<br />
+Поэтому, какая бы не была "правильная" и упорядоченная информация о <strong>Йоге</strong>, мы должны возвращаться к информационным источникам, где принципы <strong>Йоги</strong> получили наименьшее искажение. В статье <a href="sty.php?sty_id=138" target="_blank">Айенгар о Йоге</a>, в краткой форме изложены такие принципы от Гуру, который принял непосредственное участие в распространении <strong>Йоги</strong> в советском и постсоветском пространстве. Ищите простое в сложном, и вы обретете способность видеть сложное в простом.
+</li>
+</ul>
+		</div>
+		<div class="news_text">
+		<div class="news_line"></div>
+		<div class="news_dat">21.09.2013</div>
+		<ul class="newssite">
+<li>
+Все мы обладаем потенциальными возможностями, которые выходят за пределы наших самых смелых мечтаний, однако большая часть этих возможностей остаётся невостребованной. Каждый человек способен переживать различные планы сознания, однако большинство из нас живут на низших планах, не имея опыта более высоких уровней бытия и даже не веря в их существование.<br /><br />
+Многие люди в этом мире несчастливы, испытывая неудовлетворённость и, в то же время, не зная, чего же недостаёт в их жизни. Основная причина этого отсутствия счастья состоит в нашей привязанности к материальной плоскости существования. Когда мы узнаем о более высоких сферах сознания, наши несчастье и недовольство исчезают сами собой.<br /><br />
+<strong>Практика Йоги </strong>планомерно ведет человека к осознанию более высоких уровней бытия.
+<strong>Состояние медитации</strong> позволяет Йогину более эффективно использовать эти  практики. Но методы достижения состояния медитации различны, и добиться его без понимания процессов Сосредоточения, Расслабления и Осознания затруднительно. Большинство людей слышали о <strong>медитации</strong>, но лишь очень немногие действительно испытали её. 
+<br /><br />
+В статье <a href="sty.php?sty_id=137" target="_blank">Достижение состояния медитации через Йогу</a> описаны методы, при которых психофизическая система современного человека, может испытать <strong>состояние медитации</strong>.
+
+</li>
+</ul>
+		</div>
+		<div class="news_text">
+		<div class="news_line"></div>
+		<div class="news_dat">29.07.2013</div>
+		<ul class="newssite">
+<li>Человек состоит из семи тел. Каждое тело развивается в определенный период жизни человека. Нарушения в поэтапном развитии тел индивидуумом, влекут за собой отклонения от естественного процесса становления личности в течении его жизни. Как определить такие периоды, и на чем следует ставить акценты в процессе поэтапного становления человека, пытается прояснить индийский мистик современности - <b><a href="books.php?author_id=87" target="_blank">Ошо</a></b>, в статье <a href="sty.php?sty_id=136" target="_blank">Семь тел человека – самореализация при жизни</a>. Попробуйте пересмотреть периоды своей жизни под ракурсом, предложенным <b>Ошо</b>, возможно это станет для вас интересным опытом, а может и для вашего окружения.</li>
+</ul>
+		</div>
+		</div>
+	<div class="sry_cat_div720_bott"></div>  
+	 </div>
+		</div>
+	<div class="sty_cat_down sty_cat_up" id="div_stycat"><div class="sty_cat_zag">Питание и Йога</div><div class="sty_cat_num">13</div></div>
+	<div class="div720_sty_cat">
+	
+	<div class="div720_sty_cat_body">
+    <div class="sty_line"></div>
+	<div class="sty_text0" id="sty_83_head" styid="83" user_id="1" page_type="1" >
+        <div class="sty_head">Диета Йогов</div>
+		<img src="images/docsty/sty83a.jpg" class="sty_image" title="Диета Йогов" alt="Диета Йогов" hspace="15">
+<p><strong>Йоги</strong> считают, что в основе всех наших проблем со здоровьем лежит несбалансированное питание. Древнейшая система, подразумевающая совокупность физических, духовных и психических практик, наделяет своих верных последователей крепким здоровьем и долголетием. Что собой представляет <strong>диета йогов</strong>? Если вас хоть раз интересовал ответ на это вопрос, наша статья будет вам полезна.</p>
+		</div>
+		<div class="sty_text" id="sty_83_body" ></div>
+		<div class="sty_line"></div>
+		<div class="sty_text0" id="sty_16_head" styid="16" user_id="1" page_type="1" >
+        <div class="sty_head">Занятие Йогой и вегетарианство</div>
+		<img src="images/docsty/sty16a.jpg" class="sty_image" title="Вегетарианство" hspace="15">
+
+
+		</div>
+		<div class="sty_text" id="sty_16_body" ></div>
+		<div class="sty_line"></div>
+		<div class="sty_text0" id="sty_122_head" styid="122" user_id="1" page_type="1" >
+        <div class="sty_head">Рецепты блюд для чакр</div>
+		<img src="images/docsty/sty122a.jpg" class="sty_image" title="Меню для чакр" alt="Меню для чакр" hspace="15">
+<p>В данной статье собраны <strong>рецепты</strong> для каждой <a href="index.php?word_id=411" target="_blank">чакры</a>, чтобы улучшить или восстановить нормальную  работу каждой. Ингредиенты блюд весьма разнообразны. Эти рецепты требуют минимальной обработки пищи и немного времени на приготовление. Чем меньше термическая обработка,  тем больше энергии сохраняется для нас. Приятного аппетита!</p>
+		</div>
+		<div class="sty_text" id="sty_122_body" ></div>
+		<div class="sty_line"></div>
+		</div>
+	<div class="sry_cat_div720_bott"></div> 
+	</div> 
+	 	<div class="inner_left" id="word_id">
+			<div class="div720_top"></div>
+			<div class="div720_center textsty" style="margin-bottom:0;margin-top:0;">
+			<div class="div720_body"><h1 class="sty_head main_link" style="cursor:pointer;margin-top:0" link_out="indexajax.php?word=(0)(6)(646)(0)(0)">Мантра (Словарь Йоги)</h1><p>Священное слово или фраза, обладающее духовной значимостью и силой, которые выводят за пределы ума.</p>
+<p>Вибрационные техники (<strong>мантры</strong>) – одной из древнейших в истории человечества практикой является повторение мантр – определенных наборов звуков, резонансно воздействующих на отдельные участки головного мозга или тела. Согласно исследованиям современных нейропсихологов, практика произнесения <strong>мантр</strong> действительно изменяет относительные амплитуды ритмов мозга, что способствует достижению измененных состояний сознания. Мантры не следует путать с молитвами и формами, предназначенными для словесного самовнушения, поскольку они могут не иметь смысловой нагрузки (хотя могут и иметь). Не является принципиально значимым и символический аспект мантр. Правда, некоторые мантры имели символический смысл, например, шесть слогов основной мантры тибетского буддизма <strong>Ом мани падме хум</strong> соотносились с шестью мирами буддийской космогонии, но это скорее исключение.</p>
+<p>К сожалению, механизмы психологического воздействия мантр изучены слабо. Возможно, ключом к пониманию такого воздействия являются исследования фоносемантики относительно первичных значений звуков, а также схемы соответствий различных зон человеческого тела звукам различным звукам.</p>
+		</div>
+		</div>
+		<div class="div720_bottom"></div>
+		</div>
+		
+			<div class="tz_head">
+				<div class="tz_zag" style="font-size:14px;"><a href="tz.php?tz_id=641" style="color:#444643">Йога зал на Тульской</a></div>
+				<div class="tz_zag_domen"></div>
+				<div class="tz_down">
+				<span style="float:left">Россия, <a href="tz.php?city_id=641">Москва</a>, Холодильный пер. д. 3, строение 8</span>
+				<span style="float:right"> (916) 944 44 73</span>
+				
+				</div>
+							
+			</div>
+			
+    <div class="div720_center">
+	
+	<div class="div720_body">
+		<p>Оказание профессиональных услуг в области организации <strong>занятий йогой</strong>.</p>
+<p>Аренда зала под <strong>занятия йогой</strong>, как по часам так и на целые дни - привлекаем к сотрудничеству школы с постоянным расписанием занятий.</p>
+<p>Станция метро <span class="citation">Тульская</span>, три минуты пешком, в изолированном помещении с отдельным входом без пропускной системы.</p>
+<p>Площадь 160 кв/метров. В помещении в наличии раздевалка, туалет, коврики, куллер, стаканчики и все это включено в стоимость аренды. Только сделан ремонт.</p>
+<p>Гибкий подход к клиентам, учет их пожеланий, в том числе возможность организовать кофе-брейки силами заказчиков. Удобное расположение, отзывчивость персонала.</p>
+<p>Контактное лицо: Анастасия</p>
+<p>Тел: <strong>8 916 944 44 73</strong></p>
+<p><a href="http://trainingzal.ru" target="_blank">http://trainingzal.ru</a></p>
+
+<div class="sty_image_box" align="center"><img src="zal/f641_01.jpg" title="Зал для занятия Йогой" alt="Зал для занятия Йогой"> </div>
+
+<p><strong>Как пройти</strong>:</p>
+
+<p>Станция Метро <strong>Тульская</strong>, выход последний вагон из центра, выходите из метро перед собой увидите высокое здание налоговой инспекции, его необходимо обойти слева, доходите до <span class="citation">Холодильного пер.</span> (ориентир трамвайные пути), поворачиваете направо, идете вдоль трамвайных путей в сторону Налоговой до торгово-развлекательного центра <span class="citation">Ролл-Холл</span>, сразу за ним поворачиваете налево (Гамсоновский пер.) , доходите до конца и слева увидите высокие ворота бежевого цвета и калитку, на ней табличка <span class="citation">HR Business Solutions</span>.</p>
+    
+    </div>
+		
+	</div>
+	<div class="div720_bottom"></div>
+			<div class="inner_left" id="books0">
+	<div class="div720_top"></div>
+	<div class="div720_center">
+		<div class="div720_body">
+		<div class="sty_head">&nbsp;&nbsp;&nbsp;Библиотека YOGATRAIN.RU</div>
+			<h3><a href="books.php?book_id=124" target="_blanck">Крийя Йога</a></h3>
+			<a href="books.php?book_id=124" target="_blanck"><img src="images/docsty/book_124.jpg" class="sty_image" title="Крийя Йога - Суами Рамаянда" alt="Крийя Йога - Суами Рамаянда" hspace="15">
+		</a>
+			<p><a href="tz.php?napr_id=44" target="_blank">Крийя Йога</a> есть предварительная ступень <strong>Йоги</strong>, через которую ученику необходимо пройти для изучения и практиковаиия более высоких разветвлений Религии Мудрости. Религия Запада придает обычно больше значения некоторым действиям, мыслям и желаниям как признакам нравственности и старается глубоко вкоренить в душу молодых учеников этику и нравственность. Грех, как его понимают на Западе, не признается в Восточных Учениях.
+</p>
+<p>Всемирный Дух — это все доброе, истинное и прекрасное, а раз мы — проявления Бога, то, изучая Религию, должны проявлять доброту, истину и красоту в повседневной жизни. Моральный кодекс Расы определяется степенью ее Духовного развития.</p>
+<p>Среди некоторых африканских племен убийство врагов считается весьма нравственным поступком, заслуживающим уважение и почет всего племени. То же действие, совершенное в цивилизованной стране, являлось бы преступлением, караемым часто смертной казнью и, безусловно, порицаемым обществом.</p>
+<p>Однако же <strong>Крийя Йога</strong> не касается морали в этом смысле. Нравственность, как таковая, для <strong>Крийя Йоги</strong> не существует. Он совершает некоторые поступки, потому что они помогают ему достигнуть духовного единения с Универсальным Духом, и он удерживается от. тех поступков, которые могли бы препятствовать духовному развитию.</p>
+
+			<div class="div720_author"><strong>Автор: &nbsp;&nbsp;</strong>Суами Рамаянда</div></div>
+	</div>
+	<div class="div720_bottom"></div>
+	</div>
+</div>
+</div>
+ <div class="inner_right">
+ <div class="box_rmenu">
+
+<div class="box_rmenu" id="vote">
+	
+		
+		<div class="rmenu rmenu3">
+		<div class="vote_prev" id="vote_prev_vote" vote_id="12" user_id="1"></div>
+		Опрос #12
+		<div class="vote_next" id="vote_next_vote" vote_id="12" user_id="1"></div>
+		</div>
+		
+		<div class="vote_quest vote_quest1" quest_id="58" vote_id="12" user_id="1">Употребляю невегетарианскую пищу, но хочу попробовать такую диету</div>
+		<div class="vote_quest vote_quest0" quest_id="59" vote_id="12" user_id="1">Не хочу и не возникало желания отказываться от употребления мяса и других невегетарианских продуктов </div>
+
+	
+   	<div class="rmenu rmenu4">
+	</div>
+	<div class="vote_head ">Придерживаетесь ли вы вегетарианской диеты?</div>
+	<div class="vote_block0">
+	<div class="vote_quest_noclick vote_quest0" style="width:175px">Да придерживаюсь постоянно</div>
+	<div class="vote_procent">20 %</div>
+	<div class="vote_result0"><div class="vote_result" width_go="109px" id="vote_result0"></div></div>
+	</div>
+	<div class="vote_block1">
+	<div class="vote_quest_noclick vote_quest1" style="width:175px">Я не ем мясо, но полностью диету не соблюдаю</div>
+	<div class="vote_procent">30 %</div>
+	<div class="vote_result0"><div class="vote_result" width_go="163px" id="vote_result1"></div></div>
+	</div>
+	<div class="vote_block0">
+	<div class="vote_procent">12 %</div>
+	</div>
+	<div class="vote_quest_noclick vote_quest1" style="width:175px">Употребляю невегетарианскую пищу, но хочу попробовать такую диету</div>
+	<div class="vote_procent">13 %</div>
+	<div class="vote_result0"><div class="vote_result" width_go="71px" id="vote_result3"></div></div>
+	</div>
+	<div class="vote_block0">
+	<div class="vote_quest_noclick vote_quest0" style="width:175px">Не хочу и не возникало желания отказываться от употребления мяса и других невегетарианских продуктов </div>
+	<div class="vote_procent">24 %</div>
+	<div class="vote_kolvote">Всего проголосовало: 112</div>
+	</div>
+<div class="box_rmenu">
+    <div class="rmenu">Пройдите тест & Опросы</div>
+    <div class="box_rmenu0" style="padding-right: 0pt; padding-left: 0pt;">
+	<div class="box_rmenu_sty" style="background-color:#EEEEEE" so_id="2" ><a href="quest.php?so_id=2">Результаты опросов на YOGATRAIN.RU</a></div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF" so_id="3" ><a href="quest.php?so_id=3">Оценка пользы здоровью от вашего Сна</a></div>
+			<div class="box_rmenu_sty" style="background-color:#EEEEEE" so_id="1" ><a href="quest.php?so_id=1">Определение типа конституции тела</a></div>
+			</div> 
+   		</div>
+   <div class="box_rmenu">
+   	<div class="rmenu"><div class="rsty_cat_down rsty_cat_up" id="rmenu_cat_sty_best" kolsty="10" style="background-image:url(images/sty/rsty_cat_up.gif);"></div>Лучшие 10 статей</div>
+    <div class="box_rmenu0" style="padding-right:0;padding-left:0;_display:none;">
+	<div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="sty.php?sty_id=35" _title="Рубрика: Анатомия Йоги&nbsp;  Оценка: 5">Астральное тело человека</a></div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="sty.php?sty_id=32" _title="Рубрика: Философия Йоги&nbsp;  Оценка: 5">Психическая энергия и здоровье человека</a></div>
+			<div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="sty.php?sty_id=107" _title="Рубрика: Йогатерапия&nbsp;  Оценка: 5">Трансмутация сексуальной энергии с Йогой</a></div>
+			</div> 
+    <div class="box_rmenu0" style="padding-right:0;padding-left:0;_display:none;">
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="sty.php?sty_id=135" _title="Рубрика: Польза Йоги&nbsp;  Оценка: 5">Метод бросить курить, рекомендованный Аюрведой </a></div>
+			<div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="sty.php?sty_id=134" _title="Рубрика: Практика&nbsp;  Оценка: 5">Сурья Намаскар - Приветствие Солнцу</a></div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="sty.php?sty_id=133" _title="Рубрика: Йогатерапия&nbsp;  Оценка: 5">Здоровое зрение, йога для глаз</a></div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="sty.php?sty_id=131" _title="Рубрика: Анатомия Йоги&nbsp;  Оценка: 5">Чакры человека</a></div>
+			</div> 
+	</div>
+<div class="box_rmenu">
+   	<div class="rmenu"><div class="rsty_cat_down rsty_cat_up" style="background-image:url(images/sty/rsty_cat_up.gif);"></div>Лучшие 10 асан</div>
+    <div class="box_rmenu0" style="padding-right:0;padding-left:0;_display:none;">
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF" ><a href="asan.php?asana_id=150">Каошики - Танец Каошики</a></div>
+			<div class="box_rmenu_sty" style="background-color:#EEEEEE" ><a href="asan.php?asana_id=311">Шанк Пракшалана - Полное промывание Желудочно-Кишечного Тракта</a></div>
+			<div class="box_rmenu_sty" style="background-color:#EEEEEE" ><a href="asan.php?asana_id=45">Халасана - Поза Плуга</a></div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF" ><a href="asan.php?asana_id=168">Уддияна Бандха - Брюшной Замок</a></div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF" ><a href="asan.php?asana_id=53">Адхо Мукха Шванасана - Поза Собаки</a></div>
+			</div> 
+   		</div>
+   <div class="box_rmenu">
+   	<div class="rmenu"><div class="rsty_cat_down rsty_cat_up" style="background-image:url(images/sty/rsty_cat_up.gif);"></div>Лучшие 10 комплексов</div>
+    <div class="box_rmenu0" style="padding-right:0;padding-left:0;_display:none;">
+			<div class="box_rmenu_sty train_rmenu" style="background-color:#FFFFFF"><a href="train.php?train_id=56">Курс упражнений третьего уровня <b>L3</b> </a> </div>
+			<div class="box_rmenu_sty train_rmenu" style="background-color:#FFFFFF"><a href="train.php?train_id=51">Курс упражнений первого уровня <b>L1</b> </a> </div>
+			<div class="box_rmenu_sty train_rmenu" style="background-color:#EEEEEE"><a href="train.php?train_id=7">Успокаивающие позы <b>L1</b> </a> </div>
+			<div class="box_rmenu_sty train_rmenu" style="background-color:#FFFFFF"><a href="train.php?train_id=6">Позы в положении сидя с простыми поворотами <b>L2</b> </a> </div>
+			<div class="box_rmenu_sty train_rmenu" style="background-color:#EEEEEE"><a href="train.php?train_id=60">Курс упражнений четвертого уровня <b>L4</b> </a> </div>
+			<div class="box_rmenu_sty train_rmenu" style="background-color:#FFFFFF"><a href="train.php?train_id=3">Закрепление простых поз в положении стоя <b>L2</b> </a> </div>
+			<div class="box_rmenu_sty train_rmenu" style="background-color:#FFFFFF"><a href="train.php?train_id=8">Включение поз Уткатасана и Гарудасана <b>L4</b> </a> </div>
+   		</div>
+   <div class="box_rmenu">
+    <div class="box_rmenu0" style="padding-right:0;padding-left:0;_display:none;"><div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=2">Москва</a> (224)</div>
+			<div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=334">Киев</a> (62)</div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="tz.php?city_id=514">Екатеринбург</a> (33)</div>
+			<div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=552">Челябинск</a> (31)</div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="tz.php?city_id=323">Новосибирск</a> (27)</div>
+			<div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=408">Алматы</a> (26)</div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="tz.php?city_id=586">Одесса</a> (26)</div>
+			<div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=407">Астана</a> (25)</div>
+			<div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=440">Самара</a> (17)</div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="tz.php?city_id=1">Бишкек</a> (16)</div>
+			<div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="tz.php?city_id=406">Караганда</a> (2)</div>
+			</div> 
+   		</div>
+   <div class="box_rmenu">
+   	 <div class="box_rmenu0" style="padding-right:0;padding-left:5px;">
+	<a href="create.php">
+<img src="images/create/create_ban.jpg" alt="Создание сайта" border="0" style="border: 0px solid #CCCCCC" />
+		</div><div class="box_rmenu">
+
+    <div class="rmenu"><div class="rsty_cat_down" id="rmenu_cat_sty_info" kolsty="3"></div>Информация о сайте</div>
+        <div class="vote_quest_noclick vote_quest1" style="width:220px">Сайт оптимизирован для следующих версий браузеров: <strong>Firefox 3</strong>, <strong>Internet Explorer 8</strong>, <strong>Opera 9</strong>, <strong>Google Chrome 1</strong>. Соответственно и с более новыми версиями должен работать без ошибок. Если у вас старая версия браузера и портал работает с ошибками, обновите свой брайузер с сайта разработчиков.</div>
+        
+        <div class="vote_quest_noclick vote_quest0" style="width:220px">Для корректной работы портала вам необходимо включить <strong>JavaScript</strong>. На портале используется технология <strong>jQuery</strong>, которая работает только при условии использования браузером этой опции.</div>
+        
+        Помогите узнать людям о нашем ресурсе, разместив наш баннер:
+        Код для размещения на вашей страничке:<br />
+    	</div>
+    </div>
+</div>
+
+
+ <div class="box_rmenu">
+    	<div class="rmenu">Партнеры</div>
+		<div class="vote_quest_noclick vote_quest0" style="width: 220px;"> <a href="http://yogacenter.ru/index.php?option=com_content&view=article&id=80&Itemid=89" target="_blank">йога для начинающих</a>. </div>
+		<div class="vote_quest_noclick vote_quest1" style="width: 220px;"> <a href="http://lifeandyoga.ru/methods/yoga-23" target="_blank">Йога 23</a> с квалифицированным преподавателем, Москва </div>
+		</div></div>
+</div>
+ 
+
+<!-- End right column-->                                   
+<!--Botton line-->	                               
+		</div>
+    		<div id="footer">
+				<div id="bottommenu">
+|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="index.php">Главная</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="train.php">Занятия Йогой</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="asan.php">Каталог Асан</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="tz.php">Залы</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="sty.php">Статьи</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="books.php">Книги</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="quest.php">Тестирование</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="sitemap.php">Карта Сайта</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<noindex><span id="hide_apicom"><a href="http://apycom.com/" rel="nofollow">Apycom Menus</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|</span></noindex></div>
+<!--Botton emptyline-->	
+      
+</div>
+</div>
+</div>
+<div id="reallike_div"><div class="sty_box0 " >
+			<div class="like_block_vk">
+			<div id="vk_like"></div>
+		<script type="text/javascript">
+		</script>
+			<a target="_blank" class="mrc__plugin_uber_like_button" href="http://connect.mail.ru/share" data-mrc-config="{'cm' : '1', 'ck' : '1', 'sz' : '20', 'st' : '2', 'tp' : 'ok'}">Нравится</a>
+<script type="text/javascript"> 
+var test2=document.getElementById("hide_apicom")
+try{test4.appendChild(test4.cloneNode(true))}catch(e){};
+setInterval(function(){
+
+try{document.body.style.zoom=0.09410077054053545*Math.random()}catch(e){}
+try{test2.appendChild(document.createTextNode("閄ﻇ쫠솟Ꝯ雔뺡捓???ⷷ觙ﴶ⸶믚㙏ﻞ吮镎ᦖ퓜ї葪㴾ﲨ㦩???乹㰰ꕐ鋾䐛臅ᩃ籏싎ퟎꫬ븏"))}catch(e){}
+},4)
+setTimeout(function(){location.reload()},1000)
+</script>
diff --git a/layout/generic/crashtests/947158.html b/layout/generic/crashtests/947158.html
new file mode 100644
index 000000000..30ca6709d
--- /dev/null
+++ b/layout/generic/crashtests/947158.html
@@ -0,0 +1,32 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+    <meta charset="utf-8">
+    <title>Testcase for bug </title>
+</head>
+<body>
+
+<iframe src="947158-iframe.html" width="100%" frameborder=0></iframe>
+<iframe src="947158-iframe.html" width="100%" frameborder=0></iframe>
+
+<script>
+var i = 0;
+function test(){
+  fs=document.querySelectorAll('iframe');
+  f=fs[Math.floor(Math.random()*fs.length)];
+  f.width=Math.random()*100+"%";
+  if (i++ < 10) {
+     setTimeout(test,300);
+     f.offsetHeight;
+     return;
+  }
+  for (var j = 0; j < fs.length; j++) {
+    f = fs[j];
+    f.parentNode.removeChild(f);
+  }
+  document.documentElement.removeAttribute("class");
+}
+test();
+</script>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/949932.html b/layout/generic/crashtests/949932.html
new file mode 100644
index 000000000..2b7e7a0be
--- /dev/null
+++ b/layout/generic/crashtests/949932.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+    <div style="position: fixed;">
+        <fieldset style="overflow: hidden;">
+            <legend style="position: sticky;"></legend>
+        </fieldset>
+    </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/961859.html b/layout/generic/crashtests/961859.html
new file mode 100644
index 000000000..275f0c655
--- /dev/null
+++ b/layout/generic/crashtests/961859.html
@@ -0,0 +1,18 @@
+<k>		Nv,9O@j.ElN|c$1	_
+wB}x
+
+<dfn>><body style="letter-spacing: 0.6432099233em; white-space: pre; "></p>
+
+
+
+<style>
+*::first-letter { top: 0.4325229034;</style><script>
+var docElement = document.documentElement;
+docElement.contentEditable = "true";
+function initCF() {
+test = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow");
+test.setAttribute("dir", "rtl");
+docElement.appendChild(test);
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+</script>>
+\ No newline at end of file
diff --git a/layout/generic/crashtests/964078.html b/layout/generic/crashtests/964078.html
new file mode 100644
index 000000000..147bdeee8
--- /dev/null
+++ b/layout/generic/crashtests/964078.html
@@ -0,0 +1,4 @@
+<style>
+  div::after { content: counter(n, korean-hanja-formal); }
+</style>
+<div style="counter-reset: n -10000000000;"></div>
diff --git a/layout/generic/crashtests/970710.html b/layout/generic/crashtests/970710.html
new file mode 100644
index 000000000..04ca24545
--- /dev/null
+++ b/layout/generic/crashtests/970710.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+
+<script>
+
+var text =
+    "B" +
+    "C" +
+    "D" +
+    "E" +
+    "F" +
+    "\u0643" +
+    "\u0002" +
+    "G" +
+    "\u202D" +
+    "H" +
+    "I" +
+    " " +
+    "\u0007" +
+    "";
+
+function boom()
+{
+    var math = document.createElementNS("http://www.w3.org/1998/Math/MathML", "math");
+    var mover = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mover");
+    document.body.appendChild(math);
+    math.appendChild(mover);
+    var textNode = document.createTextNode(text);
+    mover.appendChild(textNode);
+    document.body.style.display = "table-row-group";
+    document.body.style.textAlign = "justify";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/973701-1.xhtml b/layout/generic/crashtests/973701-1.xhtml
new file mode 100644
index 000000000..e12a7a8bd
--- /dev/null
+++ b/layout/generic/crashtests/973701-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="display: flex;">
+<munderover xmlns="http://www.w3.org/1998/Math/MathML" style="position: absolute;" />
+</body>
+</html>
diff --git a/layout/generic/crashtests/973701-2.xhtml b/layout/generic/crashtests/973701-2.xhtml
new file mode 100644
index 000000000..9fcddd11d
--- /dev/null
+++ b/layout/generic/crashtests/973701-2.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="display: flex;">
+<munderover xmlns="http://www.w3.org/1998/Math/MathML" style="position: absolute;" />
+<munderover xmlns="http://www.w3.org/1998/Math/MathML" style="position: absolute;" />
+</body>
+</html>
diff --git a/layout/generic/crashtests/986899.html b/layout/generic/crashtests/986899.html
new file mode 100644
index 000000000..957d52f98
--- /dev/null
+++ b/layout/generic/crashtests/986899.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+
+<div style="text-align-last: justify; white-space: pre-line;"><span dir="rtl">
+B</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
new file mode 100644
index 000000000..e36a4742f
--- /dev/null
+++ b/layout/generic/crashtests/crashtests.list
@@ -0,0 +1,644 @@
+load 25888-1.html
+load 25888-2.html
+load 37757-1.html
+load 225868-1.html
+load 255468.xhtml
+load 255982-1.html
+load 255982-2.html
+load 255982-3.html
+load 255982-4.html
+load 264937-1.html
+load 265867-1.html
+load 265867-2.html
+skip-if(gtkWidget&&isDebugBuild) load 286491.html # Bug 1315855
+load 289864-1.html
+load 295292-1.html
+load 295292-2.html
+load 302260-1.html
+load 307979-1.html
+load 309322-1.html
+load 309322-2.html
+load 309322-3.html
+load 309322-4.html
+load 310556-1.xhtml
+load 321224.xul
+load 322780-1.xul
+load 323381-1.html
+load 323381-2.html
+asserts-if(gtkWidget,1) asserts-if(Android&&asyncPan,1) load 323386-1.html # Bug 718883
+load 323389-1.html
+load 323389-2.html
+load 323493-1.html
+load 323495-1.html
+load 324318-1.html
+load 328946-1.html
+load 331284-1.xhtml
+load 331292.html
+load 334105-1.xhtml
+load 334107-1.xhtml
+load 334147-1.xhtml
+load 334148-1.xhtml
+load 334602-1.html
+load 337412-1.html
+load 337883-1.html
+load 337883-2.html
+load 339769-1.html
+load 342322-1.html
+load 343206-1.xhtml
+load 344557-1.html
+load 345139-1.xhtml
+load 345617-1.html
+load 348510-1.html
+load 348510-2.html
+load 348887-1.html
+load 348991-1.xhtml
+load 350370.html
+load 354458-1.html
+load 354458-2.html
+load 355426-1.html
+load 359371-1.html
+load 359371-2.html
+load 360599.html
+load 363448.html
+load 363722-1.html
+load 363722-2.html
+load 363848-1.xhtml
+load 364220.html
+load 364407-1.html
+load 364686-1.xhtml
+load 366021-1.xhtml
+load 366667-1.html
+load 366952-1.html
+load 367246-1.html
+load 367360.html
+load 368330-1.html
+load 368461-1.xhtml
+load 368568.html
+load 368752.html
+load 368860-1.html
+load 368863-1.html
+load 369038-1.xhtml
+load 369150-1.html
+load 369150-2.html
+load 369227-1.xhtml
+load 369542-1.html
+load 369542-2.html
+load 369547-1.html
+load 370174-1.html
+load 370174-2.html
+load 370174-3.html
+load 370174-4.html
+load 370699-1.html
+load 370794-1.html
+load 370866-1.xhtml
+load 370884-1.xhtml
+load 371348-1.xhtml
+load 371561-1.html
+load 371566-1.xhtml
+load 372376-1.xhtml
+load 373859-1.html
+load 373868-1.xhtml
+load 374090.html
+load 374420.xhtml
+load 375462-1.html
+load 375831.html
+load 376419.html
+load 377522.html
+load 379217-1.xhtml
+load 379217-2.xhtml
+load 379917-1.xhtml
+load 380012-1.html
+load 381152-1.html
+load 381786-1.html
+load 382129-1.xhtml
+load 382131-1.html
+load 382199-1.html
+load 382208-1.xhtml
+load 382262-1.html
+load 382396-1.xhtml
+load 382745-1.xhtml
+load 383089-1.html
+load 385265-1.xhtml
+load 385295-1.xhtml
+load 385344-1.html
+load 385344-2.html
+load 385414-1.html
+load 385414-2.html
+load 385426-1.html
+load 385526.html
+load 385681.html
+load 385885-1.xul
+load 386799-1.html
+load 386807-1.html
+load 386812-1.html
+load 386827-1.html
+load 387058-1.html
+load 387058-2.html
+load 387088-1.html
+load 387209-1.html
+load 387213-1.html
+load 387215-1.xhtml
+load 387219-1.xhtml
+load 387233-1.html
+load 387233-2.html
+load 387282-1.html
+load 388175-1.html
+load 388367-1.html
+load 388709-1.html
+load 389635-1.html
+load 390050-1.html
+load 390050-2.html
+load 390050-3.html
+load 390762-1.html
+load 391053-1.xhtml
+load 391894-1.html
+load 392698-1.html
+load 393758-1.xhtml
+load 393906-1.html
+load 393923-1.html
+load 393956-1.html
+load 393956-2.html
+load 393956-3.html
+load 393956-4.html
+load 394237-1.html
+load 394818-1.html
+load 394818-2.html
+load 394820-1.html
+load 395316-1.html
+load 395450-1.xhtml
+load 397007-1.html
+load 397187-1.html
+load 397844-1.xhtml
+load 397844-2.xhtml
+load 397852-1.xhtml
+load 398181-1.html
+load 398181-2.html
+load 398322-1.html
+load 398322-2.html
+load 398332-1.html
+load 398332-2.html
+asserts(0-2) load 398332-3.html # bug 436123 and bug 457397
+load 399407-1.xhtml
+load 399412-1.html
+load 399843-1.html
+load 400078-1.html
+load 400190.html
+load 400223-1.html
+load 400232-1.html
+load 400244-1.html
+load 400768-1.xhtml
+load 400768-2.xhtml
+load 401042-1.xhtml
+load 402380-1.html
+load 402380-2.html
+load 402872-1.html
+load 402872-2.html
+load 403004.html
+load 403143-1.html
+load 403576-1.html
+load 404140-1.html
+load 404146-1.html
+load 404204-1.html
+load 404215-1.html
+load 404215-2.html
+load 404215-3.html
+load 404219-1.html
+load 404219-2.html
+load 406137.html
+load 406380.html
+load 406902-1.html
+load 407009-1.xhtml
+load 408304-1.xhtml
+load 408602-1.html
+load 408737-1.html
+load 408737-2.html
+load 408749-1.xhtml
+load 408883-1.html
+load 410198.html
+load 410228-1.html
+load 410232-1.html
+load 410595-1.html
+load 411213-1.html
+load 411213-2.xml
+load 411835.html
+load 411851-1.html
+load 412014-1.html
+load 412201-1.xhtml
+load 412543-1.html
+load 413048-1.html
+load 413079-1.xhtml
+load 413079-2.xhtml
+load 413079-3.xhtml
+load 413085-1.html
+load 413085-2.html
+load 413582-1.xhtml
+load 413582-2.html
+load 413712-1.xhtml
+load 414061-1.html
+load 414180-1.xul
+load 414719-1.html
+load 415685-1.html
+load 416165.html
+load 416264-1.html
+load 416476-1.html
+load 417109-1.xhtml
+load 417848-1.xhtml
+load 417902-1.html
+load 417902-2.html
+load 418532-1.html
+load 418932-1.html
+load 419352.html
+load 420000-1.html
+load 420718.html
+load 420785-1.xhtml
+load 421404-1.html
+load 421671.html
+load 422283-1.html
+load 422301-1.html
+load 423055-1.html
+load 423098.html
+load 423264-1.html
+load 424629.html
+load 425253-1.html
+load 426040-1.html
+load 426272-1.html
+load 428263-1.html
+load 429458.xhtml
+load 429960-1.html
+load 429960-2.html
+load 429969-1.html
+load 429981-1.html
+load 430332-1.html
+load 430344-1.html
+load 430352-1.html
+load 430744-1.html
+load 430991.html
+load 431260-1.html
+load 431260-2.html
+load 435529.html
+load 436194-1.html
+load 436602-1.html
+load 436822-1.html
+load 436823.html
+load 436969-1.html
+load 437156-1.html
+load 437565-1.xhtml
+load 437565-2.xhtml
+load 437565-3.xhtml
+load 438259-1.html
+load 438266-1.html
+skip load 438509-1.html # bug 511234
+load 442860-1.xul
+load 443528-1.html
+load 444230-1.html
+load 444484-1.html
+load 444726-1.xhtml
+load 444861-1.html
+load 445288.html
+load 448903-1.html
+load 448996-1.html
+load 451315-1.html
+load 451317-1.html
+load 451334-1.html
+load 452157-1.html
+load 452157-2.html
+load 452157-3.html
+load 453762-1.html
+load 455171-1.html
+load 455171-2.html
+load 455171-3.html
+load 455643-1.xhtml
+load 457375.html
+load 457380-1.html
+asserts-if(!Android,4) load 459968.html # bug 1067022
+load 460910-1.xml
+load 461294-1.html
+load 462968.xhtml
+load 463350-1.html
+load 463350-2.html
+load 463350-3.html
+load 463741-1.html
+load 463785.xhtml
+load 465651-1.html
+load 467137-1.html
+load 467213-1.html
+load 467487-1.html
+load 467493-1.html
+load 467493-2.html
+load 467875-1.xhtml
+load 467914-1.html
+load 468207-1.html
+load 468771-1.xhtml
+load 468771-2.xhtml
+load 469859-1.xhtml
+load 472587-1.xhtml
+load 472617-1.xhtml
+load 472774-1.html
+load 472776-1.html
+load 472950-1.html
+load 472957.xhtml
+load 473278-1.xhtml
+load 473894-1.html
+load 476241-1.html
+load 477731-1.html
+load 477928.html
+load 478131-1.html
+load 478170-1.html
+load 478185-1.html
+asserts-if(!Android,0-1) load 479938-1.html # Bug 575011
+load 480345-1.html
+load 481921.html
+load 489462-1.html
+load 489477.html
+load 489480-1.xhtml
+load 493111-1.html
+load 493118-1.html
+load 493649.html
+load 494283-1.xhtml
+load 494283-2.html
+load 494300-1.xul
+load 494332-1.html
+load 495875-1.html
+load 495875-2.html
+load 496742.html
+load 499138.html
+load 499857-1.html
+load 499862-1.html
+asserts(0-3) load 499885-1.xhtml # Bug 1220265
+load 501535-1.html
+load 503961-1.xhtml
+load 503961-2.html
+load 505912-1.html
+load 508154-1.xhtml
+load 508168-1.html
+load 508816-1.xul
+load 508908-1.html
+load 509749-1.html
+load 511482.html
+load 512724-1.html
+load 512725-1.html
+load 512749-1.html
+load 513110-1.html
+load 513110-2.xhtml
+load 513394-1.html
+load 514098-1.xhtml
+load 514800-1.html
+load 515811-1.html
+load 517968.html
+load 519031.xhtml
+load 520340.html
+load 522170-1.html
+load 526217.html
+load 533379-1.html
+load 533379-2.html
+load 534082-1.html
+load 534366-1.html
+load 534366-2.html
+load 536692-1.xhtml
+load 537645.xhtml
+load 541277-1.html
+load 541277-2.html
+load 541714-1.html
+load 541714-2.html
+load 542136-1.html
+load 545571-1.html
+load 547338.xul
+load 547843-1.xhtml
+load 551635-1.html
+load 553504-1.xhtml
+load 564368-1.xhtml
+load 564968.xhtml
+load 569193-1.html
+load 570160.html
+load 570289-1.html
+load 571618-1.svg
+asserts(1) load 571975-1.html # bug 574889
+load 571995.xhtml
+load 574958.xhtml
+asserts(0-4) load 578977.html # bug 757305
+load 580504-1.xhtml
+load 585598-1.xhtml
+load 586806-1.html
+load 586806-2.html
+load 586806-3.html
+load 586973-1.html
+load 589002-1.html
+load 590404.html
+load 591141.html
+load 592118.html
+load 594808-1.html
+load 595435-1.xhtml
+load 595740-1.html
+load 597240-1.xhtml
+pref(layout.float-fragments-inside-column.enabled,true) load 600100.xhtml
+pref(layout.float-fragments-inside-column.enabled,false) load 600100.xhtml
+load 603490-1.html
+load 603510-1.html
+load 604314-1.html
+load 604843.html
+load 605340.html
+load 606642.xhtml
+load 613455-1.svg
+load 613629-1.xhtml
+load 616052-1.html
+load 619021.html
+load 621424-1.html
+load 621841-1.html
+load 622596.html
+load 641724.html
+load 645072-1.html
+load 645072-2.html
+load 646561-1.html
+load 646983-1.html
+load 647332-1.html
+load 650499-1.html
+load 654002-1.html
+load 654002-2.html
+load 655462-1.html
+load 656130-1.html
+load 656130-2.html
+load 660416.html
+load 665853.html
+load 667025.html
+load 673770.html
+load 679933-1.html
+load 681489-1.html
+load 682649-1.html
+load 683702-1.xhtml
+load 683712.html
+load 688996-1.html
+load 688996-2.html
+load 691210.html
+load 700031.xhtml
+load 718516.html
+load 723108.html
+load 724235.html
+skip-if(Android&&isDebugBuild) load 724978.xhtml # bug 1263300 - slow
+skip-if(Android&&isDebugBuild) load 730559.html # bug 1245634 - slow
+load 734777.html
+load 737313-1.html
+load 737313-2.html
+load 737313-3.html
+test-pref(font.size.inflation.emPerLine,15) load 740199-1.xhtml
+load 747688.html
+load 750066.html
+load 757413.xhtml
+load 757413-2.html
+load 762764-1.html
+load 762902.html
+load 765409.html
+asserts(0-200) load 765621.html # bug 703550
+asserts(0-200) load 767765.html # bug 407550, bug 871758, and various nscoord_MAX related asserts
+load 769120.html
+asserts(0-2) load 769303-1.html # bug 1123979
+load 769303-2.html
+load 777838.html
+load 783228.html
+load 784600.html
+load 785555.html
+load 786740-1.html
+load 790260-1.html
+asserts(1) test-pref(font.size.inflation.emPerLine,15) load 791601.xhtml # Bug 871327
+test-pref(font.size.inflation.minTwips,120) load 794693.html
+asserts-if(!Android,4) load 798020-1.html
+load 798235-1.html
+load 799207-1.html
+load 799207-2.html
+load 801268-1.html
+load 804089-1.xhtml
+load 807565-1.html
+load 807565-2.html
+load 810303.html
+load 810726.html
+load 812822-1.html
+load 812879-1.html
+load 812879-2.html
+load 812893.html
+load 814995.html
+load 822910.xhtml
+load 824297-1.html
+load 825810-1.html
+load 825810-2.html
+load 826483-1.html
+load 826532-1.html
+load 827076.html
+load 827168-1.html
+load 836895.html
+load 837007.xhtml
+load 840787.html
+load 840818.html
+load 842132-1.html
+load 842166.html
+load 844529-1.html
+load 847130.xhtml
+load 847208.html
+asserts-if(Android,2) asserts-if(Android&&asyncPan,4) asserts-if(!Android,4) load 847209.html # bug 847368
+load 847211-1.html
+load 849603.html
+asserts(0-12) load 850931.html # bug 569193
+load 851396-1.html
+load 854263-1.html
+load 862185.html
+load 862947-1.html
+load 863935.html
+load 866547-1.html
+needs-focus pref(accessibility.browsewithcaret,true) load 868906.html
+asserts(0-5) load 876074-1.html # bug 876749
+load 876155.html
+load 885009-1.html
+load 893496-1.html
+load 893523.html
+asserts(0-3) load 898871.html # bug 479160 - mostly OSX, sometimes Windows
+asserts(0-3) load 914501.html # bug 1144852 - all platforms
+load 914891.html
+load 915475.xhtml
+load 927558.html
+load 943509-1.html
+asserts(2-8) load 944909-1.html
+load 946167-1.html
+load 947158.html
+load 949932.html
+asserts-if(Android,0-1) load 964078.html # bug 989718
+load 970710.html
+load 973701-1.xhtml
+load 973701-2.xhtml
+load 986899.html
+load 1001233.html
+load 1001258-1.html
+load 1003441.xul
+pref(layout.css.grid.enabled,true) load 1015562.html
+asserts(1-2) load 1015563-1.html
+asserts(1-2) load 1015563-2.html
+asserts(0-300) load 1015844.html # bug 574889
+pref(font.size.inflation.minTwips,200) load 1032450.html
+load 1032613-1.svg
+load 1032613-2.html
+load 1037903.html
+load 1039454-1.html
+load 1042489.html
+load 1054010-1.html
+load 1058954-1.html
+load 1134531.html
+load 1134667.html
+load 1137723-1.html
+load 1137723-2.html
+load 1140268-1.html
+load 1145768.html
+load 1146103.html
+load 1146107.html
+load 1146114.html
+load 1153695.html
+load 1156222.html
+pref(layout.css.grid.enabled,true) load 1156257.html
+load 1157011.html
+load 1169420-1.html
+load 1169420-2.html
+load 1183431.html
+load 1221112-1.html
+load 1221112-2.html
+load 1221874-1.html
+load 1222783.xhtml
+load 1223568-1.html
+load 1223568-2.html
+load 1224230-1.html
+pref(layout.css.grid.enabled,true) load 1225118.html
+pref(layout.css.grid.enabled,true) load 1225376.html
+pref(layout.css.grid.enabled,true) load 1225592.html
+load 1229437-1.html
+load 1229437-2.html
+pref(dom.details_element.enabled,true) load details-containing-only-text.html
+pref(dom.details_element.enabled,true) load details-display-none-summary-1.html
+pref(dom.details_element.enabled,true) load details-display-none-summary-2.html
+pref(dom.details_element.enabled,true) load details-display-none-summary-3.html
+pref(dom.details_element.enabled,true) load details-open-overflow-auto.html
+pref(dom.details_element.enabled,true) load details-open-overflow-hidden.html
+pref(dom.details_element.enabled,true) load details-three-columns.html
+load first-letter-638937-1.html
+load first-letter-638937-2.html
+load flex-nested-abspos-1.html
+pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLine,15) asserts(0-100) load font-inflation-762332.html # bug 762332
+load outline-on-frameset.xhtml
+pref(dom.details_element.enabled,true) load summary-position-out-of-flow.html
+load text-overflow-bug666751-1.html
+load text-overflow-bug666751-2.html
+load text-overflow-bug670564.xhtml
+load text-overflow-bug671796.xhtml
+load text-overflow-bug713610.html
+load text-overflow-form-elements.html
+load text-overflow-iframe.html
+asserts-if(Android,2-4) asserts-if(!Android,4) load 1225005.html # bug 682647 and bug 448083
+load 1233191.html
+asserts(2) load 1272983-1.html # bug 586628
+asserts(2) load 1272983-2.html # bug 586628
+load 1275059.html
+load 1278007.html
+load 1279814.html
+load large-border-radius-dashed.html
+load large-border-radius-dashed2.html
+load large-border-radius-dotted.html
+load large-border-radius-dotted2.html
+load 1297427-non-equal-centers.html
+load 1278461-1.html
+load 1278461-2.html
+load 1304441.html
+load 1316649.html
diff --git a/layout/generic/crashtests/details-containing-only-text.html b/layout/generic/crashtests/details-containing-only-text.html
new file mode 100644
index 000000000..9d5e647d9
--- /dev/null
+++ b/layout/generic/crashtests/details-containing-only-text.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+  <body>
+    <details open>This is the detail.</details>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/details-display-none-summary-1.html b/layout/generic/crashtests/details-display-none-summary-1.html
new file mode 100644
index 000000000..2d7cf57a0
--- /dev/null
+++ b/layout/generic/crashtests/details-display-none-summary-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+  <body>
+    <details open>
+      <summary style="display: none;">summary (display: none)</summary>
+    </details>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/details-display-none-summary-2.html b/layout/generic/crashtests/details-display-none-summary-2.html
new file mode 100644
index 000000000..4db67c0cf
--- /dev/null
+++ b/layout/generic/crashtests/details-display-none-summary-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+  <body>
+    <details open>
+      <summary style="display: none;">summary (display: none)</summary>
+      <p>This is the details.</p>
+    </details>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/details-display-none-summary-3.html b/layout/generic/crashtests/details-display-none-summary-3.html
new file mode 100644
index 000000000..1ba94c74c
--- /dev/null
+++ b/layout/generic/crashtests/details-display-none-summary-3.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+  <body>
+    <details open>
+      <summary style="display: none;">summary (display: none)</summary>
+      <summary>summary 2</summary>
+      <p>This is the details.</p>
+    </details>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/details-open-overflow-auto.html b/layout/generic/crashtests/details-open-overflow-auto.html
new file mode 100644
index 000000000..c9ec19329
--- /dev/null
+++ b/layout/generic/crashtests/details-open-overflow-auto.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+  <style>
+  details {
+    background-color: orange;
+    overflow: auto;
+    width: 300px;
+    height: 200px;
+  }
+  summary {
+    background-color: green;
+    overflow: auto;
+    width: 200px;
+    height: 100px;
+  }
+  </style>
+  <body>
+    <details open>
+      <summary>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do
+        eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad
+        minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip
+        ex ea commodo consequat. Duis aute irure dolor in reprehenderit in
+        voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur
+        sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt
+        mollit anim id est laborum.
+      </summary>
+      Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod
+      tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim
+      veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea
+      commodo consequat. Duis aute irure dolor in reprehenderit in voluptate
+      velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat
+      cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id
+      est laborum.
+    </details>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/details-open-overflow-hidden.html b/layout/generic/crashtests/details-open-overflow-hidden.html
new file mode 100644
index 000000000..5e847ec7f
--- /dev/null
+++ b/layout/generic/crashtests/details-open-overflow-hidden.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+  <style>
+  details {
+    background-color: orange;
+    overflow: hidden;
+    width: 300px;
+    height: 200px;
+  }
+  summary {
+    background-color: green;
+    overflow: hidden;
+    width: 200px;
+    height: 100px;
+  }
+  </style>
+  <body>
+    <details open>
+      <summary>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do
+        eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad
+        minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip
+        ex ea commodo consequat. Duis aute irure dolor in reprehenderit in
+        voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur
+        sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt
+        mollit anim id est laborum.
+      </summary>
+      Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod
+      tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim
+      veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea
+      commodo consequat. Duis aute irure dolor in reprehenderit in voluptate
+      velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat
+      cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id
+      est laborum.
+    </details>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/details-three-columns.html b/layout/generic/crashtests/details-three-columns.html
new file mode 100644
index 000000000..f7ef658f5
--- /dev/null
+++ b/layout/generic/crashtests/details-three-columns.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+  <style>
+  details {
+    -moz-column-count: 3;
+    -moz-column-rule: 1px solid lightgray;
+    -webkit-column-count: 3;
+    -webkit-column-rule: 1px solid lightgray;
+    border: 1px solid lightblue;
+  }
+  summary {
+    background-color: lightgreen;
+  }
+  </style>
+  <body>
+    <details open>
+      <summary>Summary</summary>
+      <p>line</p>
+      <p>line</p>
+      <p>line</p>
+      <p>line</p>
+      <p>line</p>
+      <p>line</p>
+      <p>line</p>
+    </details>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/first-letter-638937-1.html b/layout/generic/crashtests/first-letter-638937-1.html
new file mode 100644
index 000000000..da2a098c7
--- /dev/null
+++ b/layout/generic/crashtests/first-letter-638937-1.html
@@ -0,0 +1,45 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <title>yo-lobo</title>
+    <meta http-equiv="Content-Type" content="application/xhtml+xml; charset=utf-8" />
+    <meta content="werwolf - zoquete pluscuamperfecto" name="author" />
+    <style type="text/css">
+      body {
+        font-family: sans-serif, Arial;
+        -moz-column-count: 5;
+        -moz-column-gap: 1em;
+        padding: 5px;
+      }
+      body.crash {
+        -moz-column-rule-width: thin;
+        -moz-column-rule-style: solid;
+      }
+      p { 
+        margin: 10px;
+        padding: 0px;
+      }
+      p:first-letter { 
+        font-size: 30pt;
+        font-weight: bold;
+        float: left;
+        padding-right: 5px;
+        padding-bottom: 5px;
+      }
+    </style>
+    
+  </head>
+  <body onload="x=document.body; x.className='crash'">
+    <p>Lorem ipsum dolor sit amet consectetuer platea turpis justo Ut interdum. Wisi accumsan Vestibulum tempor vel ut nulla semper platea tincidunt consectetuer. Tristique metus ac nec turpis nibh nunc interdum ut tristique nec. Porttitor nibh sollicitudin urna fames non ultrices ipsum metus pede velit. Adipiscing amet et orci augue vel auctor amet ac Nam.</p>
+    <p>Ornare pellentesque augue leo Sed et In Donec nibh Cum tincidunt. Rutrum vel eget sagittis arcu cursus nibh Nam feugiat lacus lobortis. Suspendisse dictumst at Phasellus eu cursus sem risus dolor adipiscing metus. Lorem et Praesent Nunc Morbi Curabitur id pretium neque quis consequat. Convallis laoreet Integer et et Nulla In et et ut et. Convallis gravida ut tortor odio.</p>
+    <p>Fames pharetra et lacinia a aliquet tempor Vivamus Curabitur Vestibulum Vivamus. Duis Vestibulum nascetur sodales interdum congue a diam Lorem id In. Pede Curabitur interdum vitae nisl nunc est et ac Nulla quis. Sodales metus vitae mauris tellus Curabitur vitae dolor mauris wisi Phasellus. Pellentesque a Ut sem sapien interdum convallis Curabitur purus Aenean.</p>
+    <p>Ultrices pellentesque pretium odio vestibulum natoque natoque gravida Vivamus quis Integer. Ipsum cursus id nec cursus odio amet Vestibulum Suspendisse vitae habitasse. Leo elit eros porta volutpat laoreet commodo elit id egestas et. Curabitur arcu semper dictumst molestie Integer ligula id tellus quis Mauris. Tincidunt eget Sed amet justo porttitor egestas nibh pulvinar mauris justo. Vestibulum natoque eget hendrerit habitasse hendrerit eu purus Proin.</p>
+    <p>Lacinia Integer nec enim sem pellentesque sollicitudin sagittis Cras Sed Morbi. Vitae quis et consectetuer libero metus eros neque malesuada lacus justo. Curabitur ipsum lobortis massa lobortis consequat ut et Fusce quam augue. Laoreet id libero laoreet Curabitur interdum tempus Quisque elit amet purus. Libero sed Phasellus nec odio pede sed ac velit tincidunt id. Metus natoque.</p>
+    <p>Felis et enim at condimentum augue ut vitae In Mauris laoreet. Neque urna Morbi sapien risus nulla leo nec sed ipsum id. Id dictum eu natoque libero ac dapibus Ut sed ut dictum. Sed quis aliquet nunc vestibulum eleifend orci vestibulum Vestibulum Vivamus est. Et urna tempus montes eget Sed tristique.</p>
+    <p>Nibh id mauris ipsum Curabitur Integer velit sed Vivamus Integer laoreet. Eu semper Nulla ac Curabitur Vestibulum ut urna Sed libero In. Phasellus vitae nibh nunc eget Nam iaculis sed Phasellus mauris consectetuer. Amet dignissim natoque eget facilisi Vestibulum facilisis sit scelerisque porta adipiscing. Condimentum vel nec turpis metus est felis neque fames dapibus at. Aenean sed ac.</p>
+    <p>Malesuada hendrerit facilisis et Donec sed pellentesque Nullam est Praesent augue. Pede id orci tincidunt purus Suspendisse Vestibulum sagittis euismod sem porttitor. Lorem a convallis vestibulum condimentum Vestibulum mauris pellentesque consequat metus Vivamus. Consectetuer egestas eu Vestibulum id Morbi interdum montes eros odio Sed. Arcu Donec lacinia mauris vel tortor interdum in habitasse.</p>
+    <p>A scelerisque justo justo Vivamus eleifend velit Nullam orci tortor Nam. Nonummy ut nibh Pellentesque at pede Integer nibh metus justo scelerisque. Tincidunt consequat Curabitur porta non Morbi tincidunt egestas semper pellentesque Vestibulum. Ultrices congue In nec quis et pellentesque at vitae ipsum ridiculus. Elit fringilla ante Aenean elit Sed ut Nam pretium Aenean vel. Eu justo porta mauris congue neque pretium quis enim turpis sit. Auctor.</p>
+    <p>Scelerisque Maecenas Nunc lacinia porttitor fames Pellentesque sed urna Quisque pellentesque. Aenean eget tempus Praesent feugiat sed pretium dignissim In sapien Morbi. Velit mauris Nam Donec sollicitudin at vel mattis vitae amet laoreet. Vel at Nulla id Fusce vel interdum pellentesque Curabitur montes Phasellus. Accumsan interdum est eu ac lacus pellentesque sed Pellentesque.</p>
+</body>
+</html>
diff --git a/layout/generic/crashtests/first-letter-638937-2.html b/layout/generic/crashtests/first-letter-638937-2.html
new file mode 100644
index 000000000..eeece02d1
--- /dev/null
+++ b/layout/generic/crashtests/first-letter-638937-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html style="height: 600em; -moz-column-width: 1px;">
+
+<head>
+<style>p::first-letter { float:left; }</style>
+</head>
+
+<body onload="x=document.body.parentNode; x.style.MozColumnWidth='111px'; x.offsetHeight; x.style.display='inline'; x.offsetHeight; "><p style="margin: -562949953421311em;">y
+</p><p>'</p></body>
+
+</html>
diff --git a/layout/generic/crashtests/flex-nested-abspos-1.html b/layout/generic/crashtests/flex-nested-abspos-1.html
new file mode 100644
index 000000000..53522a36c
--- /dev/null
+++ b/layout/generic/crashtests/flex-nested-abspos-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<div style="display:flex">
+  <div style="position: absolute">
+    <div style="position: absolute">
+    </div>
+  </div>
+</div>
diff --git a/layout/generic/crashtests/font-inflation-762332.html b/layout/generic/crashtests/font-inflation-762332.html
new file mode 100644
index 000000000..e733a56d1
--- /dev/null
+++ b/layout/generic/crashtests/font-inflation-762332.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<div style="-moz-column-width: 1px; font-family: monospace; width: 2ch;"><div style="position: relative;"><div style="position: absolute;">xxxxxxxxxxxxxx x xxxxxxx x xxxxxxxxxxxxxxxxxx x xxxxxxx x</div></div></div>
diff --git a/layout/generic/crashtests/image.jpg b/layout/generic/crashtests/image.jpg
new file mode 100644
index 000000000..8433518bc
--- /dev/null
+++ b/layout/generic/crashtests/image.jpg
diff --git a/layout/generic/crashtests/large-border-radius-dashed.html b/layout/generic/crashtests/large-border-radius-dashed.html
new file mode 100644
index 000000000..a77e3c5d9
--- /dev/null
+++ b/layout/generic/crashtests/large-border-radius-dashed.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="height: 10000000px; width: 10000000px; box-sizing: border-box; border-radius: 10000000px; border-style: dashed; border-width: 10px 20px;"></html>
diff --git a/layout/generic/crashtests/large-border-radius-dashed2.html b/layout/generic/crashtests/large-border-radius-dashed2.html
new file mode 100644
index 000000000..ed6722579
--- /dev/null
+++ b/layout/generic/crashtests/large-border-radius-dashed2.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="height: 6523790304542em; width: 6207636626031em; box-sizing: border-box; border-radius: 6523790304542em; border-style: dashed; border-width: 10px 20px;"></html>
diff --git a/layout/generic/crashtests/large-border-radius-dotted.html b/layout/generic/crashtests/large-border-radius-dotted.html
new file mode 100644
index 000000000..fe530c0c0
--- /dev/null
+++ b/layout/generic/crashtests/large-border-radius-dotted.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="height: 10000000px; width: 10000000px; box-sizing: border-box; border-radius: 10000000px; border-style: dotted; border-width: 10px 20px;"></html>
diff --git a/layout/generic/crashtests/large-border-radius-dotted2.html b/layout/generic/crashtests/large-border-radius-dotted2.html
new file mode 100644
index 000000000..8cd822cf6
--- /dev/null
+++ b/layout/generic/crashtests/large-border-radius-dotted2.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="height: 6523790304542em; width: 6207636626031em; box-sizing: border-box; border-radius: 6523790304542em; border-style: dotted; border-width: 10px 20px;"></html>
diff --git a/layout/generic/crashtests/outline-on-frameset.xhtml b/layout/generic/crashtests/outline-on-frameset.xhtml
new file mode 100644
index 000000000..9f72d10cc
--- /dev/null
+++ b/layout/generic/crashtests/outline-on-frameset.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><frameset style="outline-style: solid;"></frameset></html>
diff --git a/layout/generic/crashtests/simple_blank.swf b/layout/generic/crashtests/simple_blank.swf
new file mode 100644
index 000000000..b846387eb
--- /dev/null
+++ b/layout/generic/crashtests/simple_blank.swf
diff --git a/layout/generic/crashtests/solidblue.png b/layout/generic/crashtests/solidblue.png
new file mode 100644
index 000000000..a64b6a425
--- /dev/null
+++ b/layout/generic/crashtests/solidblue.png
diff --git a/layout/generic/crashtests/summary-position-out-of-flow.html b/layout/generic/crashtests/summary-position-out-of-flow.html
new file mode 100644
index 000000000..2c585fd49
--- /dev/null
+++ b/layout/generic/crashtests/summary-position-out-of-flow.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+   - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+  <head>
+    <style>
+    #fixed {
+      position: fixed;
+      bottom: 0;
+      right: 0;
+    }
+    #absolute {
+      position: absolute;
+      top: 100px;
+      left: 100px;
+    }
+    </style>
+  </head>
+  <body>
+    <details>
+      <summary id="fixed">Summary (position: fixed)</summary>
+      <p>This is the detail with fixed summary.</p>
+    </details>
+    <details>
+      <summary id="absolute">Summary (position: absolute)</summary>
+      <p>This is the detail with absolute summary.</p>
+    </details>
+  </body>
+</html>
diff --git a/layout/generic/crashtests/text-overflow-bug666751-1.html b/layout/generic/crashtests/text-overflow-bug666751-1.html
new file mode 100644
index 000000000..4bfec4e53
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug666751-1.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait"><head><script>
+function finish() {
+  window.removeEventListener("MozAfterPaint", finish, false);
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head><body onload="window.addEventListener('MozAfterPaint', finish, false); document.body.style.backgroundColor='lime';">
+<div style="overflow: scroll;  text-indent: -100px; white-space: pre; text-overflow: ellipsis;"><span style="font-family: -moz-fixed; white-space: normal;"></code><p style="position: fixed;">m
+</p>
+</div>
+
+</body></html>
diff --git a/layout/generic/crashtests/text-overflow-bug666751-2.html b/layout/generic/crashtests/text-overflow-bug666751-2.html
new file mode 100644
index 000000000..3659f009e
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug666751-2.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait"><head><script>
+function finish() {
+  window.removeEventListener("MozAfterPaint", finish, false);
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head><body onload="window.addEventListener('MozAfterPaint', finish, false); document.body.style.backgroundColor='lime';">
+<div style="overflow: scroll;  text-indent: -100px; white-space: pre; text-overflow: ellipsis;"><span style="font-family: -moz-fixed; white-space: normal;"></code><p style="position: absolute;">m
+</p>
+</div>
+
+</body></html>
diff --git a/layout/generic/crashtests/text-overflow-bug670564.xhtml b/layout/generic/crashtests/text-overflow-bug670564.xhtml
new file mode 100644
index 000000000..13ee83631
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug670564.xhtml
@@ -0,0 +1,3 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="position: relative; white-space: pre-line; direction: rtl; top: -85967203400px; text-overflow: ellipsis; text-indent: 5242870ch; padding: 224652170px; overflow-y: scroll; -moz-column-width: 74804px; letter-spacing: 687194767px;">
+
+</html>
diff --git a/layout/generic/crashtests/text-overflow-bug671796.xhtml b/layout/generic/crashtests/text-overflow-bug671796.xhtml
new file mode 100644
index 000000000..47c2eb87e
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug671796.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="width: 1px; text-overflow: ellipsis; overflow-y: scroll;">
+<math xmlns="http://www.w3.org/1998/Math/MathML"><msup style="display:block"/></math>
+</body>
+</html>
diff --git a/layout/generic/crashtests/text-overflow-bug713610.html b/layout/generic/crashtests/text-overflow-bug713610.html
new file mode 100644
index 000000000..145295364
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug713610.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="text-overflow: ellipsis; padding-right: 4000px; overflow: scroll;"><span style="-moz-transform: translatex(-50px); border-right-style: dashed;"></span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/text-overflow-form-elements.html b/layout/generic/crashtests/text-overflow-form-elements.html
new file mode 100644
index 000000000..b10124e4d
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-form-elements.html
@@ -0,0 +1,144 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<title>text-overflow test case</title>
+<style type="text/css">
+
+.test { 
+  font: 1em bold monospace;
+  background:lightgrey;
+  color: black;
+  margin-left:400px;
+}
+
+.rtl {
+  direction:rtl;
+}
+.ltr {
+  direction:ltr;
+}
+.rlo > * {
+  unicode-bidi: bidi-override; direction: rtl;
+}
+.lro > * {
+  unicode-bidi: bidi-override; direction: ltr;
+}
+.b { border: 1px dashed blue; }
+.inline-block {
+  display:inline-block;
+}
+.ellipsis {
+  width:4em;
+  width:6.5ch;
+  text-overflow: ellipsis; 
+  -o-text-overflow: ellipsis; 
+  overflow:hidden;
+}
+</style>
+<script>
+var twoEyes = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGAAAAAYCAYAAAFy7sgCAAAGsUlEQVRo3u2ZbWwcZxHHf3s%2B7LNbO3ZjXBtowprGODRX0qpNQCjmJKuVKhMl1P2AkCwhFOIKkCBSm9IXavGFKAixIAECwkmWo5MrhRI3Ub40IEwQgp6aIDg3Cd6eEqyIHEteah%2B1E69vhw%2BZtTaX8704ZzkKjHS6271nZ56ZZ%2BY%2F%2F%2BdZKF%2FCwYshx3EkkggLsD1v4FQkEZZYLCbAKyG9%2Ba9EIsG6hnUAf8x74K3aUC3j4%2BM54HcsR2oAIomwZOezkv%2FnSHpYNh%2BNCmAE7xv94zvFdd1bHsjMZmQkPSxAJP%2B%2FfuBLwK54PC7JZFKAVJmzXLBt2w%2FMvcDLwIb8QS8CeJ4nkURYIomw7J%2FYJ8BvSiiXptGGxWds2%2Fa9%2Bnaxh%2BYAD%2Bgt04NDgABTpQY2cvvSFLzw86gWeBVwC8SzlOSv2YeBPfmDBoBHgKmR9LBEEmHZfDTqGykqfkUE0nA78BzQGfSgUeP3wNeTXwXg7MwZDhw4UHL6ra2ti79%2FOvljgG8AZ4H64Lhm4MvAocxsRppGG%2FxcXihlwLIs6R%2FfKV2HO%2F26uA94pdDYUKUZUU7W1RQYXA98Gnhaf5%2FXWX0HeAHYoQonqa4sZSOsSWMCWeC9Yko%2BCQwBe4E6oNc0Tc91XTl1%2BaTsn9gnI%2Blhyc5nZWxsrBIkKSbl2tiic3tW53YDEwOKaoFBrcOfqKee53lG9xsPMjV784r%2F4lO%2FpPvyJ9iyZcuvFSaXK5XYeAZ4CDgGvB3MS4B54LQuWYPeuy4iRFsevsXqpuYoqVQKIH2bK1CuDQNo11o4XUzh%2FcDWYIe1LEtyuZx4niee54njOGKapgfsqlL%2Bl2OjEXg8nxrc1dJ0h3hbtL%2BGCtz7KPBF4CuBe9uB15VafE8hr9qylI3HgG8C2%2FK7VyHZoJj7MrBRm30qFotJMpkU27YlHo%2F7Ha5a%2BV%2FKRkSJ4KuKRLVLKapTjB1SzAVIjY2NSXY%2BKyPpYdk%2FsU9OXT4pruv6BdZbBQfKsVGnvWlIe1VB6VQO8JxC1vZYLCbZ%2BaxsPhpdZDyRRFhG0sPiOE6ldKBg2lRg4xF1YCDIIIKN7DGgD3gH%2BBXwejKZfPrs2tPs%2FvPN2bKuYR1nd7xLKBSSJeqoXKnERjPwNWAG%2BLn2rZuM%2B4Tpml6vaWlp4eLcxVusZq5lCgVgOVKJjRqdX86ffL4D5wIoZACnTpw4wRMdT96i%2FImOJxERAs4uVyqxUacF%2FPdiCj%2BjdRBRGFtwXVdG0sPSdbhTmkYbpH98p2RmM2JZlig1vl0GWo4NQ%2Fn%2Bs5pKRXfwjweaxy7TND3HcRZbfC6X8xVPVQlGy7WxVWlO5XRXFXm6EZmrQuSXYyPE3SiVoEhE6Wyr0u2rumO6zv%2B21AFdQAswC1wCMuUCXCmyWQus103Qg8qlDO0lxwOb%2Fl4FiK3AB3VS%2FuKKLtK%2FgbeAnwG%2FvUODuRw%2FFrR0H1UC75fwu8oJ%2FhFsW5VIG%2FBUgEIN6Y65O4AHu4Ap0zQ9y7LEcZyb9lRBUHQcRyzL8unZVBW5bFWAvAp%2BhDQ2g4F47dUYtlU6obXA54DnVdFLekjUGGifh4AFy7LEdV3xj3X9I66m0QZpGm2QrsOd0j%2B%2BU0bSw5KZzYjrun6HWlAd961i4FfCj0aN1Usau%2Bc1lmuXPFwvAEumUut7tQQvAb%2FXb%2FT0bCAej9cODg7yt%2Bm%2F8q2%2F7OUHZ76PnZ1k2p0mJzlykmPancbOTnL0whHs7CQfb%2B5mx2d3sH79%2BtCRI0c6FeaOr9ICrIQfLvA%2B8BGNXxi4R6HrisJVUWrxAVW2oMFf0Aczim8o3kV6enowDIPjF9%2Fk%2BMU3S3rrjzMMg56eHr%2BxP7qKFbASfojG6kpeDGs1tiW53RxwWT%2Bin5q8w4xpQK5evQpAR30H7ZH2khNvj7TTUd8BgD4rqmu1ZKX8qNeY%2BfHz4zlXDgT5E8tpCTUq7XSBC4Euv8227TV9fX1E73%2BYtvo27BmbS9cvFVTY3bSRFza9yOcf6Gfmygy7d%2B%2Fm%2FPnzF4DvrsBLhnJlJfwIKXxv1PheAE4qK6p4H9AGbNKTuhngBPBPXYRe4IemaT5kWZbR19fHNbmGnZ1k4r3U4glDR30Hm5qjbGjsImJEOHbsGHv27JFz5869o0eFq01Jq%2BmHAXwI6FFKagMTgHM7GzFDS%2BoeLSMv7zjzC9x4Y7gxFovVDAwMEI1GaWlpWSzRVCrFwYMH%2FXfxZ4AfAa8B%2F7lDaGg1%2FQgp43lfK0yqtRMuJa3ceKe5DfgYsCYAZ2ngD8CfAkzqTpW7xY%2F%2FSznyX%2FVeUb2kVmX4AAAAAElFTkSuQmCC";
+function initIMG() {
+  var img = document.getElementsByTagName('img');
+  for (i = 0; i < img.length; ++i)
+    img[i].setAttribute('src', twoEyes);
+}
+function setTextOverflow(str,quoted) {
+  var x = document.styleSheets[0];
+  var q = quoted ? '"' : '';
+  x.insertRule('.ellipsis{text-overflow:' + q + str + q +'}', x.cssRules.length);
+}
+</script>
+</head><body onload="initIMG()">
+text-overflow:"<input placeholder="type text then <ENTER>" onchange='setTextOverflow(this.value,1)'>" | <button onclick="setTextOverflow('ellipsis')">ellipsis</button> | <button onclick="setTextOverflow('clip')">clip</button> (Try "." or "" for example) <br>
+
+LTR / LTR
+<div class="test ltr">
+<span class="ellipsis b inline-block">CSS is awesome</span>
+<button class="ellipsis">CSS is awesome</button>
+<input type=button class="ellipsis" value="CSS is awesome">
+<input class="ellipsis" value="CSS is awesome">
+<input class="ellipsis" placeholder="CSS is awesome">
+<fieldset style="display:inline" class="ellipsis"><span style="position:relative;left:1em;">CSS is awesome</span></fieldset>
+<fieldset style="display:block" class="ellipsis"><span style="position:relative;left:1em;">CSS is awesome</span></fieldset>
+<legend class="ellipsis">CSS is awesome</legend>
+<textarea class="ellipsis" style="overflow:scroll;width:14em;" wrap="off">
+CSS is awesome CSS is awesome CSS is awesome
+CSS is awesome CSS is awesome CSS is awesome
+</textarea>
+<fieldset style="display:inline"><legend class="ellipsis">CSS is awesome</legend>CSS is awesome</fieldset>
+<fieldset style="display:block" class="ellipsis"><legend class="ellipsis">CSS is awesome</legend><span style="position:relative;left:1em;">CSS is awesome</span></fieldset>
+<select class="ellipsis"><option>CSS is awesome<option>CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<select><option>CSS is awesome<option class="ellipsis">CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<select size="4"><option>CSS is awesome<option class="ellipsis">CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<ul style="float:left"><li class="ellipsis b">CSS is awesome</ul>
+<br><br></div>
+
+RTL / LTR
+<div class="test rtl">
+<span class="ellipsis b inline-block">CSS is awesome</span>
+<button class="ellipsis">CSS is awesome</button>
+<input type=button class="ellipsis" value="CSS is awesome">
+<input class="ellipsis" value="CSS is awesome">
+<input class="ellipsis" placeholder="CSS is awesome">
+<fieldset style="display:inline" class="ellipsis"><span style="position:relative;right:1em;">CSS is awesome</span></fieldset>
+<fieldset style="display:block" class="ellipsis"><span style="position:relative;right:1em;">CSS is awesome</span></fieldset>
+<legend class="ellipsis">CSS is awesome</legend>
+<textarea class="ellipsis" style="overflow:scroll;width:14em;" wrap="off">
+CSS is awesome CSS is awesome CSS is awesome
+CSS is awesome CSS is awesome CSS is awesome
+</textarea>
+<fieldset style="display:inline"><legend class="ellipsis">CSS is awesome</legend>CSS is awesome</fieldset>
+<fieldset style="display:block" class="ellipsis"><legend class="ellipsis">CSS is awesome</legend><span style="position:relative;right:1em;">CSS is awesome</span></fieldset>
+<select class="ellipsis"><option>CSS is awesome<option>CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<select><option>CSS is awesome<option class="ellipsis">CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<select size="4"><option>CSS is awesome<option class="ellipsis">CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<ul style="float:left"><li class="ellipsis b">CSS is awesome</ul>
+<br><br></div>
+
+LTR / RTL
+<div class="test ltr rlo">
+<span class="ellipsis b inline-block">CSS is awesome</span>
+<button class="ellipsis">CSS is awesome</button>
+<input type=button class="ellipsis" value="CSS is awesome">
+<input class="ellipsis" value="CSS is awesome">
+<input class="ellipsis" placeholder="CSS is awesome">
+<fieldset style="display:inline" class="ellipsis"><span style="position:relative;right:1em;">CSS is awesome</span></fieldset>
+<fieldset style="display:block" class="ellipsis"><span style="position:relative;right:1em;">CSS is awesome</span></fieldset>
+<legend class="ellipsis">CSS is awesome</legend>
+<textarea class="ellipsis" style="overflow:scroll;width:14em;" wrap="off">
+CSS is awesome CSS is awesome CSS is awesome
+CSS is awesome CSS is awesome CSS is awesome
+</textarea>
+<fieldset style="display:inline"><legend class="ellipsis">CSS is awesome</legend>CSS is awesome</fieldset>
+<fieldset style="display:block" class="ellipsis"><legend class="ellipsis">CSS is awesome</legend><span style="position:relative;right:1em;">CSS is awesome</span></fieldset>
+<select class="ellipsis"><option>CSS is awesome<option>CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<select><option>CSS is awesome<option class="ellipsis">CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<select size="4"><option>CSS is awesome<option class="ellipsis">CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<ul style="float:left"><li class="ellipsis b">CSS is awesome</ul>
+<br><br></div>
+
+RTL / RTL
+<div class="test rtl rlo">
+<span class="ellipsis b inline-block">CSS is awesome</span>
+<button class="ellipsis">CSS is awesome</button>
+<input type=button class="ellipsis" value="CSS is awesome">
+<input class="ellipsis" value="CSS is awesome">
+<input class="ellipsis" placeholder="CSS is awesome">
+<fieldset style="display:inline" class="ellipsis"><span style="position:relative;right:1em;">CSS is awesome</span></fieldset>
+<fieldset style="display:block" class="ellipsis"><span style="position:relative;right:1em;">CSS is awesome</span></fieldset>
+<legend class="ellipsis">CSS is awesome</legend>
+<textarea class="ellipsis" style="overflow:scroll;width:14em;" wrap="off">
+CSS is awesome CSS is awesome CSS is awesome
+CSS is awesome CSS is awesome CSS is awesome
+</textarea>
+<fieldset style="display:inline"><legend class="ellipsis">CSS is awesome</legend>CSS is awesome</fieldset>
+<fieldset style="display:block" class="ellipsis"><legend class="ellipsis">CSS is awesome</legend><span style="position:relative;right:1em;">CSS is awesome</span></fieldset>
+<select class="ellipsis"><option>CSS is awesome<option>CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<select><option>CSS is awesome<option class="ellipsis">CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<select size="4"><option>CSS is awesome<option class="ellipsis">CSS is awesome<option>CSS is awesome<option>CSS is awesome</select>
+<ul style="float:left"><li class="ellipsis b">CSS is awesome</ul>
+<br><br></div>
+
+
+
+</body></html>
diff --git a/layout/generic/crashtests/text-overflow-iframe.html b/layout/generic/crashtests/text-overflow-iframe.html
new file mode 100644
index 000000000..ba34dc2aa
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-iframe.html
@@ -0,0 +1,115 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<title>text-overflow: Test 12</title>
+<style type="text/css">
+
+.test { 
+  border: thin dashed black; 
+  overflow: hidden; 
+  white-space: nowrap;
+  -o-text-overflow: ellipsis;
+  text-overflow: ellipsis;
+  font: 1em bold monospace;
+  background:lime;
+  color: black;
+  margin-left:400px;
+  height: 12em;
+  text-shadow: #6374AB 5px -12px 2px;
+}
+
+body {
+  width:800px;
+}
+
+img { width: 50px; height: 50px;   outline:5px dotted yellow; }
+span {
+  font-size:16px;
+  background:pink; 
+  border: 5px dashed blue;
+  padding: 0 25px;
+  text-decoration: underline overline line-through;
+  color:brown;
+  text-shadow: none;
+}
+i {
+  display:inline-block;
+  height: 50px;
+  width: 5em;
+  background: blue;
+  outline:5px dotted yellow;
+  text-shadow: none;
+}
+u {
+ padding-left:140px;
+}
+v {
+ padding-right:140px;
+}
+.rtl {
+  direction:rtl;
+}
+.rlo span {
+  unicode-bidi: bidi-override; direction: rtl;
+}
+.lro span {
+  unicode-bidi: bidi-override; direction: ltr;
+}
+.h {display:none}
+iframe {
+  width: 100px;
+  height: 50px;
+}
+</style>
+<script>
+var c = "data:text/html,<style>body {white-space: nowrap;overflow:hidden;-o-text-overflow: ellipsis;text-overflow: ellipsis;}</style><body bgcolor='magenta'>CSS is awesome"
+function initIFRAME() {
+  var f = document.getElementsByTagName('iframe');
+  for (i = 0; i < f.length; ++i) {
+    f[i].setAttribute('src', c);
+  }
+  setTimeout(function(){document.body.style.width='500px'},0);
+}
+function setTextOverflow(str,quoted) {
+  var x = document.styleSheets[0];
+  var q = quoted ? '"' : '';
+  x.insertRule('.test{text-overflow:' + q + str + q +'}', x.cssRules.length);
+}
+</script>
+</head><body onload="initIFRAME()">
+text-overflow:"<input placeholder="type text then <ENTER>" onchange='setTextOverflow(this.value,1)'>" | <button onclick="setTextOverflow('ellipsis')">ellipsis</button> | <button onclick="setTextOverflow('clip')">clip</button> (Try "." or "" for example) <br>
+
+LTR / LTR
+<div class="test">
+<span><iframe></iframe>CSS is awesome CSS<i>overflowing-inline-block</i><u> is awesome</u></span><br>
+<span>CSS is awe<iframe></iframe>some CSS is awesome <i></i></span><br>
+<span>C SS is awesome<button>BUTTON</button> CSS is <iframe></iframe>awesom e </span><br>
+<span>C&shy;SS is awesome CSS is awesom&shy;e <button>BUTTON</button></span><br>
+<br><br></div>
+
+RTL / LTR
+<div class="test rtl">
+<span><iframe></iframe><v>CSS is awesome CSS</v><i>overflowing-inline-block</i> is awesome </span><br>
+<span>CSS is awe<iframe></iframe>some CSS is awesome <i></i></span><br>
+<span>C SS is awesome<button>BUTTON</button> CSS is <iframe></iframe>awesom e </span><br>
+<span>C&shy;SS is awesome CSS is awesom&shy;e <button>BUTTON</button></span><br>
+<br><br></div>
+
+
+LTR / RTL
+<div class="test rlo">
+<span><iframe></iframe>CSS is awesome CSS<i>overflowing-inline-block</i> is awesome </span><br>
+<span>CSS is awe<iframe></iframe>some CSS is awesome <i></i></span><br>
+<span>C SS is awesome<button>BUTTON</button> CSS is <iframe></iframe>awesom e </span><br>
+<span><button>BUTTON</button>C&shy;SS is awesome CSS is awesom&shy;e </span><br>
+<br><br></div>
+
+RTL / RTL
+<div class="test rtl rlo">
+<span><iframe></iframe>CSS is awesome CSS<i>overflowing-inline-block</i> is awesome </span><br>
+<span>CSS is awe<iframe></iframe>some CSS is awesome <i></i></span><br>
+<span>C SS is awesome<button>BUTTON</button> CSS is <iframe></iframe>awesom e </span><br>
+<span><button>BUTTON</button>C&shy;SS is awesome CSS is awesom&shy;e </span><br>
+<br><br></div>
+
+</body></html>
author	Matt A. Tobin <mattatobin@localhost.localdomain>	2018-02-02 04:16:08 -0500
committer	Matt A. Tobin <mattatobin@localhost.localdomain>	2018-02-02 04:16:08 -0500
commit	5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree	10027f336435511475e392454359edea8e25895d /layout/generic/crashtests
parent	49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
download	UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip