summaryrefslogtreecommitdiffstats
path: root/layout/style/crashtests
diff options
context:
space:
mode:
authorMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
committerMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
commit5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree10027f336435511475e392454359edea8e25895d /layout/style/crashtests
parent49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
downloadUXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
Add m-esr52 at 52.6.0
Diffstat (limited to 'layout/style/crashtests')
-rw-r--r--layout/style/crashtests/1017798-1.css84
-rw-r--r--layout/style/crashtests/1017798-1.html124
-rw-r--r--layout/style/crashtests/1028514-1.html18
-rw-r--r--layout/style/crashtests/105619-1.html33
-rw-r--r--layout/style/crashtests/1066089-1.html21
-rw-r--r--layout/style/crashtests/1074651-1.html4
-rw-r--r--layout/style/crashtests/1089463-1.html20
-rw-r--r--layout/style/crashtests/1135534.html1
-rw-r--r--layout/style/crashtests/1136010-1.html16
-rw-r--r--layout/style/crashtests/1146101-1.html10
-rw-r--r--layout/style/crashtests/1153693-1.html22
-rw-r--r--layout/style/crashtests/1161320-1.html25
-rw-r--r--layout/style/crashtests/1161320-2.html25
-rw-r--r--layout/style/crashtests/1161366-1.html7
-rw-r--r--layout/style/crashtests/1163446-1.html4
-rw-r--r--layout/style/crashtests/1164813-1.html33
-rw-r--r--layout/style/crashtests/1167782-1.html11
-rw-r--r--layout/style/crashtests/1186768-1.xhtml10
-rw-r--r--layout/style/crashtests/1200568-1.html16
-rw-r--r--layout/style/crashtests/1206105-1.html6
-rw-r--r--layout/style/crashtests/1223688-1.html19
-rw-r--r--layout/style/crashtests/1223694-1.html17
-rw-r--r--layout/style/crashtests/1226400-1.html55
-rw-r--r--layout/style/crashtests/1227501-1.html8
-rw-r--r--layout/style/crashtests/1230408-1.html8
-rw-r--r--layout/style/crashtests/1233135-1.html13
-rw-r--r--layout/style/crashtests/1233135-2.html11
-rw-r--r--layout/style/crashtests/1238660-1.html19
-rw-r--r--layout/style/crashtests/1245260-1.html53
-rw-r--r--layout/style/crashtests/1247865-1.html19
-rw-r--r--layout/style/crashtests/1264396-1.html14
-rw-r--r--layout/style/crashtests/1264949.html23
-rw-r--r--layout/style/crashtests/1265611-1.html16
-rw-r--r--layout/style/crashtests/1270795.html15
-rw-r--r--layout/style/crashtests/1275026.html4
-rw-r--r--layout/style/crashtests/1277908-1.html26
-rw-r--r--layout/style/crashtests/1277908-2.html19
-rw-r--r--layout/style/crashtests/1278463-1.html21
-rw-r--r--layout/style/crashtests/1282076-1.html51
-rw-r--r--layout/style/crashtests/1282076-2.html46
-rw-r--r--layout/style/crashtests/1290994-1.html11
-rw-r--r--layout/style/crashtests/1290994-2.html11
-rw-r--r--layout/style/crashtests/1290994-3.html11
-rw-r--r--layout/style/crashtests/1290994-4.html8
-rw-r--r--layout/style/crashtests/1314531.html2
-rw-r--r--layout/style/crashtests/1315889-1.html12
-rw-r--r--layout/style/crashtests/1315894-1.html9
-rw-r--r--layout/style/crashtests/1321357-1.html12
-rw-r--r--layout/style/crashtests/1356601-1.html18
-rw-r--r--layout/style/crashtests/147777-1.html6
-rw-r--r--layout/style/crashtests/187671-1.html12
-rw-r--r--layout/style/crashtests/192408-1.html15
-rw-r--r--layout/style/crashtests/285727-1.html13
-rw-r--r--layout/style/crashtests/286707-1.html2
-rw-r--r--layout/style/crashtests/317561-1.html104
-rw-r--r--layout/style/crashtests/330998-1.html30
-rw-r--r--layout/style/crashtests/363950.html20
-rw-r--r--layout/style/crashtests/368175-1.html14
-rw-r--r--layout/style/crashtests/368740.html25
-rw-r--r--layout/style/crashtests/379788-1.html9
-rw-r--r--layout/style/crashtests/383979-1.xhtml31
-rw-r--r--layout/style/crashtests/383979-2.html36
-rw-r--r--layout/style/crashtests/386939-1.html24
-rw-r--r--layout/style/crashtests/391034-1.xhtml17
-rw-r--r--layout/style/crashtests/397022-1.html17
-rw-r--r--layout/style/crashtests/399289-1.svg3
-rw-r--r--layout/style/crashtests/404470-1.html15
-rw-r--r--layout/style/crashtests/411603-1.html7
-rw-r--r--layout/style/crashtests/412588-1.html5
-rw-r--r--layout/style/crashtests/413274-1.xhtml18
-rw-r--r--layout/style/crashtests/416461-1.xul6
-rw-r--r--layout/style/crashtests/418007-1.xhtml24
-rw-r--r--layout/style/crashtests/431705-1.xul6
-rw-r--r--layout/style/crashtests/432561-1.html17
-rw-r--r--layout/style/crashtests/437170-1.html23
-rw-r--r--layout/style/crashtests/437532-1.html12
-rw-r--r--layout/style/crashtests/439184-1.html31
-rw-r--r--layout/style/crashtests/444237-1.html1
-rw-r--r--layout/style/crashtests/444848-1.html9
-rw-r--r--layout/style/crashtests/447776-1.html7
-rw-r--r--layout/style/crashtests/447783-1.html8
-rw-r--r--layout/style/crashtests/448161-1.html22
-rw-r--r--layout/style/crashtests/448161-2.html9
-rw-r--r--layout/style/crashtests/452150-1.xhtml6
-rw-r--r--layout/style/crashtests/456196.html16
-rw-r--r--layout/style/crashtests/460209-1.html9
-rw-r--r--layout/style/crashtests/460217-1.html15
-rw-r--r--layout/style/crashtests/460323-1.html30
-rw-r--r--layout/style/crashtests/466845-1.html14
-rw-r--r--layout/style/crashtests/469432-1.xhtml8
-rw-r--r--layout/style/crashtests/472195-1.html13
-rw-r--r--layout/style/crashtests/472237-1.html26
-rw-r--r--layout/style/crashtests/473720-1.html15
-rw-r--r--layout/style/crashtests/473892-1.html12
-rw-r--r--layout/style/crashtests/473914-1.html23
-rw-r--r--layout/style/crashtests/474377-1.xhtml18
-rw-r--r--layout/style/crashtests/478321-1.xhtml1
-rw-r--r--layout/style/crashtests/495269-1.html12
-rw-r--r--layout/style/crashtests/495269-2.html12
-rw-r--r--layout/style/crashtests/498036-1.html15
-rw-r--r--layout/style/crashtests/509155-1.html4
-rw-r--r--layout/style/crashtests/509156-1.html5
-rw-r--r--layout/style/crashtests/509569-1.html2
-rw-r--r--layout/style/crashtests/512851-1.xhtml23
-rw-r--r--layout/style/crashtests/524252-1.html10
-rw-r--r--layout/style/crashtests/536789-1.html11
-rw-r--r--layout/style/crashtests/539613-1.xhtml5
-rw-r--r--layout/style/crashtests/558943-1.xhtml11
-rw-r--r--layout/style/crashtests/559491.html29
-rw-r--r--layout/style/crashtests/565248-1.html2
-rw-r--r--layout/style/crashtests/571105-1.xhtml1
-rw-r--r--layout/style/crashtests/573127-1.html20
-rw-r--r--layout/style/crashtests/575464-1.html1
-rw-r--r--layout/style/crashtests/580685.html10
-rw-r--r--layout/style/crashtests/585185-1.html1
-rw-r--r--layout/style/crashtests/588627-1.html4
-rw-r--r--layout/style/crashtests/592698-1.html29
-rw-r--r--layout/style/crashtests/601437-1.html7
-rw-r--r--layout/style/crashtests/601439-1.html8
-rw-r--r--layout/style/crashtests/605689-1.html13
-rw-r--r--layout/style/crashtests/611922-1.html13
-rw-r--r--layout/style/crashtests/621596-1.html18
-rw-r--r--layout/style/crashtests/622314-1.xhtml26
-rw-r--r--layout/style/crashtests/637242.xhtml27
-rw-r--r--layout/style/crashtests/645142.html11
-rw-r--r--layout/style/crashtests/645951-1-ref.html4
-rw-r--r--layout/style/crashtests/645951-1.css1
-rw-r--r--layout/style/crashtests/645951-1.html11
-rw-r--r--layout/style/crashtests/652976-1.svg10
-rw-r--r--layout/style/crashtests/665209-1.html16
-rw-r--r--layout/style/crashtests/671799-1.html6
-rw-r--r--layout/style/crashtests/671799-2.html17
-rw-r--r--layout/style/crashtests/690990-1.html20
-rw-r--r--layout/style/crashtests/696188-1.html20
-rw-r--r--layout/style/crashtests/696869-1.html2
-rw-r--r--layout/style/crashtests/700116.html5
-rw-r--r--layout/style/crashtests/729126-1.html10
-rw-r--r--layout/style/crashtests/729126-2.html10
-rw-r--r--layout/style/crashtests/786108-1.html22
-rw-r--r--layout/style/crashtests/786108-2.html23
-rw-r--r--layout/style/crashtests/788836.html3
-rw-r--r--layout/style/crashtests/806310-1.html4
-rw-r--r--layout/style/crashtests/812824.html1
-rw-r--r--layout/style/crashtests/822766-1.html31
-rw-r--r--layout/style/crashtests/822842.html13
-rw-r--r--layout/style/crashtests/827591-1.html19
-rw-r--r--layout/style/crashtests/829817.html20
-rw-r--r--layout/style/crashtests/840898.html17
-rw-r--r--layout/style/crashtests/842134.html1
-rw-r--r--layout/style/crashtests/861489-1.html29
-rw-r--r--layout/style/crashtests/862113.html16
-rw-r--r--layout/style/crashtests/867487.html24
-rw-r--r--layout/style/crashtests/873222.html17
-rw-r--r--layout/style/crashtests/880862.html28
-rw-r--r--layout/style/crashtests/915440.html4
-rw-r--r--layout/style/crashtests/927734-1.html10
-rw-r--r--layout/style/crashtests/930270-1.html6
-rw-r--r--layout/style/crashtests/930270-2.html9
-rw-r--r--layout/style/crashtests/945048-1.html5
-rw-r--r--layout/style/crashtests/972199-1.html37
-rw-r--r--layout/style/crashtests/989965-1.html9
-rw-r--r--layout/style/crashtests/992333-1.html10
-rw-r--r--layout/style/crashtests/blue-32x32.pngbin0 -> 110 bytes
-rw-r--r--layout/style/crashtests/border-image-visited-link.html10
-rw-r--r--layout/style/crashtests/crashtests.list166
-rw-r--r--layout/style/crashtests/font-face-truncated-src.html2
-rw-r--r--layout/style/crashtests/large_border_image_width.html9
-rw-r--r--layout/style/crashtests/long-url-list-stack-overflow.html23
168 files changed, 2875 insertions, 0 deletions
diff --git a/layout/style/crashtests/1017798-1.css b/layout/style/crashtests/1017798-1.css
new file mode 100644
index 000000000..feb77d9dc
--- /dev/null
+++ b/layout/style/crashtests/1017798-1.css
@@ -0,0 +1,84 @@
+/* ----------------------------------
+ * SWITCHES
+ * ---------------------------------- */
+
+label.pack-switch {
+ display: inline-block;
+ vertical-align: middle;
+ width: 100%;
+ height: 5rem;
+ position: relative;
+ background: none;
+}
+
+label.pack-switch span {
+ float: left;
+ font-size: 1.8rem;
+ color: #333;
+ padding: 1rem 0 0;
+ height: 6rem;
+ line-height: 3rem;
+ box-sizing: border-box;
+ display: block;
+}
+
+label.pack-switch input {
+ margin: 0;
+ opacity: 0;
+ position: absolute;
+ top: 0;
+ left: 0;
+}
+
+label.pack-switch input:checked ~ span:after {
+ background-position: center bottom;
+}
+
+/* ----------------------------------
+ * ON/OFF SWITCHES
+ * ---------------------------------- */
+
+label.pack-switch input ~ span:after {
+ content: '';
+ position: absolute;
+ right: 0;
+ top: 50%;
+ width: 6rem;
+ margin: -1.4rem 0 0;
+ height: 2.7rem;
+ border-radius: 1.35rem;
+ overflow: hidden;
+ background: #e6e6e6 url(images/background_off.png) no-repeat -3.2rem 0 / 9.2rem 2.7rem;
+ transition: background 0.2s ease;
+}
+
+/* switch: 'ON' state */
+label.pack-switch input:checked ~ span:after {
+ background: #e6e6e6 url(images/background.png) no-repeat 0 0 / 9.2rem 2.7rem;
+}
+
+/* switch: disabled state */
+label.pack-switch input:disabled ~ span:after {
+ opacity: 0.4;
+}
+
+label.pack-switch input.uninit ~ span:after {
+ transition: none;
+}
+
+/******************************************************************************
+ * Right-To-Left tweaks
+ */
+html[dir="rtl"] label.pack-switch input {
+ left: auto;
+ right: 0;
+}
+
+html[dir="rtl"] label.pack-switch input ~ span:after {
+ left: 0;
+ right: auto;
+}
+
+html[dir="rtl"] label.pack-switch input ~ span:after {
+ background-position: 0;
+}
diff --git a/layout/style/crashtests/1017798-1.html b/layout/style/crashtests/1017798-1.html
new file mode 100644
index 000000000..097217d18
--- /dev/null
+++ b/layout/style/crashtests/1017798-1.html
@@ -0,0 +1,124 @@
+
+<!DOCTYPE html>
+<!--
+This is a slightly minimised, modified and self-contained version of
+gaia_switch/examples/index.html from the Gaia repository.
+-->
+<script>
+'use strict';
+
+(function(exports) {
+
+ /**
+ * ComponentUtils is a utility which allows us to use web components earlier
+ * than we should be able to by polyfilling and fixing platform deficiencies.
+ */
+ var ComponentUtils = {
+
+ /**
+ * Injects a style.css into both the shadow root and outside the shadow
+ * root so we can style projected content. Bug 992249.
+ */
+ style: function(baseUrl) {
+ var style = document.createElement('style');
+ style.setAttribute('scoped', '');
+ var url = baseUrl + '1017798-1.css';
+ style.innerHTML = '@import url(' + url + ');';
+
+ this.appendChild(style);
+
+ if (!this.shadowRoot) {
+ return;
+ }
+
+ // The setTimeout is necessary to avoid missing @import styles
+ // when appending two stylesheets. Bug 1003294.
+ setTimeout(function nextTick() {
+ this.shadowRoot.appendChild(style.cloneNode(true));
+ }.bind(this));
+ }
+
+ };
+
+ exports.ComponentUtils = ComponentUtils;
+
+}(window));
+</script>
+<script>
+'use strict';
+/* global ComponentUtils */
+
+window.GaiaSwitch = (function(win) {
+ // Extend from the HTMLElement prototype
+ var proto = Object.create(HTMLElement.prototype);
+
+ proto.createdCallback = function() {
+ var shadow = this.createShadowRoot();
+ this._template = template.content.cloneNode(true);
+ this._input = this._template.querySelector('input[type="checkbox"]');
+
+ var checked = this.getAttribute('checked');
+ if (checked !== null) {
+ this._input.checked = true;
+ }
+
+ shadow.appendChild(this._template);
+
+ ComponentUtils.style.call(this, '');
+ };
+
+ /**
+ * Proxy the checked property to the input element.
+ */
+ Object.defineProperty( proto, 'checked', {
+ get: function() {
+ return this._input.checked;
+ },
+ set: function(value) {
+ this._input.checked = value;
+ }
+ });
+
+ /**
+ * Proxy the name property to the input element.
+ */
+ Object.defineProperty( proto, 'name', {
+ get: function() {
+ return this.getAttribute('name');
+ },
+ set: function(value) {
+ this.setAttribute('name', value);
+ }
+ });
+
+ // HACK: Create a <template> in memory at runtime.
+ // When the custom-element is created we clone
+ // this template and inject into the shadow-root.
+ // Prior to this we would have had to copy/paste
+ // the template into the <head> of every app that
+ // wanted to use <gaia-switch>, this would make
+ // markup changes complicated, and could lead to
+ // things getting out of sync. This is a short-term
+ // hack until we can import entire custom-elements
+ // using HTML Imports (bug 877072).
+ var template = document.createElement('template');
+ template.innerHTML = '<label id="switch-label" class="pack-switch">' +
+ '<input type="checkbox">' +
+ '<span><content select="label"></content></span>' +
+ '</label>';
+
+ // Register and return the constructor
+ return document.registerElement('gaia-switch', { prototype: proto });
+})(window);
+</script>
+<body>
+<section>
+ <gaia-switch>
+ <label>With a label</label>
+ </gaia-switch>
+</section>
+<script>
+window.onload = function() {
+ document.querySelector('gaia-switch').checked = true;
+};
+</script>
diff --git a/layout/style/crashtests/1028514-1.html b/layout/style/crashtests/1028514-1.html
new file mode 100644
index 000000000..bbe7f3ba5
--- /dev/null
+++ b/layout/style/crashtests/1028514-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ document.documentElement.style.animation = "137438953471s bounce";
+ document.documentElement.offsetHeight;
+ document.documentElement.style.animationIterationCount = "infinite";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/105619-1.html b/layout/style/crashtests/105619-1.html
new file mode 100644
index 000000000..27746f29a
--- /dev/null
+++ b/layout/style/crashtests/105619-1.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<html>
+<head>
+ <title>International Herald Tribune</title>
+
+ <script type="text/javascript">
+
+ function displayFix() {
+ document.getElementById("bodyNode").style.display = "block";
+ }
+
+ </script>
+ <style type="text/css">
+
+ #clippingsContainer {overflow:auto;}
+ #menuSearch {position:absolute;}
+
+ </style>
+
+</head>
+
+<body id="bodyNode" onload="displayFix()">
+ <div>
+ <div id="menuSearch"><input type="text"></div>
+ <div id="clippingsContainer"></div>
+ </div>
+
+ <table>
+ <tr><td></td><td></td><td></td></tr>
+ <tr><td></td><td></td><td></td></tr>
+ </table>
+
+</body></html>
diff --git a/layout/style/crashtests/1066089-1.html b/layout/style/crashtests/1066089-1.html
new file mode 100644
index 000000000..019a20a7f
--- /dev/null
+++ b/layout/style/crashtests/1066089-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf8">
+<style>
+ @counter-style triangle { symbols: a; }
+ @counter-style disc { system: extends triangle; }
+</style>
+<script>
+ function crash() {
+ var styleNode = document.createElement("style");
+ styleNode.textContent =
+ "@counter-style triangle { symbols: b; } " +
+ "@counter-style disc { system: extends triangle; } " +
+ "ul {}";
+ document.getElementsByTagName("head")[0].appendChild(styleNode);
+ }
+</script>
+</head>
+<body onload="crash()">
+ <ul><li>Don't technically need any text here, but here's some anyway.
diff --git a/layout/style/crashtests/1074651-1.html b/layout/style/crashtests/1074651-1.html
new file mode 100644
index 000000000..b76855cc1
--- /dev/null
+++ b/layout/style/crashtests/1074651-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html style="transition-duration: 500000000000000000ms">
+<body onload="document.documentElement.style.strokeWidth = '17px';"></body>
+</html>
diff --git a/layout/style/crashtests/1089463-1.html b/layout/style/crashtests/1089463-1.html
new file mode 100644
index 000000000..f7a2f5961
--- /dev/null
+++ b/layout/style/crashtests/1089463-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<div></div>
+<script>
+window.onload = function() {
+ var div = document.querySelector("div");
+ var shadow = div.createShadowRoot();
+ shadow.innerHTML = "<p style='display: none'><span><i>x</i></span></p>";
+ var p = shadow.lastChild;
+ var span = p.firstChild;
+ var i = span.firstChild;
+
+ span.style.color = 'blue';
+ p.remove();
+
+ document.body.offsetTop;
+
+ shadow.appendChild(p);
+ i.style.color = 'red';
+};
+</script>
diff --git a/layout/style/crashtests/1135534.html b/layout/style/crashtests/1135534.html
new file mode 100644
index 000000000..920ec9c7b
--- /dev/null
+++ b/layout/style/crashtests/1135534.html
@@ -0,0 +1 @@
+<ruby><rtc style="border-image: url(whatever); border-style: solid;"></ruby>
diff --git a/layout/style/crashtests/1136010-1.html b/layout/style/crashtests/1136010-1.html
new file mode 100644
index 000000000..bdf63f9c0
--- /dev/null
+++ b/layout/style/crashtests/1136010-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<style>
+body { text-transform: uppercase; width: 200px; height: 200px; background-color: white; }
+#a, #b { font-size: 24px; }
+</style>
+<div id=a><div id=b><span>x</span><span>y</span></div></div>
+<script>
+document.body.offsetTop;
+var a = document.getElementById("a");
+var b = document.getElementById("b");
+a.style.fontSize = "24px";
+b.style.fontSize = "24px";
+document.body.offsetTop;
+b.style.fontSize = "36px";
+document.body.offsetTop;
+</script>
diff --git a/layout/style/crashtests/1146101-1.html b/layout/style/crashtests/1146101-1.html
new file mode 100644
index 000000000..e3f8f2aa3
--- /dev/null
+++ b/layout/style/crashtests/1146101-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<script>
+function boom()
+{
+ document.getElementsByTagName("tbody")[0].style.position = "absolute";
+ document.getElementsByTagName("table")[0].style.color = "green";
+}
+</script>
+<body onload="boom();">
+<table><tbody></tbody></table>
diff --git a/layout/style/crashtests/1153693-1.html b/layout/style/crashtests/1153693-1.html
new file mode 100644
index 000000000..8035f1b21
--- /dev/null
+++ b/layout/style/crashtests/1153693-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+
+.a { clip-path: url(z); }
+#x { clip-path: inherit; }
+
+</style>
+</head>
+
+<body>
+ <div class="a">
+ <div class="a" id="x"></div>
+ </div>
+ <script>
+ getComputedStyle(document.getElementById("x"), "").clipPath;
+ </script>
+</body>
+
+</html>
diff --git a/layout/style/crashtests/1161320-1.html b/layout/style/crashtests/1161320-1.html
new file mode 100644
index 000000000..3cb3a7b45
--- /dev/null
+++ b/layout/style/crashtests/1161320-1.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+<meta charset=utf-8>
+<style>
+@keyframes a { }
+body {
+ animation-name: a;
+}
+</style>
+
+<script>
+function boom()
+{
+ var body = document.body;
+ body.style.animationPlayState = 'paused';
+ window.getComputedStyle(body).animationPlayState;
+ body.style.animationPlayState = 'running';
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="setTimeout(boom, 100);"></body>
+</html>
diff --git a/layout/style/crashtests/1161320-2.html b/layout/style/crashtests/1161320-2.html
new file mode 100644
index 000000000..71db694d0
--- /dev/null
+++ b/layout/style/crashtests/1161320-2.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+<meta charset=utf-8>
+<style>
+@keyframes a { }
+body {
+ animation: a 100s;
+}
+</style>
+
+<script>
+function boom()
+{
+ var anim = document.body.getAnimations()[0];
+ anim.finish();
+ anim.pause();
+ anim.play();
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="setTimeout(boom, 100);"></body>
+</html>
diff --git a/layout/style/crashtests/1161366-1.html b/layout/style/crashtests/1161366-1.html
new file mode 100644
index 000000000..d4eacccdc
--- /dev/null
+++ b/layout/style/crashtests/1161366-1.html
@@ -0,0 +1,7 @@
+<script>
+var f = new FontFace("x", "url(x.ttf)", { unicodeRange: "U+0041" });
+f.load();
+document.fonts.add(f);
+f = new FontFace("x", "url(x.ttf)", { unicodeRange: "U+0042" });
+f.load();
+</script>
diff --git a/layout/style/crashtests/1163446-1.html b/layout/style/crashtests/1163446-1.html
new file mode 100644
index 000000000..a3ca0c44d
--- /dev/null
+++ b/layout/style/crashtests/1163446-1.html
@@ -0,0 +1,4 @@
+<script>
+// Will leak with bug 1161413 patches and without bug 1163446 fix.
+new FontFace("x", new ArrayBuffer(0));
+</script>
diff --git a/layout/style/crashtests/1164813-1.html b/layout/style/crashtests/1164813-1.html
new file mode 100644
index 000000000..ee5a60ffd
--- /dev/null
+++ b/layout/style/crashtests/1164813-1.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html class="reftest-wait">
+<style>
+#parent.hidden {
+ display: none;
+}
+.icon {
+ opacity: 0;
+ transition: opacity 0.5s;
+}
+.icon.shrink {
+ animation: shrink 1s;
+}
+@keyframes shrink {
+ to { transform: scale(0); }
+}
+</style>
+<div id="parent">
+ <div class="icon">Searching</div>
+</div>
+<script>
+var icon = document.querySelector('.icon');
+getComputedStyle(icon).opacity;
+icon.style.opacity = 1;
+icon.classList.add('shrink');
+setTimeout(function() {
+ document.getElementById('parent').classList.add('hidden');
+ setTimeout(function() {
+ document.documentElement.removeAttribute('class');
+ }, 500);
+}, 500);
+</script>
+</html>
diff --git a/layout/style/crashtests/1167782-1.html b/layout/style/crashtests/1167782-1.html
new file mode 100644
index 000000000..4b41ea398
--- /dev/null
+++ b/layout/style/crashtests/1167782-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+<html>
+<body>
+<script>
+ var d = window.getComputedStyle(document.body, "::-moz-color-swatch").display;
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1186768-1.xhtml b/layout/style/crashtests/1186768-1.xhtml
new file mode 100644
index 000000000..22608557d
--- /dev/null
+++ b/layout/style/crashtests/1186768-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body>
+ <mfrac xmlns="http://www.w3.org/1998/Math/MathML">
+ <mi>
+ <div xmlns="http://www.w3.org/1999/xhtml" style="font-family: monospace; font-size: 1.17em;"></div>
+ </mi>
+ <mi/>
+ </mfrac>
+ </body>
+</html>
diff --git a/layout/style/crashtests/1200568-1.html b/layout/style/crashtests/1200568-1.html
new file mode 100644
index 000000000..e2dc9c09d
--- /dev/null
+++ b/layout/style/crashtests/1200568-1.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html>
+<head>
+<style>
+.anim { animation: anim 2s infinite linear }
+@keyframes anim { }
+</style>
+</head>
+<body>
+<script>
+var i = document.createElement('i');
+i.setAttribute('class', 'anim');
+getComputedStyle(i).display;
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1206105-1.html b/layout/style/crashtests/1206105-1.html
new file mode 100644
index 000000000..88af39e53
--- /dev/null
+++ b/layout/style/crashtests/1206105-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<title>crashtest, bug 1206105</title>
+<style>
+*:nth-child(-n-2147483647) {}
+</style>
+<body>
diff --git a/layout/style/crashtests/1223688-1.html b/layout/style/crashtests/1223688-1.html
new file mode 100644
index 000000000..70f9d8579
--- /dev/null
+++ b/layout/style/crashtests/1223688-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+ CSS.supports('');
+
+ var style = document.createElement("style");
+ var tn = document.createTextNode("* { border: var(--b); }");
+ style.appendChild(tn);
+ document.body.appendChild(style);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/1223694-1.html b/layout/style/crashtests/1223694-1.html
new file mode 100644
index 000000000..c4589884f
--- /dev/null
+++ b/layout/style/crashtests/1223694-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var sheet = document.createElement("style");
+ sheet.scoped = true;
+ document.documentElement.appendChild(sheet);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/1226400-1.html b/layout/style/crashtests/1226400-1.html
new file mode 100644
index 000000000..dea15642c
--- /dev/null
+++ b/layout/style/crashtests/1226400-1.html
@@ -0,0 +1,55 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>FontFaceSet::Load crasher</title>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+
+<style type="text/css">
+
+body {
+ margin: 50px;
+}
+
+p {
+ margin: 0;
+ font-size: 300%;
+}
+
+</style>
+
+</head>
+<body>
+
+<p>This may crash on load...</p>
+
+<script>
+var scriptText = `
+ var fontFaceSet = document.fonts;
+ var link = document.createElement("link");
+ link.onerror = link.onload = function() {
+ fontFaceSet.load("12px foo");
+ }
+ link.rel = "stylesheet";
+ link.href = "data:text/css,";
+ document.body.appendChild(link);
+`;
+
+var styleText = `
+ @font-face {
+ font-family: foo;
+ src: url("data:text/ttf,");
+ }
+`;
+
+var ifr = document.createElement("iframe");
+document.body.appendChild(ifr);
+var style = ifr.contentDocument.createElement("style");
+style.textContent = styleText;
+ifr.contentDocument.body.appendChild(style);
+var script = ifr.contentDocument.createElement("script");
+script.textContent = scriptText;
+ifr.contentDocument.body.appendChild(script);
+ifr.remove();
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1227501-1.html b/layout/style/crashtests/1227501-1.html
new file mode 100644
index 000000000..03383813d
--- /dev/null
+++ b/layout/style/crashtests/1227501-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+* { will-change: --t; }
+</style>
+</head>
+</html>
diff --git a/layout/style/crashtests/1230408-1.html b/layout/style/crashtests/1230408-1.html
new file mode 100644
index 000000000..0a2588c8a
--- /dev/null
+++ b/layout/style/crashtests/1230408-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<style>
+body { width: 1px; }
+body:first-letter { }
+</style>
+<body>
+<rb>C</rb>
+</body>
diff --git a/layout/style/crashtests/1233135-1.html b/layout/style/crashtests/1233135-1.html
new file mode 100644
index 000000000..58a82f304
--- /dev/null
+++ b/layout/style/crashtests/1233135-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<style>
+ fieldset, input, select {
+ display: ruby;
+ }
+</style>
+<fieldset></fieldset>
+<input type="color">
+<input type="file">
+<input type="number">
+<input type="range">
+<select></select>
+<select size="2"></select>
diff --git a/layout/style/crashtests/1233135-2.html b/layout/style/crashtests/1233135-2.html
new file mode 100644
index 000000000..03e356ae1
--- /dev/null
+++ b/layout/style/crashtests/1233135-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<ruby>
+ <fieldset></fieldset>
+ <input type="color">
+ <input type="file">
+ <input type="number">
+ <input type="range">
+ <select></select>
+ <select size="2"></select>
+ <span style="display: block; overflow: scroll"></span>
+</ruby>
diff --git a/layout/style/crashtests/1238660-1.html b/layout/style/crashtests/1238660-1.html
new file mode 100644
index 000000000..2323d2cfa
--- /dev/null
+++ b/layout/style/crashtests/1238660-1.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<html>
+ <head>
+ <title>Bug 1238660</title>
+ </head>
+ <body>
+ <span>
+ <div>
+ <span></span>
+ </div>
+ </span>
+ <style>
+ span {
+ animation: anim 0.1s 0.1s;
+ }
+ @keyframes anim { to { opacity:1 } }
+ </style>
+ </body>
+</html>
diff --git a/layout/style/crashtests/1245260-1.html b/layout/style/crashtests/1245260-1.html
new file mode 100644
index 000000000..6f2dda995
--- /dev/null
+++ b/layout/style/crashtests/1245260-1.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<html>
+<head lang="en">
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<title>Bug 1245260</title>
+</head>
+<body>
+<style>
+body {
+ color: blue;
+}
+
+div {
+ transition: text-emphasis-color 0.1s;
+}
+
+.hide {
+ display: none;
+}
+
+a {
+ color: red;
+ transition: text-emphasis-color 0.1s;
+}
+
+span {
+ transition: text-emphasis-color 0.1s;
+}
+
+@font-face {
+ font-family: "icon-fonts";
+ src: url(x);
+}
+</style>
+
+<div>
+<span><a>Shows</a></span>
+<span><a>Video</a></span>
+<span><a>Schedule</a></span>
+<span><a>Topics</a></span>
+<span><a>Games</a></span>
+<span><a>Shop</a></span>
+<span><a>This Day In History</a></span>
+<span><a>Ask History</a></span>
+<span><a>History Lists</a></span>
+<span><a>Hungry History</a></span>
+<span><a>Speeches &amp; Audio</a></span>
+<span class="hide"><a>Sign In</a></span>
+<span><a class="hide">Sign Out</a></span>
+</div>
+<script/>
+</body>
+</html>
diff --git a/layout/style/crashtests/1247865-1.html b/layout/style/crashtests/1247865-1.html
new file mode 100644
index 000000000..b7ec8ba60
--- /dev/null
+++ b/layout/style/crashtests/1247865-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ .nav { display: table }
+ .nav:after { content: " " }
+ </style>
+</head>
+<body>
+ <div style="font-size: 1rem"></div>
+ <div class="nav">
+ </div>
+ <script>
+ document.documentElement.style.fontSize = "10px";
+ document.documentElement.offsetHeight;
+ document.documentElement.style.fontSize = "15px";
+ </script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1264396-1.html b/layout/style/crashtests/1264396-1.html
new file mode 100644
index 000000000..abba4de3b
--- /dev/null
+++ b/layout/style/crashtests/1264396-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8" />
+<style>
+@keyframes bug {
+ from {display:none}
+ to {display:inline-block}
+}
+body {
+ animation-name: bug;
+ animation-duration: 1s;
+}
+</style>
+</html>
diff --git a/layout/style/crashtests/1264949.html b/layout/style/crashtests/1264949.html
new file mode 100644
index 000000000..780bff97a
--- /dev/null
+++ b/layout/style/crashtests/1264949.html
@@ -0,0 +1,23 @@
+<!doctype HTML>
+<html>
+ <head>
+ <style>
+ div {
+ background-image: linear-gradient(green, red);
+ background-clip: text;
+ width: 150px;
+ color:transparent;
+ overflow: hidden;
+ opacity:0.5;
+ text-overflow: ellipsis;
+ }
+ </style>
+ </head>
+ <body>
+ <div>
+ <span stype="font-size: 30px;">
+ ALongLongLongLongLongLongLongLongLongLongLongLongString
+ </span>
+ </div>
+ </body>
+</html>
diff --git a/layout/style/crashtests/1265611-1.html b/layout/style/crashtests/1265611-1.html
new file mode 100644
index 000000000..7685ad633
--- /dev/null
+++ b/layout/style/crashtests/1265611-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<!--
+ This test relies on triggering a transition on the 'color' property which,
+ at least when this test was written, would trigger a transition on the
+ -webkit-text-fill-color property since its default value is 'currentcolor'.
+
+ However, in crashtests.list we turn off layout.css.prefixes.webkit so
+ we should not trigger a transition on -webkit-test-fill-color.
+
+ This test exercises some code that, prior to this bug, would fail because we
+ would initially create the transition on -webkit-test-fill-color (because we
+ forgot to check if it was enabled or not) and then we would call other
+ methods that *do* check for the enabled-ness of the property leaving us
+ in an unexpected state.
+-->
+<body style="transition: all 4s" onload="document.body.style.color = 'green';"></body>
diff --git a/layout/style/crashtests/1270795.html b/layout/style/crashtests/1270795.html
new file mode 100644
index 000000000..c4262078e
--- /dev/null
+++ b/layout/style/crashtests/1270795.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+ <body>
+ <table style="background-image: linear-gradient(black, white); background-clip: text;">
+ <tr>
+ <td>Table 1</td>
+ </tr>
+ </table>
+ <table style="background-color: red; background-clip: text;">
+ <tr>
+ <td>Table 2</td>
+ </tr>
+ </table>
+ </body>
+</html> \ No newline at end of file
diff --git a/layout/style/crashtests/1275026.html b/layout/style/crashtests/1275026.html
new file mode 100644
index 000000000..7960d2889
--- /dev/null
+++ b/layout/style/crashtests/1275026.html
@@ -0,0 +1,4 @@
+<!doctype HTML>
+<html style="background: linear-gradient(to right, red, blue); background-clip: text;">
+<body></body>
+</html> \ No newline at end of file
diff --git a/layout/style/crashtests/1277908-1.html b/layout/style/crashtests/1277908-1.html
new file mode 100644
index 000000000..6f9ca3bd0
--- /dev/null
+++ b/layout/style/crashtests/1277908-1.html
@@ -0,0 +1,26 @@
+<script>
+window.onload = function () {
+ var root = document.documentElement; while(root.firstChild) { root.removeChild(root.firstChild); }
+ var a = document.createElementNS("http://www.w3.org/1999/xhtml", "link");
+ a.setAttributeNS(null, "href", "mailto:");
+ root.appendChild(a);
+ var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ var c = document.createElementNS("http://www.w3.org/1999/xhtml", "p");
+ root.appendChild(b);
+ root.animate([{"opacity":1},
+ {"opacity":-64},
+ {"opacity":1024},
+ {"opacity":32},
+ {"opacity":3},
+ {"opacity":1024},
+ {"opacity":0.19310025712314532},
+ {"opacity":512}],
+ {"duration":1,"fill":"backwards"});
+ a.style.maskType = "alpha, luminance";
+ c.animate({}, 1);
+ root.style.position = "fixed";
+ b.getAnimations();
+ a.style.MozPerspectiveOrigin = "1rem bottom";
+ root.style.position = "static";
+};
+</script>
diff --git a/layout/style/crashtests/1277908-2.html b/layout/style/crashtests/1277908-2.html
new file mode 100644
index 000000000..4c5266826
--- /dev/null
+++ b/layout/style/crashtests/1277908-2.html
@@ -0,0 +1,19 @@
+<script>
+function start() {
+ o28=document.createElement('a');
+ o28.href='javascript:x()';
+ o115=document.createElement('tr');
+ o116=document.createElement('th');
+ o116.innerHTML="<style>{}\n*{ display: table;> </style><style>@keyframes key8 { from{ left; background-position-x: 128vw}to{}label}\n*{ animation-name: key8; animation-duration: 0.001s";
+ document.documentElement.appendChild(o28);
+ document.documentElement.appendChild(o115);
+ document.documentElement.appendChild(o116);
+ o213=document.createElement('input');
+ o115.appendChild(o213);
+ o216=document.createElement('style');
+ o217=document.createTextNode("*{ text-shadow: 196608rem -3px");
+ o216.appendChild(o217);
+ o213.appendChild(o216);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1278463-1.html b/layout/style/crashtests/1278463-1.html
new file mode 100644
index 000000000..da3b976d8
--- /dev/null
+++ b/layout/style/crashtests/1278463-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+ @keyframes c {
+ 50% {
+ stroke-dasharray: context-value;
+ }
+ }
+
+ div {
+ animation-name: c;
+ }
+
+</style>
+</head>
+<body>
+<div></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/1282076-1.html b/layout/style/crashtests/1282076-1.html
new file mode 100644
index 000000000..d5d1f0c74
--- /dev/null
+++ b/layout/style/crashtests/1282076-1.html
@@ -0,0 +1,51 @@
+<script>
+function start() {
+ o0=document;
+ o24=document.createElement('table');
+ o35=window;
+ o60=document.createElement('input');
+ o24.appendChild(o60);
+ o62=document.body;
+ o66=document.createElement('input');
+ o62.appendChild(o66);
+ o60.innerHTML="<svg><color-profile><script><rect><animateColor><style><style>*{ all: unset<script><style>div<style>";
+ o93=o60.querySelectorAll('*')[5];
+ o97=o60.querySelectorAll('*')[9];
+ document.body.appendChild(o24);
+ o305=document.createTextNode("{}:first-line{");
+ o93.appendChild(o305);
+ o318=(new DOMParser()).parseFromString('','text/html');
+ o320=o318.all[1];
+ o355=document.createElement('style');
+ o356=document.createTextNode("@keyframes key2{ from{ opacity: 0}}#id2{ animation-name: key2; animation-duration: 0.01s");
+ o355.appendChild(o356);
+ o97.appendChild(o355);
+ o66.style.display='list-item';
+ o473=document.createElement('script');
+ o24.appendChild(o473);
+ o577=document.createElement('style');
+ o320.appendChild(o577);
+ o577.style.position='fixed';
+ document.replaceChild(o318.documentElement,document.documentElement);
+ o908=(new DOMParser()).parseFromString('','text/html');
+ o911=o908.all[2];
+ o911.style.display='inline';
+ o577.id='id2';
+ o1202=document.createElement('table');
+ document.body=o911;
+ document.body.appendChild(o1202);
+ document.replaceChild(o0.documentElement,document.documentElement);
+ o1232=o473.parentNode;
+ o1233=o1232.parentNode;
+ document.body=o1233;
+ o35.scrollByLines(1);
+ o577.style.position='absolute';
+ setTimeout(f2, 4);
+}
+
+function f2() {
+ o0.designMode='on';
+ o0.execCommand('insertparagraph',false,null);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1282076-2.html b/layout/style/crashtests/1282076-2.html
new file mode 100644
index 000000000..1c6f98639
--- /dev/null
+++ b/layout/style/crashtests/1282076-2.html
@@ -0,0 +1,46 @@
+<script>
+function start() {
+ o0=document;
+ o24=document.createElement('table');
+ o35=window;
+ o60=document.createElement('input');
+ o24.appendChild(o60);
+ o62=document.body;
+ o66=document.createElement('input');
+ o62.appendChild(o66);
+ o60.innerHTML="<svg><color-profile><script><rect><animateColor><style><style>*{ all: unset<script>";
+ o93=o60.querySelectorAll('*')[5];
+ document.body.appendChild(o24);
+ o305=document.createTextNode("{}:first-line{");
+ o93.appendChild(o305);
+ o318=(new DOMParser()).parseFromString('','text/html');
+ o320=o318.all[1];
+ o66.style.display='list-item';
+ o473=document.createElement('script');
+ o24.appendChild(o473);
+ o577=document.createElement('style');
+ o320.appendChild(o577);
+ o577.style.position='fixed';
+ document.replaceChild(o318.documentElement,document.documentElement);
+ o908=(new DOMParser()).parseFromString('','text/html');
+ o911=o908.all[2];
+ o911.style.display='inline';
+ o577.animate({ opacity: [0, 1] }, 100);
+ o1202=document.createElement('table');
+ document.body=o911;
+ document.body.appendChild(o1202);
+ document.replaceChild(o0.documentElement,document.documentElement);
+ o1232=o473.parentNode;
+ o1233=o1232.parentNode;
+ document.body=o1233;
+ o35.scrollByLines(1);
+ o577.style.position='absolute';
+ setTimeout(f2, 4);
+}
+
+function f2() {
+ o0.designMode='on';
+ o0.execCommand('insertparagraph',false,null);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1290994-1.html b/layout/style/crashtests/1290994-1.html
new file mode 100644
index 000000000..d9d99a5b0
--- /dev/null
+++ b/layout/style/crashtests/1290994-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+ var a = document.createElement("div");
+ document.documentElement.appendChild(a);
+ a.animate([{borderLeftColor:"black"},
+ {borderLeftColor:"hsl(0,0e309%,0%)"}]);
+};
+</script>
+</html>
diff --git a/layout/style/crashtests/1290994-2.html b/layout/style/crashtests/1290994-2.html
new file mode 100644
index 000000000..e592b84ee
--- /dev/null
+++ b/layout/style/crashtests/1290994-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+ var a = document.createElement("div");
+ document.documentElement.appendChild(a);
+ a.animate([{color:"rgb(0,0,0)"},
+ {color:"rgb(0e309%,0%,0%)"}]);
+};
+</script>
+</html>
diff --git a/layout/style/crashtests/1290994-3.html b/layout/style/crashtests/1290994-3.html
new file mode 100644
index 000000000..76589f5a6
--- /dev/null
+++ b/layout/style/crashtests/1290994-3.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+ var a = document.createElement("div");
+ document.documentElement.appendChild(a);
+ a.animate([{background: "-webkit-gradient(radial, 1 2, 8, 3 4, 9, from(lime))"},
+ {background: "-webkit-gradient(radial, 0e309 2, 8, 3 4, 9, from(lime))"}]);
+};
+</script>
+</html>
diff --git a/layout/style/crashtests/1290994-4.html b/layout/style/crashtests/1290994-4.html
new file mode 100644
index 000000000..4278856d0
--- /dev/null
+++ b/layout/style/crashtests/1290994-4.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<style>
+@keyframes anim {
+ 0e309% {}
+}
+</style>
+</html>
diff --git a/layout/style/crashtests/1314531.html b/layout/style/crashtests/1314531.html
new file mode 100644
index 000000000..8e804643f
--- /dev/null
+++ b/layout/style/crashtests/1314531.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<style>::-moz-tree-row:hover {}</style>
diff --git a/layout/style/crashtests/1315889-1.html b/layout/style/crashtests/1315889-1.html
new file mode 100644
index 000000000..29186fac1
--- /dev/null
+++ b/layout/style/crashtests/1315889-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<style>
+.x { color: blue; }
+</style>
+<div class=x>hello</div>
+<script>
+document.body.offsetWidth;
+var x = document.querySelector(".x");
+x.className = "";
+x.remove();
+document.body.offsetWidth;
+</script>
diff --git a/layout/style/crashtests/1315894-1.html b/layout/style/crashtests/1315894-1.html
new file mode 100644
index 000000000..e0192460f
--- /dev/null
+++ b/layout/style/crashtests/1315894-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<div style="display: none"><span>x</span></div>
+<script>
+document.body.offsetWidth;
+document.querySelector("div").style.display = "inline";
+document.body.offsetWidth;
+document.querySelector("span").style.color = "blue";
+document.body.offsetWidth;
+</script>
diff --git a/layout/style/crashtests/1321357-1.html b/layout/style/crashtests/1321357-1.html
new file mode 100644
index 000000000..7b3a3c39c
--- /dev/null
+++ b/layout/style/crashtests/1321357-1.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html>
+<body onload="document.getElementById('containerA').pauseAnimations()">
+ <svg id="containerA">
+ <animate id="ia" end="50s"></animate>
+ <animate begin="60s" end="ic.end"></animate>
+ </svg>
+ <svg>
+ <animate id="ic" end="ia.end"></animate>
+ </svg>
+</body>
+</html>
diff --git a/layout/style/crashtests/1356601-1.html b/layout/style/crashtests/1356601-1.html
new file mode 100644
index 000000000..4fc28bd58
--- /dev/null
+++ b/layout/style/crashtests/1356601-1.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<html>
+<style>
+div::first-line {
+ --bar: left;
+}
+span {
+ animation: var(--bar) 5s infinite alternate;
+}
+@keyframes left {
+ from {left: 0;}
+ to {left: 30px;}
+}
+</style>
+<div>
+ <span>Crash</span>
+</div>
+</html>
diff --git a/layout/style/crashtests/147777-1.html b/layout/style/crashtests/147777-1.html
new file mode 100644
index 000000000..2500fae9f
--- /dev/null
+++ b/layout/style/crashtests/147777-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<title>crashtest for NS_ABORT_IF_FALSE during development of 147777</title>
+<style type="text/css">
+:link::before { content: "link: " }
+</style>
+<a href="http://www.example.com/">example</a>
diff --git a/layout/style/crashtests/187671-1.html b/layout/style/crashtests/187671-1.html
new file mode 100644
index 000000000..7395c23b4
--- /dev/null
+++ b/layout/style/crashtests/187671-1.html
@@ -0,0 +1,12 @@
+<a href="http://mozillazine.org/">Link text</a>
+
+<SPAN><p>Paragraph text</p></span>
+
+
+
+<!-- The styles have to be after the content. (In the original, the styles were loaded using javascript, with the style sheet loaded depending on the browser.) -->
+
+<style>
+a {font-size: 13px }
+span {position: relative;}
+</style>
diff --git a/layout/style/crashtests/192408-1.html b/layout/style/crashtests/192408-1.html
new file mode 100644
index 000000000..bb75e4401
--- /dev/null
+++ b/layout/style/crashtests/192408-1.html
@@ -0,0 +1,15 @@
+<html>
+ <head>
+ <title>bug 192408</title>
+ </head>
+ <body>
+ <span>
+ <embed src="foo.mid"></embed>
+ <script>
+ document;
+ </script>
+ <center></center>
+ <script src="bar.js"></script>
+ </span>
+ </body>
+</html>
diff --git a/layout/style/crashtests/285727-1.html b/layout/style/crashtests/285727-1.html
new file mode 100644
index 000000000..db1d28d8d
--- /dev/null
+++ b/layout/style/crashtests/285727-1.html
@@ -0,0 +1,13 @@
+<BODY STYLE="display:table-row;">
+<SPAN>
+1
+</SPAN>
+<FORM>
+<DIV STYLE="float:left;">
+1
+<FONT>
+1
+</FONT>
+</DIV>
+</FORM>
+</BODY>
diff --git a/layout/style/crashtests/286707-1.html b/layout/style/crashtests/286707-1.html
new file mode 100644
index 000000000..7485a9644
--- /dev/null
+++ b/layout/style/crashtests/286707-1.html
@@ -0,0 +1,2 @@
+<html><body><p style="font-size:1px">hi<sup>1
+
diff --git a/layout/style/crashtests/317561-1.html b/layout/style/crashtests/317561-1.html
new file mode 100644
index 000000000..01335a17c
--- /dev/null
+++ b/layout/style/crashtests/317561-1.html
@@ -0,0 +1,104 @@
+<!doctype html>
+<html>
+<head>
+<style type="text/css">
+div:not([id^='img']) {
+ height: 20px; width: 20px; border: 1px solid #000;
+}
+#img1 {position:absolute; left:180px; top:17px;}
+#img2 {position:absolute; left:-72px; top:58px;}
+#img3 {position:absolute; left:2px; top:0px;}
+#img4 {position:absolute; left:25px; top:-3px;}
+#img5 {position:absolute; left:1px; top:-3px;}
+#img6 {position:absolute; left:27px; top:-1px;}
+#img7 {position:absolute; left:41px; top:14px;}
+#img8 {position:absolute; left:17px; top:3px;}
+#img9 {position:absolute; left:50px; top:42px;}
+#img11 {position:absolute; left:-265px; top:113px;}
+#img12 {position:absolute; left:25px; top:-57px;}
+#img13 {position:absolute; left:17px; top:-4px;}
+#img14 {position:absolute; left:8px; top:-13px;}
+#img15 {position:absolute; left:38px; top:0px;}
+#img16 {position:absolute; left:37px; top:8px;}
+#img17 {position:absolute; left:11px; top:12px;}
+#img18 {position:absolute; left:4px; top:12px;}
+#img19 {position:absolute; left:-7px; top:13px;}
+#img20 {position:absolute; left:17px; top:13px;}
+#img21 {position:absolute; left:7px; top:12px;}
+#img22 {position:absolute; left:32px; top:6px;}
+#img23 {position:absolute; left:20px; top:10px;}
+#img24 {position:absolute; left:22px; top:10px;}
+#img25 {position:absolute; left:81px; top:-27px;}
+#img26 {position:absolute; left:9px; top:-19px;}
+#img27 {position:absolute; left:0px; top:-15px;}
+#img28 {position:absolute; left:19px; top:63px;}
+#img29 {position:absolute; left:-68px; top:0px;}
+#img32 {position:absolute; left:42px; top:121px;}
+#img33 {position:absolute; left:21px; top:1px;}
+#img34 {position:absolute; left:29px; top:2px;}
+#img35 {position:absolute; left:25px; top:1px;}
+#img36 {position:absolute; left:-115px; top:16px;}
+#img37 {position:absolute; left:11px; top:-8px;}
+#img38 {position:absolute; left:-16px; top:-15px;}
+#img39 {position:absolute; left:-18px; top:-1px;}
+#img40 {position:absolute; left:-28px; top:-8px;}
+#img41 {position:absolute; left:-6px; top:-6px;}
+#img42 {position:absolute; left:-19px; top:-12px;}
+#img43 {position:absolute; left:-26px; top:-9px;}
+#img44 {position:absolute; left:1px; top:-23px;}
+#img45 {position:absolute; left:-10px; top:-22px;}
+#img46 {position:absolute; left:-59px; top:-39px;}
+#img47 {position:absolute; left:-28px; top:0px;}
+#img48 {position:absolute; left:-13px; top:4px;}
+#img49 {position:absolute; left:-21px; top:4px;}
+</style>
+</head>
+<body>
+<div id="img1"><div></div>
+<div id="img2"><div></div>
+<div id="img3"><div></div>
+<div id="img4"><div></div>
+<div id="img5"><div></div>
+<div id="img6"><div></div>
+<div id="img7"><div></div>
+<div id="img8"><div></div>
+<div id="img9"><div></div>
+<div id="img11"><div></div>
+<div id="img12"><div></div>
+<div id="img13"><div></div>
+<div id="img14"><div></div>
+<div id="img15"><div></div>
+<div id="img16"><div></div>
+<div id="img17"><div></div>
+<div id="img18"><div></div>
+<div id="img19"><div></div>
+<div id="img20"><div></div>
+<div id="img21"><div></div>
+<div id="img22"><div></div>
+<div id="img23"><div></div>
+<div id="img24"><div></div>
+<div id="img25"><div></div>
+<div id="img26"><div></div>
+<div id="img27"><div></div>
+<div id="img28"><div></div>
+<div id="img29"><div></div>
+<div id="img32"><div></div>
+<div id="img33"><div></div>
+<div id="img34"><div></div>
+<div id="img35"><div></div>
+<div id="img36"><div></div>
+<div id="img37"><div></div>
+<div id="img38"><div></div>
+<div id="img39"><div></div>
+<div id="img40"><div></div>
+<div id="img41"><div></div>
+<div id="img42"><div></div>
+<div id="img43"><div></div>
+<div id="img44"><div></div>
+<div id="img45"><div></div>
+<div id="img46"><div></div>
+<div id="img47"><div></div>
+<div id="img48"><div></div>
+<div id="img49"><div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/330998-1.html b/layout/style/crashtests/330998-1.html
new file mode 100644
index 000000000..46522094e
--- /dev/null
+++ b/layout/style/crashtests/330998-1.html
@@ -0,0 +1,30 @@
+<html>
+
+<head>
+
+<script>
+
+function init()
+{
+ var form1 = document.getElementById("form1");
+ var tr1 = document.getElementById("tr1");
+
+ tr1.appendChild(form1);
+ tr1.removeChild(form1);
+}
+
+window.addEventListener("load", init, false);
+
+</script>
+
+</head>
+
+<body>
+
+<table><tr id="tr1"><td></td></tr></table>
+
+<form id="form1"><span style="float:left"></span></form>
+
+</body>
+
+</html>
diff --git a/layout/style/crashtests/363950.html b/layout/style/crashtests/363950.html
new file mode 100644
index 000000000..46bfb2f9c
--- /dev/null
+++ b/layout/style/crashtests/363950.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<title>Testcase bug 363950 - crash [@ nsComputedDOMStyle::GetMarginWidthCoordFor]</title>
+</head>
+<body>
+This page should not crash Mozilla
+<script>
+var properties = ['margin-left','margin-right','margin-top','padding-bottom','padding-left','padding-right','padding-top'];
+
+function removestyles(i, j){
+if (j>=properties.length)
+ j = 0;
+document.defaultView.getComputedStyle(document.getElementsByTagName('head')[0], null).getPropertyValue(properties[j]);
+j++;
+setTimeout(removestyles,50,j);
+}
+setTimeout(removestyles,500,0,0);
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/368175-1.html b/layout/style/crashtests/368175-1.html
new file mode 100644
index 000000000..c7eeddf8c
--- /dev/null
+++ b/layout/style/crashtests/368175-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8">
+</head>
+<body>
+<div style="width: 300px; height: 200px; overflow: auto">
+ <div style='direction: rtl; -moz-column-width:1em; -moz-column-gap:1em; width: 500px;'>
+ <p>滾滾長江東逝水,浪花淘盡英雄。是非成敗轉頭空:青山依舊在,幾度夕陽紅。</p>
+ <p style='direction: rtl; -moz-column-width:1em; -moz-column-gap:1em;'>
+ 滾滾長江東逝水,浪花淘盡英雄。是非成敗轉頭空:青山依舊在,幾度夕陽紅。</p>
+ </div>
+</div>
+</body>
+</html>
diff --git a/layout/style/crashtests/368740.html b/layout/style/crashtests/368740.html
new file mode 100644
index 000000000..ed315dd44
--- /dev/null
+++ b/layout/style/crashtests/368740.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<title>Testcase bug - Crash [@ nsIFrame::IsThemed] when trying to get the computed style of a button in iframe</title>
+
+<style>
+iframe {
+width: 800px;
+height: 400px;
+}
+</style>
+</head>
+<body>
+This page should not crash Mozilla<br>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%0A%3Cbutton%3E%3C/button%3E%0A%3C/body%3E%3C/html%3E"></iframe>
+
+<script>
+function getComputedStyles(){
+var x=document.getElementById('content').contentDocument.getElementsByTagName('button')[0];
+var style = document.defaultView.getComputedStyle(x, null).getPropertyValue('border-left-width');
+}
+setTimeout(getComputedStyles,300);
+</script>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/style/crashtests/379788-1.html b/layout/style/crashtests/379788-1.html
new file mode 100644
index 000000000..40e38a7cc
--- /dev/null
+++ b/layout/style/crashtests/379788-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('p2').style.position = 'fixed';">
+
+<p style="right: 1em; bottom: 1em; position: fixed;">Foo</p>
+<p id="p2">Bar</p>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/383979-1.xhtml b/layout/style/crashtests/383979-1.xhtml
new file mode 100644
index 000000000..9a3f8e673
--- /dev/null
+++ b/layout/style/crashtests/383979-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("div1").appendChild(document.getElementById("div2"));
+}
+
+</script>
+
+<style type="text/css">
+
+#s1, #s2 {
+ font: 8pt arial;
+}
+
+#div1 #s1, #div1 #s2 {
+ font-size: 20pt;
+}
+
+</style>
+</head>
+
+<body onload="boom();">
+
+<div id="div1"></div>
+<div id="div2"><span id="s1"><span id="s2">foo</span></span></div>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/383979-2.html b/layout/style/crashtests/383979-2.html
new file mode 100644
index 000000000..06f900e12
--- /dev/null
+++ b/layout/style/crashtests/383979-2.html
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function run()
+{
+ var a = getComputedStyle(document.getElementById("s1"), "").listStyleType;
+ var b = getComputedStyle(document.getElementById("s3"), "").listStyleType;
+}
+
+</script>
+
+<style type="text/css">
+
+body { display: none } /* so we control the order of the ComputeListData calls */
+
+#s1, #s2, #s3 {
+ -moz-image-region: auto;
+ list-style-image: none;
+ list-style-position: outside;
+ list-style-type: disc;
+}
+
+#s2, #s3 {
+ list-style-type: disc;
+}
+
+</style>
+</head>
+
+<body onload="run();">
+
+<div id="s1"><div id="s2"><div id="s3"></div></div></div>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/386939-1.html b/layout/style/crashtests/386939-1.html
new file mode 100644
index 000000000..679d2b27e
--- /dev/null
+++ b/layout/style/crashtests/386939-1.html
@@ -0,0 +1,24 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function rM(n)
+{
+ n.parentNode.removeChild(n);
+}
+
+function boom()
+{
+ rM(document.getElementById("f1"));
+ rM(document.getElementById("f2"));
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<frameset rows="170,*" onload="setTimeout(boom, 30);">
+<frame src="data:text/html,frame1" id="f1">
+<frame src="data:text/html,frame2" id="f2">
+</frameset>
+
+</html>
diff --git a/layout/style/crashtests/391034-1.xhtml b/layout/style/crashtests/391034-1.xhtml
new file mode 100644
index 000000000..315796d28
--- /dev/null
+++ b/layout/style/crashtests/391034-1.xhtml
@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+ var p = document.getElementById("p");
+ window.getComputedStyle(p, null).getPropertyValue("right");
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<p id="p" style="position: relative; left: 3ch;">foo</p>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/397022-1.html b/layout/style/crashtests/397022-1.html
new file mode 100644
index 000000000..ececc3fa5
--- /dev/null
+++ b/layout/style/crashtests/397022-1.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<style>
+
+div:before { content: counter(c); }
+
+.b:before { content: "x"; }
+
+</style>
+</head>
+
+<body onload="document.getElementById('v').setAttribute('class', 'b');">
+
+<div id="v"></div>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/399289-1.svg b/layout/style/crashtests/399289-1.svg
new file mode 100644
index 000000000..583de2c24
--- /dev/null
+++ b/layout/style/crashtests/399289-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="url(#x)">
+ <rect fill="url(#y)" />
+</svg>
diff --git a/layout/style/crashtests/404470-1.html b/layout/style/crashtests/404470-1.html
new file mode 100644
index 000000000..481ba4233
--- /dev/null
+++ b/layout/style/crashtests/404470-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var iframe = document.createElement("iframe");
+ document.body.appendChild(iframe);
+ iframe.setAttribute("src", 'data:application/vnd.mozilla.xul+xml,<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><script>window.parent.document.body.style.display="inline"; window.parent.document.body.offsetWidth;</' + 'script></window>');
+}
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/411603-1.html b/layout/style/crashtests/411603-1.html
new file mode 100644
index 000000000..596565fbc
--- /dev/null
+++ b/layout/style/crashtests/411603-1.html
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+<body onload="document.getElementById('ms').setAttribute('scriptminsize', '9em');">
+<math:mstyle id="ms" /><span />
+</body>
+</html>
diff --git a/layout/style/crashtests/412588-1.html b/layout/style/crashtests/412588-1.html
new file mode 100644
index 000000000..561aed564
--- /dev/null
+++ b/layout/style/crashtests/412588-1.html
@@ -0,0 +1,5 @@
+<html><head>
+<link rel="stylesheet" href="data:text/css;charset=utf-8,@media%20print%20%7B%7B%7D%0Aa%20%7B%20%7D%0Aa%7Bfont-size%3A%20200%25%3B%7D" type="text/css">
+<style>
+</style>
+</head><body></body></html> \ No newline at end of file
diff --git a/layout/style/crashtests/413274-1.xhtml b/layout/style/crashtests/413274-1.xhtml
new file mode 100644
index 000000000..19d8fab0f
--- /dev/null
+++ b/layout/style/crashtests/413274-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+ <mstyle scriptsizemultiplier="8205" scriptlevel="15">
+ <mroot>
+ <mrow/>
+ <mrow>
+ <span xmlns="http://www.w3.org/1999/xhtml"/>
+ </mrow>
+ </mroot>
+ </mstyle>
+</math>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/416461-1.xul b/layout/style/crashtests/416461-1.xul
new file mode 100644
index 000000000..1986cda91
--- /dev/null
+++ b/layout/style/crashtests/416461-1.xul
@@ -0,0 +1,6 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <wizard>
+ <msqrt xmlns="http://www.w3.org/1998/Math/MathML"/>
+ </wizard>
+ <menupopup style="display: inline; -moz-box-ordinal-group: 2147483646;"/>
+</window> \ No newline at end of file
diff --git a/layout/style/crashtests/418007-1.xhtml b/layout/style/crashtests/418007-1.xhtml
new file mode 100644
index 000000000..f07a69344
--- /dev/null
+++ b/layout/style/crashtests/418007-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+ <ms fontsize="8179em">
+ <span xmlns="http://www.w3.org/1999/xhtml">
+ <span>
+ <td>
+ <mfrac xmlns="http://www.w3.org/1998/Math/MathML">
+ <mfrac>
+ <mrow/>
+ <mrow/>
+ </mfrac>
+ <mrow/>
+ </mfrac>
+ </td>
+ </span>
+ </span>
+ </ms>
+</math>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/431705-1.xul b/layout/style/crashtests/431705-1.xul
new file mode 100644
index 000000000..8b64d4b3b
--- /dev/null
+++ b/layout/style/crashtests/431705-1.xul
@@ -0,0 +1,6 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <span xmlns="http://www.w3.org/1999/xhtml" style="-moz-box-ordinal-group: 2;">
+ <mtext xmlns="http://www.w3.org/1998/Math/MathML" style="display: block;"/>
+ </span>
+ <div xmlns="http://www.w3.org/1999/xhtml" style="overflow: auto;"/>
+</window> \ No newline at end of file
diff --git a/layout/style/crashtests/432561-1.html b/layout/style/crashtests/432561-1.html
new file mode 100644
index 000000000..81bb082e4
--- /dev/null
+++ b/layout/style/crashtests/432561-1.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<title>Testcase, Bug 432561</title>
+</head>
+<body>
+<script>
+var str = '{';
+for (var i=0;i<22;i++)
+ str+=str;
+document.write('<style type="text/css">div '+str+'</style>');
+str = '{{[('
+for (var i=0;i<20;i++)
+ str+=str;
+document.write('<style type="text/css">div '+str+'</style>');
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/437170-1.html b/layout/style/crashtests/437170-1.html
new file mode 100644
index 000000000..af6fa1d66
--- /dev/null
+++ b/layout/style/crashtests/437170-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+html img { color: blue; }
+</style>
+<script>
+
+function boom()
+{
+ var r = document.createRange();
+ r.selectNodeContents(document.documentElement);
+ r.cloneContents();
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<img src="data:image/gif,GIF87a%02%00%02%00%B3%00%00%00%00%00%FF%FF%FF%00%00%00%00%00%00%FF%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%2C%00%00%00%00%02%00%02%00%00%04%03%90H%12%00%3B" onload="window.getComputedStyle(this, null).getPropertyValue('color');">
+
+</body>
+</html>
diff --git a/layout/style/crashtests/437532-1.html b/layout/style/crashtests/437532-1.html
new file mode 100644
index 000000000..52eefa530
--- /dev/null
+++ b/layout/style/crashtests/437532-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/csS">
+
+a\[href$=".pdf"\] { }
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/439184-1.html b/layout/style/crashtests/439184-1.html
new file mode 100644
index 000000000..f22660726
--- /dev/null
+++ b/layout/style/crashtests/439184-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"
+ "http://www.w3.org/TR/html4/strict.dtd">
+<html lang="en-US">
+<head>
+ <title>Testcase, bug 439184</title>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+ <meta http-equiv="Content-Style-Type" content="text/css">
+ <meta http-equiv="Content-Script-Type" content="text/javascript">
+ <style type="text/css" id="style">
+
+ </style>
+ <script type="text/javascript">
+
+ var styleText = "p { color: green; }";
+
+ // We want to end up with a million rules or so, so double this text
+ // 20 times to make it 2^20 rules:
+ for (var i = 0; i < 20; ++i) {
+ styleText += styleText;
+ }
+
+ document.getElementById("style").firstChild.data = styleText;
+
+ </script>
+</head>
+<body>
+
+<p>This should be green.</p>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/444237-1.html b/layout/style/crashtests/444237-1.html
new file mode 100644
index 000000000..7eac32ed8
--- /dev/null
+++ b/layout/style/crashtests/444237-1.html
@@ -0,0 +1 @@
+<input style="box-shadow: initial;">
diff --git a/layout/style/crashtests/444848-1.html b/layout/style/crashtests/444848-1.html
new file mode 100644
index 000000000..d2c75d576
--- /dev/null
+++ b/layout/style/crashtests/444848-1.html
@@ -0,0 +1,9 @@
+<style>
+ [^=foo
+</style>
+<style>
+ [*=bar
+</style>
+<style>
+ [$=baz
+</style>
diff --git a/layout/style/crashtests/447776-1.html b/layout/style/crashtests/447776-1.html
new file mode 100644
index 000000000..dde700fae
--- /dev/null
+++ b/layout/style/crashtests/447776-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<title>Hang with zero width and word-wrap</title>
+</head><body>
+<div style="width: 0px; word-wrap: break-word;">abc</div>
+</body></html>
diff --git a/layout/style/crashtests/447783-1.html b/layout/style/crashtests/447783-1.html
new file mode 100644
index 000000000..05f12bf72
--- /dev/null
+++ b/layout/style/crashtests/447783-1.html
@@ -0,0 +1,8 @@
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<title>Hang with -moz-column-count and word-wrap</title>
+</head><body>
+<div style="border: 1px solid black; word-wrap: normal; -moz-column-count: 2; width: 110px;">
+a<span style="word-wrap: break-word;">abcde</span>
+</div>
+</body></html>
diff --git a/layout/style/crashtests/448161-1.html b/layout/style/crashtests/448161-1.html
new file mode 100644
index 000000000..ef200462b
--- /dev/null
+++ b/layout/style/crashtests/448161-1.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var r = document.createRange();
+ r.setStart(document.body, 0);
+ r.setEnd(document.getElementById("g"), 0);
+ r.deleteContents();
+
+ // Give spell-check a chance to run
+ setTimeout(function() { document.documentElement.className = ""; },
+ 50);
+}
+
+</script>
+</head>
+
+<body onload="boom();" contenteditable="true"><span><span contenteditable="true"><a href="http://www.mozilla.org/">5</a></span></span><span id="g"></span></body>
+
+</html>
diff --git a/layout/style/crashtests/448161-2.html b/layout/style/crashtests/448161-2.html
new file mode 100644
index 000000000..41dc7800f
--- /dev/null
+++ b/layout/style/crashtests/448161-2.html
@@ -0,0 +1,9 @@
+<html>
+ <body>
+ <script>
+ var node = document.createElement("a");
+ node.href = "http://www.mozilla.org";
+ document.defaultView.getComputedStyle(node, "").color
+ </script>
+ </body>
+</html>
diff --git a/layout/style/crashtests/452150-1.xhtml b/layout/style/crashtests/452150-1.xhtml
new file mode 100644
index 000000000..4ff411c6d
--- /dev/null
+++ b/layout/style/crashtests/452150-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head></head>
+<body>
+<p><m:mo fontsize="268435456em"><m:mstyle scriptlevel="30"><m:mstyle scriptlevel="15"><span/></m:mstyle></m:mstyle></m:mo></p>
+</body>
+</html>
diff --git a/layout/style/crashtests/456196.html b/layout/style/crashtests/456196.html
new file mode 100644
index 000000000..ed82ca0d4
--- /dev/null
+++ b/layout/style/crashtests/456196.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+<title>Crash [@ nsCSSValueList::~nsCSSValueList] with adding a lot of values in css property</title>
+</head>
+<body>
+<div style="border: 1px solid black; width: 100px; height: 100px;"></div>
+<script>
+function forceFree() {
+ var str = ' rotate(1deg)';
+ for(var i=0;i<17;i++) {str += str;}
+ document.getElementsByTagName('div')[0].style.MozTransform = str;
+}
+setTimeout(forceFree,100);
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/460209-1.html b/layout/style/crashtests/460209-1.html
new file mode 100644
index 000000000..d78235738
--- /dev/null
+++ b/layout/style/crashtests/460209-1.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<style>
+@import "404.css" s x
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/460217-1.html b/layout/style/crashtests/460217-1.html
new file mode 100644
index 000000000..e5918ad6e
--- /dev/null
+++ b/layout/style/crashtests/460217-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+@font-face
+{
+}
+@font-face
+{ font-family: 1;
+}
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/460323-1.html b/layout/style/crashtests/460323-1.html
new file mode 100644
index 000000000..0bae55aaf
--- /dev/null
+++ b/layout/style/crashtests/460323-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <head>
+ <script>
+ var expectedLoads = 3;
+ function load_done() {
+ --expectedLoads;
+ if (expectedLoads == 0) {
+ document.documentElement.className = "";
+ }
+ }
+ function addLink() {
+ var l = document.createElement("link");
+ l.rel = "stylesheet";
+ l.type = "text/css";
+ l.href = "data:text/css,some { random: data }";
+ l.onload = load_done;
+ document.getElementsByTagName("head")[0].appendChild(l);
+ }
+ function doIt() {
+ document.styleSheets[0].insertRule('a {}', 0)
+ addLink();
+ addLink();
+ }
+ addLink();
+ </script>
+ </head>
+ <body onload="doIt()">
+ <body>
+</body>
diff --git a/layout/style/crashtests/466845-1.html b/layout/style/crashtests/466845-1.html
new file mode 100644
index 000000000..f15c934f1
--- /dev/null
+++ b/layout/style/crashtests/466845-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<title>Crash [@ nsViewManager::CreateView] with ::first-line position: absolute and -moz-transform</title>
+<style>
+#a::first-line { -moz-transform: translate(50px);}
+</style>
+</head>
+<body style="position: absolute;">
+<span style="position: absolute;" id="a">
+<span style="-moz-transform: translate(50px);">&#1593; &#1593; &#1593;
+</span>
+</span>
+</body>
+</html>
diff --git a/layout/style/crashtests/469432-1.xhtml b/layout/style/crashtests/469432-1.xhtml
new file mode 100644
index 000000000..9b11a88c4
--- /dev/null
+++ b/layout/style/crashtests/469432-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<xul:menuitem>
+<select/>
+<xul:tooltip/>
+<mathml:msup/>
+</xul:menuitem>
+</html> \ No newline at end of file
diff --git a/layout/style/crashtests/472195-1.html b/layout/style/crashtests/472195-1.html
new file mode 100644
index 000000000..0eff97e46
--- /dev/null
+++ b/layout/style/crashtests/472195-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Copy of 473892-1.html for bug 472195</title>
+<style type="text/css">
+
+@media (min-width: 5rem) { body { color: green; } }
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/472237-1.html b/layout/style/crashtests/472237-1.html
new file mode 100644
index 000000000..0d0e273db
--- /dev/null
+++ b/layout/style/crashtests/472237-1.html
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+
+@font-face {
+ font-family: "Fontin-Sans SC";
+ /* the font url below is correct but won't be accessed due to cross-site restrictions */
+ src: url(../../reftests/fonts/markA.ttf) format("opentype");
+}
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("r").style.fontFamily = "'Fontin-Sans SC'";
+ document.documentElement.offsetHeight;
+ document.removeChild(document.documentElement);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div id="r">R</div></body>
+</html>
diff --git a/layout/style/crashtests/473720-1.html b/layout/style/crashtests/473720-1.html
new file mode 100644
index 000000000..a29316181
--- /dev/null
+++ b/layout/style/crashtests/473720-1.html
@@ -0,0 +1,15 @@
+<html><head><style>
+/* Recovery from an unparseable recognized @-rule is not the same thing
+ as recovery from an unrecognized @-rule. */
+
+@charset # { }
+@import # { }
+@namespace # { }
+@media # { }
+@-moz-document # { }
+@font-face # { }
+@page # { }
+@-non-mozilla # { }
+@nonstandard # { }
+
+</style></head></html>
diff --git a/layout/style/crashtests/473892-1.html b/layout/style/crashtests/473892-1.html
new file mode 100644
index 000000000..362e38a6d
--- /dev/null
+++ b/layout/style/crashtests/473892-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+@media (width: 5ex) { }
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/473914-1.html b/layout/style/crashtests/473914-1.html
new file mode 100644
index 000000000..47a7a9898
--- /dev/null
+++ b/layout/style/crashtests/473914-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style id="s"></style>
+<script type="text/javascript">
+
+// Duplicates the string 2^n times
+function exp(s, n)
+{
+ for (var i = 0; i < n; ++i)
+ s += s;
+ return s;
+}
+
+var stylesheet = exp("/**/", 20);
+document.getElementById("s").textContent = stylesheet;
+
+</script>
+</head>
+<body>
+<div></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/474377-1.xhtml b/layout/style/crashtests/474377-1.xhtml
new file mode 100644
index 000000000..519a753cf
--- /dev/null
+++ b/layout/style/crashtests/474377-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+
+#q:after {
+ content: 'A';
+}
+
+</style>
+</head>
+<body>
+
+<mrow xmlns="http://www.w3.org/1998/Math/MathML"></mrow>
+<span id="q"><span><div></div></span></span>
+
+</body>
+</html>
+
diff --git a/layout/style/crashtests/478321-1.xhtml b/layout/style/crashtests/478321-1.xhtml
new file mode 100644
index 000000000..654e11c10
--- /dev/null
+++ b/layout/style/crashtests/478321-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="display: table; float: left; line-height: 1rem;"/>
diff --git a/layout/style/crashtests/495269-1.html b/layout/style/crashtests/495269-1.html
new file mode 100644
index 000000000..40090edc8
--- /dev/null
+++ b/layout/style/crashtests/495269-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <link rel="stylesheet" href="data:text/css,@font-face {}';">
+ <link rel="stylesheet" href="data:text/css,@font-face {}';">
+ <script>
+ // Force a unique inner for the second linked sheet
+ document.styleSheets[1].cssRules[0];
+ </script>
+ </head>
+</html>
+
diff --git a/layout/style/crashtests/495269-2.html b/layout/style/crashtests/495269-2.html
new file mode 100644
index 000000000..8deca08e8
--- /dev/null
+++ b/layout/style/crashtests/495269-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <link rel="stylesheet" href="data:text/css,@-moz-document domain(example.com) {}';">
+ <link rel="stylesheet" href="data:text/css,@-moz-document domain(example.com) {}';">
+ <script>
+ // Force a unique inner for the second linked sheet
+ document.styleSheets[1].cssRules[0];
+ </script>
+ </head>
+</html>
+
diff --git a/layout/style/crashtests/498036-1.html b/layout/style/crashtests/498036-1.html
new file mode 100644
index 000000000..0128be749
--- /dev/null
+++ b/layout/style/crashtests/498036-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<!-- bogus assertion when one stylesheet contains two @import rules
+ specifying malformed URIs -->
+<html>
+<head>
+<style type="text/css">
+
+@import 'data:css';
+@import 'data:css';
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/509155-1.html b/layout/style/crashtests/509155-1.html
new file mode 100644
index 000000000..d21137332
--- /dev/null
+++ b/layout/style/crashtests/509155-1.html
@@ -0,0 +1,4 @@
+<html style="outline-color: inherit;">
+<head></head>
+<body></body>
+</html>
diff --git a/layout/style/crashtests/509156-1.html b/layout/style/crashtests/509156-1.html
new file mode 100644
index 000000000..f75776a5d
--- /dev/null
+++ b/layout/style/crashtests/509156-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE HTML>
+<html>
+<head></head>
+<body><div style="text-align: -moz-right;"><div style="display: table;"></div></div></body>
+</html>
diff --git a/layout/style/crashtests/509569-1.html b/layout/style/crashtests/509569-1.html
new file mode 100644
index 000000000..41a3cc559
--- /dev/null
+++ b/layout/style/crashtests/509569-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html style="border-inline-start: inherit; border: none"><body></body></html>
diff --git a/layout/style/crashtests/512851-1.xhtml b/layout/style/crashtests/512851-1.xhtml
new file mode 100644
index 000000000..d772390cd
--- /dev/null
+++ b/layout/style/crashtests/512851-1.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<style type="text/css">
+mover { font-size: 326590449211mm; }
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("r").setAttribute("accentunder", "4");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<mover xmlns="http://www.w3.org/1998/Math/MathML" id="mover"><munderover id="r"><merror/><msqrt/></munderover></mover>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/524252-1.html b/layout/style/crashtests/524252-1.html
new file mode 100644
index 000000000..65686e818
--- /dev/null
+++ b/layout/style/crashtests/524252-1.html
@@ -0,0 +1,10 @@
+<html>
+<head><script>
+function boom()
+{
+ var f = document.getElementById("f");
+ window.getComputedStyle(f, null).getPropertyValue("text-decoration");
+}
+</script></head>
+<body onload="boom();"><font id="f" color="black">a</font></body>
+</html>
diff --git a/layout/style/crashtests/536789-1.html b/layout/style/crashtests/536789-1.html
new file mode 100644
index 000000000..86fcb344f
--- /dev/null
+++ b/layout/style/crashtests/536789-1.html
@@ -0,0 +1,11 @@
+<!-- Must be in quirks mode -->
+<html>
+ <body>
+ <script>
+ var docEl = document.documentElement;
+ var b = document.body;
+ docEl.removeChild(b);
+ docEl.appendChild(document.createElement("table"));
+ docEl.offsetWidth;
+ </script>
+</html>
diff --git a/layout/style/crashtests/539613-1.xhtml b/layout/style/crashtests/539613-1.xhtml
new file mode 100644
index 000000000..386d7e127
--- /dev/null
+++ b/layout/style/crashtests/539613-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<body>
+<m:ms fontsize="90071992547409pc"><span><m:mfrac><m:mtext fontsize="625%"><m:mfrac>f<m:mrow><m:mstyle scriptlevel="3"><m:msup/></m:mstyle></m:mrow></m:mfrac></m:mtext><m:malignmark/></m:mfrac></span></m:ms>
+</body>
+</html>
diff --git a/layout/style/crashtests/558943-1.xhtml b/layout/style/crashtests/558943-1.xhtml
new file mode 100644
index 000000000..e3d978fd3
--- /dev/null
+++ b/layout/style/crashtests/558943-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<style>
+.x:first-line { }
+.y { }
+</style>
+</head>
+<body onload="setTimeout(function(){ document.documentElement.className = 'y'; }, 0)">
+<td class="x"><a href="#">Link</a></td>
+</body>
+</html>
diff --git a/layout/style/crashtests/559491.html b/layout/style/crashtests/559491.html
new file mode 100644
index 000000000..19126e560
--- /dev/null
+++ b/layout/style/crashtests/559491.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ for (var i = 0; i < 200; ++i) {
+ //dump(i + "\n");
+ r1 = document.createElementNS("http://www.w3.org/1999/xhtml", "a");
+ r1.setAttributeNS(null, "href", "404");
+ r1.style.color = "green";
+ r2 = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+ r2.style.color = "red";
+ document.removeChild(document.documentElement);
+ document.appendChild(r1);
+ document.removeChild(document.documentElement);
+ document.appendChild(r2);
+ document.removeChild(document.documentElement);
+ document.appendChild(r1);
+ document.documentElement.offsetHeight;
+ }
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/565248-1.html b/layout/style/crashtests/565248-1.html
new file mode 100644
index 000000000..18c8add08
--- /dev/null
+++ b/layout/style/crashtests/565248-1.html
@@ -0,0 +1,2 @@
+<html><body style="font-size: 18014398509481984%"></body></html>
+
diff --git a/layout/style/crashtests/571105-1.xhtml b/layout/style/crashtests/571105-1.xhtml
new file mode 100644
index 000000000..4dce42dc8
--- /dev/null
+++ b/layout/style/crashtests/571105-1.xhtml
@@ -0,0 +1 @@
+<link xmlns="http://www.w3.org/1999/xhtml" href="http://www.mozilla.org/"/> \ No newline at end of file
diff --git a/layout/style/crashtests/573127-1.html b/layout/style/crashtests/573127-1.html
new file mode 100644
index 000000000..72fbaf63e
--- /dev/null
+++ b/layout/style/crashtests/573127-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var mspace = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mspace");
+ var emptyset = document.createElementNS("http://www.w3.org/1998/Math/MathML", "emptyset");
+ emptyset.setAttributeNS(null, "mathvariant", "3");
+ mspace.appendChild(emptyset);
+ document.body.appendChild(mspace);
+ emptyset.removeAttribute('mathvariant');
+}
+
+</script>
+</head>
+
+<body onload="boom()"></body>
+</html>
diff --git a/layout/style/crashtests/575464-1.html b/layout/style/crashtests/575464-1.html
new file mode 100644
index 000000000..e77649ed7
--- /dev/null
+++ b/layout/style/crashtests/575464-1.html
@@ -0,0 +1 @@
+<html><body style="font-size: 1823190rem;"><big><big><span style="text-shadow: 0pt 0pt 0.2em rgb(136, 255, 119);"></span></big></big></body></html>
diff --git a/layout/style/crashtests/580685.html b/layout/style/crashtests/580685.html
new file mode 100644
index 000000000..4cb015393
--- /dev/null
+++ b/layout/style/crashtests/580685.html
@@ -0,0 +1,10 @@
+<html>
+<head></head>
+<body style="outline-offset: 0.1rem; ">
+<script>
+var body = document.body;
+document.removeChild(document.documentElement);
+var compstyle = window.getComputedStyle(body, null).getPropertyValue('outline-offset');
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/style/crashtests/585185-1.html b/layout/style/crashtests/585185-1.html
new file mode 100644
index 000000000..17eec73b3
--- /dev/null
+++ b/layout/style/crashtests/585185-1.html
@@ -0,0 +1 @@
+<a style="font: -2px Verdana;">
diff --git a/layout/style/crashtests/588627-1.html b/layout/style/crashtests/588627-1.html
new file mode 100644
index 000000000..04684950c
--- /dev/null
+++ b/layout/style/crashtests/588627-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="-moz-column-rule: 137438953471mozmm groove transparent"></body>
+</html> \ No newline at end of file
diff --git a/layout/style/crashtests/592698-1.html b/layout/style/crashtests/592698-1.html
new file mode 100644
index 000000000..9dcab0e32
--- /dev/null
+++ b/layout/style/crashtests/592698-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <iframe id="x"
+ src="data:text/html;charset=utf-8,%3Cdiv%20id%3D%22a%22%3Eaaa"></iframe>
+
+ <script>
+ window.onload = function() {
+ window.frames[0].document.getElementById("a").setAttribute("style",
+ '-moz-transition-property: color;' +
+ '-moz-transition-duration: 10s;' +
+ 'transition-property: color;' +
+ 'transition-duration: 10s; ' +
+ 'color: red;');
+
+ // And start the transition
+ window.frames[0].document.documentElement.getBoundingClientRect();
+
+ // Now kill off the presshell
+ var frame = document.getElementById("x");
+ frame.style.display = "none";
+ document.documentElement.getBoundingClientRect();
+
+ // And wait for the refresh driver to fire
+ setTimeout(function() {
+ document.documentElement.className = "";
+ }, 100);
+ }
+ </script>
+</html>
diff --git a/layout/style/crashtests/601437-1.html b/layout/style/crashtests/601437-1.html
new file mode 100644
index 000000000..8b5efd6cc
--- /dev/null
+++ b/layout/style/crashtests/601437-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link id="s" rel="stylesheet" href="data:text/css,@font-face { font-family: 'F'; src: url('file:///404/'); }">
+</head>
+<body onload="document.getElementById('s').sheet.media.appendMedium('x');"></body>
+</html>
diff --git a/layout/style/crashtests/601439-1.html b/layout/style/crashtests/601439-1.html
new file mode 100644
index 000000000..e76e4520e
--- /dev/null
+++ b/layout/style/crashtests/601439-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var elt = document.createElement("span");
+elt.setAttribute("style", "color: red ! important;");
+elt.style.getPropertyPriority("foo");
+
+</script>
diff --git a/layout/style/crashtests/605689-1.html b/layout/style/crashtests/605689-1.html
new file mode 100644
index 000000000..be02ac2e7
--- /dev/null
+++ b/layout/style/crashtests/605689-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+ var r = document.documentElement;
+ r.style.display = "table-cell";
+ r.style.transitionProperty = "x";
+ window.getComputedStyle(r).transitionProperty;
+}
+
+</script>
+<body onload="boom();"></body>
diff --git a/layout/style/crashtests/611922-1.html b/layout/style/crashtests/611922-1.html
new file mode 100644
index 000000000..f6affa0de
--- /dev/null
+++ b/layout/style/crashtests/611922-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <body onload="setTimeout(boom, 100)">
+ <a id="x" href=""><span>This link starts out visited</span></a>
+ <script>
+ function boom() {
+ document.getElementById("x").removeAttribute("href");
+ document.body.offsetWidth;
+ document.documentElement.className = "";
+ }
+ </script>
+ </body>
+</body>
diff --git a/layout/style/crashtests/621596-1.html b/layout/style/crashtests/621596-1.html
new file mode 100644
index 000000000..8bfd68185
--- /dev/null
+++ b/layout/style/crashtests/621596-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.style.MozColumnWidth = "1px";
+ document.documentElement.style.MozOutlineRadiusBottomleft = "100%";
+ document.documentElement.style.padding = "2251799813685249em";
+ window.getComputedStyle(document.documentElement).MozOutlineRadiusBottomleft;
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/622314-1.xhtml b/layout/style/crashtests/622314-1.xhtml
new file mode 100644
index 000000000..4daf23169
--- /dev/null
+++ b/layout/style/crashtests/622314-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <div>
+ <body link="orange" style="position: absolute;"></body>
+ <body link="yellow" style="position: absolute;"></body>
+
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+ <span style="display: inline;"></span>
+
+ </div>
+</html>
diff --git a/layout/style/crashtests/637242.xhtml b/layout/style/crashtests/637242.xhtml
new file mode 100644
index 000000000..a8d99a732
--- /dev/null
+++ b/layout/style/crashtests/637242.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style id="style">p { color: red; }</style>
+<script>
+<![CDATA[
+
+function boom()
+{
+ var styleText = "p { color: green; }";
+
+ // Make 2^17 rules
+ for (var i = 0; i < 17; ++i) {
+ styleText += styleText;
+ }
+
+ document.getElementById("style").firstChild.data = styleText;
+
+ document.body.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"));
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><p>This should be green</p></body>
+
+</html>
diff --git a/layout/style/crashtests/645142.html b/layout/style/crashtests/645142.html
new file mode 100644
index 000000000..290355c18
--- /dev/null
+++ b/layout/style/crashtests/645142.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html><html>
+<head><title>Testcase for bug 645142</title></head>
+<body>
+<div style="font-size: 18446744073709552000mozmm"></div>
+<div style="font-size: 18446744073709552000px"></div>
+<div style="font-size: 18446744073709552000pc"></div>
+<div style="font-size: 18446744073709552000pt"></div>
+<div style="font-size: 18446744073709552000in"></div>
+<div style="font-size: 18446744073709552000mm"></div>
+<div style="font-size: 18446744073709552000cm"></div>
+</body></html>
diff --git a/layout/style/crashtests/645951-1-ref.html b/layout/style/crashtests/645951-1-ref.html
new file mode 100644
index 000000000..7259e9603
--- /dev/null
+++ b/layout/style/crashtests/645951-1-ref.html
@@ -0,0 +1,4 @@
+<!DOCTYPE HTML>
+<title>Test, bug 645951</title>
+<body>
+<p style="color: green">Should not crash, and should be green too.</p>
diff --git a/layout/style/crashtests/645951-1.css b/layout/style/crashtests/645951-1.css
new file mode 100644
index 000000000..25ccf7a26
--- /dev/null
+++ b/layout/style/crashtests/645951-1.css
@@ -0,0 +1 @@
+@import url(chrome:///browser/skin/);
diff --git a/layout/style/crashtests/645951-1.html b/layout/style/crashtests/645951-1.html
new file mode 100644
index 000000000..a977e1ed4
--- /dev/null
+++ b/layout/style/crashtests/645951-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE HTML>
+<title>Test, bug 645951</title>
+<link rel=stylesheet href="645951-1.css">
+<link id="two" rel=stylesheet href="645951-1.css">
+<body onload="run()">
+<script>
+function run() {
+ document.getElementById("two").sheet.insertRule("p { color: green}", 1);
+}
+</script>
+<p>Should not crash, and should be green too.</p>
diff --git a/layout/style/crashtests/652976-1.svg b/layout/style/crashtests/652976-1.svg
new file mode 100644
index 000000000..1ca6ee28e
--- /dev/null
+++ b/layout/style/crashtests/652976-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+window.addEventListener("load", function() {
+ setTimeout(function() {
+ document.getElementById("a").style.MozAnimationName = "a";
+ }, 0);
+}, false);
+</script>
+<rect id="a"><animate attributeName="fill" by="#AAF573"/></rect>
+</svg>
diff --git a/layout/style/crashtests/665209-1.html b/layout/style/crashtests/665209-1.html
new file mode 100644
index 000000000..30e8055eb
--- /dev/null
+++ b/layout/style/crashtests/665209-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+ var w = '<div xmlns="http://www.w3.org/1999/xhtml" style="content: url(#);" />';
+ var v = 'url("data:image/svg+xml,' + encodeURIComponent(w) + '")';
+ document.documentElement.style.content = v;
+ document.documentElement.className = "";
+}
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/671799-1.html b/layout/style/crashtests/671799-1.html
new file mode 100644
index 000000000..cc89495b3
--- /dev/null
+++ b/layout/style/crashtests/671799-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<iframe src="data:text/html,<style>@font-face { font-family: 'x'; src: url(x.ttf); } :root { font-family: 'x'; }</style>"></iframe>
+</body>
+</html>
diff --git a/layout/style/crashtests/671799-2.html b/layout/style/crashtests/671799-2.html
new file mode 100644
index 000000000..a8398680e
--- /dev/null
+++ b/layout/style/crashtests/671799-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+@font-face {
+ font-family: foo;
+ src: url("http://spaces in hostname/");
+}
+body {
+ font-family: foo, monospace;
+}
+</style>
+</head>
+<body>
+foo bar
+</body>
+</html>
diff --git a/layout/style/crashtests/690990-1.html b/layout/style/crashtests/690990-1.html
new file mode 100644
index 000000000..19520e4f9
--- /dev/null
+++ b/layout/style/crashtests/690990-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+
+<link id="e" href="data:text/css,.ref { background-color: green; }" rel="stylesheet">
+
+<script>
+
+function boom()
+{
+ document.documentElement.appendChild(document.getElementById("e"));
+ document.styleSheets[0].cssRules[0];
+ // Remove reftest-wait async so we give the SheetComplete a chance to run
+ setTimeout(function() { document.documentElement.className = ""; }, 0);
+}
+
+</script>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/style/crashtests/696188-1.html b/layout/style/crashtests/696188-1.html
new file mode 100644
index 000000000..e52a26747
--- /dev/null
+++ b/layout/style/crashtests/696188-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<script>
+
+function boom()
+{
+ var e = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ document.body.appendChild(e);
+ e.setAttribute("style", "-moz-transform: rotate3d(2, 3, 4, 45deg) scale(10);");
+ e.offsetHeight;
+ e.setAttribute("style", "-moz-transition-duration: 1ms;");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/696869-1.html b/layout/style/crashtests/696869-1.html
new file mode 100644
index 000000000..e85a882a6
--- /dev/null
+++ b/layout/style/crashtests/696869-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<body style="-moz-transition: 4000000000000000s" onload="document.body.style.color = 'green';"></body> \ No newline at end of file
diff --git a/layout/style/crashtests/700116.html b/layout/style/crashtests/700116.html
new file mode 100644
index 000000000..de35ce702
--- /dev/null
+++ b/layout/style/crashtests/700116.html
@@ -0,0 +1,5 @@
+<head>
+ <script>
+ document.write('<link rel="stylesheet" href="#"><link rel="alternate stylesheet" title="x" href="data:text/css,"><link rel="stylesheet" title="x" href="data:text/css,">');
+ </script>
+</head>
diff --git a/layout/style/crashtests/729126-1.html b/layout/style/crashtests/729126-1.html
new file mode 100644
index 000000000..a5c50abd0
--- /dev/null
+++ b/layout/style/crashtests/729126-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body style="transition-duration: 1ms"></body>
+<script>
+var body = document.body;
+/* flush */ getComputedStyle(body, "").background;
+body.style.background = 'url(none.png), repeat';
+/* flush */ getComputedStyle(body, "").background;
+</script>
+</html>
diff --git a/layout/style/crashtests/729126-2.html b/layout/style/crashtests/729126-2.html
new file mode 100644
index 000000000..63533ee30
--- /dev/null
+++ b/layout/style/crashtests/729126-2.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body style="background-size: cover; transition-duration: 1ms"></body>
+<script>
+var body = document.body;
+/* flush */ getComputedStyle(body, "").backgroundSize;
+body.style.backgroundSize = 'contain';
+/* flush */ getComputedStyle(body, "").backgroundSize;
+</script>
+</html>
diff --git a/layout/style/crashtests/786108-1.html b/layout/style/crashtests/786108-1.html
new file mode 100644
index 000000000..2962e7117
--- /dev/null
+++ b/layout/style/crashtests/786108-1.html
@@ -0,0 +1,22 @@
+<html>
+ <head></head>
+ <body></body>
+ <script type="text/javascript">
+ // Detect severe performance and memory issues when large amounts of errors
+ // are reported from CSS embedded in a file with a long data URI. Addressed
+ // by 786108; should finish quickly with that patch and run for a very long
+ // time otherwise.
+
+ var img = new Array;
+ img.push('<img src="data:image/svg+xml,');
+ img.push(encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300px" height="300px">'));
+
+ for (var i = 0 ; i < 10000 ; i++)
+ img.push(encodeURIComponent('<circle cx="0" cy="0" r="1" style="xxx-invalid-property: 0;"/>'));
+
+ img.push(encodeURIComponent('</svg>'));
+ img.push('">');
+
+ document.getElementsByTagName('body')[0].innerHTML = img.join('');
+ </script>
+</html>
diff --git a/layout/style/crashtests/786108-2.html b/layout/style/crashtests/786108-2.html
new file mode 100644
index 000000000..1b2892040
--- /dev/null
+++ b/layout/style/crashtests/786108-2.html
@@ -0,0 +1,23 @@
+<html>
+ <head></head>
+ <body></body>
+ <script type="text/javascript">
+ // Detect severe performance and memory issues when large amounts of errors
+ // are reported from CSS embedded in a file with a long data URI. Addressed
+ // by 786108; should finish quickly with that patch and run for a very long
+ // time otherwise. This version is designed for slow / memory constrained
+ // platforms like Android.
+
+ var img = new Array;
+ img.push('<img src="data:image/svg+xml,');
+ img.push(encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300px" height="300px">'));
+
+ for (var i = 0 ; i < 2500 ; i++)
+ img.push(encodeURIComponent('<circle cx="0" cy="0" r="1" style="xxx-invalid-property: 0;"/>'));
+
+ img.push(encodeURIComponent('</svg>'));
+ img.push('">');
+
+ document.getElementsByTagName('body')[0].innerHTML = img.join('');
+ </script>
+</html>
diff --git a/layout/style/crashtests/788836.html b/layout/style/crashtests/788836.html
new file mode 100644
index 000000000..938c21675
--- /dev/null
+++ b/layout/style/crashtests/788836.html
@@ -0,0 +1,3 @@
+<style>@\</style>
+<style>@\
+</style>
diff --git a/layout/style/crashtests/806310-1.html b/layout/style/crashtests/806310-1.html
new file mode 100644
index 000000000..505b41076
--- /dev/null
+++ b/layout/style/crashtests/806310-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html lang="en-US" style="font: caption; font-size: 1rem;">
+<body></body>
+</html>
diff --git a/layout/style/crashtests/812824.html b/layout/style/crashtests/812824.html
new file mode 100644
index 000000000..5367b6c30
--- /dev/null
+++ b/layout/style/crashtests/812824.html
@@ -0,0 +1 @@
+<html style="border: inherit;"><div></div><style>html, div { border-image-source: url('border.png'); }</style></html>
diff --git a/layout/style/crashtests/822766-1.html b/layout/style/crashtests/822766-1.html
new file mode 100644
index 000000000..77bb1e25a
--- /dev/null
+++ b/layout/style/crashtests/822766-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+@-moz-keyframes togreen {
+ 100% {
+ color: green;
+ }
+}
+
+.a:after {
+ animation-name: togreen;
+ animation-duration: 10s;
+}
+
+</style>
+<script>
+
+function boom()
+{
+ document.documentElement.setAttribute("class", "a");
+ document.documentElement.offsetHeight;
+ document.documentElement.appendChild(document.createElement("span"));
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/822842.html b/layout/style/crashtests/822842.html
new file mode 100644
index 000000000..a8c7acfbf
--- /dev/null
+++ b/layout/style/crashtests/822842.html
@@ -0,0 +1,13 @@
+<html>
+ <head></head>
+ <body></body>
+ <script type="text/javascript">
+ window.x = window.getComputedStyle(document.documentElement, null).getPropertyCSSValue("transition-timing-function");
+ window.x = window.getComputedStyle(document.documentElement, null).getPropertyCSSValue("color");
+ x.z = x.getRGBColorValue().blue;
+ x.getRGBColor().blue.d = x;
+ x= null;
+ SpecialPowers.forceGC();
+ SpecialPowers.forceCC();
+ </script>
+</html>
diff --git a/layout/style/crashtests/827591-1.html b/layout/style/crashtests/827591-1.html
new file mode 100644
index 000000000..a0ab10091
--- /dev/null
+++ b/layout/style/crashtests/827591-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+@page {}
+
+</style>
+<script>
+
+function boom()
+{
+ document.styleSheets[0].cssRules[0].style.paddingLeft = "initial";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/829817.html b/layout/style/crashtests/829817.html
new file mode 100644
index 000000000..a81fb6b79
--- /dev/null
+++ b/layout/style/crashtests/829817.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+@page {}
+
+</style>
+<script>
+
+function boom()
+{
+ // This shouldn't cause a shutdown leak.
+ document.styleSheets[0].cssRules[0].style.someExpando = "set an expando to preserve the wrapper";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/840898.html b/layout/style/crashtests/840898.html
new file mode 100644
index 000000000..352bf3c3d
--- /dev/null
+++ b/layout/style/crashtests/840898.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var styleDeclaration = window.getComputedStyle(document.createElement('div'), null);
+ var cursorValue = styleDeclaration.getPropertyCSSValue('cursor');
+ cursorValue.item(1000);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/842134.html b/layout/style/crashtests/842134.html
new file mode 100644
index 000000000..f5bab1214
--- /dev/null
+++ b/layout/style/crashtests/842134.html
@@ -0,0 +1 @@
+<!doctype html><style>body { marker: url(#m) url(#m); }</style>
diff --git a/layout/style/crashtests/861489-1.html b/layout/style/crashtests/861489-1.html
new file mode 100644
index 000000000..bb394cef5
--- /dev/null
+++ b/layout/style/crashtests/861489-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+
+@keyframes anim {
+ 20% {
+ color: green;
+ }
+}
+
+a {
+ animation-name: anim;
+ animation-duration: 40s;
+}
+
+</style>
+<style>
+
+:link { background: red ! important; }
+
+</style>
+</head>
+
+<body onload="document.documentElement.style.border = 'initial';">
+<div><a href="data:text/html,unlikely to be visited"></a></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/862113.html b/layout/style/crashtests/862113.html
new file mode 100644
index 000000000..319132b78
--- /dev/null
+++ b/layout/style/crashtests/862113.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ window.getComputedStyle(document.documentElement, ":foo");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/867487.html b/layout/style/crashtests/867487.html
new file mode 100644
index 000000000..a259690d1
--- /dev/null
+++ b/layout/style/crashtests/867487.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="stylesheet" href="data:text/css,">
+<script>
+
+function boom()
+{
+ var s = document.styleSheets[0];
+ var n = s.ownerNode;
+ var p = n.parentNode;
+
+ s.insertRule("#a { }", 0);
+
+ for (var i = 0; i < 3; ++i) {
+ p.removeChild(n);
+ p.appendChild(n);
+ }
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/873222.html b/layout/style/crashtests/873222.html
new file mode 100644
index 000000000..1ffcc623a
--- /dev/null
+++ b/layout/style/crashtests/873222.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var r = document.documentElement;
+ r.style.font = "170% fantasy";
+ r.style.fontSynthesis = "none";
+ r.getAttribute("style");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/880862.html b/layout/style/crashtests/880862.html
new file mode 100644
index 000000000..d89e24d90
--- /dev/null
+++ b/layout/style/crashtests/880862.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ // This file tests if we create a shutdown leak.
+ document.getElementById("c").getContext("2d").fillText("x", 0, 0);
+ document.styleSheets[0].cssRules[0].style.whatever = "create an expando to preserve the wrapper";
+}
+
+</script>
+
+<style>
+
+@font-face {
+ font-family: missing;
+ src: local(missing);
+}
+
+</style>
+</head>
+
+<body onload="boom();">
+<canvas id="c"></canvas>
+</body>
+</html>
diff --git a/layout/style/crashtests/915440.html b/layout/style/crashtests/915440.html
new file mode 100644
index 000000000..f3a291f1f
--- /dev/null
+++ b/layout/style/crashtests/915440.html
@@ -0,0 +1,4 @@
+<!DOCTYPE HTML>
+<body>
+<iframe src="data:text/html,<!DOCTYPE HTML><style>@font-face { font-family: 'a'; src: url('not-found') format('woff'); }</style>"></iframe>
+</body>
diff --git a/layout/style/crashtests/927734-1.html b/layout/style/crashtests/927734-1.html
new file mode 100644
index 000000000..bd99f9b9e
--- /dev/null
+++ b/layout/style/crashtests/927734-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<table>
+ <tr>
+ <td>
+ <style scoped></style>
+ <span></span>
+ </td>
+ </tr>
+</table>
+<style>div {}</style>
diff --git a/layout/style/crashtests/930270-1.html b/layout/style/crashtests/930270-1.html
new file mode 100644
index 000000000..cbdf5a9e3
--- /dev/null
+++ b/layout/style/crashtests/930270-1.html
@@ -0,0 +1,6 @@
+<nobr>
+<form>
+<style scoped></style>
+<input required="required">
+<button>
+<nobr>
diff --git a/layout/style/crashtests/930270-2.html b/layout/style/crashtests/930270-2.html
new file mode 100644
index 000000000..6240ca20e
--- /dev/null
+++ b/layout/style/crashtests/930270-2.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+<style scoped>span { color: red; }</style>
+<div><span></span></div>
+<script>
+var div = document.querySelector("div");
+div.parentNode.removeChild(div);
+getComputedStyle(div.firstChild, "").color;
+</script>
diff --git a/layout/style/crashtests/945048-1.html b/layout/style/crashtests/945048-1.html
new file mode 100644
index 000000000..753efb66f
--- /dev/null
+++ b/layout/style/crashtests/945048-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<style>
+button::-moz-focus-inner:active { }
+</style>
+<button>hello</button>
diff --git a/layout/style/crashtests/972199-1.html b/layout/style/crashtests/972199-1.html
new file mode 100644
index 000000000..a4e0de0d8
--- /dev/null
+++ b/layout/style/crashtests/972199-1.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+ <style type="text/css">
+ @keyframes anim {
+ 0% { transform: translate(0px) }
+ 100% { transform: translate(100px) }
+ }
+ div {
+ width: 100px;
+ height: 100px;
+ background-color: white;
+ }
+ </style>
+</head>
+<body>
+<div></div>
+<script type="application/javascript">
+
+window.addEventListener("load", function() {
+ document.querySelector("div").setAttribute("style",
+ "animation: 100s 300s anim linear");
+ advance_clock(200000);
+ advance_clock(300000);
+
+ Promise.resolve().then(function() {
+ SpecialPowers.DOMWindowUtils.restoreNormalRefresh();
+ }).then(function() {
+ document.documentElement.className = "";
+ });
+});
+
+function advance_clock(milliseconds) {
+ SpecialPowers.DOMWindowUtils.advanceTimeAndRefresh(milliseconds);
+}
+</script>
+</html>
diff --git a/layout/style/crashtests/989965-1.html b/layout/style/crashtests/989965-1.html
new file mode 100644
index 000000000..a2879d973
--- /dev/null
+++ b/layout/style/crashtests/989965-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+<style>
+::placeholder { color: red; }
+::placeholder:focus { color: green; }
+</style>
+<script>
+window.getComputedStyle(document.body, "::placeholder").color;
+</script>
diff --git a/layout/style/crashtests/992333-1.html b/layout/style/crashtests/992333-1.html
new file mode 100644
index 000000000..86a1d57d7
--- /dev/null
+++ b/layout/style/crashtests/992333-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<style>
+p { --variable: value; transition: 1s --variable; }
+</style>
+<p>Hello.</p>
+<script>
+window.onload = function() {
+ document.querySelector("p").style.color = "green";
+};
+</script>
diff --git a/layout/style/crashtests/blue-32x32.png b/layout/style/crashtests/blue-32x32.png
new file mode 100644
index 000000000..deefd19b2
--- /dev/null
+++ b/layout/style/crashtests/blue-32x32.png
Binary files differ
diff --git a/layout/style/crashtests/border-image-visited-link.html b/layout/style/crashtests/border-image-visited-link.html
new file mode 100644
index 000000000..b6e3ae5d7
--- /dev/null
+++ b/layout/style/crashtests/border-image-visited-link.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<title>border-image on link with visited styles</title>
+<style>
+
+:link { color: blue }
+:visited { color: purple }
+:link, :visited { border: medium solid; border-image: url(blue-32x32.png) 4 4 4 4; }
+
+</style>
+<a href="http://example.com/">test</a>
diff --git a/layout/style/crashtests/crashtests.list b/layout/style/crashtests/crashtests.list
new file mode 100644
index 000000000..1ddb01d6b
--- /dev/null
+++ b/layout/style/crashtests/crashtests.list
@@ -0,0 +1,166 @@
+load 105619-1.html
+load 147777-1.html
+load 187671-1.html
+load 192408-1.html
+load 285727-1.html
+load 286707-1.html
+load 317561-1.html
+load 330998-1.html
+load 363950.html
+load 368175-1.html
+load 368740.html
+load 379788-1.html
+load 383979-1.xhtml
+load 383979-2.html
+load 386939-1.html
+load 391034-1.xhtml
+load 397022-1.html
+load 399289-1.svg
+load 404470-1.html
+load 411603-1.html
+load 412588-1.html
+load 413274-1.xhtml
+load 416461-1.xul
+load 418007-1.xhtml
+load 431705-1.xul
+load 432561-1.html
+load 437170-1.html
+load 437532-1.html
+load 439184-1.html
+load 444237-1.html
+load 444848-1.html
+load 447776-1.html
+load 447783-1.html
+load 448161-1.html
+load 448161-2.html
+load 452150-1.xhtml
+load 456196.html
+load 460209-1.html
+load 460217-1.html
+load 460323-1.html
+load 466845-1.html
+load 469432-1.xhtml
+load 472195-1.html
+load 472237-1.html # will fail, test for leak (474704)
+HTTP(..) load 472237-1.html
+load 473720-1.html
+load 473892-1.html
+load 473914-1.html
+load 474377-1.xhtml
+load 478321-1.xhtml
+load 495269-1.html
+load 495269-2.html
+load 498036-1.html
+load 509155-1.html
+load 509156-1.html
+load 509569-1.html
+load 512851-1.xhtml
+load 524252-1.html
+load 536789-1.html
+load 539613-1.xhtml
+load 558943-1.xhtml
+load 559491.html
+load 565248-1.html
+load 571105-1.xhtml
+load 573127-1.html
+load 575464-1.html
+load 580685.html
+load 585185-1.html
+load 588627-1.html
+load 592698-1.html
+load 601437-1.html
+load 601439-1.html
+load 605689-1.html
+load 611922-1.html
+load 621596-1.html
+load 622314-1.xhtml
+load 637242.xhtml
+load 645142.html
+== 645951-1.html 645951-1-ref.html
+load 652976-1.svg
+load 665209-1.html
+load 671799-1.html
+load 671799-2.html
+load 690990-1.html
+load 696188-1.html
+load 696869-1.html
+load 700116.html
+load 729126-1.html
+load 729126-2.html
+load 786108-1.html
+load 786108-2.html
+load 788836.html
+load 806310-1.html
+load 812824.html
+load 822766-1.html
+load 822842.html
+load 827591-1.html
+load 829817.html
+load 840898.html
+load 842134.html
+load 861489-1.html
+load 862113.html
+load 867487.html
+load 873222.html
+load 880862.html
+load 915440.html
+load 927734-1.html
+load 930270-1.html
+load 930270-2.html
+load 945048-1.html
+load 972199-1.html
+load 989965-1.html
+load 992333-1.html
+pref(dom.webcomponents.enabled,true) load 1017798-1.html
+load 1028514-1.html
+load 1066089-1.html
+load 1074651-1.html
+load 1135534.html
+pref(dom.webcomponents.enabled,true) load 1089463-1.html
+pref(layout.css.expensive-style-struct-assertions.enabled,true) load 1136010-1.html
+pref(layout.css.expensive-style-struct-assertions.enabled,true) load 1146101-1.html
+load 1153693-1.html
+load 1161320-1.html
+pref(dom.animations-api.core.enabled,true) load 1161320-2.html
+load 1161366-1.html
+load 1163446-1.html
+load 1164813-1.html
+load 1167782-1.html
+load 1186768-1.xhtml
+load 1200568-1.html
+load 1206105-1.html
+load 1223688-1.html
+load 1223694-1.html
+load 1226400-1.html
+load 1227501-1.html
+load 1230408-1.html
+load 1233135-1.html
+load 1233135-2.html
+load 1238660-1.html
+load 1245260-1.html
+load 1247865-1.html
+load 1264396-1.html
+# The following test relies on -webkit-text-fill-color being behind the
+# layout.css.prefixes.webkit pref
+pref(layout.css.prefixes.webkit,false) load 1265611-1.html
+load border-image-visited-link.html
+load font-face-truncated-src.html
+load large_border_image_width.html
+load long-url-list-stack-overflow.html
+pref(layout.css.background-clip-text.enabled,true) load 1264949.html
+pref(layout.css.background-clip-text.enabled,true) load 1270795.html
+pref(layout.css.background-clip-text.enabled,true) load 1275026.html
+load 1278463-1.html
+pref(dom.animations-api.core.enabled,true) load 1277908-1.html
+load 1277908-2.html
+load 1282076-1.html
+pref(dom.animations-api.core.enabled,true) load 1282076-2.html
+pref(dom.animations-api.core.enabled,true) load 1290994-1.html
+pref(dom.animations-api.core.enabled,true) load 1290994-2.html
+pref(dom.animations-api.core.enabled,true) load 1290994-3.html
+load 1290994-4.html
+load 1314531.html
+load 1315889-1.html
+load 1315894-1.html
+load 1321357-1.html
+load 1356601-1.html
diff --git a/layout/style/crashtests/font-face-truncated-src.html b/layout/style/crashtests/font-face-truncated-src.html
new file mode 100644
index 000000000..c3d7dbda5
--- /dev/null
+++ b/layout/style/crashtests/font-face-truncated-src.html
@@ -0,0 +1,2 @@
+<!doctype html>
+<style>@font-face { src:</style>
diff --git a/layout/style/crashtests/large_border_image_width.html b/layout/style/crashtests/large_border_image_width.html
new file mode 100644
index 000000000..915d94eb1
--- /dev/null
+++ b/layout/style/crashtests/large_border_image_width.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<div style="border: 10px solid transparent; border-image-source: -moz-linear-gradient(0rad, blue 25px, green 25px); border-image-width: 5464618830153;"></div>
+</body>
+</html>
+
diff --git a/layout/style/crashtests/long-url-list-stack-overflow.html b/layout/style/crashtests/long-url-list-stack-overflow.html
new file mode 100644
index 000000000..899e858df
--- /dev/null
+++ b/layout/style/crashtests/long-url-list-stack-overflow.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style id="s"></style>
+<script type="text/javascript">
+
+// Duplicates the string 2^n times
+function exp(s, n)
+{
+ for (var i = 0; i < n; ++i)
+ s += s;
+ return s;
+}
+
+var stylesheet = "@-moz-document url(http://www.w3.org/)" + exp(", url-prefix(file:///)", 20) + " { }";
+document.getElementById("s").textContent = stylesheet;
+
+</script>
+</head>
+<body>
+<div></div>
+</body>
+</html>