19 files changed, 266 insertions, 0 deletions
diff --git a/dom/events/crashtests/1033343.html b/dom/events/crashtests/1033343.html
new file mode 100644
index 000000000..99160cebf
--- /dev/null
+++ b/dom/events/crashtests/1033343.html
@@ -0,0 +1,5 @@
+<script>
+
+document.createEvent('CustomEvent').detail;
+
+</script>
diff --git a/dom/events/crashtests/1035654-1.html b/dom/events/crashtests/1035654-1.html
new file mode 100644
index 000000000..6e3e3c027
--- /dev/null
+++ b/dom/events/crashtests/1035654-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<script>
+
+function boom()
+{
+  var video = document.createElement('video');
+  var track = video.addTextTrack('chapters');
+  window.meep = new TrackEvent("t", { "track": track });
+  document.documentElement.style.expando = null;
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+</body>
+
+</html>
diff --git a/dom/events/crashtests/1035654-2.html b/dom/events/crashtests/1035654-2.html
new file mode 100644
index 000000000..19f5a1cc8
--- /dev/null
+++ b/dom/events/crashtests/1035654-2.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<script>
+
+function boom()
+{
+  var video = document.createElement('video');
+  var track = video.addTextTrack('chapters');
+  track.expando = new TrackEvent("t", { "track": track })
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+</body>
+
+</html>
diff --git a/dom/events/crashtests/104310-1.html b/dom/events/crashtests/104310-1.html
new file mode 100644
index 000000000..f9544c2f8
--- /dev/null
+++ b/dom/events/crashtests/104310-1.html
@@ -0,0 +1,22 @@
+<HTML>
+
+<HEAD>
+</HEAD>
+
+<BODY onload=document.input.name.focus()>
+
+
+<form method="post" action="index.cfm" name="input">
+<CENTER><TABLE BORDER=0>
+<TD><INPUT TYPE="text" NAME="name" onClick="this.focus()" onFocus="this.select()" onSelect="this.select()"></TD>
+
+</TABLE></CENTER>
+<HR>
+
+</FORM>
+
+</BODY>
+
+</HTML>
+
+
diff --git a/dom/events/crashtests/1072137-1.html b/dom/events/crashtests/1072137-1.html
new file mode 100644
index 000000000..ae26188ab
--- /dev/null
+++ b/dom/events/crashtests/1072137-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<script>
+
+function boom()
+{
+  var textareaRoot = document.createElement("textarea");
+  document.removeChild(document.documentElement);
+  document.appendChild(textareaRoot);
+  var input = document.createElement("input");
+  textareaRoot.appendChild(input);
+  input.select();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/events/crashtests/1143972-1.html b/dom/events/crashtests/1143972-1.html
new file mode 100644
index 000000000..992bf9478
--- /dev/null
+++ b/dom/events/crashtests/1143972-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML>
+<script>
+var x;
+function doTest() {
+  f.contentDocument.body.onclick = function (event) {
+    x = event.offsetX;
+  }
+  f.contentDocument.body.dispatchEvent(f.contentWindow.ev);
+}
+</script>
+<iframe id="f" style="display:none" onload="doTest()"
+        src="data:text/html,<script>var ev = new MouseEvent('click', {clientX:0, clientY:0})</script>"></iframe>
diff --git a/dom/events/crashtests/116206-1.html b/dom/events/crashtests/116206-1.html
new file mode 100644
index 000000000..b04c15097
--- /dev/null
+++ b/dom/events/crashtests/116206-1.html
@@ -0,0 +1,23 @@
+<html>
+   <head>
+      <script language="JavaScript">
+	 function InitialFocus(){
+	    document.frmSelectUser.radResidence[0].focus();
+	 }
+      </script>
+   </head>
+   <body onfocus="InitialFocus();" >
+      <form name="frmSelectUser">
+	 <table>
+	    <tbody> 
+	       <tr> 
+		  <td><input name="radResidence" type="radio" value="KOR"></td> 
+	       </tr> 
+	       <tr> 
+		  <td><input name="radResidence" type="radio" value="JPN"></td>
+	       </tr> 
+	    </tbody>
+         </table>
+      </form>
+   </body> 
+</html>     
diff --git a/dom/events/crashtests/1190036-1.html b/dom/events/crashtests/1190036-1.html
new file mode 100644
index 000000000..00a6a25db
--- /dev/null
+++ b/dom/events/crashtests/1190036-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    var ev = new ClipboardEvent("p");
+    ev.clipboardData.getFilesAndDirectories();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/events/crashtests/135345-1.html b/dom/events/crashtests/135345-1.html
new file mode 100644
index 000000000..f9bfe0275
--- /dev/null
+++ b/dom/events/crashtests/135345-1.html
@@ -0,0 +1,14 @@
+<html>
+<body>
+  <form name="frmlogin">
+    <input type="text" name="username" 
+           onfocus="frmlogin.username.select();" 
+           onblur="frmlogin.password.focus();">
+    <input type="password" name="password" 
+           onfocus="frmlogin.password.select();">
+  </form>
+  <script language="JavaScript">
+    document.frmlogin.username.focus();
+  </script>
+</body>
+</html>
diff --git a/dom/events/crashtests/422009-1.xhtml b/dom/events/crashtests/422009-1.xhtml
new file mode 100644
index 000000000..1bf37906d
--- /dev/null
+++ b/dom/events/crashtests/422009-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="g">
+    <implementation>
+      <constructor>
+        throw 3;
+      </constructor>
+    </implementation>
+  </binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var HTML_NS = "http://www.w3.org/1999/xhtml";
+  var span = document.createElementNS(HTML_NS, 'span');
+  span.style.MozBinding = "url(#g)";
+  document.removeChild(document.documentElement)
+  var w = document.createElementNS(HTML_NS, 'body');
+  w.setAttribute('onload', "/");
+  document.appendChild(span);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/events/crashtests/457776-1.html b/dom/events/crashtests/457776-1.html
new file mode 100644
index 000000000..2c3910815
--- /dev/null
+++ b/dom/events/crashtests/457776-1.html
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+new XMLHttpRequest().upload.onabort = function(){};
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/events/crashtests/496308-1.html b/dom/events/crashtests/496308-1.html
new file mode 100644
index 000000000..29d9a646c
--- /dev/null
+++ b/dom/events/crashtests/496308-1.html
@@ -0,0 +1,3 @@
+<script>
+  document.createEvent("popupblockedevents").requestingWindow;
+</script>
diff --git a/dom/events/crashtests/682637-1.html b/dom/events/crashtests/682637-1.html
new file mode 100644
index 000000000..5afc12377
--- /dev/null
+++ b/dom/events/crashtests/682637-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<script>
+
+function boom()
+{
+  var frame = document.getElementById("f");
+  var frameWin = frame.contentWindow;
+  frame.parentNode.removeChild(frame);
+  frameWin.onmouseover = function(){};
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="f" src="data:text/html,1"></iframe>
+</body>
+
+</html>
diff --git a/dom/events/crashtests/938341.html b/dom/events/crashtests/938341.html
new file mode 100644
index 000000000..3190b4a6b
--- /dev/null
+++ b/dom/events/crashtests/938341.html
@@ -0,0 +1,7 @@
+<html hidden>
+<script>
+function a(){document.getElementById('id1').click();}
+window.onload = a;
+</script>
+<applet <ol onclick='' contenteditable='true' onended='' oncanplay=''>
+<article id='id1'></article>
+\ No newline at end of file
diff --git a/dom/events/crashtests/crashtests.list b/dom/events/crashtests/crashtests.list
new file mode 100644
index 000000000..fb11e4ec5
--- /dev/null
+++ b/dom/events/crashtests/crashtests.list
@@ -0,0 +1,18 @@
+load 104310-1.html
+load 116206-1.html
+load 135345-1.html
+load 422009-1.xhtml
+load 457776-1.html
+load 496308-1.html
+load 682637-1.html
+load 938341.html
+load 1033343.html
+load 1035654-1.html
+load 1035654-2.html
+needs-focus load 1072137-1.html
+load 1143972-1.html
+load 1190036-1.html
+load eventctor-nulldictionary.html
+load eventctor-nullstorage.html
+load recursive-DOMNodeInserted.html
+load recursive-onload.html
diff --git a/dom/events/crashtests/eventctor-nulldictionary.html b/dom/events/crashtests/eventctor-nulldictionary.html
new file mode 100644
index 000000000..f81399413
--- /dev/null
+++ b/dom/events/crashtests/eventctor-nulldictionary.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+new MouseEvent("click", null);
+</script>
diff --git a/dom/events/crashtests/eventctor-nullstorage.html b/dom/events/crashtests/eventctor-nullstorage.html
new file mode 100644
index 000000000..beae2f3df
--- /dev/null
+++ b/dom/events/crashtests/eventctor-nullstorage.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+new StorageEvent("").storageArea;
+</script>
diff --git a/dom/events/crashtests/recursive-DOMNodeInserted.html b/dom/events/crashtests/recursive-DOMNodeInserted.html
new file mode 100644
index 000000000..c3e6f41d5
--- /dev/null
+++ b/dom/events/crashtests/recursive-DOMNodeInserted.html
@@ -0,0 +1,17 @@
+<HTML>
+<HEAD>
+<TITLE></TITLE>
+
+</HEAD>
+<BODY BGCOLOR="#FFFFFF" TEXT="#000000" LINK="#0000FF" VLINK="#800080" onload="test()">
+<INPUT id="txt1" type="text" value="">
+
+<SCRIPT>
+document.addEventListener("DOMNodeInserted",test,0);
+count = 0;
+function test(){
+   n = document.createTextNode("test");
+   document.body.appendChild(n);
+}
+</SCRIPT>
+</BODY>
diff --git a/dom/events/crashtests/recursive-onload.html b/dom/events/crashtests/recursive-onload.html
new file mode 100644
index 000000000..e8f15610b
--- /dev/null
+++ b/dom/events/crashtests/recursive-onload.html
@@ -0,0 +1 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<HTML>
+<head>
+<title>Goodjet!</title>
+<script language="JavaScript">
+function onload()
+{
+// nothing here
+}
+</script>
+</head>
+<body onload ="onload();">
+Body text
+</body>
+</html>
+\ No newline at end of file