summaryrefslogtreecommitdiffstats
path: root/dom/html/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'dom/html/crashtests')
-rw-r--r--dom/html/crashtests/1032654.html1
-rw-r--r--dom/html/crashtests/1141260.html4
-rw-r--r--dom/html/crashtests/1228876.html21
-rw-r--r--dom/html/crashtests/1230110.html19
-rw-r--r--dom/html/crashtests/1237633.html1
-rw-r--r--dom/html/crashtests/1281972-1.html5
-rw-r--r--dom/html/crashtests/1282894.html17
-rw-r--r--dom/html/crashtests/1290904.html37
-rw-r--r--dom/html/crashtests/1386905.html13
-rw-r--r--dom/html/crashtests/257818-1.html82
-rw-r--r--dom/html/crashtests/285166-1.html3
-rw-r--r--dom/html/crashtests/294235-1.html14
-rw-r--r--dom/html/crashtests/307616-1.html8
-rw-r--r--dom/html/crashtests/324918-1.xhtml26
-rw-r--r--dom/html/crashtests/338649-1.xhtml22
-rw-r--r--dom/html/crashtests/339501-1.xhtml33
-rw-r--r--dom/html/crashtests/339501-2.xhtml33
-rw-r--r--dom/html/crashtests/378993-1.xhtml7
-rw-r--r--dom/html/crashtests/382568-1-inner.xhtml52
-rw-r--r--dom/html/crashtests/382568-1.html9
-rw-r--r--dom/html/crashtests/383137.xhtml13
-rw-r--r--dom/html/crashtests/388183-1.html8
-rw-r--r--dom/html/crashtests/395340-1.html28
-rw-r--r--dom/html/crashtests/399694-1.html20
-rw-r--r--dom/html/crashtests/407053.html6
-rw-r--r--dom/html/crashtests/423371-1.html9
-rw-r--r--dom/html/crashtests/448564.html7
-rw-r--r--dom/html/crashtests/451123-1.html7
-rw-r--r--dom/html/crashtests/453406-1.html34
-rw-r--r--dom/html/crashtests/464197-1.html23
-rw-r--r--dom/html/crashtests/465466-1.xhtml23
-rw-r--r--dom/html/crashtests/468562-1.html6
-rw-r--r--dom/html/crashtests/468562-2.html6
-rw-r--r--dom/html/crashtests/494225.html10
-rw-r--r--dom/html/crashtests/495543.svg16
-rw-r--r--dom/html/crashtests/495546-1.html19
-rw-r--r--dom/html/crashtests/504183-1.html12
-rw-r--r--dom/html/crashtests/515829-1.html7
-rw-r--r--dom/html/crashtests/515829-2.html7
-rw-r--r--dom/html/crashtests/564461.xhtml26
-rw-r--r--dom/html/crashtests/570566-1.html2
-rw-r--r--dom/html/crashtests/571428-1.html14
-rw-r--r--dom/html/crashtests/580507-1.xhtml18
-rw-r--r--dom/html/crashtests/590387.html8
-rw-r--r--dom/html/crashtests/596785-1.html9
-rw-r--r--dom/html/crashtests/596785-2.html9
-rw-r--r--dom/html/crashtests/601422.html23
-rw-r--r--dom/html/crashtests/602117.html8
-rw-r--r--dom/html/crashtests/604807.html9
-rw-r--r--dom/html/crashtests/605264.html8
-rw-r--r--dom/html/crashtests/606430-1.html31
-rw-r--r--dom/html/crashtests/613027.html21
-rw-r--r--dom/html/crashtests/614279.html18
-rw-r--r--dom/html/crashtests/614988-1.html5
-rw-r--r--dom/html/crashtests/616401.html8
-rw-r--r--dom/html/crashtests/620078-1.html20
-rw-r--r--dom/html/crashtests/620078-2.html6
-rw-r--r--dom/html/crashtests/631421.html34
-rw-r--r--dom/html/crashtests/631421.pngbin0 -> 38661 bytes
-rw-r--r--dom/html/crashtests/673853.html20
-rw-r--r--dom/html/crashtests/680922-1.xul9
-rw-r--r--dom/html/crashtests/680922-binding.xml7
-rw-r--r--dom/html/crashtests/682058.xhtml11
-rw-r--r--dom/html/crashtests/682460.html21
-rw-r--r--dom/html/crashtests/68912-1.html24
-rw-r--r--dom/html/crashtests/738744.xhtml4
-rw-r--r--dom/html/crashtests/741218.json1
-rw-r--r--dom/html/crashtests/741218.json^headers^1
-rw-r--r--dom/html/crashtests/741250.xhtml9
-rw-r--r--dom/html/crashtests/795221-1.html7
-rw-r--r--dom/html/crashtests/795221-2.html9
-rw-r--r--dom/html/crashtests/795221-3.html14
-rw-r--r--dom/html/crashtests/795221-4.html9
-rw-r--r--dom/html/crashtests/795221-5.xml6
-rw-r--r--dom/html/crashtests/798802-1.html18
-rw-r--r--dom/html/crashtests/811226.html6
-rw-r--r--dom/html/crashtests/819745.html5
-rw-r--r--dom/html/crashtests/828180.html5
-rw-r--r--dom/html/crashtests/828472.html6
-rw-r--r--dom/html/crashtests/837033.html4
-rw-r--r--dom/html/crashtests/838256-1.html20
-rw-r--r--dom/html/crashtests/862084.html9
-rw-r--r--dom/html/crashtests/865147.html7
-rw-r--r--dom/html/crashtests/877910.html1
-rw-r--r--dom/html/crashtests/903106.html3
-rw-r--r--dom/html/crashtests/916322-1.html10
-rw-r--r--dom/html/crashtests/916322-2.html10
-rw-r--r--dom/html/crashtests/crashtests.list81
88 files changed, 1282 insertions, 0 deletions
diff --git a/dom/html/crashtests/1032654.html b/dom/html/crashtests/1032654.html
new file mode 100644
index 000000000..3067e1077
--- /dev/null
+++ b/dom/html/crashtests/1032654.html
@@ -0,0 +1 @@
+<template>&#x000d;#
diff --git a/dom/html/crashtests/1141260.html b/dom/html/crashtests/1141260.html
new file mode 100644
index 000000000..c5ced3a44
--- /dev/null
+++ b/dom/html/crashtests/1141260.html
@@ -0,0 +1,4 @@
+<img src="foo" srcset="bar">
+<script>
+ document.querySelector("img").removeAttribute('src');
+</script>
diff --git a/dom/html/crashtests/1228876.html b/dom/html/crashtests/1228876.html
new file mode 100644
index 000000000..b7beb645c
--- /dev/null
+++ b/dom/html/crashtests/1228876.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var a = document.createElement("select");
+ var f = document.createElement("optgroup");
+ var g = document.createElement("optgroup");
+ a.appendChild(f);
+ g.appendChild(document.createElement("option"));
+ f.appendChild(g);
+ a.appendChild(document.createElement("option"));
+ document.body.appendChild(a);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/1230110.html b/dom/html/crashtests/1230110.html
new file mode 100644
index 000000000..9802dd775
--- /dev/null
+++ b/dom/html/crashtests/1230110.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+// This test case should not leak.
+function leak()
+{
+ var img = document.createElement("img");
+ var iframe = document.createElement("iframe");
+ img.appendChild(iframe);
+ document.body.appendChild(img);
+
+ document.addEventListener('Foo', function(){}, false);
+}
+</script>
+</head>
+<body onload="leak();"></body>
+</html>
diff --git a/dom/html/crashtests/1237633.html b/dom/html/crashtests/1237633.html
new file mode 100644
index 000000000..c235f0315
--- /dev/null
+++ b/dom/html/crashtests/1237633.html
@@ -0,0 +1 @@
+<img srcset="data:,a 2400w" sizes="(min-width: 1px) calc(300px - 100vw)">
diff --git a/dom/html/crashtests/1281972-1.html b/dom/html/crashtests/1281972-1.html
new file mode 100644
index 000000000..6fa5bb250
--- /dev/null
+++ b/dom/html/crashtests/1281972-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<body onload="window[0].document.forms[0].submit();">
+<iframe src="data:text/html;charset=UTF-8,<form accept-charset=HZ-GB-2312>"></iframe>
+</body>
diff --git a/dom/html/crashtests/1282894.html b/dom/html/crashtests/1282894.html
new file mode 100644
index 000000000..456a4541f
--- /dev/null
+++ b/dom/html/crashtests/1282894.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+ var table = document.createElement("table");
+ var cap = document.createElement("caption");
+ cap.appendChild(table)
+ table.caption = cap;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/1290904.html b/dom/html/crashtests/1290904.html
new file mode 100644
index 000000000..5ea23ba3b
--- /dev/null
+++ b/dom/html/crashtests/1290904.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+ <body>
+ <fieldset id="outer">
+ <fieldset id="inner">
+ </fieldset>
+ </fieldset>
+ </body>
+</html>
+<script>
+function appendTextareaToFieldset(fieldset) {
+ var textarea = document.createElement("textarea");
+ textarea.setAttribute("required", "");
+ fieldset.appendChild(textarea);
+}
+
+var innerFieldset = document.getElementById('inner');
+var outerFieldset = document.getElementById('outer');
+
+var fieldset = document.createElement('fieldset');
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+
+// Adding a fieldset to a nested fieldset.
+innerFieldset.appendChild(fieldset);
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+// This triggers mInvalidElementsCount checks in outer fieldset.
+appendTextareaToFieldset(outerFieldset);
+
+// Removing a fieldset from a nested fieldset.
+innerFieldset.removeChild(fieldset);
+// This triggers mInvalidElementsCount checks in outer fieldset.
+appendTextareaToFieldset(outerFieldset);
+</script>
diff --git a/dom/html/crashtests/1386905.html b/dom/html/crashtests/1386905.html
new file mode 100644
index 000000000..6ecc59e23
--- /dev/null
+++ b/dom/html/crashtests/1386905.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+document.documentElement.getBoundingClientRect()
+document.documentElement.innerHTML = "<input placeholder=e type=number readonly>"
+document.designMode = "on"
+document.execCommand("inserttext", false, "")
+document.designMode = "off"
+document.documentElement.style.display = 'none'
+</script>
+</head>
+</html>
diff --git a/dom/html/crashtests/257818-1.html b/dom/html/crashtests/257818-1.html
new file mode 100644
index 000000000..162390efa
--- /dev/null
+++ b/dom/html/crashtests/257818-1.html
@@ -0,0 +1,82 @@
+<html><head>
+<script type="text/javascript">
+function cE (v) {
+ return document.createElement(v)
+}
+function cTN (v) {
+ return document.createTextNode(v)
+}
+
+function OSXBarIcon(elt) {
+ this.element = elt;
+ this.labelNode = this.element.firstChild;
+ this.labelNodeParent = this.element;
+ this.labelNodeParent.removeChild(this.labelNode);
+
+ this.contents = [];
+ var kids = this.element.childNodes;
+ for(var i=0; i<kids.length; i++) this.contents[this.contents.length] = this.element.removeChild(kids[i]);
+ this.popupSubmenu = new OSXBarSubmenu(this);
+}
+
+function OSXBarSubmenu(icon) {
+ this.parentIcon = icon;
+ this.create();
+ this.addContent();
+}
+OSXBarSubmenu.prototype = {
+ create : function() {
+ var p = this.popupNode = document.createElement("div");
+ var b = document.getElementsByTagName("body").item(0);
+ if(b) b.appendChild(p);
+ this.popupNode.style.display = "none";
+ // Uncomment next line to fix the problem
+// var v = document.body.offsetWidth;
+ }
+};
+OSXBarSubmenu.prototype.addContent = function() {
+
+ // add popup label:
+ var label = document.createElement("div");
+ label.appendChild(document.createTextNode(this.parentIcon.label));
+ this.popupNode.appendChild(label);
+
+ // add <li> children to the popup:
+ var contents = this.parentIcon.contents;
+ for(var i=0; i<contents.length; i++) {
+ this.popupNode.appendChild(contents[i]);
+
+ }
+};
+
+</script>
+
+<script type="text/javascript">
+function createControlPanel() {
+ var bar = document.getElementById("navigation");
+ var item = cE("li");
+ item.appendChild(cTN("aaa"));
+ var textfield = cE("input");
+ textfield.value = 0;
+ item.appendChild(textfield);
+ bar.insertBefore(item, bar.firstChild);
+}
+
+window.addEventListener("load", createControlPanel, false);
+</script>
+
+<script type="text/javascript">
+function ssload() {
+ new OSXBarIcon(document.getElementById("navigation").childNodes[0]);
+}
+window.addEventListener("load",ssload,false);
+
+
+</script>
+</head>
+
+<body>
+<ul id="navigation"></ul>
+</body></html>
+
+
diff --git a/dom/html/crashtests/285166-1.html b/dom/html/crashtests/285166-1.html
new file mode 100644
index 000000000..8a73d7d74
--- /dev/null
+++ b/dom/html/crashtests/285166-1.html
@@ -0,0 +1,3 @@
+<script>
+document.createElement("#text");
+</script>
diff --git a/dom/html/crashtests/294235-1.html b/dom/html/crashtests/294235-1.html
new file mode 100644
index 000000000..00eed38f4
--- /dev/null
+++ b/dom/html/crashtests/294235-1.html
@@ -0,0 +1,14 @@
+<html>
+ <head>
+ <title>bug 294235</title>
+ <script>
+ function countdown(){
+ count2.innerHTML="foo";
+ }
+ document.links.length;
+ </script>
+ </head>
+ <body>
+ <strong><div id="count2"><script>countdown();</script><noscript>bar</noscript></div></strong>
+ </body>
+</html>
diff --git a/dom/html/crashtests/307616-1.html b/dom/html/crashtests/307616-1.html
new file mode 100644
index 000000000..8f28ddd6e
--- /dev/null
+++ b/dom/html/crashtests/307616-1.html
@@ -0,0 +1,8 @@
+<html>
+<head><title>Testcase for assertion</title></head>
+<body>
+
+<input type="image" src="./nosuch.gif" alt="Search">
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/html/crashtests/324918-1.xhtml b/dom/html/crashtests/324918-1.xhtml
new file mode 100644
index 000000000..921714cff
--- /dev/null
+++ b/dom/html/crashtests/324918-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+
+function init()
+{
+ var sel = document.getElementById("sel");
+ var div = document.getElementById("div");
+ var newo = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+
+ sel.appendChild(div);
+ div.appendChild(newo);
+ sel.removeChild(div);
+}
+
+</script>
+</head>
+<body onload="init();">
+
+<div id="div"><option></option></div>
+
+<select id="sel"></select>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/338649-1.xhtml b/dom/html/crashtests/338649-1.xhtml
new file mode 100644
index 000000000..b0bf3186f
--- /dev/null
+++ b/dom/html/crashtests/338649-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>ASSERTION: Options collection broken</title>
+</head>
+
+<body>
+
+<div>
+
+<select>
+ <option id="n29">B
+ <optgroup label="middle" id="n20">
+ <option>N</option>
+ </optgroup>
+ </option>
+ <option>M</option>
+</select>
+
+</div>
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/html/crashtests/339501-1.xhtml b/dom/html/crashtests/339501-1.xhtml
new file mode 100644
index 000000000..1a231ee64
--- /dev/null
+++ b/dom/html/crashtests/339501-1.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+
+function boom()
+{
+ document.addEventListener("DOMNodeRemoved", foo, false);
+ remove(document.getElementById("A"));
+ document.removeEventListener("DOMNodeRemoved", foo, false);
+
+ function foo()
+ {
+ document.removeEventListener("DOMNodeRemoved", foo, false);
+ remove(document.getElementById("B"));
+ }
+}
+
+
+window.addEventListener("load", boom, false);
+
+function remove(q1) { q1.parentNode.removeChild(q1); }
+
+</script>
+
+</head>
+
+<body>
+
+<select><option id="A">A</option><option id="B">B</option></select>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/339501-2.xhtml b/dom/html/crashtests/339501-2.xhtml
new file mode 100644
index 000000000..6a1835fb7
--- /dev/null
+++ b/dom/html/crashtests/339501-2.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+
+function boom()
+{
+ document.addEventListener("DOMNodeRemoved", foo, false);
+ remove(document.getElementById("B"));
+ document.removeEventListener("DOMNodeRemoved", foo, false);
+
+ function foo()
+ {
+ document.removeEventListener("DOMNodeRemoved", foo, false);
+ remove(document.getElementById("A"));
+ }
+}
+
+
+window.addEventListener("load", boom, false);
+
+function remove(q1) { q1.parentNode.removeChild(q1); }
+
+</script>
+
+</head>
+
+<body>
+
+<select><option id="A">A</option><option id="B">B</option></select>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/378993-1.xhtml b/dom/html/crashtests/378993-1.xhtml
new file mode 100644
index 000000000..99cbb01da
--- /dev/null
+++ b/dom/html/crashtests/378993-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<script>
+document.createElement('AREA');
+</script>
+</body>
+</html>
diff --git a/dom/html/crashtests/382568-1-inner.xhtml b/dom/html/crashtests/382568-1-inner.xhtml
new file mode 100644
index 000000000..a3685f4c6
--- /dev/null
+++ b/dom/html/crashtests/382568-1-inner.xhtml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<!DOCTYPE html
+PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml"> <head>
+<title>Test</title>
+<script type="text/javascript"><![CDATA[
+
+function onAttrModified(evt) {
+// window.alert("Mutation event fired within the frame code.");
+// evt.target.focus();
+// evt.target.blur();
+ evt.target.style.background = 'green';
+ bounce(evt.target);
+// evt.target.normalize();
+// bounce(evt.target.parentNode);
+}
+function die(n) {
+ p = n.parentNode;
+ p.removeChild(n);
+}
+
+function bounce(n) {
+ p = n.parentNode;
+ p.removeChild(n);
+ p.appendChild(n);
+}
+
+
+function test_AttrModified() {
+ var x = document.getElementById("x");
+ x.addEventListener("DOMAttrModified", onAttrModified, false);
+ bounce(x);
+}
+
+function test() {
+ setTimeout(test_AttrModified, 3000);
+}
+]]></script>
+</head>
+
+<body onload="test()">
+<h1>TestCase for unsafe mutable events from textarea</h1>
+<p>Please wait for 3 seconds after document was loaded,
+if your browser is vulnerable, it may stop responding
+to keyboard and mouse event
+and most likely it will eventually crash (may take a
+while for debug builds).</p>
+<p>
+<textarea id="x"></textarea>
+</p>
+</body> </html>
diff --git a/dom/html/crashtests/382568-1.html b/dom/html/crashtests/382568-1.html
new file mode 100644
index 000000000..c10c71fd1
--- /dev/null
+++ b/dom/html/crashtests/382568-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 3500);
+</script>
+<body>
+<iframe src="382568-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/dom/html/crashtests/383137.xhtml b/dom/html/crashtests/383137.xhtml
new file mode 100644
index 000000000..87d853c03
--- /dev/null
+++ b/dom/html/crashtests/383137.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">//<![CDATA[
+function doe(){
+document.documentElement.setAttribute('style', '');
+}
+
+setTimeout(doe,100);
+//]]></script>
+
+<style style="overflow: scroll; display: block;">
+style::before {content: counter(section); }
+</style>
+</html> \ No newline at end of file
diff --git a/dom/html/crashtests/388183-1.html b/dom/html/crashtests/388183-1.html
new file mode 100644
index 000000000..fcca410e9
--- /dev/null
+++ b/dom/html/crashtests/388183-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+</head>
+<body>
+<div contenteditable="true"></div>
+</body>
+</html>
diff --git a/dom/html/crashtests/395340-1.html b/dom/html/crashtests/395340-1.html
new file mode 100644
index 000000000..ddbccfe96
--- /dev/null
+++ b/dom/html/crashtests/395340-1.html
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var div1 = document.createElement("div");
+ div1.style.counterIncrement = "chicken";
+ div1.contentEditable = "true";
+
+ var div2 = document.createElement("div");
+ div2.style.counterIncrement = "chicken";
+
+ document.body.style.content = "'A'";
+
+ div1.appendChild(div2);
+ document.body.appendChild(div1);
+ div1.removeChild(div2);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+</body>
+</html>
diff --git a/dom/html/crashtests/399694-1.html b/dom/html/crashtests/399694-1.html
new file mode 100644
index 000000000..e6db2342b
--- /dev/null
+++ b/dom/html/crashtests/399694-1.html
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+ var legend = document.createElementNS("http://www.w3.org/1999/xhtml", "legend")
+ var input = document.getElementById("input");
+ input.appendChild(legend);
+ legend.focus();
+
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(boom, 3);" contenteditable="true">
+
+<input contenteditable="false"><input id="input"><q><div></div></q>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/407053.html b/dom/html/crashtests/407053.html
new file mode 100644
index 000000000..b80a23172
--- /dev/null
+++ b/dom/html/crashtests/407053.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.execCommand('copy', false, '');">
+<div contenteditable="true"></div>
+</body>
+</html>
diff --git a/dom/html/crashtests/423371-1.html b/dom/html/crashtests/423371-1.html
new file mode 100644
index 000000000..0069cf95d
--- /dev/null
+++ b/dom/html/crashtests/423371-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<div style="position:fixed; top:100px;" id="d">hello</div>
+<script>
+document.write(document.getElementById("d").offsetTop);
+</script>
+</body>
+</html>
diff --git a/dom/html/crashtests/448564.html b/dom/html/crashtests/448564.html
new file mode 100644
index 000000000..f31830afa
--- /dev/null
+++ b/dom/html/crashtests/448564.html
@@ -0,0 +1,7 @@
+<s>
+<form>a</form>
+<iframe></iframe>
+<script src=a></script>
+<form></form>
+<table>
+<optgroup>
diff --git a/dom/html/crashtests/451123-1.html b/dom/html/crashtests/451123-1.html
new file mode 100644
index 000000000..abf23c1e7
--- /dev/null
+++ b/dom/html/crashtests/451123-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<input type="file" type="file">
+</body>
+</html>
diff --git a/dom/html/crashtests/453406-1.html b/dom/html/crashtests/453406-1.html
new file mode 100644
index 000000000..4017c97ca
--- /dev/null
+++ b/dom/html/crashtests/453406-1.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+<script type="text/javascript">
+function boom()
+{
+ var r = document.documentElement;
+ while (r.firstChild)
+ r.removeChild(r.firstChild);
+
+ var b = document.createElement("BODY");
+ var s = document.createElement("SCRIPT");
+ var f1 = document.createElement("FORM");
+ var i = document.createElement("INPUT");
+ var br = document.createElement("BR");
+ var f2 = document.createElement("FORM");
+ var span = document.createElement("SPAN");
+ f1.appendChild(i);
+ f1.appendChild(br);
+ s.appendChild(f1);
+ b.appendChild(s);
+ f2.appendChild(span);
+ b.appendChild(f2)
+ document.documentElement.appendChild(b);
+ b.contentEditable = "true";
+ document.execCommand("indent", false, null);
+ b.contentEditable = "false";
+ span.appendChild(i);
+ i.parentNode.removeChild(i);
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/html/crashtests/464197-1.html b/dom/html/crashtests/464197-1.html
new file mode 100644
index 000000000..785686023
--- /dev/null
+++ b/dom/html/crashtests/464197-1.html
@@ -0,0 +1,23 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+var i = 0;
+
+function boom()
+{
+ var s = document.createElement("span");
+ s.innerHTML = "<audio src='javascript:5'><\/audio>";
+ s.innerHTML = "";
+
+ if (++i < 10)
+ setTimeout(boom, 0);
+ else
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/html/crashtests/465466-1.xhtml b/dom/html/crashtests/465466-1.xhtml
new file mode 100644
index 000000000..4e1258702
--- /dev/null
+++ b/dom/html/crashtests/465466-1.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="u">
+<content><foopy><children xmlns="http://www.mozilla.org/xbl"/></foopy></content>
+</binding></bindings>
+
+
+<script type="text/javascript">
+
+function boom()
+{
+ var f = document.getElementById("f");
+ var anon = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(f))[0];
+ document.body.removeChild(f);
+ anon.appendChild(document.createElement("label"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"><form id="f" style="-moz-binding: url(#u);"><label></label></form></body>
+</html>
diff --git a/dom/html/crashtests/468562-1.html b/dom/html/crashtests/468562-1.html
new file mode 100644
index 000000000..81123fe2e
--- /dev/null
+++ b/dom/html/crashtests/468562-1.html
@@ -0,0 +1,6 @@
+<html>
+<head></head>
+<body>
+<table><script>document.write("Q");</script><link>
+</body>
+</html>
diff --git a/dom/html/crashtests/468562-2.html b/dom/html/crashtests/468562-2.html
new file mode 100644
index 000000000..e0db5cd97
--- /dev/null
+++ b/dom/html/crashtests/468562-2.html
@@ -0,0 +1,6 @@
+<html>
+<head></head>
+<body>
+<table><script>document.write("Q");</script><link></table>
+</body>
+</html>
diff --git a/dom/html/crashtests/494225.html b/dom/html/crashtests/494225.html
new file mode 100644
index 000000000..a78051d2a
--- /dev/null
+++ b/dom/html/crashtests/494225.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html><head><script>
+ var x = "f: '" + document.fgColor +
+ "' b: '" + document.bgColor +
+ "' l: '" + document.linkColor +
+ "' a: '" + document.alinkColor +
+ "' v: '" + document.vlinkColor + "'";
+</script></head><body
+onload="document.body.appendChild(document.createTextNode(x))"
+></body></html>
diff --git a/dom/html/crashtests/495543.svg b/dom/html/crashtests/495543.svg
new file mode 100644
index 000000000..b795796ad
--- /dev/null
+++ b/dom/html/crashtests/495543.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script type="text/javascript">
+
+function boom()
+{
+ var htmlBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ document.documentElement.appendChild(htmlBody);
+ htmlBody.setAttribute('vlink', "transparent");
+ document.height;
+ document.vlinkColor;
+}
+
+window.addEventListener("load", boom, false);
+</script>
+
+</svg>
diff --git a/dom/html/crashtests/495546-1.html b/dom/html/crashtests/495546-1.html
new file mode 100644
index 000000000..0547b9867
--- /dev/null
+++ b/dom/html/crashtests/495546-1.html
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var video = document.createElement("video");
+ var source = document.createElement("source");
+ source.setAttributeNS(null, "src", "http://127.0.0.1/");
+ video.appendChild(source);
+ document.body.appendChild(video);
+ setTimeout(function() { document.body.removeChild(video); }, 20);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/504183-1.html b/dom/html/crashtests/504183-1.html
new file mode 100644
index 000000000..e44db4152
--- /dev/null
+++ b/dom/html/crashtests/504183-1.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait">
+<input id="a" type="file">
+<script>
+function doe() {
+var elem = document.getElementById('a');
+elem.style.display = "none";
+elem.focus();
+document.documentElement.className = "";
+}
+setTimeout(doe, 0);
+</script>
+</html>
diff --git a/dom/html/crashtests/515829-1.html b/dom/html/crashtests/515829-1.html
new file mode 100644
index 000000000..e2fc655c0
--- /dev/null
+++ b/dom/html/crashtests/515829-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body onload="document.getElementById('x').innerHTML = '<button></button>';">
+<form><div id="x"><button></button></div><button></button></form>
+</body>
+</html>
diff --git a/dom/html/crashtests/515829-2.html b/dom/html/crashtests/515829-2.html
new file mode 100644
index 000000000..6de6d5986
--- /dev/null
+++ b/dom/html/crashtests/515829-2.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body onload="document.getElementById('x').innerHTML = '<button></button>';">
+<form><div id="x"><button></button></div><button></button><input type="image"></form>
+</body>
+</html>
diff --git a/dom/html/crashtests/564461.xhtml b/dom/html/crashtests/564461.xhtml
new file mode 100644
index 000000000..9a7bfeb24
--- /dev/null
+++ b/dom/html/crashtests/564461.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+ <binding id="editable"><content><div contenteditable="true" xmlns="http://www.w3.org/1999/xhtml"></div></content></binding>
+</bindings>
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+ while (document.documentElement.firstChild) document.documentElement.removeChild(document.documentElement.firstChild);
+
+ document.addEventListener("DOMSubtreeModified", function(){}, false);
+ document.addEventListener("DOMNodeInsertedIntoDocument", function(){}, false);
+ document.documentElement.appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "body"));
+ document.body.style.MozBinding = 'url(#editable)';
+}
+
+]]>
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/570566-1.html b/dom/html/crashtests/570566-1.html
new file mode 100644
index 000000000..70ec003a6
--- /dev/null
+++ b/dom/html/crashtests/570566-1.html
@@ -0,0 +1,2 @@
+<body onload="document.getElementById('i').removeAttribute('type')"><input id=i type=image></body>
+
diff --git a/dom/html/crashtests/571428-1.html b/dom/html/crashtests/571428-1.html
new file mode 100644
index 000000000..ae2b960ca
--- /dev/null
+++ b/dom/html/crashtests/571428-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ var i = document.getElementById("i");
+ i.setAttribute("type", "button");
+ i.removeAttribute("type");
+}
+</script>
+</head>
+<body onload="boom();"><input id="i"></body>
+</html>
diff --git a/dom/html/crashtests/580507-1.xhtml b/dom/html/crashtests/580507-1.xhtml
new file mode 100644
index 000000000..eff3fb255
--- /dev/null
+++ b/dom/html/crashtests/580507-1.xhtml
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var input = document.getElementById("i");
+ input.setAttribute('type', "image");
+ input.removeAttribute('type');
+ input.placeholder = "Y";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><input id="i" /></body>
+</html>
diff --git a/dom/html/crashtests/590387.html b/dom/html/crashtests/590387.html
new file mode 100644
index 000000000..50cd05ac9
--- /dev/null
+++ b/dom/html/crashtests/590387.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+document.createElement("div").innerHTML = "<output form=x>";
+</script>
+</head>
+</html>
diff --git a/dom/html/crashtests/596785-1.html b/dom/html/crashtests/596785-1.html
new file mode 100644
index 000000000..5d830628b
--- /dev/null
+++ b/dom/html/crashtests/596785-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <body onload="document.getElementById('i').type = 'image';
+ document.documentElement.className = '';">
+ <form>
+ <input id='i' required>
+ </form>
+ </body>
+</html>
diff --git a/dom/html/crashtests/596785-2.html b/dom/html/crashtests/596785-2.html
new file mode 100644
index 000000000..18cfe2788
--- /dev/null
+++ b/dom/html/crashtests/596785-2.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <body onload="document.getElementById('i').type = 'text';
+ document.documentElement.className = '';">
+ <form>
+ <input id='i' type='image' required>
+ </form>
+ </body>
+</html>
diff --git a/dom/html/crashtests/601422.html b/dom/html/crashtests/601422.html
new file mode 100644
index 000000000..d3468a306
--- /dev/null
+++ b/dom/html/crashtests/601422.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var frame = document.getElementById("f");
+ var frameDoc = frame.contentDocument;
+ document.body.removeChild(frame);
+ try { frameDoc.shrinkToFit(); }catch(e){}
+ try { frameDoc.restoreImageTo(1,1); }catch(e){}
+ try { frameDoc.restoreImage(); }catch(e){}
+ try { frameDoc.toggleImageSize(); }catch(e){}
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="f" src="data:image/gif;base64,R0lGODlhAQABAID/AP///wAAACwAAAAAAQABAAACAkQBADs="></iframe>
+</body>
+</html>
diff --git a/dom/html/crashtests/602117.html b/dom/html/crashtests/602117.html
new file mode 100644
index 000000000..0d1818b2a
--- /dev/null
+++ b/dom/html/crashtests/602117.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+ <script>
+ var isindex = document.createElement("isindex");
+ isindex.setAttribute("form", "f");
+ isindex.form;
+ </script>
+</html>
diff --git a/dom/html/crashtests/604807.html b/dom/html/crashtests/604807.html
new file mode 100644
index 000000000..a519a778f
--- /dev/null
+++ b/dom/html/crashtests/604807.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<script>
+try {
+ var selectElem = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
+ selectElem.QueryInterface(Components.interfaces.nsISelectElement);
+ selectElem.getOptionIndex(null, 0, true);
+} catch (e) {
+}
+</script>
diff --git a/dom/html/crashtests/605264.html b/dom/html/crashtests/605264.html
new file mode 100644
index 000000000..3c1db3578
--- /dev/null
+++ b/dom/html/crashtests/605264.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var v = document.createElementNS("http://www.w3.org/1999/xhtml", "video");
+v.QueryInterface(Components.interfaces.nsIObserver);
+v.observe(null, null, null);
+
+</script>
diff --git a/dom/html/crashtests/606430-1.html b/dom/html/crashtests/606430-1.html
new file mode 100644
index 000000000..c347e3c9f
--- /dev/null
+++ b/dom/html/crashtests/606430-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var r = document.documentElement;
+ var i = document.getElementById("i");
+
+ document.removeChild(r);
+ document.appendChild(r);
+ w("dump('A\\n')");
+ document.removeChild(r);
+ w("dump('B\\n')");
+ document.appendChild(r);
+
+ function w(s)
+ {
+ var ns = document.createElement("script");
+ var nt = document.createTextNode(s);
+ ns.appendChild(nt);
+ i.appendChild(ns);
+ }
+}
+
+</script>
+</head>
+
+<body onload="boom();"><input id="i"></body>
+</html>
diff --git a/dom/html/crashtests/613027.html b/dom/html/crashtests/613027.html
new file mode 100644
index 000000000..a866860f1
--- /dev/null
+++ b/dom/html/crashtests/613027.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var a = document.createElementNS("http://www.w3.org/1999/xhtml", "fieldset");
+ var b = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");
+ var c = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+
+ a.appendChild(b);
+ a.appendChild(c);
+ a.removeChild(b);
+ c.expandoQ = a;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/614279.html b/dom/html/crashtests/614279.html
new file mode 100644
index 000000000..ff1c50516
--- /dev/null
+++ b/dom/html/crashtests/614279.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var a = document.createElementNS("http://www.w3.org/1999/xhtml", "datalist");
+ var b = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+
+ a.appendChild(b);
+ b.expando = a.options;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/614988-1.html b/dom/html/crashtests/614988-1.html
new file mode 100644
index 000000000..931f83ac7
--- /dev/null
+++ b/dom/html/crashtests/614988-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head><script>window.addEventListener("load", function() { var t = document.getElementById("t"); t.appendChild(t.previousSibling); }, false);</script></head>
+<body><fieldset><legend></legend><textarea id="t"></textarea></fieldset></body>
+</html>
diff --git a/dom/html/crashtests/616401.html b/dom/html/crashtests/616401.html
new file mode 100644
index 000000000..eb5a0bcf4
--- /dev/null
+++ b/dom/html/crashtests/616401.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<script>
+var c = document.createElement("canvas");
+c.getContext("experimental-webgl", {
+ get a() { throw 7; },
+ get b() { throw 8; }
+});
+</script>
diff --git a/dom/html/crashtests/620078-1.html b/dom/html/crashtests/620078-1.html
new file mode 100644
index 000000000..39462706c
--- /dev/null
+++ b/dom/html/crashtests/620078-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var frame = document.getElementById("f");
+ var frameRoot = frame.contentDocument.documentElement;
+ document.body.removeChild(frame);
+ var i = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+ i.setAttribute("autofocus", "true");
+ frameRoot.appendChild(i);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body>
+</html>
diff --git a/dom/html/crashtests/620078-2.html b/dom/html/crashtests/620078-2.html
new file mode 100644
index 000000000..1be23fa1f
--- /dev/null
+++ b/dom/html/crashtests/620078-2.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+ <body onload='document.cloneNode(1)'>
+ <button autofocus></button>
+ </body>
+</html>
diff --git a/dom/html/crashtests/631421.html b/dom/html/crashtests/631421.html
new file mode 100644
index 000000000..e4a7b9192
--- /dev/null
+++ b/dom/html/crashtests/631421.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+"use strict";
+
+var f2;
+
+function newIframe()
+{
+ var f = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ f.setAttributeNS(null, "src", "631421.png");
+ document.body.appendChild(f);
+ return f;
+}
+
+function b1()
+{
+ void newIframe();
+ f2 = newIframe();
+ setTimeout(b2, 0);
+}
+
+function b2()
+{
+ document.body.removeChild(f2);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="b1();"></body>
+</html>
diff --git a/dom/html/crashtests/631421.png b/dom/html/crashtests/631421.png
new file mode 100644
index 000000000..ef350c467
--- /dev/null
+++ b/dom/html/crashtests/631421.png
Binary files differ
diff --git a/dom/html/crashtests/673853.html b/dom/html/crashtests/673853.html
new file mode 100644
index 000000000..1325fa9ed
--- /dev/null
+++ b/dom/html/crashtests/673853.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var otherDoc = document.implementation.createDocument('', '', null);
+ var input = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "input");
+ var form = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "form");
+ input.setAttributeNS(null, "form", "x");
+ form.setAttributeNS(null, "id", "x");
+ input.appendChild(form);
+ otherDoc.appendChild(input);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/680922-1.xul b/dom/html/crashtests/680922-1.xul
new file mode 100644
index 000000000..2fd1784f6
--- /dev/null
+++ b/dom/html/crashtests/680922-1.xul
@@ -0,0 +1,9 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<box id="e">
+<box id="b" name="e" style="-moz-binding:url(680922-binding.xml#xbl);">
+</box>
+</box>
+
+</window>
diff --git a/dom/html/crashtests/680922-binding.xml b/dom/html/crashtests/680922-binding.xml
new file mode 100644
index 000000000..86cb0932b
--- /dev/null
+++ b/dom/html/crashtests/680922-binding.xml
@@ -0,0 +1,7 @@
+<bindings xmlns="http://www.mozilla.org/xbl" xmlns:html="http://www.w3.org/1999/xhtml">
+<binding id="xbl" inheritstyle="false">
+<content>
+<html:form id="g" observes="b"/>
+</content>
+</binding>
+</bindings>
diff --git a/dom/html/crashtests/682058.xhtml b/dom/html/crashtests/682058.xhtml
new file mode 100644
index 000000000..95e7da98f
--- /dev/null
+++ b/dom/html/crashtests/682058.xhtml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body onload="test()">
+ <script>
+ function test() {
+ document.body.innerHTML = "Foobar";
+ }
+ document.addEventListener("DOMNodeRemoved", function() {});
+ </script>
+ </body>
+</html>
diff --git a/dom/html/crashtests/682460.html b/dom/html/crashtests/682460.html
new file mode 100644
index 000000000..91306be71
--- /dev/null
+++ b/dom/html/crashtests/682460.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var f = function() {
+ document.documentElement.offsetHeight;
+ };
+ window.addEventListener("DOMSubtreeModified", f, true);
+
+ document.getElementsByTagName("table")[0].setAttribute("cellpadding", "2");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<table><tr><td></td></tr></table>
+</body>
+</html>
diff --git a/dom/html/crashtests/68912-1.html b/dom/html/crashtests/68912-1.html
new file mode 100644
index 000000000..bdd2ab461
--- /dev/null
+++ b/dom/html/crashtests/68912-1.html
@@ -0,0 +1,24 @@
+<html>
+<head>
+<title>Crash TR.cells = null</title>
+<script language="javascript">
+function crashme()
+{
+ var elm = document.createElement('tr');
+
+ elm.cells = null;
+}
+
+</script>
+</head>
+<body onload="crashme()">
+
+<p>
+This test case creates a TR element then tries to assign to the cells property
+</p>
+<p>
+Crash
+</p>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/738744.xhtml b/dom/html/crashtests/738744.xhtml
new file mode 100644
index 000000000..7f91d0149
--- /dev/null
+++ b/dom/html/crashtests/738744.xhtml
@@ -0,0 +1,4 @@
+<input xmlns="http://www.w3.org/1999/xhtml" form="f">
+ <form id="f" />
+ <input form="f" />
+</input>
diff --git a/dom/html/crashtests/741218.json b/dom/html/crashtests/741218.json
new file mode 100644
index 000000000..0967ef424
--- /dev/null
+++ b/dom/html/crashtests/741218.json
@@ -0,0 +1 @@
+{}
diff --git a/dom/html/crashtests/741218.json^headers^ b/dom/html/crashtests/741218.json^headers^
new file mode 100644
index 000000000..7b5e82d4b
--- /dev/null
+++ b/dom/html/crashtests/741218.json^headers^
@@ -0,0 +1 @@
+Content-Type: application/json
diff --git a/dom/html/crashtests/741250.xhtml b/dom/html/crashtests/741250.xhtml
new file mode 100644
index 000000000..e18a9409f
--- /dev/null
+++ b/dom/html/crashtests/741250.xhtml
@@ -0,0 +1,9 @@
+<input form="f" id="x" xmlns="http://www.w3.org/1999/xhtml">
+<form id="f"></form>
+<script>
+window.addEventListener("load", function() {
+ var x = document.getElementById("x");
+ x.appendChild(x.cloneNode(true));
+}, false);
+</script>
+</input>
diff --git a/dom/html/crashtests/795221-1.html b/dom/html/crashtests/795221-1.html
new file mode 100644
index 000000000..70e400bed
--- /dev/null
+++ b/dom/html/crashtests/795221-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<style>
+ div { }
+</style>
+<script>
+ document.styleSheets[0].cssRules[0].style.foo = document;
+</script>
diff --git a/dom/html/crashtests/795221-2.html b/dom/html/crashtests/795221-2.html
new file mode 100644
index 000000000..fc2aa7d50
--- /dev/null
+++ b/dom/html/crashtests/795221-2.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<style>
+ @media all {
+ div { }
+ }
+</style>
+<script>
+ document.styleSheets[0].cssRules[0].cssRules[0].style.foo = document;
+</script>
diff --git a/dom/html/crashtests/795221-3.html b/dom/html/crashtests/795221-3.html
new file mode 100644
index 000000000..93348af0b
--- /dev/null
+++ b/dom/html/crashtests/795221-3.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+<script>
+ // Create the stylesheet via script, so that the parser's preloading doesn't
+ // make the CSS loader hold on to the sheet we're _not_ trying to form a
+ // cycle through, thus accidentally avoiding the cycle
+ var link = document.createElement("link");
+ link.setAttribute("rel", "stylesheet");
+ link.setAttribute("href", "data:text/css,div { }");
+ link.onload = function () {
+ document.styleSheets[0].cssRules[0].style.foo = document;
+ }
+ document.body.appendChild(link);
+</script>
diff --git a/dom/html/crashtests/795221-4.html b/dom/html/crashtests/795221-4.html
new file mode 100644
index 000000000..476dd3467
--- /dev/null
+++ b/dom/html/crashtests/795221-4.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<svg>
+ <style>
+ div { }
+ </style>
+</svg>
+<script>
+ document.styleSheets[0].cssRules[0].style.foo = document;
+</script>
diff --git a/dom/html/crashtests/795221-5.xml b/dom/html/crashtests/795221-5.xml
new file mode 100644
index 000000000..286dcff0d
--- /dev/null
+++ b/dom/html/crashtests/795221-5.xml
@@ -0,0 +1,6 @@
+<?xml-stylesheet href="data:text/css,div {}"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <script>
+ document.styleSheets[0].cssRules[0].style.foo = document;
+ </script>
+</html>
diff --git a/dom/html/crashtests/798802-1.html b/dom/html/crashtests/798802-1.html
new file mode 100644
index 000000000..92ab50fd8
--- /dev/null
+++ b/dom/html/crashtests/798802-1.html
@@ -0,0 +1,18 @@
+<html>
+ <head>
+ <script>
+ onload = function() {
+ var canvas2d = document.createElement('canvas')
+ canvas2d.setAttribute('width', 0)
+ document.body.appendChild(canvas2d)
+ var ctx2d = canvas2d.getContext('2d')
+ ctx2d.fillStyle = 'black'
+ var gl = document.createElement('canvas').getContext('experimental-webgl')
+ gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, canvas2d)
+ ctx2d.fillRect(0, 0, 1, 1)
+ }
+ </script>
+ </head>
+ <body>
+ </body>
+</html>
diff --git a/dom/html/crashtests/811226.html b/dom/html/crashtests/811226.html
new file mode 100644
index 000000000..990ef9af5
--- /dev/null
+++ b/dom/html/crashtests/811226.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('s').onerror;">
+<span id="s" onerror="0;"></span>
+</body>
+</html>
diff --git a/dom/html/crashtests/819745.html b/dom/html/crashtests/819745.html
new file mode 100644
index 000000000..389e6b8c1
--- /dev/null
+++ b/dom/html/crashtests/819745.html
@@ -0,0 +1,5 @@
+<!doctype="html">
+<body>
+<script>
+ document.body.onerror = null;
+</script>
diff --git a/dom/html/crashtests/828180.html b/dom/html/crashtests/828180.html
new file mode 100644
index 000000000..055c8a34b
--- /dev/null
+++ b/dom/html/crashtests/828180.html
@@ -0,0 +1,5 @@
+<script>
+var table = document.createElement("table");
+table.tHead = null;
+table.tFoot = null;
+</script>
diff --git a/dom/html/crashtests/828472.html b/dom/html/crashtests/828472.html
new file mode 100644
index 000000000..59ce4d280
--- /dev/null
+++ b/dom/html/crashtests/828472.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<input type='date' value='2013-01-01'>
+</body>
+</html>
diff --git a/dom/html/crashtests/837033.html b/dom/html/crashtests/837033.html
new file mode 100644
index 000000000..772d24014
--- /dev/null
+++ b/dom/html/crashtests/837033.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.createElement('button').validity.x = null;"></body>
+</html>
diff --git a/dom/html/crashtests/838256-1.html b/dom/html/crashtests/838256-1.html
new file mode 100644
index 000000000..e1cdc588e
--- /dev/null
+++ b/dom/html/crashtests/838256-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<style>
+
+::-moz-range-track {
+ display: none ! important;
+}
+
+::-moz-range-thumb {
+ display: none ! important;
+}
+
+</style>
+</head>
+<body>
+<input type="range">
+</body>
+</html>
diff --git a/dom/html/crashtests/862084.html b/dom/html/crashtests/862084.html
new file mode 100644
index 000000000..d6d04f74d
--- /dev/null
+++ b/dom/html/crashtests/862084.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<select></select>
+<script>
+var select = document.getElementsByTagName("select");
+select.item(0);
+select[0];
+select.namedItem("x")
+select["x"]
+</script>
diff --git a/dom/html/crashtests/865147.html b/dom/html/crashtests/865147.html
new file mode 100644
index 000000000..841cf8b6d
--- /dev/null
+++ b/dom/html/crashtests/865147.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<select></select>
+<script>
+var select = document.getElementsByTagName("select")[0];
+var newOpt = document.createElement("option");
+select.add(newOpt, newOpt);
+</script>
diff --git a/dom/html/crashtests/877910.html b/dom/html/crashtests/877910.html
new file mode 100644
index 000000000..d454c4478
--- /dev/null
+++ b/dom/html/crashtests/877910.html
@@ -0,0 +1 @@
+<select><option id="foo"><script>document.querySelector("select").namedItem("foo")</script>
diff --git a/dom/html/crashtests/903106.html b/dom/html/crashtests/903106.html
new file mode 100644
index 000000000..fceaf4761
--- /dev/null
+++ b/dom/html/crashtests/903106.html
@@ -0,0 +1,3 @@
+<script>
+ document.createElement("tr").sectionRowIndex;
+</script>
diff --git a/dom/html/crashtests/916322-1.html b/dom/html/crashtests/916322-1.html
new file mode 100644
index 000000000..279a8e59f
--- /dev/null
+++ b/dom/html/crashtests/916322-1.html
@@ -0,0 +1,10 @@
+<canvas height=16 id=gl>
+<script>
+// Without the fix, this would trigger an assertion in the debug build
+document.addEventListener("DOMContentLoaded", DifferentSizes, false);
+function DifferentSizes() {
+ gl.getContext("2d");
+ gl.removeAttribute('height');
+ gl.toBlob(function() { }, false)
+}
+</script>
diff --git a/dom/html/crashtests/916322-2.html b/dom/html/crashtests/916322-2.html
new file mode 100644
index 000000000..29e390119
--- /dev/null
+++ b/dom/html/crashtests/916322-2.html
@@ -0,0 +1,10 @@
+<canvas height=200 id=gl>
+<script>
+// Without the fix, this would trigger an assertion in the debug build
+document.addEventListener("DOMContentLoaded", DifferentSizes, false);
+function DifferentSizes() {
+ gl.getContext("2d");
+ gl.removeAttribute('height');
+ gl.toBlob(function() { }, false)
+}
+</script>
diff --git a/dom/html/crashtests/crashtests.list b/dom/html/crashtests/crashtests.list
new file mode 100644
index 000000000..e55a0a350
--- /dev/null
+++ b/dom/html/crashtests/crashtests.list
@@ -0,0 +1,81 @@
+load 68912-1.html
+load 257818-1.html
+load 285166-1.html
+load 294235-1.html
+load 307616-1.html
+load 324918-1.xhtml
+load 338649-1.xhtml
+load 339501-1.xhtml
+load 339501-2.xhtml
+load 378993-1.xhtml
+load 382568-1.html
+load 383137.xhtml
+load 388183-1.html
+load 395340-1.html
+load 399694-1.html
+load 407053.html
+load 423371-1.html
+load 448564.html
+load 451123-1.html
+load 453406-1.html
+load 464197-1.html
+load 465466-1.xhtml
+load 468562-1.html
+load 468562-2.html
+load 494225.html
+load 495543.svg
+load 495546-1.html
+load 504183-1.html
+load 515829-1.html
+load 515829-2.html
+load 564461.xhtml
+load 570566-1.html
+load 571428-1.html
+load 580507-1.xhtml
+load 590387.html
+load 596785-1.html
+load 596785-2.html
+load 601422.html
+load 602117.html
+load 604807.html
+load 605264.html
+load 606430-1.html
+load 613027.html
+load 614279.html
+load 614988-1.html
+load 620078-1.html
+load 620078-2.html
+load 631421.html
+load 673853.html
+load 680922-1.xul
+load 682058.xhtml
+load 682460.html
+load 738744.xhtml
+load 741218.json
+load 741250.xhtml
+load 795221-1.html
+load 795221-2.html
+load 795221-3.html
+load 795221-4.html
+load 795221-5.xml
+load 811226.html
+load 819745.html
+load 828180.html
+pref(dom.experimental_forms,true) load 828472.html
+load 837033.html
+load 838256-1.html
+load 862084.html
+load 865147.html
+load 877910.html
+load 903106.html
+load 916322-1.html
+load 916322-2.html
+load 1032654.html
+load 1141260.html
+load 1228876.html
+load 1230110.html
+load 1237633.html
+load 1281972-1.html
+load 1282894.html
+load 1290904.html
+load 1386905.html