45 files changed, 1069 insertions, 0 deletions
diff --git a/dom/xbl/crashtests/205735-1.xhtml b/dom/xbl/crashtests/205735-1.xhtml
new file mode 100644
index 000000000..bfc42773b
--- /dev/null
+++ b/dom/xbl/crashtests/205735-1.xhtml
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>Bug 205735</title>
+<xbl:bindings xmlns:xbl="http://www.mozilla.org/xbl" xmlns="http://www.mozilla.org/xbl">
+<binding id="rd">
+<xbl:content xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl"><div><div>binding content<xbl:children/></div></div></xbl:content>
+  <implementation>
+    <constructor>
+    <![CDATA[
+  var x=document.getAnonymousNodes(this)[0];
+  x.removeChild(x.childNodes[0]);
+    ]]>
+    </constructor>  
+  </implementation>
+</binding>
+</xbl:bindings>
+<style type="text/css">
+.chapter{-moz-binding:url(#rd);}
+</style>
+</head>
+<body>
+<div class="chapter">test</div>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/223799-1.xul b/dom/xbl/crashtests/223799-1.xul
new file mode 100644
index 000000000..455ac9e05
--- /dev/null
+++ b/dom/xbl/crashtests/223799-1.xul
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  >
+  <bindings xmlns="http://www.mozilla.org/xbl">
+    <binding id="foo">
+      <content><xul:box><xul:box><children/></xul:box></xul:box></content>
+    </binding>
+      <implementation>
+        <field name="box">document.getAnonymousNodes(this)[0]</field>
+      </implementation>
+  </bindings>
+  <html:style type="text/css">
+  <!-- CSS style rules for XBL bindings go here -->
+  <![CDATA[
+foo {
+  -moz-binding: url("#foo");
+}
+  ]]>
+  </html:style>
+  <!-- XUL application goes here -->
+
+  <foo><description>World</description></foo>
+</window>
diff --git a/dom/xbl/crashtests/226744-1.xhtml b/dom/xbl/crashtests/226744-1.xhtml
new file mode 100644
index 000000000..63915dbe8
--- /dev/null
+++ b/dom/xbl/crashtests/226744-1.xhtml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<html xmlns="http://www.w3.org/1999/xhtml"
+    xmlns:html="http://www.w3.org/1999/xhtml"
+    xmlns:xbl="http://www.mozilla.org/xbl">
+
+    <xbl:bindings>
+        <xbl:binding id="rd">
+				<xbl:resources>
+<xbl:stylesheet src="data:text/html;charset=utf-8,"/>
+</xbl:resources>
+            <xbl:content>
+<xbl:children/>
+            </xbl:content>
+        </xbl:binding>
+
+    </xbl:bindings>
+
+    <head>
+        <title>testcase bug ?</title>
+        
+        <style type="text/css">
+        .hoofdstuk {
+            -moz-binding: url(#rd);
+        }
+        </style>
+    </head>
+    
+    <body>    
+<div class="hoofdstuk">test
+</div>
+<div class="hoofdstuk">test
+</div>
+    </body>
+
+</html>
diff --git a/dom/xbl/crashtests/232095-1.xul b/dom/xbl/crashtests/232095-1.xul
new file mode 100644
index 000000000..bfd5476e6
--- /dev/null
+++ b/dom/xbl/crashtests/232095-1.xul
@@ -0,0 +1,44 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  xmlns:xbl="http://www.mozilla.org/xbl"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  >
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="serverpost_base">
+    <implementation>
+      <method name="getSuccessfulControls">
+        <parameter name="aNode"/>
+        <body><![CDATA[
+          dump("<html:input type="file"/> has not been tested yet!  This may not work!!!\n");
+        ]]></body>
+      </method>
+
+      <method name='finalizeAndSubmit'>
+        <body>
+	  return true;
+        </body>
+      </method>
+    </implementation>
+  </binding>
+</bindings>
+
+  <html:style type="text/css"><![CDATA[
+  @namespace xbl url("http://www.mozilla.org/xbl");
+  @namespace xul url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
+
+  xbl|bindings {
+    display: none;
+  }
+
+  xul|serverpost {
+    -moz-binding: url("#serverpost_base");
+  }
+
+  ]]></html:style>
+
+  <serverpost/>
+  <serverpost/>
+</window>
diff --git a/dom/xbl/crashtests/277523-1.xhtml b/dom/xbl/crashtests/277523-1.xhtml
new file mode 100644
index 000000000..74dc5d808
--- /dev/null
+++ b/dom/xbl/crashtests/277523-1.xhtml
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+<title>Testcase bug 277208 - appendChild to a hidden box from a binding crashes</title>
+
+<xbl:bindings><xbl:binding id="crash"><xbl:content>
+<span style="display:none"><xbl:children includes="span"/></span>
+</xbl:content></xbl:binding></xbl:bindings>
+
+<style type="text/css">
+#test{-moz-binding:url(#crash);}
+</style>
+</head>
+<body onload="init()">
+<span id="test"></span>
+<script>
+function init(){
+         document.getElementById('test').appendChild(document.createElement('span'));
+}
+</script>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/277950-1.xhtml b/dom/xbl/crashtests/277950-1.xhtml
new file mode 100644
index 000000000..eae6f1574
--- /dev/null
+++ b/dom/xbl/crashtests/277950-1.xhtml
@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>Testcase</title>
+<xbl:bindings xmlns="http://www.mozilla.org/xbl"
+  xmlns:xbl="http://www.mozilla.org/xbl">
+  <binding id="test">
+    <implementation>
+      <property/>
+    </implementation>
+  </binding>
+</xbl:bindings>
+<style type="text/css">
+  p{ -moz-binding: url(#test); }
+</style>
+</head>
+<body>
+<p></p>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/336744-1-inner.html b/dom/xbl/crashtests/336744-1-inner.html
new file mode 100644
index 000000000..4af1fbd52
--- /dev/null
+++ b/dom/xbl/crashtests/336744-1-inner.html
@@ -0,0 +1,6 @@
+<html><head>
+<title>Testcase bug 336744 - Crash when window gets destroyed during popuphiding event</title>
+</head><body>
+This should not crash Mozilla within 1 second<br>
+<iframe src="data:application/vnd.mozilla.xul+xml;charset=utf-8,%3C%3Fxml%20version%3D%221.0%22%3F%3E%0A%3C%3Fxml-stylesheet%20href%3D%22chrome%3A//global/skin%22%20type%3D%22text/css%22%3F%3E%0A%0A%3Cwindow%20xmlns%3Ahtml%3D%22http%3A//www.w3.org/1999/xhtml%22%0A%20%20%20%20%20%20%20%20xmlns%3D%22http%3A//www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%22%3E%0A%3Chtml%3Ascript%3E%0Adocument.addEventListener%28%22popuphiding%22%2C%20doe%2C%20true%29%3B%0Afunction%20doe%28e%29%20%7B%0Avar%20x%3D%20parent.document.getElementsByTagName%28%27iframe%27%29%5B0%5D%3B%0Ax.parentNode.removeChild%28x%29%3B%0A%7D%0AsetTimeout%28function%28%29%20%7B%20document.getElementsByTagName%28%22menupopup%22%29%5B0%5D.showPopup%28%29%3B%20%7D%2C%20800%29%3B%0AsetTimeout%28function%28%29%20%7B%20document.getElementsByTagName%28%22menupopup%22%29%5B0%5D.hidePopup%28%29%3B%20%7D%2C%201000%29%3B%0A%3C/html%3Ascript%3E%0A%3Cscript%3E%0A%0A%3C/script%3E%0A%3Cmenupopup%3E%0A%20%20%3Cmenuitem%20label%3D%22One%22/%3E%0A%3C/menupopup%3E%0A%3C/window%3E%0A"></iframe>
+</body></html>
+\ No newline at end of file
diff --git a/dom/xbl/crashtests/336744-1.html b/dom/xbl/crashtests/336744-1.html
new file mode 100644
index 000000000..48d5c1701
--- /dev/null
+++ b/dom/xbl/crashtests/336744-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="336744-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/336960-1-inner.xhtml b/dom/xbl/crashtests/336960-1-inner.xhtml
new file mode 100644
index 000000000..2064f8977
--- /dev/null
+++ b/dom/xbl/crashtests/336960-1-inner.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+  <script>
+    var x=document.createElementNS('http://www.w3.org/1999/xhtml','style');
+    document.documentElement.appendChild(x);
+    function doe(){
+      var y=document.getElementsByTagName('style')[0];
+    }
+    setTimeout(doe,500);
+  </script>
+
+  <style>
+  style {-moz-binding:url(#randomxbl);}
+  </style>
+
+  <bindings xmlns="http://www.mozilla.org/xbl">
+    <binding id="randomxbl">
+      <implementation>
+        <constructor>
+          var x= parent.document.getElementsByTagName('iframe')[0];
+x.parentNode.removeChild(x);
+        </constructor>
+      </implementation>
+    </binding>
+  </bindings>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/336960-1.html b/dom/xbl/crashtests/336960-1.html
new file mode 100644
index 000000000..0263d3095
--- /dev/null
+++ b/dom/xbl/crashtests/336960-1.html
@@ -0,0 +1,13 @@
+<html class="reftest-wait">
+<head>
+
+<title>Testcase bug 336960 - Crash when window gets destroyed when constructor of xbl is running</title>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+</head><body>
+This page should not crash Mozilla, you should see no iframe<br>
+<iframe src="./336960-1-inner.xhtml"></iframe>
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/dom/xbl/crashtests/342954-1.xhtml b/dom/xbl/crashtests/342954-1.xhtml
new file mode 100644
index 000000000..dbaa15384
--- /dev/null
+++ b/dom/xbl/crashtests/342954-1.xhtml
@@ -0,0 +1,46 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+
+
+<head>
+
+<script>
+<![CDATA[
+
+function boo()
+{
+  s1 = document.getElementById("s1");  
+  marq = document.getElementById("marq");
+  marqAnonymousSomething = document.getAnonymousNodes(marq)[0].childNodes[0];
+
+  removeNode(marqAnonymousSomething);
+  s1.appendChild(document.createElement("div"));
+}
+
+function removeNode(q1) { q1.parentNode.removeChild(q1); }
+
+]]>
+</script>
+
+<xbl:bindings id="marqueeBindings">
+  <xbl:binding id="marquee-horizontal-12">
+    <xbl:content>
+      <div>
+        <xbl:children/>
+      </div>
+    </xbl:content>
+  </xbl:binding>
+</xbl:bindings>
+
+</head>
+
+
+<body onload="boo()">
+
+<span id="s1">Span</span>
+
+<div id="marq" style="-moz-binding: url('#marquee-horizontal-12');">Marquee</div>
+
+</body>
+
+
+</html>
diff --git a/dom/xbl/crashtests/342954-2-xbl.xml b/dom/xbl/crashtests/342954-2-xbl.xml
new file mode 100644
index 000000000..3e73f1355
--- /dev/null
+++ b/dom/xbl/crashtests/342954-2-xbl.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+
+<bindings id="marqueeBindings"
+          xmlns="http://www.mozilla.org/xbl"
+          xmlns:html="http://www.w3.org/1999/xhtml"
+          xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+          xmlns:xbl="http://www.mozilla.org/xbl">
+
+  <binding id="marquee-horizontal-10">
+
+    <content>
+      <html:div>
+        <children/>
+      </html:div>
+    </content>
+
+  </binding>
+
+</bindings>
diff --git a/dom/xbl/crashtests/342954-2.xhtml b/dom/xbl/crashtests/342954-2.xhtml
new file mode 100644
index 000000000..4a250e31c
--- /dev/null
+++ b/dom/xbl/crashtests/342954-2.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boo()
+{
+  s1 = document.getElementById("s1");  
+  marq = document.getElementById("marq");
+  marqAnonymousSomething = document.getAnonymousNodes(marq)[0].childNodes[0];
+
+  removeNode(marqAnonymousSomething);
+  s1.appendChild(document.createElement("div"));
+}
+
+function removeNode(q1) { q1.parentNode.removeChild(q1); }
+
+]]>
+</script>
+</head>
+
+<body onload="boo()">
+
+<span id="s1">Span</span>
+
+<div id="marq" style="-moz-binding: url('342954-2-xbl.xml#marquee-horizontal-10');">Marquee</div>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/368276-1.xhtml b/dom/xbl/crashtests/368276-1.xhtml
new file mode 100644
index 000000000..162494b2c
--- /dev/null
+++ b/dom/xbl/crashtests/368276-1.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      class="reftest-wait">
+
+<head>
+<script>
+
+function boom()
+{
+  var quote = document.getElementById("quote");
+  var para = document.getElementById("para");
+  var dialog = document.getElementById("dialog");
+  var e = document.getElementById("e");
+
+  dialog.appendChild(quote);
+  e.insertBefore(quote, para);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30)">
+
+<p>He said <q id="quote">J<xul:hbox/></q></p>
+
+<xul:dialog id="dialog"/>
+
+<div id="e"><p id="para">Foopy</p></div>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/368641-1.xhtml b/dom/xbl/crashtests/368641-1.xhtml
new file mode 100644
index 000000000..0b42ac813
--- /dev/null
+++ b/dom/xbl/crashtests/368641-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<head>
+<script>
+
+function boom()
+{
+  var yaz = document.getElementById("yaz");
+
+  document.body.appendChild(yaz);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+  
+  <xul:tabs><span id="yaz"><xul:hbox><xul:popup/><xul:template/></xul:hbox></span></xul:tabs>
+</body>
+
+</html>
diff --git a/dom/xbl/crashtests/378521-1.xhtml b/dom/xbl/crashtests/378521-1.xhtml
new file mode 100644
index 000000000..3db89d49a
--- /dev/null
+++ b/dom/xbl/crashtests/378521-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="foo" extends="html:input">
+    <content>
+      Foo?
+      <children/>
+    </content>
+  </binding>
+</bindings>
+</head>
+
+<body>
+<div>Hi!</div>
+<div style="-moz-binding: url(#foo)">XXX</div>
+</body>
+
+</html>
+\ No newline at end of file
diff --git a/dom/xbl/crashtests/382376-1.xhtml b/dom/xbl/crashtests/382376-1.xhtml
new file mode 100644
index 000000000..55457f79e
--- /dev/null
+++ b/dom/xbl/crashtests/382376-1.xhtml
@@ -0,0 +1,37 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boom1()
+{
+  var c = document.getElementById("c");
+  c.style.MozBinding = "url('#foo')";
+  
+  setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+  var v = document.getElementById("v");
+  v.parentNode.removeChild(v);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo">
+  <content>x x x x x <children/></content>
+</binding></bindings>
+
+</head>
+
+<body style="font-family: monospace; width: 10ch;" onload="setTimeout(boom1, 30);">
+
+<div style="background: lightblue; border: 1px solid blue; margin-bottom: 1em;">
+  <span id="c">y y<span id="v">Z<div/></span></span>
+</div>
+
+<div style="background: lightgreen; border: 1px solid green; height: 2000px;">s</div>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/382376-2.xhtml b/dom/xbl/crashtests/382376-2.xhtml
new file mode 100644
index 000000000..4e22b8f4e
--- /dev/null
+++ b/dom/xbl/crashtests/382376-2.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  var v = document.getElementById("v");
+  v.parentNode.removeChild(v);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo">
+  <content>x x x x x <children/></content>
+</binding></bindings>
+
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<div style="background: lightblue; border: 1px solid blue; width: 300px">
+  <span style="-moz-binding: url(#foo);" >y y<span id="v">Z<div/></span></span>
+</div>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/397596-1.xhtml b/dom/xbl/crashtests/397596-1.xhtml
new file mode 100644
index 000000000..c7b562b52
--- /dev/null
+++ b/dom/xbl/crashtests/397596-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>Testcase bug - 100% cpu usage with binding setting position: fixed in constructor</title>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="b" inheritstyle="false">
+<content>
+<div xmlns="http://www.w3.org/1999/xhtml" style=" -moz-binding: url(#a);"/>
+<children/>
+</content>
+</binding>
+
+<binding id="a">
+<implementation>
+<constructor>
+  this.style.position='fixed';
+</constructor>
+</implementation>
+<content>
+<children xmlns="http://www.mozilla.org/xbl"/>
+</content>
+</binding>
+</bindings>
+
+</head>
+<body>
+<span style="-moz-binding:url();"></span>
+</body>
+</html>
+\ No newline at end of file
diff --git a/dom/xbl/crashtests/404125-1.xhtml b/dom/xbl/crashtests/404125-1.xhtml
new file mode 100644
index 000000000..46b0fd6f8
--- /dev/null
+++ b/dom/xbl/crashtests/404125-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="lc">
+    <content>
+      <xul:listcell> t <children/></xul:listcell>
+    </content>
+  </binding>
+</bindings>
+
+<script>
+function boom()
+{
+  var hbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox");
+  document.getElementById("vv").appendChild(hbox);
+}
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<div style="-moz-binding: url(#lc);" id="vv"></div>
+
+</body>
+
+</html>
diff --git a/dom/xbl/crashtests/406900-1.xul b/dom/xbl/crashtests/406900-1.xul
new file mode 100644
index 000000000..3b3dc1f87
--- /dev/null
+++ b/dom/xbl/crashtests/406900-1.xul
@@ -0,0 +1,33 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="boom();">
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="lit">
+    <content>
+      <children>
+        <xul:hbox/>
+      </children>
+    </content>
+  </binding>
+</bindings>
+
+<script type="text/javascript"> 
+
+function boom()
+{
+  var x = document.getElementById("x");
+  var anon = document.getAnonymousNodes(x)[0];
+  document.documentElement.removeChild(x);
+  document.documentElement.appendChild(x);
+  var hbox = document.createElement('hbox');
+  anon.appendChild(hbox);
+}
+
+</script>
+
+<hbox id="x" style="-moz-binding: url(#lit)" />
+
+</window>
diff --git a/dom/xbl/crashtests/406904-1.xhtml b/dom/xbl/crashtests/406904-1.xhtml
new file mode 100644
index 000000000..758fb04cd
--- /dev/null
+++ b/dom/xbl/crashtests/406904-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+
+<xbl:bindings xmlns="http://www.mozilla.org/xbl"><xbl:binding id="a"><xbl:content>
+<span>foo<xbl:children/></span>
+</xbl:content></xbl:binding></xbl:bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var s = document.getElementById("s");
+  var anon = document.getAnonymousNodes(s)[0];
+
+  while (anon.firstChild)
+    anon.removeChild(anon.firstChild);
+
+  document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3EQ%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><span id="s" style="-moz-binding: url('#a');"></span></body>
+</html>
diff --git a/dom/xbl/crashtests/406904-2.xhtml b/dom/xbl/crashtests/406904-2.xhtml
new file mode 100644
index 000000000..763672b3f
--- /dev/null
+++ b/dom/xbl/crashtests/406904-2.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+
+<xbl:bindings xmlns="http://www.mozilla.org/xbl"><xbl:binding id="a"><xbl:content>
+<span><span></span><xbl:children/></span>
+</xbl:content></xbl:binding></xbl:bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var s = document.getElementById("s");
+  var anon = document.getAnonymousNodes(s)[0];
+
+  while (anon.firstChild)
+    anon.removeChild(anon.firstChild);
+
+  document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3EQ%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><span id="s" style="-moz-binding: url('#a');"></span></body>
+</html>
diff --git a/dom/xbl/crashtests/415192-1.xul b/dom/xbl/crashtests/415192-1.xul
new file mode 100644
index 000000000..3795ca220
--- /dev/null
+++ b/dom/xbl/crashtests/415192-1.xul
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+<script type="text/javascript">
+
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+  var wizard = document.createElementNS(XUL_NS, "wizard");
+  var space = document.createTextNode(" ");
+  var hbox = document.createElementNS(XUL_NS, "hbox");
+  hbox.setAttribute("anonid", "Buttons");
+
+  document.documentElement.appendChild(wizard);
+  wizard.appendChild(space);
+  wizard.appendChild(hbox);
+  wizard.cloneNode(true);
+}
+
+</script>
+</window>
diff --git a/dom/xbl/crashtests/415301-1.xul b/dom/xbl/crashtests/415301-1.xul
new file mode 100644
index 000000000..cee274fcd
--- /dev/null
+++ b/dom/xbl/crashtests/415301-1.xul
@@ -0,0 +1,34 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="boom();">
+
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+
+<binding id="chil"><content><children/></content></binding>
+
+<binding id="ichil"><content>
+<xul:hbox style="-moz-binding: url(#chil)"><children/></xul:hbox>
+</content></binding>
+
+</bindings>
+
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("inner").removeChild(document.getElementById("lbb"));
+  document.getElementById("outer").style.MozBinding = "";
+}
+
+</script>
+
+
+<hbox id="outer" style="-moz-binding: url(#chil)"><hbox id="inner" style="-moz-binding: url(#ichil)"><listboxbody id="lbb" /></hbox></hbox>
+
+
+</window>
diff --git a/dom/xbl/crashtests/418133-1.xhtml b/dom/xbl/crashtests/418133-1.xhtml
new file mode 100644
index 000000000..ea821b76e
--- /dev/null
+++ b/dom/xbl/crashtests/418133-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  for(var p in document.getElementById("prefs")) {
+  }
+  
+  for(var p in window) {
+  }
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<xul:preferences id="prefs" />
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/420233-1.xhtml b/dom/xbl/crashtests/420233-1.xhtml
new file mode 100644
index 000000000..8ec425075
--- /dev/null
+++ b/dom/xbl/crashtests/420233-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="ab"><content><html:span>a b<children/></html:span></content></binding>
+  <binding id="empty"><content></content></binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("td").style.MozBinding = "url('#empty')";
+}
+
+</script>
+
+</head>
+
+<body onload="boom();"><div style="width: 1px;"><span style="-moz-binding: url(#ab);"><td id="td"/></span></div></body>
+</html>
diff --git a/dom/xbl/crashtests/421997-1.xhtml b/dom/xbl/crashtests/421997-1.xhtml
new file mode 100644
index 000000000..4b91f00fc
--- /dev/null
+++ b/dom/xbl/crashtests/421997-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="g">
+    <implementation>
+      <constructor>
+        throw 3;
+      </constructor>
+    </implementation>
+  </binding>
+</bindings>
+
+<script type="text/javascript">
+
+function e()
+{
+  var listboxbody = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listboxbody");
+  document.getElementById("s").appendChild(listboxbody);
+}
+
+</script>
+</head>
+
+<body onerror="e();"><span id="s" style="-moz-binding: url(#g)"></span></body>
+
+</html>
diff --git a/dom/xbl/crashtests/432813-1-xbl.xml b/dom/xbl/crashtests/432813-1-xbl.xml
new file mode 100644
index 000000000..b2940e638
--- /dev/null
+++ b/dom/xbl/crashtests/432813-1-xbl.xml
@@ -0,0 +1,7 @@
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a">
+<content>
+<div xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: inherit;"/>
+</content>
+</binding>
+</bindings>
diff --git a/dom/xbl/crashtests/432813-1.xhtml b/dom/xbl/crashtests/432813-1.xhtml
new file mode 100644
index 000000000..586ac05f1
--- /dev/null
+++ b/dom/xbl/crashtests/432813-1.xhtml
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <box style="-moz-binding:url(432813-1-xbl.xml);"/>
+</window>
diff --git a/dom/xbl/crashtests/454820-1.html b/dom/xbl/crashtests/454820-1.html
new file mode 100644
index 000000000..31a8316f6
--- /dev/null
+++ b/dom/xbl/crashtests/454820-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html><head>
+    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+    <title>Testcase for bug 454820</title>
+</head>
+<body>
+
+<p>PASS if Firefox does not crash.</p>
+<script type="text/javascript">
+var evObj = document.createEvent('UIEvents');
+evObj.initUIEvent( 'keypress', true, true, window, 1 );
+document.getElementsByTagName('p')[0].dispatchEvent(evObj);
+</script>
+
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/460665-1.xhtml b/dom/xbl/crashtests/460665-1.xhtml
new file mode 100644
index 000000000..2ea1f7212
--- /dev/null
+++ b/dom/xbl/crashtests/460665-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="a">
+    <content></content>
+    <implementation>
+      <field>t</field>
+      <field/>
+      <property/>
+      <property>
+        <getter>x</getter>
+        <setter>y</setter>
+      </property>
+      <method/>
+      <method>
+        <body/>
+      </method>
+      <method>
+        <body>a</body>
+      </method>
+    </implementation>
+  </binding>
+</bindings>
+</head>
+
+<body><span id="s" style="-moz-binding: url('#a');"></span></body>
+</html>
diff --git a/dom/xbl/crashtests/463511-1.xhtml b/dom/xbl/crashtests/463511-1.xhtml
new file mode 100644
index 000000000..a9fec3b50
--- /dev/null
+++ b/dom/xbl/crashtests/463511-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="foo"><content><listcell xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listcell></content></binding>
+</bindings>
+</head>
+
+<body onload="document.documentElement.innerHTML = 'x';"></body>
+</html>
diff --git a/dom/xbl/crashtests/464863-1.xhtml b/dom/xbl/crashtests/464863-1.xhtml
new file mode 100644
index 000000000..a665afc9c
--- /dev/null
+++ b/dom/xbl/crashtests/464863-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><qqq><children xmlns="http://www.mozilla.org/xbl"/></qqq></content></binding></bindings>
+
+<script type="text/javascript">
+// <![CDATA[
+
+function boom()
+{
+  var s = document.getElementById("s");
+  var o = document.getAnonymousNodes(s)[0];
+  (document.body).appendChild(s);
+  o.appendChild(document.createTextNode("F"));
+}
+
+// ]]>
+</script>
+</head>
+
+<body onload="boom();"><span id="s" style="-moz-binding: url(#foo)"></span></body>
+</html>
diff --git a/dom/xbl/crashtests/472260-1.xhtml b/dom/xbl/crashtests/472260-1.xhtml
new file mode 100644
index 000000000..49d5407d4
--- /dev/null
+++ b/dom/xbl/crashtests/472260-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="foo"><content><span xmlns="http://www.w3.org/1999/xhtml"/></content></binding>
+  <binding id="bar"><content></content></binding>
+</bindings>
+
+<script type="text/javascript">
+// <![CDATA[
+
+function boom()
+{
+  var bo = document.getElementById("bo");
+  var anon = SpecialPowers.wrap(document).getAnonymousNodes(bo)[0];
+
+  bo.style.MozBinding = "url(#bar)";
+
+  var fr = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+  fr.setAttribute("src", "javascript:void 0;"); 
+  anon.appendChild(fr);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(boom, 100);">
+
+<span style="-moz-binding: url(#foo)" id="bo"></span>
+
+</body>
+</html>
diff --git a/dom/xbl/crashtests/477878-1.html b/dom/xbl/crashtests/477878-1.html
new file mode 100644
index 000000000..17e4002b4
--- /dev/null
+++ b/dom/xbl/crashtests/477878-1.html
@@ -0,0 +1,4 @@
+<html>
+<head></head>
+<body><iframe style="display:none" src="data:text/html,<marquee>Marquee</marquee>" onload="this.style.display = '';"></iframe></body>
+</html>
diff --git a/dom/xbl/crashtests/492978-1.xul b/dom/xbl/crashtests/492978-1.xul
new file mode 100644
index 000000000..365ecfc9e
--- /dev/null
+++ b/dom/xbl/crashtests/492978-1.xul
@@ -0,0 +1,15 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a" inheritstyle="false">
+<content>
+<style xmlns="http://www.w3.org/1999/xhtml">
+window::after, box::after, bindings::after { content:"m"; float:right;}
+</style>
+</content>
+</binding>
+</bindings>
+
+<box style="-moz-binding:url(crash1.xul);overflow: scroll;"/>
+
+</window>
+\ No newline at end of file
diff --git a/dom/xbl/crashtests/493123-1.xhtml b/dom/xbl/crashtests/493123-1.xhtml
new file mode 100644
index 000000000..1c568ae15
--- /dev/null
+++ b/dom/xbl/crashtests/493123-1.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="a"><content></content></binding>
+  <binding id="b"><content><style xmlns="http://www.w3.org/1999/xhtml" style="display: none;">* { overflow: hidden; }</style><children xmlns="http://www.mozilla.org/xbl"/></content></binding>
+</bindings>
+
+<script type="text/javascript" style="display: none">
+
+function one()
+{
+  while (document.documentElement.firstChild) document.documentElement.removeChild(document.documentElement.firstChild)
+  document.documentElement.style.MozBinding = 'url("#a")';
+  setTimeout(two, 1);
+}
+
+function two()
+{
+  document.documentElement.style.MozBinding = 'url("#b")';
+  setTimeout(three, 1);
+}
+
+function three()
+{
+  document.documentElement.style.MozBinding = 'url("#a")';
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="one();"></body>
+</html>
diff --git a/dom/xbl/crashtests/495354-1.xhtml b/dom/xbl/crashtests/495354-1.xhtml
new file mode 100644
index 000000000..2e76fb846
--- /dev/null
+++ b/dom/xbl/crashtests/495354-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="x"><content><caption xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></caption></content></binding></bindings>
+</head>
+<body onload="document.getElementById('x').innerHTML = '9';">
+<span id="x" style="-moz-binding: url(#x)"><div></div></span>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/507628-1.xhtml b/dom/xbl/crashtests/507628-1.xhtml
new file mode 100644
index 000000000..a82871f71
--- /dev/null
+++ b/dom/xbl/crashtests/507628-1.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="b" inheritstyle="false">
+<content>
+<span xmlns="http://www.w3.org/1999/xhtml"/><span xmlns="http://www.w3.org/1999/xhtml"><embed style="display: block;" type="*"/></span>
+</content>
+</binding>
+</bindings>
+
+<div style="-moz-binding:url();"/>
+
+</html>
+\ No newline at end of file
diff --git a/dom/xbl/crashtests/507991-1.xhtml b/dom/xbl/crashtests/507991-1.xhtml
new file mode 100644
index 000000000..402e680ee
--- /dev/null
+++ b/dom/xbl/crashtests/507991-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<title>Crash [@ nsSprocketLayout::PopulateBoxSizes] with object and position:absolute;overflow:scroll in binding</title>
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a" inheritstyle="false">
+<content>
+<object xmlns="http://www.w3.org/1999/xhtml" style="display: table;"/>
+<div xmlns="http://www.w3.org/1999/xhtml" style="position: absolute;overflow: scroll; "/>
+</content>
+</binding>
+</bindings>
+</head>
+
+<body>
+<span style="-moz-binding:url()"></span>
+</body>
+</html>
+\ No newline at end of file
diff --git a/dom/xbl/crashtests/830614-1.xul b/dom/xbl/crashtests/830614-1.xul
new file mode 100644
index 000000000..f2f9bb352
--- /dev/null
+++ b/dom/xbl/crashtests/830614-1.xul
@@ -0,0 +1,24 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="document.getElementById('trigger');">
+  <box style="display: none">
+    <bindings xmlns="http://www.mozilla.org/xbl">
+      <binding id="crash">
+        <implementation>
+          <constructor>
+            // Fetch it
+            var obj = this.getElementsByTagName("box")[0];
+            // And make it preserve its wrapper.  Note that this will happen
+            // while we're wrapping our box as the parent for id="trigger",
+            // so then we'll unwind and things will be bad.
+            if (obj) obj.expando = 5;
+          </constructor>
+        </implementation>
+      </binding>
+    </bindings>
+    <box style="-moz-binding:url(#crash);">
+      <box id="trigger"/>
+    </box>
+  </box>
+  <!-- Make sure we load our XBL before we try to run our test -->
+  <box style="-moz-binding:url(#crash);"/>
+</window>
diff --git a/dom/xbl/crashtests/895805-1.xhtml b/dom/xbl/crashtests/895805-1.xhtml
new file mode 100644
index 000000000..a6598de9c
--- /dev/null
+++ b/dom/xbl/crashtests/895805-1.xhtml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+<title>Bug 895805 - Adopting bound element to another document.</title>
+<xbl:bindings>
+  <xbl:binding id="crash">
+    <xbl:content>
+      <xbl:children />
+      Bug 895805 dummy binding
+    </xbl:content>
+  </xbl:binding>
+</xbl:bindings>
+<style type="text/css">
+#test {
+  -moz-binding:url(#crash);
+}
+</style>
+</head>
+<body onload="init()">
+<span id="test">Test</span>
+<script>
+function init() {
+  var boundElement = document.getElementById('test');
+  var otherDoc = document.implementation.createDocument('', '', null);
+  otherDoc.adoptNode(boundElement);
+}
+</script>
+</body>
+</html>
diff --git a/dom/xbl/crashtests/crashtests.list b/dom/xbl/crashtests/crashtests.list
new file mode 100644
index 000000000..26424c7d8
--- /dev/null
+++ b/dom/xbl/crashtests/crashtests.list
@@ -0,0 +1,40 @@
+load 205735-1.xhtml
+load 223799-1.xul
+load 226744-1.xhtml
+load 232095-1.xul
+load 277523-1.xhtml
+load 277950-1.xhtml
+skip-if(Android) load 336744-1.html # bug 1268050
+load 336960-1.html
+load 342954-1.xhtml
+load 342954-2.xhtml
+load 368276-1.xhtml
+load 368641-1.xhtml
+load 378521-1.xhtml
+load 382376-1.xhtml
+load 382376-2.xhtml
+load 397596-1.xhtml
+load 404125-1.xhtml
+load 406900-1.xul
+load 406904-1.xhtml
+load 406904-2.xhtml
+load 415192-1.xul
+load 415301-1.xul
+load 418133-1.xhtml
+load 420233-1.xhtml
+load 421997-1.xhtml
+load 432813-1.xhtml
+load 454820-1.html
+load 460665-1.xhtml
+load 463511-1.xhtml
+load 464863-1.xhtml
+load 472260-1.xhtml
+load 477878-1.html
+load 492978-1.xul
+load 493123-1.xhtml
+load 495354-1.xhtml
+load 507628-1.xhtml
+load 507991-1.xhtml
+load 830614-1.xul
+load 895805-1.xhtml
+load set-field-bad-this.xhtml
diff --git a/dom/xbl/crashtests/set-field-bad-this.xhtml b/dom/xbl/crashtests/set-field-bad-this.xhtml
new file mode 100644
index 000000000..7b3dea03a
--- /dev/null
+++ b/dom/xbl/crashtests/set-field-bad-this.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+  <title>Gracefully handle setting a field on a bad |this|</title>
+
+  <bindings xmlns="http://www.mozilla.org/xbl">
+    <binding id="a">
+      <implementation>
+        <field name="f">17</field>
+      </implementation>
+    </binding>
+  </bindings>
+
+  <script type="application/javascript">
+    window.onload = function()
+    {
+      var bound = document.getElementById("bound");
+      try
+      {
+        Object.getPrototypeOf(bound).f = 42;
+      }
+      catch (e) { /* Throwing's fine, crashing isn't. */ }
+    };
+  </script>
+</head>
+
+<body>
+  <div id="bound" style="-moz-binding: url(#a)"></div>
+</body>
+
+</html>