summaryrefslogtreecommitdiffstats
path: root/dom/xul/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'dom/xul/crashtests')
-rw-r--r--dom/xul/crashtests/107518-1.xml52
-rw-r--r--dom/xul/crashtests/252448-1.xul10
-rw-r--r--dom/xul/crashtests/253479-1.xul6
-rw-r--r--dom/xul/crashtests/253479-2.xul4
-rw-r--r--dom/xul/crashtests/326204-1.xul0
-rw-r--r--dom/xul/crashtests/326644-1-inner.xul34
-rw-r--r--dom/xul/crashtests/326644-1.html9
-rw-r--r--dom/xul/crashtests/326644-2-inner.xul10
-rw-r--r--dom/xul/crashtests/326644-2.html9
-rw-r--r--dom/xul/crashtests/326864-1.xul34
-rw-r--r--dom/xul/crashtests/326875-1.xul27
-rw-r--r--dom/xul/crashtests/326881-1.xul13
-rw-r--r--dom/xul/crashtests/329982-1.xhtml42
-rw-r--r--dom/xul/crashtests/336096-1.xhtml41
-rw-r--r--dom/xul/crashtests/344215-1.xul7
-rw-r--r--dom/xul/crashtests/354611-1.html20
-rw-r--r--dom/xul/crashtests/360078-1.xhtml42
-rw-r--r--dom/xul/crashtests/360078-1xbl.xml3
-rw-r--r--dom/xul/crashtests/363791-1.xul44
-rw-r--r--dom/xul/crashtests/384740-1.xul23
-rw-r--r--dom/xul/crashtests/384877-1-inner.xul15
-rw-r--r--dom/xul/crashtests/384877-1.html9
-rw-r--r--dom/xul/crashtests/386914-1-inner.xul10
-rw-r--r--dom/xul/crashtests/386914-1.html9
-rw-r--r--dom/xul/crashtests/386947-1.xul12
-rw-r--r--dom/xul/crashtests/425821-1.xul15
-rw-r--r--dom/xul/crashtests/428951-1.xul21
-rw-r--r--dom/xul/crashtests/429085-1.xhtml21
-rw-r--r--dom/xul/crashtests/431906-1-inner.xul19
-rw-r--r--dom/xul/crashtests/431906-1.html9
-rw-r--r--dom/xul/crashtests/451311-1.xul1
-rw-r--r--dom/xul/crashtests/461917-1.xhtml6
-rw-r--r--dom/xul/crashtests/468211-1.xul23
-rw-r--r--dom/xul/crashtests/468211-2-binding.xml12
-rw-r--r--dom/xul/crashtests/468211-2.xul10
-rw-r--r--dom/xul/crashtests/468211-3.xul18
-rw-r--r--dom/xul/crashtests/495635-1.xul8
-rw-r--r--dom/xul/crashtests/509719-1-overlay.xul3
-rw-r--r--dom/xul/crashtests/509719-1.xul3
-rw-r--r--dom/xul/crashtests/509719-2-overlay.xul8
-rw-r--r--dom/xul/crashtests/509719-2.xul7
-rw-r--r--dom/xul/crashtests/583230.xul23
-rw-r--r--dom/xul/crashtests/crashtests.list33
-rw-r--r--dom/xul/crashtests/extA1.xul8
-rw-r--r--dom/xul/crashtests/extA2.xul10
-rw-r--r--dom/xul/crashtests/extB1.xul5
46 files changed, 748 insertions, 0 deletions
diff --git a/dom/xul/crashtests/107518-1.xml b/dom/xul/crashtests/107518-1.xml
new file mode 100644
index 000000000..0fa41240a
--- /dev/null
+++ b/dom/xul/crashtests/107518-1.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<!DOCTYPE window>
+
+<window
+ id = "xulnote-main-window"
+ xmlns = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ xmlns:html = "http://www.w3.org/1999/xhtml"
+ onload = "init();"
+>
+ <scrollbox>
+ <vbox style="background-color:white;">
+ <text value="hahaha 0"/>
+ <text value="hahaha 1"/>
+ <text value="hahaha 2"/>
+ <text value="hahaha 3"/>
+ <text value="hahaha 4"/>
+ <text value="hahaha 5"/>
+ <text value="hahaha 6"/>
+ <text value="hahaha 7"/>
+ <text value="hahaha 8"/>
+ <text value="hahaha 9"/>
+ <text value="hahaha 10"/>
+ <text value="hahaha 11"/>
+ <text value="hahaha 12"/>
+ <text value="hahaha 13"/>
+ <text value="hahaha 14"/>
+ <text value="hahaha 15"/>
+ <text value="hahaha 16"/>
+ <text value="hahaha 17"/>
+ <text value="hahaha 18"/>
+ <text value="hahaha 19"/>
+ </vbox>
+<scrollbar
+ id="identifier"
+ align="horizontal"
+ curpos="20"
+ maxpos="100"
+ increment="1"
+ pageincrement="10"/>
+
+ </scrollbox>
+
+ <script type="application/x-javascript">
+ <![CDATA[
+ function init()
+ {
+ }
+ ]]>
+ </script>
+
+</window>
diff --git a/dom/xul/crashtests/252448-1.xul b/dom/xul/crashtests/252448-1.xul
new file mode 100644
index 000000000..68813e740
--- /dev/null
+++ b/dom/xul/crashtests/252448-1.xul
@@ -0,0 +1,10 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin/"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="document.documentElement.firstChild.focus();">
+ <menulist>
+ <menupopup style="-moz-binding: none;">
+ <spacer/>
+ </menupopup>
+ </menulist>
+</window>
diff --git a/dom/xul/crashtests/253479-1.xul b/dom/xul/crashtests/253479-1.xul
new file mode 100644
index 000000000..5860d2200
--- /dev/null
+++ b/dom/xul/crashtests/253479-1.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+>
+<html:div style="position:fixed;"/>
+</window> \ No newline at end of file
diff --git a/dom/xul/crashtests/253479-2.xul b/dom/xul/crashtests/253479-2.xul
new file mode 100644
index 000000000..5af86f1e9
--- /dev/null
+++ b/dom/xul/crashtests/253479-2.xul
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <x style="position:fixed;"/>
+</window> \ No newline at end of file
diff --git a/dom/xul/crashtests/326204-1.xul b/dom/xul/crashtests/326204-1.xul
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/dom/xul/crashtests/326204-1.xul
diff --git a/dom/xul/crashtests/326644-1-inner.xul b/dom/xul/crashtests/326644-1-inner.xul
new file mode 100644
index 000000000..63ed9b721
--- /dev/null
+++ b/dom/xul/crashtests/326644-1-inner.xul
@@ -0,0 +1,34 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml"
+ title="Testcase bug 326644 - Crash when changing enumerated properties of objects in xul">
+
+<html:script><![CDATA[
+var timers=0;
+function doe(aObj, aNested, aCurrentTimer){
+var temp =0;
+for (var i in aObj) {
+try {
+if (typeof aObj[i] == 'object') {
+ if (aNested >= 19 || aObj[i] == window.location)
+ continue;
+ setTimeout(doe,500, aObj[i], ++aNested, timers);
+ timers++;
+}
+}
+catch(e){}
+try {
+ //if (temp == 68 && aNested == 21 && aCurrentTimer >= 116) {
+ // alert(i + '-'+ aObj[i]);
+ // return;
+ // }
+ aObj[i]= i;
+ temp+=1;
+}
+catch (e) {
+
+}
+}
+}
+var s=document.getElementsByTagName('window')[0];
+setTimeout(doe,100, s, 0);
+]]></html:script>
+</window>
diff --git a/dom/xul/crashtests/326644-1.html b/dom/xul/crashtests/326644-1.html
new file mode 100644
index 000000000..41f2cc67f
--- /dev/null
+++ b/dom/xul/crashtests/326644-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="326644-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/xul/crashtests/326644-2-inner.xul b/dom/xul/crashtests/326644-2-inner.xul
new file mode 100644
index 000000000..efbbc1c62
--- /dev/null
+++ b/dom/xul/crashtests/326644-2-inner.xul
@@ -0,0 +1,10 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml"
+ title="Testcase bug 326644 - Crash when changing enumerated properties of objects in xul">
+<html:script><![CDATA[
+function doe() {
+document.documentElement.boxObject.firstChild.hidden = true;
+document.documentElement.boxObject.firstChild.tooltip = 'test';
+}
+setTimeout(doe,100);
+]]></html:script>
+</window>
diff --git a/dom/xul/crashtests/326644-2.html b/dom/xul/crashtests/326644-2.html
new file mode 100644
index 000000000..68fd49c75
--- /dev/null
+++ b/dom/xul/crashtests/326644-2.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="326644-2-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/xul/crashtests/326864-1.xul b/dom/xul/crashtests/326864-1.xul
new file mode 100644
index 000000000..5515ca259
--- /dev/null
+++ b/dom/xul/crashtests/326864-1.xul
@@ -0,0 +1,34 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+
+<script>
+
+function getAnonymousNodes(e) {
+ return SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(e));
+}
+
+function init()
+{
+ var tt = document.getElementById("textbox");
+ var hb = getAnonymousNodes(tt)[0]; // hbox
+ var men = getAnonymousNodes(hb)[1]; // menupopup
+ var menitem = men.childNodes[0]; // menuitem
+ var hb2 = getAnonymousNodes(menitem)[1]; // hbox
+ var label2 = hb2.childNodes[0]; // label
+
+ men.menu = null;
+ label2.click();
+}
+
+window.addEventListener("load", init, false);
+
+</script>
+
+
+<textbox id="textbox"/>
+
+
+</window>
diff --git a/dom/xul/crashtests/326875-1.xul b/dom/xul/crashtests/326875-1.xul
new file mode 100644
index 000000000..e4c3f1d6d
--- /dev/null
+++ b/dom/xul/crashtests/326875-1.xul
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+
+
+<script>
+
+
+function init() {
+
+ var m = document.getElementById("m");
+ m.parentNode.removeChild(m);
+ m.controllers;
+};
+
+
+window.addEventListener("load", init, false);
+
+</script>
+
+
+
+<hbox id="m" />
+
+</window>
diff --git a/dom/xul/crashtests/326881-1.xul b/dom/xul/crashtests/326881-1.xul
new file mode 100644
index 000000000..021da398a
--- /dev/null
+++ b/dom/xul/crashtests/326881-1.xul
@@ -0,0 +1,13 @@
+<?xml version="1.0"?> <?xml-stylesheet href="chrome://global/skin/" type="text/css"?> <window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <script>
+
+function init() {
+ var n1 = document.getElementsByTagName("textbox")[0];
+ n1.cloneNode(false);
+}
+
+window.addEventListener("load", init, false);
+ </script>
+
+<textbox/>
+ </window> \ No newline at end of file
diff --git a/dom/xul/crashtests/329982-1.xhtml b/dom/xul/crashtests/329982-1.xhtml
new file mode 100644
index 000000000..43f374a57
--- /dev/null
+++ b/dom/xul/crashtests/329982-1.xhtml
@@ -0,0 +1,42 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+
+function init()
+{
+ var A = document.getElementById("z");
+ var B = A.nextSibling;
+ var C = B.nextSibling;
+ var P = A.parentNode;
+
+ document.addEventListener("DOMNodeRemoved", fizzy, false);
+ P.removeChild(B);
+ document.removeEventListener("DOMNodeRemoved", fizzy, false);
+
+ function fizzy()
+ {
+ document.removeEventListener("DOMNodeRemoved", fizzy, false); // avoid recursion
+ P.removeChild(A);
+ }
+
+ document.documentElement.appendChild(C);
+}
+
+
+window.addEventListener("load", init, false);
+
+</script>
+
+</head>
+
+<body>
+
+<hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<menupopup y="x"> <menuitem id="z"/> <menuitem/> <menuitem/> </menupopup>
+
+</hbox>
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/xul/crashtests/336096-1.xhtml b/dom/xul/crashtests/336096-1.xhtml
new file mode 100644
index 000000000..e15691d88
--- /dev/null
+++ b/dom/xul/crashtests/336096-1.xhtml
@@ -0,0 +1,41 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function init()
+{
+ var targetWindow = window.frames[0];
+ var targetDocument = targetWindow.document;
+
+ targetDocument.body.appendChild(document.getElementById('rootish'));
+ targetDocument.designMode = 'on';
+
+ var r = targetDocument.createRange();
+ r.setStart(targetDocument.getElementById("start"), 0);
+ r.setEnd (targetDocument.getElementById("end"), 0);
+ targetWindow.getSelection().addRange(r);
+
+ targetDocument.execCommand('bold', false, null);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(init, 200);">
+
+<iframe src="data:text/html," style="width: 95%; height: 500px;"></iframe>
+
+<div id="rootish">
+ <div id="start"></div>
+ <hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <hbox/>
+ <vbox id="end">
+ <hbox/>
+ </vbox>
+ </hbox>
+</div>
+
+</body>
+</html>
diff --git a/dom/xul/crashtests/344215-1.xul b/dom/xul/crashtests/344215-1.xul
new file mode 100644
index 000000000..6443c22d6
--- /dev/null
+++ b/dom/xul/crashtests/344215-1.xul
@@ -0,0 +1,7 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<observes/>
+
+<description>You should not see any assertions in a debug build.</description>
+
+</window> \ No newline at end of file
diff --git a/dom/xul/crashtests/354611-1.html b/dom/xul/crashtests/354611-1.html
new file mode 100644
index 000000000..fe25de366
--- /dev/null
+++ b/dom/xul/crashtests/354611-1.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+
+var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+ var z = document.createElementNS(XUL_NS, "window");
+ document.body.appendChild(z);
+ z.setAttribute("hidechrome", "true");
+}
+
+</script>
+
+<body onload="boom();">
+
+</body>
+
+</html> \ No newline at end of file
diff --git a/dom/xul/crashtests/360078-1.xhtml b/dom/xul/crashtests/360078-1.xhtml
new file mode 100644
index 000000000..a29087014
--- /dev/null
+++ b/dom/xul/crashtests/360078-1.xhtml
@@ -0,0 +1,42 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<style>
+<![CDATA[
+#baz { -moz-binding: url(360078-1xbl.xml#foo); }
+]]>
+</style>
+
+<script>
+<![CDATA[
+
+function stuff()
+{
+ var baz = document.getElementById("baz");
+ var count = 0;
+
+ setTimeout(step, 30);
+
+ function step()
+ {
+ ++count;
+ if (count < 15) {
+ baz.cloneNode(true);
+ setTimeout(step, 30);
+ }
+ else {
+ document.documentElement.removeAttribute("class");
+ }
+ }
+
+}
+
+]]>
+</script>
+</head>
+<body onload="stuff()">
+
+<hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="baz"></hbox>
+
+</body>
+</html>
diff --git a/dom/xul/crashtests/360078-1xbl.xml b/dom/xul/crashtests/360078-1xbl.xml
new file mode 100644
index 000000000..c0f428c05
--- /dev/null
+++ b/dom/xul/crashtests/360078-1xbl.xml
@@ -0,0 +1,3 @@
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content>
+<a xmlns="http://www.w3.org/1999/xhtml" href="http://www.mozilla.org/" id="mlink">Foo<children xmlns="http://www.mozilla.org/xbl"/></a>
+</content></binding></bindings>
diff --git a/dom/xul/crashtests/363791-1.xul b/dom/xul/crashtests/363791-1.xul
new file mode 100644
index 000000000..08d2c99e4
--- /dev/null
+++ b/dom/xul/crashtests/363791-1.xul
@@ -0,0 +1,44 @@
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="setTimeout(boom, 30);" class="reftest-wait">
+
+<script>
+
+function boom()
+{
+ var tree = document.getElementById("tree");
+ var treecols = document.getElementById("treecols");
+ var treechildren = document.getElementById("treechildren");
+
+ tree.appendChild(treechildren); // no real change
+
+ function boom2() {
+ treecols.parentNode.removeChild(treecols);
+ document.documentElement.removeAttribute("class");
+ }
+
+ setTimeout(boom2, 30);
+}
+
+</script>
+
+
+<tree rows="6" id="tree">
+
+ <treecols id="treecols">
+ <treecol id="firstname" label="First Name"/>
+ </treecols>
+
+ <treechildren id="treechildren">
+ <treeitem>
+ <treerow>
+ <treecell label="Bob"/>
+ </treerow>
+ </treeitem>
+ </treechildren>
+
+</tree>
+
+
+</window>
diff --git a/dom/xul/crashtests/384740-1.xul b/dom/xul/crashtests/384740-1.xul
new file mode 100644
index 000000000..374f47c3d
--- /dev/null
+++ b/dom/xul/crashtests/384740-1.xul
@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom()">
+
+<script>
+
+function boom()
+{
+ var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+ var scrollbar = document.createElementNS(XUL_NS, 'scrollbar');
+ document.documentElement.appendChild(scrollbar);
+ var sbb = SpecialPowers.unwrap(SpecialPowers.wrap(document).getAnonymousNodes(scrollbar))[0];
+ var action = document.createElementNS(XUL_NS, 'action');
+ action.setAttribute('datasources', "");
+ sbb.appendChild(action);
+}
+
+</script>
+
+</window>
diff --git a/dom/xul/crashtests/384877-1-inner.xul b/dom/xul/crashtests/384877-1-inner.xul
new file mode 100644
index 000000000..9bbfc07bd
--- /dev/null
+++ b/dom/xul/crashtests/384877-1-inner.xul
@@ -0,0 +1,15 @@
+<menupopup xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="d" popup="d">
+<script>
+function doe() {
+var d = document.getElementById('d');
+if (d.openPopup) {
+ d.openPopup(document.documentElement, 'before_start', 0, 0, false, false);
+// alert(d.state);
+}
+
+if (d.showPopup)
+ d.showPopup();
+}
+setTimeout(doe, 200);
+</script>
+</menupopup>
diff --git a/dom/xul/crashtests/384877-1.html b/dom/xul/crashtests/384877-1.html
new file mode 100644
index 000000000..28fd2fc58
--- /dev/null
+++ b/dom/xul/crashtests/384877-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="384877-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/xul/crashtests/386914-1-inner.xul b/dom/xul/crashtests/386914-1-inner.xul
new file mode 100644
index 000000000..909889d8b
--- /dev/null
+++ b/dom/xul/crashtests/386914-1-inner.xul
@@ -0,0 +1,10 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="a">
+
+<box id="b" observes="a"/>
+
+<html:script xmlns:html="http://www.w3.org/1999/xhtml">
+document.getElementById('b').addEventListener('DOMAttrModified', function(e) {document.removeChild(document.documentElement);}, true);
+setTimeout(function() {document.getElementById('a').setAttribute('tabindex', '1') ;}, 100);
+</html:script>
+
+</window> \ No newline at end of file
diff --git a/dom/xul/crashtests/386914-1.html b/dom/xul/crashtests/386914-1.html
new file mode 100644
index 000000000..a8961339b
--- /dev/null
+++ b/dom/xul/crashtests/386914-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="386914-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/xul/crashtests/386947-1.xul b/dom/xul/crashtests/386947-1.xul
new file mode 100644
index 000000000..cf00d35f2
--- /dev/null
+++ b/dom/xul/crashtests/386947-1.xul
@@ -0,0 +1,12 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ style="background-color: red" onload="boom();">
+
+<script><![CDATA[
+
+function boom() {
+ document.documentElement.style.MozBinding = "url('#t')";
+}
+
+]]></script>
+</window>
diff --git a/dom/xul/crashtests/425821-1.xul b/dom/xul/crashtests/425821-1.xul
new file mode 100644
index 000000000..9764e64aa
--- /dev/null
+++ b/dom/xul/crashtests/425821-1.xul
@@ -0,0 +1,15 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+<script type="text/javascript">
+
+function boom()
+{
+ var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+ var wiz = document.createElementNS(XUL_NS, "wizard");
+ var btn = document.createElementNS(XUL_NS, "hbox");
+ btn.setAttribute("anonid", "Buttons");
+ wiz.appendChild(btn);
+ wiz.cloneNode(true);
+}
+
+</script>
+</window>
diff --git a/dom/xul/crashtests/428951-1.xul b/dom/xul/crashtests/428951-1.xul
new file mode 100644
index 000000000..024bc5d5c
--- /dev/null
+++ b/dom/xul/crashtests/428951-1.xul
@@ -0,0 +1,21 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<box>
+ <box style="background: initial;" id="f">
+ <box style="margin-top: -9999999px;"/>
+ </box>
+ <mathml:divergence>
+ <box/>
+ </mathml:divergence>
+ <mathml:moment command="f"/>
+</box>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+function init() {
+ var f = document.getElementsByTagName('mathml:divergence')[0];
+ window.addEventListener('DOMAttrModified',function() { f.parentNode.removeChild(f);}, true);
+ var x=document.getElementsByTagName('mathml:moment')[0];
+ x.parentNode.removeChild(x);
+}
+window.addEventListener("load", init, false);
+]]></script>
+</window>
diff --git a/dom/xul/crashtests/429085-1.xhtml b/dom/xul/crashtests/429085-1.xhtml
new file mode 100644
index 000000000..96e030fd4
--- /dev/null
+++ b/dom/xul/crashtests/429085-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+ var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+ var prefs = document.createElementNS(XUL_NS, "preferences");
+ var textbox = document.createElementNS(XUL_NS, "textbox");
+ textbox.setAttribute("onchange", "1");
+ prefs.appendChild(textbox);
+ prefs.cloneNode(true);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/xul/crashtests/431906-1-inner.xul b/dom/xul/crashtests/431906-1-inner.xul
new file mode 100644
index 000000000..367f621b2
--- /dev/null
+++ b/dom/xul/crashtests/431906-1-inner.xul
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<colgroup id="a" command="a">
+<box xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<box id="a" command="a"/>
+<box id="a" command="a"/>
+</box>
+</colgroup>
+<script><![CDATA[
+function doe(){
+document.getElementsByTagName('*')[1].setAttribute('id','');
+document.getElementsByTagName('*')[1].setAttribute('xmlns', '');
+document.getElementsByTagName('*')[3].setAttribute('id','');
+
+document.getElementsByTagName('*')[4].removeAttribute('xmlns');
+document.getElementsByTagName('*')[4].setAttribute('width', '1px');
+}
+setTimeout(doe,100);
+]]></script>
+</html> \ No newline at end of file
diff --git a/dom/xul/crashtests/431906-1.html b/dom/xul/crashtests/431906-1.html
new file mode 100644
index 000000000..1639d3ea6
--- /dev/null
+++ b/dom/xul/crashtests/431906-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="431906-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/dom/xul/crashtests/451311-1.xul b/dom/xul/crashtests/451311-1.xul
new file mode 100644
index 000000000..f07928b66
--- /dev/null
+++ b/dom/xul/crashtests/451311-1.xul
@@ -0,0 +1 @@
+<overlay xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><iframe/></overlay>
diff --git a/dom/xul/crashtests/461917-1.xhtml b/dom/xul/crashtests/461917-1.xhtml
new file mode 100644
index 000000000..15792f6f0
--- /dev/null
+++ b/dom/xul/crashtests/461917-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+<tabs xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onselect="#"><wizard/></tabs>
+</body>
+</html>
diff --git a/dom/xul/crashtests/468211-1.xul b/dom/xul/crashtests/468211-1.xul
new file mode 100644
index 000000000..b6364f1bf
--- /dev/null
+++ b/dom/xul/crashtests/468211-1.xul
@@ -0,0 +1,23 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" style="-moz-binding:url(#xbl2)" class="reftest-wait">
+<tooltip/>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">
+function doe() {
+document.getElementsByTagName('tooltip')[0].setAttribute('style', '-moz-binding:url(#xbl)');
+document.getElementsByTagName('tooltip')[0].setAttribute('onDOMAttrModified', 'this.focus()');
+document.documentElement.removeAttribute("class");
+}
+setTimeout(doe, 1);
+</script>
+
+<bindings xmlns="http://www.mozilla.org/xbl" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<binding id="xbl">
+<content>
+<xul:box onbroadcast="document.documentElement.setAttribute('a','a')" id="g"/>
+<xul:box onDOMAttrModified="document.documentElement.style.display = 'none'" observes="g"/>
+</content>
+</binding>
+
+<binding id="xbl2"></binding>
+</bindings>
+</window> \ No newline at end of file
diff --git a/dom/xul/crashtests/468211-2-binding.xml b/dom/xul/crashtests/468211-2-binding.xml
new file mode 100644
index 000000000..6a9d14f13
--- /dev/null
+++ b/dom/xul/crashtests/468211-2-binding.xml
@@ -0,0 +1,12 @@
+<bindings xmlns="http://www.mozilla.org/xbl">
+
+<binding id="xbl">
+
+<content>
+<mrow xmlns="http://www.w3.org/1998/Math/MathML" id="f">
+<box observes="f" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/>
+</mrow>
+</content>
+
+</binding>
+</bindings> \ No newline at end of file
diff --git a/dom/xul/crashtests/468211-2.xul b/dom/xul/crashtests/468211-2.xul
new file mode 100644
index 000000000..ca3104875
--- /dev/null
+++ b/dom/xul/crashtests/468211-2.xul
@@ -0,0 +1,10 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<html:div onDOMAttrModified="this.parentNode.removeChild(this)">
+<html:div/>
+<html:style>div {-moz-binding:url(468211-2-binding.xml#xbl);</html:style>
+</html:div>
+
+</window> \ No newline at end of file
diff --git a/dom/xul/crashtests/468211-3.xul b/dom/xul/crashtests/468211-3.xul
new file mode 100644
index 000000000..4d221616e
--- /dev/null
+++ b/dom/xul/crashtests/468211-3.xul
@@ -0,0 +1,18 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<box style="-moz-binding:url(#xbl)"/>
+
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="xbl" inheritstyle="false">
+<content>
+<g xmlns="http://www.w3.org/2000/svg" onDOMAttrModified="document.removeChild(document.documentElement)" id="a"/>
+<box xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" observes="a"/>
+
+<children xmlns="http://www.mozilla.org/xbl"/>
+
+</content>
+</binding>
+</bindings>
+
+</window> \ No newline at end of file
diff --git a/dom/xul/crashtests/495635-1.xul b/dom/xul/crashtests/495635-1.xul
new file mode 100644
index 000000000..3d42a10bb
--- /dev/null
+++ b/dom/xul/crashtests/495635-1.xul
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<?xul-overlay href="extA1.xul"?>
+<?xul-overlay href="extB1.xul"?>
+<?xul-overlay href="extA2.xul"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<vbox id="browser-bottombox">
+</vbox>
+</window>
diff --git a/dom/xul/crashtests/509719-1-overlay.xul b/dom/xul/crashtests/509719-1-overlay.xul
new file mode 100644
index 000000000..880edc1cd
--- /dev/null
+++ b/dom/xul/crashtests/509719-1-overlay.xul
@@ -0,0 +1,3 @@
+<overlay xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <window id="win" removeelement="true"/>
+</overlay>
diff --git a/dom/xul/crashtests/509719-1.xul b/dom/xul/crashtests/509719-1.xul
new file mode 100644
index 000000000..4d869b323
--- /dev/null
+++ b/dom/xul/crashtests/509719-1.xul
@@ -0,0 +1,3 @@
+<?xul-overlay href="509719-1-overlay.xul"?>
+<window id="win" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+</window>
diff --git a/dom/xul/crashtests/509719-2-overlay.xul b/dom/xul/crashtests/509719-2-overlay.xul
new file mode 100644
index 000000000..fefbe194a
--- /dev/null
+++ b/dom/xul/crashtests/509719-2-overlay.xul
@@ -0,0 +1,8 @@
+<overlay xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <script>
+ if (document.getElementById("testnode")) {
+ document.loadOverlay(window.location.href.substr(0,window.location.href.lastIndexOf('/')+1)+'509719-2-overlay.xul', null);
+ }
+ </script>
+ <box xmlns="http://www.w3.org/1999/xhtml" id="testnode" removeelement="true"/>
+</overlay>
diff --git a/dom/xul/crashtests/509719-2.xul b/dom/xul/crashtests/509719-2.xul
new file mode 100644
index 000000000..5a64dc76e
--- /dev/null
+++ b/dom/xul/crashtests/509719-2.xul
@@ -0,0 +1,7 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window id="win" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <box id="testnode" onDOMAttrModified="this.parentNode.removeChild(this)"/>
+ <script>
+document.loadOverlay(window.location.href.substr(0,window.location.href.lastIndexOf('/')+1)+'509719-2-overlay.xul', null);
+ </script>
+</window>
diff --git a/dom/xul/crashtests/583230.xul b/dom/xul/crashtests/583230.xul
new file mode 100644
index 000000000..0361b619d
--- /dev/null
+++ b/dom/xul/crashtests/583230.xul
@@ -0,0 +1,23 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<richlistbox id="a" datasources="" template="d"/>
+<script><![CDATA[
+function doe() {
+var node = document.getElementById('a');
+var b = node.builder;
+document.removeChild(document.documentElement);
+b.addResult({}, node);
+b.removeResult({});
+b.replaceResult({}, {}, node);
+b.resultBindingChanged({});
+try { b.addResult(null, null); } catch(ex) { }
+try { b.removeResult(null); } catch(ex) { }
+try { b.replaceResult(null, null, null); } catch(ex) { }
+try { b.resultBindingChanged(null); } catch(ex) { }
+try { b.getResultForId("empty"); } catch(ex) { }
+try { b.getResultForContent(node); } catch(ex) { }
+try { b.hasGeneratedContent(null, null); } catch(ex) { }
+}
+window.addEventListener("load", doe, false);
+]]></script>
+</window>
diff --git a/dom/xul/crashtests/crashtests.list b/dom/xul/crashtests/crashtests.list
new file mode 100644
index 000000000..737a32f60
--- /dev/null
+++ b/dom/xul/crashtests/crashtests.list
@@ -0,0 +1,33 @@
+load 107518-1.xml
+load 252448-1.xul
+load 253479-1.xul
+load 253479-2.xul
+load 326204-1.xul
+load 326644-1.html
+load 326644-2.html
+load 326864-1.xul
+load 326875-1.xul
+load 326881-1.xul
+load 329982-1.xhtml
+load 336096-1.xhtml
+load 344215-1.xul
+load 354611-1.html
+load 360078-1.xhtml
+load 363791-1.xul
+load 384740-1.xul
+load 384877-1.html
+load 386914-1.html
+load 386947-1.xul
+load 425821-1.xul
+load 428951-1.xul
+load 429085-1.xhtml
+load 431906-1.html
+load 451311-1.xul
+load 461917-1.xhtml
+load 468211-1.xul
+load 468211-2.xul
+load 468211-3.xul
+load 495635-1.xul
+load 509719-1.xul
+asserts(3) load 509719-2.xul # bug 909819
+load 583230.xul
diff --git a/dom/xul/crashtests/extA1.xul b/dom/xul/crashtests/extA1.xul
new file mode 100644
index 000000000..bfd2c0d44
--- /dev/null
+++ b/dom/xul/crashtests/extA1.xul
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE overlay SYSTEM "chrome://exta/locale/exta.dtd">
+<overlay id="extA1"
+ xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <vbox id="browser-bottombox">
+ <statusbar id="extAbar" />
+ </vbox>
+</overlay>
diff --git a/dom/xul/crashtests/extA2.xul b/dom/xul/crashtests/extA2.xul
new file mode 100644
index 000000000..8d77a4995
--- /dev/null
+++ b/dom/xul/crashtests/extA2.xul
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE overlay SYSTEM "chrome://exta/locale/exta.dtd">
+<overlay id="extA2"
+ xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <statusbar id="extAbar">
+ <statusbarpanel id="extApanel" label="panel 1">
+ </statusbarpanel>
+ <statusbarpanel id="extApanel2" label="panel 2" />
+ </statusbar>
+</overlay>
diff --git a/dom/xul/crashtests/extB1.xul b/dom/xul/crashtests/extB1.xul
new file mode 100644
index 000000000..9e2f5c418
--- /dev/null
+++ b/dom/xul/crashtests/extB1.xul
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<overlay id="extA2"
+ xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <statusbar id="extAbar" removeelement="true" />
+</overlay>