summaryrefslogtreecommitdiffstats
path: root/layout/mathml/crashtests
diff options
context:
space:
mode:
Diffstat (limited to 'layout/mathml/crashtests')
-rw-r--r--layout/mathml/crashtests/1028521-1.xhtml5
-rw-r--r--layout/mathml/crashtests/1061027.html12
-rw-r--r--layout/mathml/crashtests/151054-1.xml15
-rw-r--r--layout/mathml/crashtests/289180-1.xml16
-rw-r--r--layout/mathml/crashtests/307826-1.xhtml30
-rw-r--r--layout/mathml/crashtests/307839-1.xhtml15
-rw-r--r--layout/mathml/crashtests/307839-2.xhtml24
-rw-r--r--layout/mathml/crashtests/323733-1.xml7
-rw-r--r--layout/mathml/crashtests/323737-1.xml9
-rw-r--r--layout/mathml/crashtests/323738-1.xml11
-rw-r--r--layout/mathml/crashtests/323741-1.xml13
-rw-r--r--layout/mathml/crashtests/323742-1.xml16
-rw-r--r--layout/mathml/crashtests/336074-1.xhtml25
-rw-r--r--layout/mathml/crashtests/347355-1-inner.xhtml28
-rw-r--r--layout/mathml/crashtests/347355-1.gifbin0 -> 980 bytes
-rw-r--r--layout/mathml/crashtests/347355-1.html9
-rw-r--r--layout/mathml/crashtests/347495-1.xhtml10
-rw-r--r--layout/mathml/crashtests/347507-1.xhtml29
-rw-r--r--layout/mathml/crashtests/348492-1.xhtml31
-rw-r--r--layout/mathml/crashtests/348709-1.xhtml20
-rw-r--r--layout/mathml/crashtests/348811-1.xhtml26
-rw-r--r--layout/mathml/crashtests/348811-2.xhtml31
-rw-r--r--layout/mathml/crashtests/353612-1.xhtml17
-rw-r--r--layout/mathml/crashtests/355986-1.xhtml34
-rw-r--r--layout/mathml/crashtests/364685-1.xhtml19
-rw-r--r--layout/mathml/crashtests/366012-1.xhtml23
-rw-r--r--layout/mathml/crashtests/366564-1.xhtml44
-rw-r--r--layout/mathml/crashtests/367107-1.html22
-rw-r--r--layout/mathml/crashtests/368430-1.xhtml5
-rw-r--r--layout/mathml/crashtests/370791-1.xhtml33
-rw-r--r--layout/mathml/crashtests/370862-1.xhtml27
-rw-r--r--layout/mathml/crashtests/372483-1.xhtml7
-rw-r--r--layout/mathml/crashtests/373472-1.xhtml20
-rw-r--r--layout/mathml/crashtests/373472-2.xhtml9
-rw-r--r--layout/mathml/crashtests/375562-1.xhtml38
-rw-r--r--layout/mathml/crashtests/377824-1.xhtml5
-rw-r--r--layout/mathml/crashtests/379418-1.xhtml7
-rw-r--r--layout/mathml/crashtests/385226-1.xhtml29
-rw-r--r--layout/mathml/crashtests/393760-1.xhtml16
-rw-r--r--layout/mathml/crashtests/397518-1.xhtml15
-rw-r--r--layout/mathml/crashtests/398038-1.html8
-rw-r--r--layout/mathml/crashtests/400157.xhtml34
-rw-r--r--layout/mathml/crashtests/400475-1.xhtml16
-rw-r--r--layout/mathml/crashtests/402400-1.xhtml41
-rw-r--r--layout/mathml/crashtests/403156-1.xhtml12
-rw-r--r--layout/mathml/crashtests/404485-1.xhtml9
-rw-r--r--layout/mathml/crashtests/405187-1.xhtml10
-rw-r--r--layout/mathml/crashtests/405271-1.xml36
-rw-r--r--layout/mathml/crashtests/412237-1.xml11
-rw-r--r--layout/mathml/crashtests/413063-1.xhtml21
-rw-r--r--layout/mathml/crashtests/416907-1.xhtml5
-rw-r--r--layout/mathml/crashtests/420420-1.xhtml7
-rw-r--r--layout/mathml/crashtests/431072-1.xhtml25
-rw-r--r--layout/mathml/crashtests/443089-1.xhtml7
-rw-r--r--layout/mathml/crashtests/463763-1.xhtml10
-rw-r--r--layout/mathml/crashtests/463763-2.xhtml12
-rw-r--r--layout/mathml/crashtests/476547-1.xhtml5
-rw-r--r--layout/mathml/crashtests/477740-1.xhtml25
-rw-r--r--layout/mathml/crashtests/541620-1.xhtml6
-rw-r--r--layout/mathml/crashtests/557474-1.html11
-rw-r--r--layout/mathml/crashtests/654928-1.html3
-rw-r--r--layout/mathml/crashtests/655451-1.xhtml15
-rw-r--r--layout/mathml/crashtests/713606-1.html24
-rw-r--r--layout/mathml/crashtests/716349-1.html13
-rw-r--r--layout/mathml/crashtests/848725-1.html17
-rw-r--r--layout/mathml/crashtests/848725-2.html17
-rw-r--r--layout/mathml/crashtests/947557-1.html21
-rw-r--r--layout/mathml/crashtests/973322-1.xhtml8
-rw-r--r--layout/mathml/crashtests/crashtests.list66
69 files changed, 1247 insertions, 0 deletions
diff --git a/layout/mathml/crashtests/1028521-1.xhtml b/layout/mathml/crashtests/1028521-1.xhtml
new file mode 100644
index 000000000..b8d094774
--- /dev/null
+++ b/layout/mathml/crashtests/1028521-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<mstyle xmlns="http://www.w3.org/1998/Math/MathML"><li xmlns="http://www.w3.org/1999/xhtml" dir="rtl"></li></mstyle>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/1061027.html b/layout/mathml/crashtests/1061027.html
new file mode 100644
index 000000000..ee69c8ed0
--- /dev/null
+++ b/layout/mathml/crashtests/1061027.html
@@ -0,0 +1,12 @@
+<style>
+.c1 { transform-style: preserve-3d; display: table-row-group;</style><script>
+var docElement = document.documentElement;
+function init() {
+test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "defs");
+test1.setAttribute("class", "c1");
+docElement.appendChild(test1);
+test2 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "msub");
+test1.appendChild(test2);
+}
+document.addEventListener("DOMContentLoaded", init, false);
+</script> \ No newline at end of file
diff --git a/layout/mathml/crashtests/151054-1.xml b/layout/mathml/crashtests/151054-1.xml
new file mode 100644
index 000000000..619345c9b
--- /dev/null
+++ b/layout/mathml/crashtests/151054-1.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+ <meta http-equiv="Content-Type" content="text/html" />
+ <title>Math with position: absolute</title>
+ <style>
+ math { position: absolute; }
+ </style>
+</head>
+<body>
+ <math xmlns="http://www.w3.org/1998/Math/MathML">
+ <infinity/>
+ </math>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/289180-1.xml b/layout/mathml/crashtests/289180-1.xml
new file mode 100644
index 000000000..7ad9f54ff
--- /dev/null
+++ b/layout/mathml/crashtests/289180-1.xml
@@ -0,0 +1,16 @@
+
+
+ <math xmlns="http://www.w3.org/1998/Math/MathML" mode="inline">
+ <mfrac>
+ <mi>x</mi>
+ <mi>y</mi>
+ </mfrac>
+ </math>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" mode="display">
+ <mfrac>
+
+ <mi>x</mi>
+ <mi>y</mi>
+ </mfrac>
+ </math>
+
diff --git a/layout/mathml/crashtests/307826-1.xhtml b/layout/mathml/crashtests/307826-1.xhtml
new file mode 100644
index 000000000..879b426e1
--- /dev/null
+++ b/layout/mathml/crashtests/307826-1.xhtml
@@ -0,0 +1,30 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+
+<title>Testcase for MathML crash</title>
+
+<script><![CDATA[
+
+function boom() {
+ var div = document.getElementById("div");
+ var mi = document.getElementById("mi");
+ mi.appendChild(div);
+ mi.removeChild(div);
+
+ document.documentElement.removeAttribute("class");
+}
+
+]]></script>
+
+</head>
+
+
+<body onload="setTimeout(boom, 30);">
+
+<div style="float: right;" id="div">Floated div</div>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><mi id="mi">mi</mi></math>
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/307839-1.xhtml b/layout/mathml/crashtests/307839-1.xhtml
new file mode 100644
index 000000000..7275f0859
--- /dev/null
+++ b/layout/mathml/crashtests/307839-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ <title>Testcase</title>
+ </head>
+ <body onload="document.getElementById('B').appendChild(document.getElementById('A'));">
+ <div style="position: relative;">
+ <math xmlns="http://www.w3.org/1998/Math/MathML">
+ <mover>
+ <mrow id="A"/>
+ <mn id="B"/>
+ </mover>
+ </math>
+ </div>
+ </body>
+</html>
diff --git a/layout/mathml/crashtests/307839-2.xhtml b/layout/mathml/crashtests/307839-2.xhtml
new file mode 100644
index 000000000..77c13fbd6
--- /dev/null
+++ b/layout/mathml/crashtests/307839-2.xhtml
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN" "http://www.w3.org/TR/MathML2/dtd/xhtml-math11-f.dtd" [
+ <!ENTITY mathml "http://www.w3.org/1998/Math/MathML">
+]>
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<title>Testcase bug - Evil mrow:hover testcase crashes Mozilla</title>
+<style type="text/css">
+#h:hover{display:block;}
+</style>
+</head>
+<body onload="document.getElementById('mrow').setAttribute('id', 'h');">
+<math mode="display" xmlns="http://www.w3.org/1998/Math/MathML">
+<mover>
+ <mrow id="mrow">hovering over this should not crash Mozilla</mrow>
+ <mover>
+ <mo>10</mo>
+ <mrow>times</mrow>
+ </mover>
+</mover>
+</math>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/323733-1.xml b/layout/mathml/crashtests/323733-1.xml
new file mode 100644
index 000000000..5551d8588
--- /dev/null
+++ b/layout/mathml/crashtests/323733-1.xml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline">
+ <ms />
+ </math>
+ </div>
+</html>
diff --git a/layout/mathml/crashtests/323737-1.xml b/layout/mathml/crashtests/323737-1.xml
new file mode 100644
index 000000000..ad673f946
--- /dev/null
+++ b/layout/mathml/crashtests/323737-1.xml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline">
+ <mtable>
+ <mroot />
+ </mtable>
+ </math>
+ </div>
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/323738-1.xml b/layout/mathml/crashtests/323738-1.xml
new file mode 100644
index 000000000..318aa93b4
--- /dev/null
+++ b/layout/mathml/crashtests/323738-1.xml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline">
+ <msub>
+ <mo>
+ <factorial />
+ </mo>
+ </msub>
+ </math>
+ </div>
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/323741-1.xml b/layout/mathml/crashtests/323741-1.xml
new file mode 100644
index 000000000..8527c1a78
--- /dev/null
+++ b/layout/mathml/crashtests/323741-1.xml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline">
+ <notin>
+ <mspace>
+ <mfenced />
+ </mspace>
+
+ f
+ </notin>
+ </math>
+ </div>
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/323742-1.xml b/layout/mathml/crashtests/323742-1.xml
new file mode 100644
index 000000000..2cd225990
--- /dev/null
+++ b/layout/mathml/crashtests/323742-1.xml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline">
+
+ <eulergamma>
+ <arcsech>
+ <mrow>
+ <mtable>
+ <maction/>
+ </mtable>
+ </mrow>
+ </arcsech>
+ </eulergamma>
+ </math>
+ </div>
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/336074-1.xhtml b/layout/mathml/crashtests/336074-1.xhtml
new file mode 100644
index 000000000..b8d3d9225
--- /dev/null
+++ b/layout/mathml/crashtests/336074-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+
+<script>
+<![CDATA[
+
+function init()
+{
+ var k = document.getElementById("k");
+ k.parentNode.removeChild(k);
+ document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+</head>
+
+<body onload="setTimeout(init, 30);">
+
+<mo xmlns='http://www.w3.org/1998/Math/MathML'><mi id="k">z</mi></mo>
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/347355-1-inner.xhtml b/layout/mathml/crashtests/347355-1-inner.xhtml
new file mode 100644
index 000000000..9c0b46ff5
--- /dev/null
+++ b/layout/mathml/crashtests/347355-1-inner.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function foo()
+{
+ var mrow = document.getElementById("mrow")
+
+ mrow.parentNode.removeChild(mrow);
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(foo, 100)">
+
+<div>
+<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <mrow id="mrow">
+ <mtd><img xmlns="http://www.w3.org/1999/xhtml" src="347355-1.gif" /></mtd>
+ <mtable> <mtr> <mtd><mi>t</mi></mtd> </mtr> </mtable>
+ </mrow>
+</math>
+</div>
+
+</body>
+
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/347355-1.gif b/layout/mathml/crashtests/347355-1.gif
new file mode 100644
index 000000000..475ea8c16
--- /dev/null
+++ b/layout/mathml/crashtests/347355-1.gif
Binary files differ
diff --git a/layout/mathml/crashtests/347355-1.html b/layout/mathml/crashtests/347355-1.html
new file mode 100644
index 000000000..7e3c6c7c5
--- /dev/null
+++ b/layout/mathml/crashtests/347355-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="347355-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/347495-1.xhtml b/layout/mathml/crashtests/347495-1.xhtml
new file mode 100644
index 000000000..9cff7bdcf
--- /dev/null
+++ b/layout/mathml/crashtests/347495-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <munderover> <mo>&#x0220F;</mo> <mn>1</mn> </munderover>
+</math></div>
+
+</body>
+
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/347507-1.xhtml b/layout/mathml/crashtests/347507-1.xhtml
new file mode 100644
index 000000000..6231950c7
--- /dev/null
+++ b/layout/mathml/crashtests/347507-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function foo()
+{
+ var div = document.getElementById("div");
+ div.appendChild(div.firstChild);
+
+ var td = document.getElementById("td");
+ td.setAttribute('rowspan', -2);
+}
+
+</script>
+
+</head>
+
+<body onload="foo()">
+
+
+<div id="div"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+
+ <mtable> <mtr> <mtd id="td"><mi>y</mi></mtd> </mtr> </mtable>
+
+</math></div>
+
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/348492-1.xhtml b/layout/mathml/crashtests/348492-1.xhtml
new file mode 100644
index 000000000..18edae35d
--- /dev/null
+++ b/layout/mathml/crashtests/348492-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<script>
+var MATHML_NS = "http://www.w3.org/1998/Math/MathML";
+
+function foo()
+{
+ var mmultiscripts = document.createElementNS(MATHML_NS, 'mmultiscripts');
+ var mtd = document.createElementNS(MATHML_NS, 'mtd');
+
+
+ document.body.appendChild(mmultiscripts);
+ aC(mmultiscripts, mtd);
+ aC(mmultiscripts, document.createTextNode('foo'));
+
+ document.documentElement.removeAttribute("class");
+}
+
+function aC(q1, q2) { q1.appendChild(q2); }
+
+</script>
+</head>
+
+<body onload="setTimeout(foo, 30)">
+
+
+
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/348709-1.xhtml b/layout/mathml/crashtests/348709-1.xhtml
new file mode 100644
index 000000000..907ede6ab
--- /dev/null
+++ b/layout/mathml/crashtests/348709-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+function foo()
+{
+ document.getElementById("mtr").appendChild(document.createTextNode("a"));
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+<mrow> <mfenced open="[" close="]"> <mtable> <mtr id="mtr"> <mtd><mi>x</mi></mtd> <mtd><mi>y</mi></mtd> </mtr> </mtable> </mfenced> </mrow>
+</math></div>
+
+</body>
+
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/348811-1.xhtml b/layout/mathml/crashtests/348811-1.xhtml
new file mode 100644
index 000000000..367cc32be
--- /dev/null
+++ b/layout/mathml/crashtests/348811-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+ var newTable = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mtable")
+
+ document.getElementById("mtr").appendChild(newTable);
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+
+<div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <mtable> <mtr id="mtr"> <mtd>
+ <mi>x</mi>
+ </mtd> </mtr> </mtable> </math>
+</div>
+
+
+</body>
+
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/348811-2.xhtml b/layout/mathml/crashtests/348811-2.xhtml
new file mode 100644
index 000000000..30f7943a9
--- /dev/null
+++ b/layout/mathml/crashtests/348811-2.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+ var m = "http://www.w3.org/1998/Math/MathML";
+ var newTable = document.createElementNS(m, "mtable")
+ document.getElementById("mtable").appendChild(newTable);
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+
+<div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <mtable id="mtable">
+ <mtr id="mtr">
+ <mtd>
+ <mi>x</mi>
+ </mtd>
+ </mtr>
+ </mtable>
+ </math>
+</div>
+
+
+</body>
+
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/353612-1.xhtml b/layout/mathml/crashtests/353612-1.xhtml
new file mode 100644
index 000000000..386e66f93
--- /dev/null
+++ b/layout/mathml/crashtests/353612-1.xhtml
@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+ document.getElementById("ms").setAttribute("lquote", "'");
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+<mtr xmlns="http://www.w3.org/1998/Math/MathML" />
+<mstyle xmlns="http://www.w3.org/1998/Math/MathML" id="ms" />
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/355986-1.xhtml b/layout/mathml/crashtests/355986-1.xhtml
new file mode 100644
index 000000000..d2736cf73
--- /dev/null
+++ b/layout/mathml/crashtests/355986-1.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+
+<head>
+<style>
+
+body * {
+ display: table-footer-group;
+ overflow: -moz-scrollbars-vertical;
+}
+
+</style>
+</head>
+
+
+
+<body onload="document.getElementById('eee').style.display = 'inline';">
+
+
+
+
+<div id="eee">
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <mtable>
+ <mtr>
+ <mtd><mi>x</mi></mtd>
+ </mtr>
+ </mtable>
+ </math>
+</div>
+
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/364685-1.xhtml b/layout/mathml/crashtests/364685-1.xhtml
new file mode 100644
index 000000000..25a2499f5
--- /dev/null
+++ b/layout/mathml/crashtests/364685-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<body onload="boom();">
+
+<script>
+function boom()
+{
+ document.getElementById("merror").appendChild(document.getElementById("s"));
+}
+</script>
+
+<math:merror id="merror"></math:merror>
+
+<span id="s" />
+
+</body>
+</html>
+
diff --git a/layout/mathml/crashtests/366012-1.xhtml b/layout/mathml/crashtests/366012-1.xhtml
new file mode 100644
index 000000000..306a84738
--- /dev/null
+++ b/layout/mathml/crashtests/366012-1.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+
+function boom()
+{
+ var doom = document.getElementById("doom");
+ doom.parentNode.removeChild(doom);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+ <div>
+ <p id="doom">This paragraph disappears.</p>
+ <math xmlns='http://www.w3.org/1998/Math/MathML' display='block'><msub><mi>y</mi><mn>0</mn><frameset xmlns="http://www.w3.org/1999/xhtml" /></msub></math>
+ </div>
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/366564-1.xhtml b/layout/mathml/crashtests/366564-1.xhtml
new file mode 100644
index 000000000..a83e5a8fe
--- /dev/null
+++ b/layout/mathml/crashtests/366564-1.xhtml
@@ -0,0 +1,44 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN" "http://www.w3.org/Math/DTD/mathml2/xhtml-math11-f.dtd" >
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+function boom1()
+{
+ document.getElementById("mfenced3").appendChild(document.getElementById("div4"));
+ setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+ document.getElementById("sup1").appendChild(document.getElementById("mo2"));
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom1, 30);">
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <msup id="sup1">
+ <mi>b</mi>
+ <mn>2</mn>
+ </msup>
+</math></div>
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <mi>j</mi>
+ <mo id="mo2">=</mo>
+ <mfenced id="mfenced3" open="[" close="]">
+ <mn>55</mn>
+ </mfenced>
+</math></div>
+
+<div id="div4"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <mo> &int; </mo>
+</math></div>
+
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/367107-1.html b/layout/mathml/crashtests/367107-1.html
new file mode 100644
index 000000000..775ace87e
--- /dev/null
+++ b/layout/mathml/crashtests/367107-1.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var MATHML_NS = "http://www.w3.org/1998/Math/MathML";
+
+ var mtr = document.createElementNS(MATHML_NS, 'mtr');
+ var mtable = document.createElementNS(MATHML_NS, 'mtable');
+
+ document.body.appendChild(mtr);
+ mtr.appendChild(mtable);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/368430-1.xhtml b/layout/mathml/crashtests/368430-1.xhtml
new file mode 100644
index 000000000..79e10c46a
--- /dev/null
+++ b/layout/mathml/crashtests/368430-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<maction xmlns="http://www.w3.org/1998/Math/MathML">Foo Bar</maction>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/370791-1.xhtml b/layout/mathml/crashtests/370791-1.xhtml
new file mode 100644
index 000000000..13e2a0b54
--- /dev/null
+++ b/layout/mathml/crashtests/370791-1.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML" class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ var mi = document.getElementById("mi");
+ var textA = mi.firstChild;
+ var textB = document.createTextNode("b");
+ var textSpace = document.createTextNode(" ");
+
+ var floater = document.getElementById("floater");
+
+ mi.appendChild(textB);
+ mi.appendChild(textSpace);
+ mi.removeChild(textA);
+ mi.removeChild(textSpace);
+
+ floater.parentNode.removeChild(floater);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<math:mi id="mi">a<p><span style="float: right;" id="floater" /></p></math:mi>
+
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/370862-1.xhtml b/layout/mathml/crashtests/370862-1.xhtml
new file mode 100644
index 000000000..42511880f
--- /dev/null
+++ b/layout/mathml/crashtests/370862-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+function boom()
+{
+ var math = document.getElementById("math");
+ var div = document.getElementById("div")
+
+ math.setAttribute("color", "g");
+ document.body.appendChild(div);
+
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<div id="div">
+
+<mo xmlns='http://www.w3.org/1998/Math/MathML'>+<math id="math"><mn>1</mn></math></mo>
+
+</div>
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/372483-1.xhtml b/layout/mathml/crashtests/372483-1.xhtml
new file mode 100644
index 000000000..41edd7d9b
--- /dev/null
+++ b/layout/mathml/crashtests/372483-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<div><munder xmlns="http://www.w3.org/1998/Math/MathML"/></div>
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/373472-1.xhtml b/layout/mathml/crashtests/373472-1.xhtml
new file mode 100644
index 000000000..6c6a304a7
--- /dev/null
+++ b/layout/mathml/crashtests/373472-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+ document.getElementById("mo").appendChild(document.getElementById("mo2"));
+ document.body.offsetWidth;
+ document.getElementById("span").appendChild(document.createTextNode("baz"));
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<p>Foo <math xmlns="http://www.w3.org/1998/Math/MathML"><mo id="mo2">-</mo></math></p>
+
+<p><math xmlns="http://www.w3.org/1998/Math/MathML"><msub id="msub"><mo id="mo">+</mo></msub></math> <span id="span">bar</span></p>
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/373472-2.xhtml b/layout/mathml/crashtests/373472-2.xhtml
new file mode 100644
index 000000000..1c7e1c7ad
--- /dev/null
+++ b/layout/mathml/crashtests/373472-2.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<p><math xmlns="http://www.w3.org/1998/Math/MathML"><mroot><mo>k</mo></mroot></math></p>
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/375562-1.xhtml b/layout/mathml/crashtests/375562-1.xhtml
new file mode 100644
index 000000000..491b31359
--- /dev/null
+++ b/layout/mathml/crashtests/375562-1.xhtml
@@ -0,0 +1,38 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+
+function boom()
+{
+ var a = document.getElementById("a");
+ var plus = document.getElementById("plus");
+ var frameset = document.createElementNS(HTML_NS, "frameset");
+
+ document.body.style.width = "300px";
+
+ a.parentNode.removeChild(a);
+
+ plus.appendChild(frameset);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <msup>
+ <mi id="a">a</mi>
+ <mo id="plus">+</mo>
+ <mi>b</mi>
+ <mi>c</mi>
+ </msup>
+</math></div>
+
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/377824-1.xhtml b/layout/mathml/crashtests/377824-1.xhtml
new file mode 100644
index 000000000..ddbe7da66
--- /dev/null
+++ b/layout/mathml/crashtests/377824-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<body>
+<math:mtable />
+</body>
+</html>
diff --git a/layout/mathml/crashtests/379418-1.xhtml b/layout/mathml/crashtests/379418-1.xhtml
new file mode 100644
index 000000000..dc6e9e571
--- /dev/null
+++ b/layout/mathml/crashtests/379418-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ע</math>
+</body>
+</html>
+
diff --git a/layout/mathml/crashtests/385226-1.xhtml b/layout/mathml/crashtests/385226-1.xhtml
new file mode 100644
index 000000000..b1d261eb3
--- /dev/null
+++ b/layout/mathml/crashtests/385226-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<head>
+<style>
+[class="capleft"] { caption-side: left; }
+[class="collapse"] { visibility: collapse; }
+</style>
+</head>
+
+<body>
+
+<div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="block" class="collapse">
+ <mtable>
+ <mtr>
+ <mtd><mi>x</mi></mtd>
+ <mtd><mi>y</mi></mtd>
+ </mtr>
+ <html:caption class="capleft">
+ <mtd><mi>z</mi></mtd>
+ <mtd><mi>w</mi></mtd>
+ </html:caption>
+ </mtable>
+ </math>
+</div>
+
+</body>
+
+</html> \ No newline at end of file
diff --git a/layout/mathml/crashtests/393760-1.xhtml b/layout/mathml/crashtests/393760-1.xhtml
new file mode 100644
index 000000000..cb5c2d7a1
--- /dev/null
+++ b/layout/mathml/crashtests/393760-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+<script>
+function boom()
+{
+ document.getElementById("mfenced").setAttribute("mathbackground", "yellow");
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<math:mfenced id="mfenced" />
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/397518-1.xhtml b/layout/mathml/crashtests/397518-1.xhtml
new file mode 100644
index 000000000..bc460ead1
--- /dev/null
+++ b/layout/mathml/crashtests/397518-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+<script>
+function boom()
+{
+ var span = document.getElementById("s");
+ var newSpan = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+ span.appendChild(newSpan);
+}
+</script>
+</head>
+<body onload="boom();">
+<math:math><span id="s"><div/></span></math:math>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/398038-1.html b/layout/mathml/crashtests/398038-1.html
new file mode 100644
index 000000000..b383141c4
--- /dev/null
+++ b/layout/mathml/crashtests/398038-1.html
@@ -0,0 +1,8 @@
+<html>
+<head><title>Crashtest for bug 398038</title></head>
+<body>
+ <math><mpadded height="20 10"/></math>
+ <math><mpadded height="10 0000000000em"/></math>
+ <math><mpadded height="10 1.2em"/></math>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/400157.xhtml b/layout/mathml/crashtests/400157.xhtml
new file mode 100644
index 000000000..78754875d
--- /dev/null
+++ b/layout/mathml/crashtests/400157.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML" class="reftest-wait">
+<mathml:mfenced/>
+
+
+<script><![CDATA[
+var docviewer;
+function do_onload() {
+ var navigator1 = SpecialPowers.wrap(parent).QueryInterface(SpecialPowers.Ci.nsIInterfaceRequestor).getInterface(SpecialPowers.Ci.nsIWebNavigation);
+ var docShell = navigator1.QueryInterface(SpecialPowers.Ci.nsIDocShell);
+ docviewer = docShell.contentViewer;
+
+ setTimeout(function() {
+ clearTimeout(timer);
+ docviewer.textZoom = 1;
+ document.documentElement.removeAttribute("class");
+ }, 500);
+ setTimeout(doe,50, 0.2);
+}
+do_onload();
+
+var timer;
+function doe(i) {
+ docviewer.textZoom += i;
+
+ if (docviewer.textZoom >=4)
+ i = -0.2;
+
+ if (docviewer.textZoom <=0)
+ i = 0.2;
+ window.status = docviewer.textZoom;
+ timer = setTimeout(doe, 50, i);
+}
+]]></script>
+</html>
diff --git a/layout/mathml/crashtests/400475-1.xhtml b/layout/mathml/crashtests/400475-1.xhtml
new file mode 100644
index 000000000..13ff2fcb6
--- /dev/null
+++ b/layout/mathml/crashtests/400475-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+ document.getElementById("ms").setAttribute("foo", "x");
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+<mstyle xmlns="http://www.w3.org/1998/Math/MathML" id="ms" />
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/402400-1.xhtml b/layout/mathml/crashtests/402400-1.xhtml
new file mode 100644
index 000000000..8a2a92753
--- /dev/null
+++ b/layout/mathml/crashtests/402400-1.xhtml
@@ -0,0 +1,41 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var textB = document.createTextNode("b");
+ var textC = document.createTextNode("c");
+ var textN = document.createTextNode("n");
+ var textP = document.createTextNode("p");
+
+ var blv = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ var odj = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ var tr = document.createElementNS("http://www.w3.org/1999/xhtml", "tr");
+ var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+ var mathMO = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
+
+ td.appendChild(textB);
+ document.body.appendChild(blv);
+ blv.appendChild(tr);
+ blv.appendChild(mathMO);
+ mathMO.appendChild(textP);
+ odj.appendChild(td);
+ odj.appendChild(textN);
+
+ blv.removeChild(tr);
+ mathMO.appendChild(odj);
+ td.removeChild(textB);
+ blv.appendChild(textC);
+ document.body.appendChild(odj);
+ odj.insertBefore(mathMO, textN);
+ document.body.appendChild(mathMO);
+ mathMO.appendChild(odj);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/mathml/crashtests/403156-1.xhtml b/layout/mathml/crashtests/403156-1.xhtml
new file mode 100644
index 000000000..b49bff7d0
--- /dev/null
+++ b/layout/mathml/crashtests/403156-1.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+
+<head>
+<style>
+maction { height: 12em; }
+</style>
+</head>
+
+<body>
+<m:maction>&#x499a;<span>c<div>t&#x499a;</div></span>&#x499a;x&#x499a;&#x499a;2</m:maction>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/404485-1.xhtml b/layout/mathml/crashtests/404485-1.xhtml
new file mode 100644
index 000000000..fea18cbd5
--- /dev/null
+++ b/layout/mathml/crashtests/404485-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<body onload="document.getElementById('s').firstChild.splitText(1);">
+
+<math:msqrt><span xmlns="http://www.w3.org/1999/xhtml" id="s">x <math:mo/></span></math:msqrt>
+
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/405187-1.xhtml b/layout/mathml/crashtests/405187-1.xhtml
new file mode 100644
index 000000000..537512e62
--- /dev/null
+++ b/layout/mathml/crashtests/405187-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<style id="s">
+[class="fx"] { position: fixed; }
+</style>
+</head>
+<body onload="document.getElementById('s').textContent = '* { color: magenta; }'">
+<m:mrow><m:mrow class="fx" /><span class="fx" /></m:mrow>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/405271-1.xml b/layout/mathml/crashtests/405271-1.xml
new file mode 100644
index 000000000..b7b9e7a60
--- /dev/null
+++ b/layout/mathml/crashtests/405271-1.xml
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+
+<style type="text/css">
+#q { width: 16px; height: 16px; }
+#a, #b { counter-increment: chicken; }
+</style>
+
+<style id="s" type="text/css">
+#a { content: 'x'; }
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ remove(document.getElementById("s"));
+ remove(document.getElementById("b"));
+}
+
+function remove(n)
+{
+ n.parentNode.removeChild(n);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<m:mrow id="a"/><m:mo id="q"><m:malignmark><m:msubsup/><m:munderover/><m:munder id="b"/></m:malignmark></m:mo>
+
+</body>
+
+</html>
diff --git a/layout/mathml/crashtests/412237-1.xml b/layout/mathml/crashtests/412237-1.xml
new file mode 100644
index 000000000..2e8f13b73
--- /dev/null
+++ b/layout/mathml/crashtests/412237-1.xml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+ <ms fontsize="-2%"><mfrac><mi>x</mi><mi>y</mi></mfrac></ms>
+</math>
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/413063-1.xhtml b/layout/mathml/crashtests/413063-1.xhtml
new file mode 100644
index 000000000..425db9a81
--- /dev/null
+++ b/layout/mathml/crashtests/413063-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var mtd = document.getElementById("mtd");
+ var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+ var nt = document.createTextNode("foo");
+ ns.appendChild(nt);
+ mtd.appendChild(ns);
+ mtd.setAttribute("rowspan", "0");
+}
+
+
+</script>
+</head>
+
+<body onload="boom();"><m:mtd id="mtd" style="display: table-footer-group"><m:mi /></m:mtd></body>
+
+</html>
diff --git a/layout/mathml/crashtests/416907-1.xhtml b/layout/mathml/crashtests/416907-1.xhtml
new file mode 100644
index 000000000..94a9abde2
--- /dev/null
+++ b/layout/mathml/crashtests/416907-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<mathml:mroot>
+<frameset/>
+</mathml:mroot>
+</html>
diff --git a/layout/mathml/crashtests/420420-1.xhtml b/layout/mathml/crashtests/420420-1.xhtml
new file mode 100644
index 000000000..db17b277a
--- /dev/null
+++ b/layout/mathml/crashtests/420420-1.xhtml
@@ -0,0 +1,7 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN" "http://www.w3.org/Math/DTD/mathml2/xhtml-math11-f.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<body>
+<m:math><span><m:mfenced><m:mo>&ApplyFunction;</m:mo></m:mfenced></span></m:math>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/431072-1.xhtml b/layout/mathml/crashtests/431072-1.xhtml
new file mode 100644
index 000000000..f25ce28f1
--- /dev/null
+++ b/layout/mathml/crashtests/431072-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("math").setAttribute("class", "li");
+ document.documentElement.offsetHeight;
+ document.documentElement.appendChild(document.createTextNode("\n"));
+}
+
+</script>
+
+<style type="text/css">
+
+[class="li"] { display: list-item; }
+
+</style>
+
+</head>
+
+<body onload="boom();"><math xmlns="http://www.w3.org/1998/Math/MathML" id="math"/></body>
+
+</html>
diff --git a/layout/mathml/crashtests/443089-1.xhtml b/layout/mathml/crashtests/443089-1.xhtml
new file mode 100644
index 000000000..2630cea13
--- /dev/null
+++ b/layout/mathml/crashtests/443089-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+<mtd xmlns="http://www.w3.org/1998/Math/MathML" id="mtd" rowspan="1073741825"/>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/463763-1.xhtml b/layout/mathml/crashtests/463763-1.xhtml
new file mode 100644
index 000000000..61df8ff0c
--- /dev/null
+++ b/layout/mathml/crashtests/463763-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<math xmlns="http://www.w3.org/1998/Math/MathML"
+ xmlns:h="http://www.w3.org/1999/xhtml">
+<msup style="display:block"><mo><h:frameset/></mo></msup>
+<msub style="display:block"><mo><h:frameset/></mo></msub>
+<msubsup style="display:block"><mo><h:frameset/></mo></msubsup>
+</math>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/463763-2.xhtml b/layout/mathml/crashtests/463763-2.xhtml
new file mode 100644
index 000000000..8d41abade
--- /dev/null
+++ b/layout/mathml/crashtests/463763-2.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<math xmlns="http://www.w3.org/1998/Math/MathML"
+ xmlns:h="http://www.w3.org/1999/xhtml">
+<mstyle displaystyle="false">
+<munder style="display:block"><mo movablelimits="true"><h:frameset/></mo></munder>
+<mover style="display:block"><mo movablelimits="true"><h:frameset/></mo></mover>
+<munderover style="display:block"><mo movablelimits="true"><h:frameset/></mo></munderover>
+</mstyle>
+</math>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/476547-1.xhtml b/layout/mathml/crashtests/476547-1.xhtml
new file mode 100644
index 000000000..0cece35ea
--- /dev/null
+++ b/layout/mathml/crashtests/476547-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="quotes: '&lt;1&gt;' '';">
+<body onload="document.getElementById('ms').setAttribute('lquote', '');" style="direction: rtl;">
+<span><ms id="ms" xmlns="http://www.w3.org/1998/Math/MathML"><mstyle/></ms></span>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/477740-1.xhtml b/layout/mathml/crashtests/477740-1.xhtml
new file mode 100644
index 000000000..b3e9c133c
--- /dev/null
+++ b/layout/mathml/crashtests/477740-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+
+<xbl:bindings><xbl:binding id="res"><xbl:content><xul:resizer><xbl:children/></xul:resizer></xbl:content></xbl:binding></xbl:bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var x = document.getElementById("x");
+
+ var r = document.createRange();
+ r.setEnd(x, 1);
+ r.extractContents();
+
+ x.appendChild(document.createElement('span'));
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<xul:rows id="x" style="-moz-binding: url(#res);"><math:ms/></xul:rows>
+</body>
+</html>
diff --git a/layout/mathml/crashtests/541620-1.xhtml b/layout/mathml/crashtests/541620-1.xhtml
new file mode 100644
index 000000000..ccef762e4
--- /dev/null
+++ b/layout/mathml/crashtests/541620-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<body>
+<m:ms><m:mfenced/></m:ms>
+</body>
+</html>
+
diff --git a/layout/mathml/crashtests/557474-1.html b/layout/mathml/crashtests/557474-1.html
new file mode 100644
index 000000000..1bf8d534c
--- /dev/null
+++ b/layout/mathml/crashtests/557474-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <title>Test mpadded</title>
+ </head>
+ <body>
+ <math>
+ <mpadded width="-100px" height="-100px" depth="-100px"></mpadded>
+ </math>
+ </body>
+</html>
diff --git a/layout/mathml/crashtests/654928-1.html b/layout/mathml/crashtests/654928-1.html
new file mode 100644
index 000000000..da52f34b4
--- /dev/null
+++ b/layout/mathml/crashtests/654928-1.html
@@ -0,0 +1,3 @@
+<html>
+ <math><maction selection="2">A<mo>B</mo></maction></math>
+</html>
diff --git a/layout/mathml/crashtests/655451-1.xhtml b/layout/mathml/crashtests/655451-1.xhtml
new file mode 100644
index 000000000..619a1c271
--- /dev/null
+++ b/layout/mathml/crashtests/655451-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.style.fontStyle = "oblique";
+ var c = document.getElementById("c");
+ c.parentNode.removeChild(c);
+}
+
+</script>
+</head>
+<body onload="boom();"><math xmlns="http://www.w3.org/1998/Math/MathML"><frameset xmlns="http://www.w3.org/1999/xhtml"></frameset><msubsup id="c"/><mo><frameset xmlns="http://www.w3.org/1999/xhtml"></frameset></mo></math>x</body>
+</html>
diff --git a/layout/mathml/crashtests/713606-1.html b/layout/mathml/crashtests/713606-1.html
new file mode 100644
index 000000000..a0d4939a8
--- /dev/null
+++ b/layout/mathml/crashtests/713606-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <title>Crashtest bug 713606</title>
+ </head>
+ <body onload="document.querySelector('mstyle').setAttribute('scriptminsize', '0%');">
+ <math>
+ <msubsup>
+ <mtext>X</mtext>
+ <mtable displaystyle="true"></mstyle>
+ </mtext>Y</mtext>
+ </msubsup>
+ </math>
+ <math>
+ <msubsup>
+ <mtext>X</mtext>
+ <mstyle displaystyle="true"></mstyle>
+ </mtext>Y</mtext>
+ </msubsup>
+ </math>
+ <math><mfrac><mstyle displaystyle="true"></mstyle></mfrac></math>
+ </body>
+</html>
+
diff --git a/layout/mathml/crashtests/716349-1.html b/layout/mathml/crashtests/716349-1.html
new file mode 100644
index 000000000..9b5895ad6
--- /dev/null
+++ b/layout/mathml/crashtests/716349-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <title>Crashtest bug 716349</title>
+ </head>
+ <body>
+ <math>
+ <mspace width="-10px"/>
+ <mspace height="-10px"/>
+ </math>
+ </body>
+</html>
+
diff --git a/layout/mathml/crashtests/848725-1.html b/layout/mathml/crashtests/848725-1.html
new file mode 100644
index 000000000..7ce9c434c
--- /dev/null
+++ b/layout/mathml/crashtests/848725-1.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html>
+ <head>
+ <title>Bug 848725</title>
+ <meta charset="utf-8"/>
+ </head>
+ <body>
+ <div>
+ <math>
+ <mover>
+ <mo>&#x21A0;</mo>
+ <mspace width="500px"></mspace>
+ </mover>
+ </math>
+ </div>
+ </body>
+</html>
diff --git a/layout/mathml/crashtests/848725-2.html b/layout/mathml/crashtests/848725-2.html
new file mode 100644
index 000000000..b6362f9bf
--- /dev/null
+++ b/layout/mathml/crashtests/848725-2.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html>
+ <head>
+ <title>Bug 848725</title>
+ <meta charset="utf-8"/>
+ </head>
+ <body>
+ <div>
+ <math>
+ <mover>
+ <mo>&#x21A1;</mo>
+ <mspace height="500px"></mspace>
+ </mover>
+ </math>
+ </div>
+ </body>
+</html>
diff --git a/layout/mathml/crashtests/947557-1.html b/layout/mathml/crashtests/947557-1.html
new file mode 100644
index 000000000..3ddfb7b98
--- /dev/null
+++ b/layout/mathml/crashtests/947557-1.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<body>
+ <math>
+ <mmultiscripts>
+ <mo>A</mo>
+ <mprescripts/>
+ <mmultiscripts>
+ <mo>A</mo>
+ <mprescripts/>
+ <mo>A</mo>
+ <mo>A</mo>
+ </mmultiscripts>
+ <mmultiscripts>
+ <mo>A</mo>
+ <mprescripts/>
+ <mo>A</mo>
+ <mo>A</mo>
+ </mmultiscripts>
+ </mmultiscripts>
+ </math>
+</body>
diff --git a/layout/mathml/crashtests/973322-1.xhtml b/layout/mathml/crashtests/973322-1.xhtml
new file mode 100644
index 000000000..dfac127fb
--- /dev/null
+++ b/layout/mathml/crashtests/973322-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body onload="document.getElementById('f').setAttribute('class', 'e');">
+ <math xmlns="http://www.w3.org/1998/Math/MathML">
+ <mfenced id="f"/>
+ </math>
+ <p style="overflow: scroll; position: sticky;"></p>
+ </body>
+</html>
diff --git a/layout/mathml/crashtests/crashtests.list b/layout/mathml/crashtests/crashtests.list
new file mode 100644
index 000000000..6322f9eaa
--- /dev/null
+++ b/layout/mathml/crashtests/crashtests.list
@@ -0,0 +1,66 @@
+load 151054-1.xml
+load 289180-1.xml
+load 307826-1.xhtml
+load 307839-1.xhtml
+load 307839-2.xhtml
+load 323733-1.xml
+load 323737-1.xml
+load 323738-1.xml
+load 323741-1.xml
+load 323742-1.xml
+load 336074-1.xhtml
+load 347355-1.html
+load 347495-1.xhtml
+load 347507-1.xhtml
+load 348492-1.xhtml
+load 348709-1.xhtml
+load 348811-1.xhtml
+load 348811-2.xhtml
+load 353612-1.xhtml
+load 355986-1.xhtml
+load 364685-1.xhtml
+load 366012-1.xhtml
+load 366564-1.xhtml
+load 367107-1.html
+load 368430-1.xhtml
+load 370791-1.xhtml
+load 370862-1.xhtml
+load 372483-1.xhtml
+load 373472-1.xhtml
+load 373472-2.xhtml
+load 375562-1.xhtml
+load 377824-1.xhtml
+load 379418-1.xhtml
+load 385226-1.xhtml
+load 393760-1.xhtml
+load 397518-1.xhtml
+load 398038-1.html
+load 400157.xhtml
+load 400475-1.xhtml
+load 402400-1.xhtml
+load 403156-1.xhtml
+load 404485-1.xhtml
+load 405187-1.xhtml
+load 405271-1.xml
+load 412237-1.xml
+load 413063-1.xhtml
+load 416907-1.xhtml
+load 420420-1.xhtml
+load 431072-1.xhtml
+load 443089-1.xhtml
+load 463763-1.xhtml
+load 463763-2.xhtml
+load 476547-1.xhtml
+load 477740-1.xhtml
+load 541620-1.xhtml
+load 557474-1.html
+load 654928-1.html
+load 655451-1.xhtml
+load 713606-1.html
+load 716349-1.html
+load 848725-1.html
+load 848725-2.html
+load 947557-1.html
+load 973322-1.xhtml
+load 1028521-1.xhtml
+load 1061027.html