168 files changed, 2875 insertions, 0 deletions
diff --git a/layout/style/crashtests/1017798-1.css b/layout/style/crashtests/1017798-1.css
new file mode 100644
index 000000000..feb77d9dc
--- /dev/null
+++ b/layout/style/crashtests/1017798-1.css
@@ -0,0 +1,84 @@
+/* ----------------------------------
+ * SWITCHES
+ * ---------------------------------- */
+
+label.pack-switch {
+  display: inline-block;
+  vertical-align: middle;
+  width: 100%;
+  height: 5rem;
+  position: relative;
+  background: none;
+}
+
+label.pack-switch span {
+  float: left;
+  font-size: 1.8rem;
+  color: #333;
+  padding: 1rem 0 0;
+  height: 6rem;
+  line-height: 3rem;
+  box-sizing: border-box;
+  display: block;
+}
+
+label.pack-switch input {
+  margin: 0;
+  opacity: 0;
+  position: absolute;
+  top: 0;
+  left: 0;
+}
+
+label.pack-switch input:checked ~ span:after {
+  background-position: center bottom;
+}
+
+/* ----------------------------------
+ * ON/OFF SWITCHES
+ * ---------------------------------- */
+
+label.pack-switch input ~ span:after {
+  content: '';
+  position: absolute;
+  right: 0;
+  top: 50%;
+  width: 6rem;
+  margin: -1.4rem 0 0;
+  height: 2.7rem;
+  border-radius: 1.35rem;
+  overflow: hidden;
+  background: #e6e6e6 url(images/background_off.png) no-repeat -3.2rem 0 / 9.2rem 2.7rem;
+  transition: background 0.2s ease;
+}
+
+/* switch: 'ON' state */
+label.pack-switch input:checked ~ span:after {
+  background: #e6e6e6 url(images/background.png) no-repeat 0 0 / 9.2rem 2.7rem;
+}
+
+/* switch: disabled state */
+label.pack-switch input:disabled ~ span:after {
+  opacity: 0.4;
+}
+
+label.pack-switch input.uninit ~ span:after {
+  transition: none;
+}
+
+/******************************************************************************
+ * Right-To-Left tweaks
+ */
+html[dir="rtl"] label.pack-switch input {
+  left: auto;
+  right: 0;
+}
+
+html[dir="rtl"] label.pack-switch input ~ span:after {
+  left: 0;
+  right: auto;
+}
+
+html[dir="rtl"] label.pack-switch input ~ span:after {
+  background-position: 0;
+}
diff --git a/layout/style/crashtests/1017798-1.html b/layout/style/crashtests/1017798-1.html
new file mode 100644
index 000000000..097217d18
--- /dev/null
+++ b/layout/style/crashtests/1017798-1.html
@@ -0,0 +1,124 @@
+
+<!DOCTYPE html>
+<!--
+This is a slightly minimised, modified and self-contained version of
+gaia_switch/examples/index.html from the Gaia repository.
+-->
+<script>
+'use strict';
+
+(function(exports) {
+
+  /**
+   * ComponentUtils is a utility which allows us to use web components earlier
+   * than we should be able to by polyfilling and fixing platform deficiencies.
+   */
+  var ComponentUtils = {
+
+    /**
+     * Injects a style.css into both the shadow root and outside the shadow
+     * root so we can style projected content. Bug 992249.
+     */
+    style: function(baseUrl) {
+      var style = document.createElement('style');
+      style.setAttribute('scoped', '');
+      var url = baseUrl + '1017798-1.css';
+      style.innerHTML = '@import url(' + url + ');';
+
+      this.appendChild(style);
+
+      if (!this.shadowRoot) {
+        return;
+      }
+
+      // The setTimeout is necessary to avoid missing @import styles
+      // when appending two stylesheets. Bug 1003294.
+      setTimeout(function nextTick() {
+        this.shadowRoot.appendChild(style.cloneNode(true));
+      }.bind(this));
+    }
+
+  };
+
+  exports.ComponentUtils = ComponentUtils;
+
+}(window));
+</script>
+<script>
+'use strict';
+/* global ComponentUtils */
+
+window.GaiaSwitch = (function(win) {
+  // Extend from the HTMLElement prototype
+  var proto = Object.create(HTMLElement.prototype);
+
+  proto.createdCallback = function() {
+    var shadow = this.createShadowRoot();
+    this._template = template.content.cloneNode(true);
+    this._input = this._template.querySelector('input[type="checkbox"]');
+
+    var checked = this.getAttribute('checked');
+    if (checked !== null) {
+      this._input.checked = true;
+    }
+
+    shadow.appendChild(this._template);
+
+    ComponentUtils.style.call(this, '');
+  };
+
+  /**
+   * Proxy the checked property to the input element.
+   */
+  Object.defineProperty( proto, 'checked', {
+    get: function() {
+      return this._input.checked;
+    },
+    set: function(value) {
+      this._input.checked = value;
+    }
+  });
+
+  /**
+   * Proxy the name property to the input element.
+   */
+  Object.defineProperty( proto, 'name', {
+    get: function() {
+      return this.getAttribute('name');
+    },
+    set: function(value) {
+      this.setAttribute('name', value);
+    }
+  });
+
+  // HACK: Create a <template> in memory at runtime.
+  // When the custom-element is created we clone
+  // this template and inject into the shadow-root.
+  // Prior to this we would have had to copy/paste
+  // the template into the <head> of every app that
+  // wanted to use <gaia-switch>, this would make
+  // markup changes complicated, and could lead to
+  // things getting out of sync. This is a short-term
+  // hack until we can import entire custom-elements
+  // using HTML Imports (bug 877072).
+  var template = document.createElement('template');
+  template.innerHTML = '<label id="switch-label" class="pack-switch">' +
+      '<input type="checkbox">' +
+      '<span><content select="label"></content></span>' +
+    '</label>';
+
+  // Register and return the constructor
+  return document.registerElement('gaia-switch', { prototype: proto });
+})(window);
+</script>
+<body>
+<section>
+  <gaia-switch>
+    <label>With a label</label>
+  </gaia-switch>
+</section>
+<script>
+window.onload = function() {
+  document.querySelector('gaia-switch').checked = true;
+};
+</script>
diff --git a/layout/style/crashtests/1028514-1.html b/layout/style/crashtests/1028514-1.html
new file mode 100644
index 000000000..bbe7f3ba5
--- /dev/null
+++ b/layout/style/crashtests/1028514-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    document.documentElement.style.animation = "137438953471s bounce";
+    document.documentElement.offsetHeight;
+    document.documentElement.style.animationIterationCount = "infinite";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/105619-1.html b/layout/style/crashtests/105619-1.html
new file mode 100644
index 000000000..27746f29a
--- /dev/null
+++ b/layout/style/crashtests/105619-1.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<html>
+<head>
+	<title>International Herald Tribune</title>
+	
+	<script type="text/javascript">
+
+	function displayFix() {
+		document.getElementById("bodyNode").style.display = "block";
+	}
+
+	</script>
+	<style type="text/css">
+
+	#clippingsContainer {overflow:auto;}
+	#menuSearch {position:absolute;}
+
+	</style>
+	
+</head>
+
+<body id="bodyNode" onload="displayFix()">
+	<div>
+		<div id="menuSearch"><input type="text"></div>
+		<div id="clippingsContainer"></div>
+	</div>
+
+	<table>
+		<tr><td></td><td></td><td></td></tr>
+		<tr><td></td><td></td><td></td></tr>
+	</table>
+
+</body></html>
diff --git a/layout/style/crashtests/1066089-1.html b/layout/style/crashtests/1066089-1.html
new file mode 100644
index 000000000..019a20a7f
--- /dev/null
+++ b/layout/style/crashtests/1066089-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf8">
+<style>
+  @counter-style triangle { symbols: a; }
+  @counter-style disc     { system: extends triangle; }
+</style>
+<script>
+  function crash() {
+    var styleNode = document.createElement("style");
+    styleNode.textContent =
+      "@counter-style triangle { symbols: b; } " +
+      "@counter-style disc     { system: extends triangle; } " +
+      "ul {}";
+    document.getElementsByTagName("head")[0].appendChild(styleNode);
+  }
+</script>
+</head>
+<body onload="crash()">
+  <ul><li>Don't technically need any text here, but here's some anyway.
diff --git a/layout/style/crashtests/1074651-1.html b/layout/style/crashtests/1074651-1.html
new file mode 100644
index 000000000..b76855cc1
--- /dev/null
+++ b/layout/style/crashtests/1074651-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html style="transition-duration: 500000000000000000ms">
+<body onload="document.documentElement.style.strokeWidth = '17px';"></body>
+</html>
diff --git a/layout/style/crashtests/1089463-1.html b/layout/style/crashtests/1089463-1.html
new file mode 100644
index 000000000..f7a2f5961
--- /dev/null
+++ b/layout/style/crashtests/1089463-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<div></div>
+<script>
+window.onload = function() {
+  var div = document.querySelector("div");
+  var shadow = div.createShadowRoot();
+  shadow.innerHTML = "<p style='display: none'><span><i>x</i></span></p>";
+  var p = shadow.lastChild;
+  var span = p.firstChild;
+  var i = span.firstChild;
+
+  span.style.color = 'blue';
+  p.remove();
+
+  document.body.offsetTop;
+
+  shadow.appendChild(p);
+  i.style.color = 'red';
+};
+</script>
diff --git a/layout/style/crashtests/1135534.html b/layout/style/crashtests/1135534.html
new file mode 100644
index 000000000..920ec9c7b
--- /dev/null
+++ b/layout/style/crashtests/1135534.html
@@ -0,0 +1 @@
+<ruby><rtc style="border-image: url(whatever); border-style: solid;"></ruby>
diff --git a/layout/style/crashtests/1136010-1.html b/layout/style/crashtests/1136010-1.html
new file mode 100644
index 000000000..bdf63f9c0
--- /dev/null
+++ b/layout/style/crashtests/1136010-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<style>
+body { text-transform: uppercase; width: 200px; height: 200px; background-color: white; }
+#a, #b { font-size: 24px; }
+</style>
+<div id=a><div id=b><span>x</span><span>y</span></div></div>
+<script>
+document.body.offsetTop;
+var a = document.getElementById("a");
+var b = document.getElementById("b");
+a.style.fontSize = "24px";
+b.style.fontSize = "24px";
+document.body.offsetTop;
+b.style.fontSize = "36px";
+document.body.offsetTop;
+</script>
diff --git a/layout/style/crashtests/1146101-1.html b/layout/style/crashtests/1146101-1.html
new file mode 100644
index 000000000..e3f8f2aa3
--- /dev/null
+++ b/layout/style/crashtests/1146101-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<script>
+function boom()
+{
+    document.getElementsByTagName("tbody")[0].style.position = "absolute";
+    document.getElementsByTagName("table")[0].style.color = "green";
+}
+</script>
+<body onload="boom();">
+<table><tbody></tbody></table>
diff --git a/layout/style/crashtests/1153693-1.html b/layout/style/crashtests/1153693-1.html
new file mode 100644
index 000000000..8035f1b21
--- /dev/null
+++ b/layout/style/crashtests/1153693-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+
+.a { clip-path: url(z); }
+#x { clip-path: inherit; }
+
+</style>
+</head>
+
+<body>
+    <div class="a">
+        <div class="a" id="x"></div>
+    </div>
+    <script>
+        getComputedStyle(document.getElementById("x"), "").clipPath;
+    </script>
+</body>
+
+</html>
diff --git a/layout/style/crashtests/1161320-1.html b/layout/style/crashtests/1161320-1.html
new file mode 100644
index 000000000..3cb3a7b45
--- /dev/null
+++ b/layout/style/crashtests/1161320-1.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+<meta charset=utf-8>
+<style>
+@keyframes a { }
+body {
+  animation-name: a;
+}
+</style>
+
+<script>
+function boom()
+{
+  var body = document.body;
+  body.style.animationPlayState = 'paused';
+  window.getComputedStyle(body).animationPlayState;
+  body.style.animationPlayState = 'running';
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="setTimeout(boom, 100);"></body>
+</html>
diff --git a/layout/style/crashtests/1161320-2.html b/layout/style/crashtests/1161320-2.html
new file mode 100644
index 000000000..71db694d0
--- /dev/null
+++ b/layout/style/crashtests/1161320-2.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+<meta charset=utf-8>
+<style>
+@keyframes a { }
+body {
+  animation: a 100s;
+}
+</style>
+
+<script>
+function boom()
+{
+  var anim = document.body.getAnimations()[0];
+  anim.finish();
+  anim.pause();
+  anim.play();
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="setTimeout(boom, 100);"></body>
+</html>
diff --git a/layout/style/crashtests/1161366-1.html b/layout/style/crashtests/1161366-1.html
new file mode 100644
index 000000000..d4eacccdc
--- /dev/null
+++ b/layout/style/crashtests/1161366-1.html
@@ -0,0 +1,7 @@
+<script>
+var f = new FontFace("x", "url(x.ttf)", { unicodeRange: "U+0041" });
+f.load();
+document.fonts.add(f);
+f = new FontFace("x", "url(x.ttf)", { unicodeRange: "U+0042" });
+f.load();
+</script>
diff --git a/layout/style/crashtests/1163446-1.html b/layout/style/crashtests/1163446-1.html
new file mode 100644
index 000000000..a3ca0c44d
--- /dev/null
+++ b/layout/style/crashtests/1163446-1.html
@@ -0,0 +1,4 @@
+<script>
+// Will leak with bug 1161413 patches and without bug 1163446 fix.
+new FontFace("x", new ArrayBuffer(0));
+</script>
diff --git a/layout/style/crashtests/1164813-1.html b/layout/style/crashtests/1164813-1.html
new file mode 100644
index 000000000..ee5a60ffd
--- /dev/null
+++ b/layout/style/crashtests/1164813-1.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html class="reftest-wait">
+<style>
+#parent.hidden {
+  display: none;
+}
+.icon {
+  opacity: 0;
+  transition: opacity 0.5s;
+}
+.icon.shrink {
+  animation: shrink 1s;
+}
+@keyframes shrink {
+  to { transform: scale(0); }
+}
+</style>
+<div id="parent">
+  <div class="icon">Searching</div>
+</div>
+<script>
+var icon = document.querySelector('.icon');
+getComputedStyle(icon).opacity;
+icon.style.opacity = 1;
+icon.classList.add('shrink');
+setTimeout(function() {
+  document.getElementById('parent').classList.add('hidden');
+  setTimeout(function() {
+    document.documentElement.removeAttribute('class');
+  }, 500);
+}, 500);
+</script>
+</html>
diff --git a/layout/style/crashtests/1167782-1.html b/layout/style/crashtests/1167782-1.html
new file mode 100644
index 000000000..4b41ea398
--- /dev/null
+++ b/layout/style/crashtests/1167782-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+<html>
+<body>
+<script>
+  var d = window.getComputedStyle(document.body, "::-moz-color-swatch").display;
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1186768-1.xhtml b/layout/style/crashtests/1186768-1.xhtml
new file mode 100644
index 000000000..22608557d
--- /dev/null
+++ b/layout/style/crashtests/1186768-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <body>
+        <mfrac xmlns="http://www.w3.org/1998/Math/MathML">
+            <mi>
+                <div xmlns="http://www.w3.org/1999/xhtml" style="font-family: monospace; font-size: 1.17em;"></div>
+            </mi>
+            <mi/>
+        </mfrac>
+    </body>
+</html>
diff --git a/layout/style/crashtests/1200568-1.html b/layout/style/crashtests/1200568-1.html
new file mode 100644
index 000000000..e2dc9c09d
--- /dev/null
+++ b/layout/style/crashtests/1200568-1.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html>
+<head>
+<style>
+.anim { animation: anim 2s infinite linear }
+@keyframes anim { }
+</style>
+</head>
+<body>
+<script>
+var i = document.createElement('i');
+i.setAttribute('class', 'anim');
+getComputedStyle(i).display;
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1206105-1.html b/layout/style/crashtests/1206105-1.html
new file mode 100644
index 000000000..88af39e53
--- /dev/null
+++ b/layout/style/crashtests/1206105-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<title>crashtest, bug 1206105</title>
+<style>
+*:nth-child(-n-2147483647) {}
+</style>
+<body>
diff --git a/layout/style/crashtests/1223688-1.html b/layout/style/crashtests/1223688-1.html
new file mode 100644
index 000000000..70f9d8579
--- /dev/null
+++ b/layout/style/crashtests/1223688-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    CSS.supports('');
+
+    var style = document.createElement("style");
+    var tn = document.createTextNode("* { border: var(--b); }");
+    style.appendChild(tn);
+    document.body.appendChild(style);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/1223694-1.html b/layout/style/crashtests/1223694-1.html
new file mode 100644
index 000000000..c4589884f
--- /dev/null
+++ b/layout/style/crashtests/1223694-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    var sheet = document.createElement("style");
+    sheet.scoped = true;
+    document.documentElement.appendChild(sheet);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/1226400-1.html b/layout/style/crashtests/1226400-1.html
new file mode 100644
index 000000000..dea15642c
--- /dev/null
+++ b/layout/style/crashtests/1226400-1.html
@@ -0,0 +1,55 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>FontFaceSet::Load crasher</title>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+
+<style type="text/css">
+
+body {
+  margin: 50px;
+}
+
+p {
+  margin: 0;
+  font-size: 300%;
+}
+
+</style>
+
+</head>
+<body>
+
+<p>This may crash on load...</p>
+
+<script>
+var scriptText = `
+  var fontFaceSet = document.fonts;
+  var link = document.createElement("link");
+  link.onerror = link.onload = function() {
+    fontFaceSet.load("12px foo");
+  }
+  link.rel = "stylesheet";
+  link.href = "data:text/css,";
+  document.body.appendChild(link);
+`;
+
+var styleText = `
+  @font-face {
+    font-family: foo;
+    src: url("data:text/ttf,");
+  }
+`;
+
+var ifr = document.createElement("iframe");
+document.body.appendChild(ifr);
+var style = ifr.contentDocument.createElement("style");
+style.textContent = styleText;
+ifr.contentDocument.body.appendChild(style);
+var script = ifr.contentDocument.createElement("script");
+script.textContent = scriptText;
+ifr.contentDocument.body.appendChild(script);
+ifr.remove();
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1227501-1.html b/layout/style/crashtests/1227501-1.html
new file mode 100644
index 000000000..03383813d
--- /dev/null
+++ b/layout/style/crashtests/1227501-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+* { will-change: --t; }
+</style>
+</head>
+</html>
diff --git a/layout/style/crashtests/1230408-1.html b/layout/style/crashtests/1230408-1.html
new file mode 100644
index 000000000..0a2588c8a
--- /dev/null
+++ b/layout/style/crashtests/1230408-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<style>
+body { width: 1px; }
+body:first-letter { }
+</style>
+<body>
+<rb>C</rb>
+</body>
diff --git a/layout/style/crashtests/1233135-1.html b/layout/style/crashtests/1233135-1.html
new file mode 100644
index 000000000..58a82f304
--- /dev/null
+++ b/layout/style/crashtests/1233135-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<style>
+  fieldset, input, select {
+    display: ruby;
+  }
+</style>
+<fieldset></fieldset>
+<input type="color">
+<input type="file">
+<input type="number">
+<input type="range">
+<select></select>
+<select size="2"></select>
diff --git a/layout/style/crashtests/1233135-2.html b/layout/style/crashtests/1233135-2.html
new file mode 100644
index 000000000..03e356ae1
--- /dev/null
+++ b/layout/style/crashtests/1233135-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<ruby>
+  <fieldset></fieldset>
+  <input type="color">
+  <input type="file">
+  <input type="number">
+  <input type="range">
+  <select></select>
+  <select size="2"></select>
+  <span style="display: block; overflow: scroll"></span>
+</ruby>
diff --git a/layout/style/crashtests/1238660-1.html b/layout/style/crashtests/1238660-1.html
new file mode 100644
index 000000000..2323d2cfa
--- /dev/null
+++ b/layout/style/crashtests/1238660-1.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<html>
+  <head>
+    <title>Bug 1238660</title>
+  </head>
+  <body>
+    <span>
+      <div>
+        <span></span>
+      </div>
+    </span>
+    <style>
+    span {
+      animation: anim 0.1s 0.1s;
+    }
+    @keyframes anim { to { opacity:1 } }
+    </style>
+  </body>
+</html>
diff --git a/layout/style/crashtests/1245260-1.html b/layout/style/crashtests/1245260-1.html
new file mode 100644
index 000000000..6f2dda995
--- /dev/null
+++ b/layout/style/crashtests/1245260-1.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<html>
+<head lang="en">
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<title>Bug 1245260</title>
+</head>
+<body>
+<style>
+body {
+  color: blue;
+}
+
+div {
+  transition: text-emphasis-color 0.1s;
+}
+
+.hide {
+  display: none;
+}
+
+a {
+  color: red;
+  transition: text-emphasis-color 0.1s;
+}
+
+span {
+  transition: text-emphasis-color 0.1s;
+}
+
+@font-face {
+  font-family: "icon-fonts";
+  src: url(x);
+}
+</style>
+
+<div>
+<span><a>Shows</a></span>
+<span><a>Video</a></span>
+<span><a>Schedule</a></span>
+<span><a>Topics</a></span>
+<span><a>Games</a></span>
+<span><a>Shop</a></span>
+<span><a>This Day In History</a></span>
+<span><a>Ask History</a></span>
+<span><a>History Lists</a></span>
+<span><a>Hungry History</a></span>
+<span><a>Speeches &amp; Audio</a></span>
+<span class="hide"><a>Sign In</a></span>
+<span><a class="hide">Sign Out</a></span>
+</div>
+<script/>
+</body>
+</html>
diff --git a/layout/style/crashtests/1247865-1.html b/layout/style/crashtests/1247865-1.html
new file mode 100644
index 000000000..b7ec8ba60
--- /dev/null
+++ b/layout/style/crashtests/1247865-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    .nav { display: table }
+    .nav:after { content: " " }
+  </style>
+</head>
+<body>
+  <div style="font-size: 1rem"></div>
+  <div class="nav">
+  </div>
+  <script>
+    document.documentElement.style.fontSize = "10px";
+    document.documentElement.offsetHeight;
+    document.documentElement.style.fontSize = "15px";
+  </script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1264396-1.html b/layout/style/crashtests/1264396-1.html
new file mode 100644
index 000000000..abba4de3b
--- /dev/null
+++ b/layout/style/crashtests/1264396-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8" />
+<style>
+@keyframes bug {
+  from {display:none}
+  to {display:inline-block}
+}
+body {
+  animation-name: bug;
+  animation-duration: 1s;
+}
+</style>
+</html>
diff --git a/layout/style/crashtests/1264949.html b/layout/style/crashtests/1264949.html
new file mode 100644
index 000000000..780bff97a
--- /dev/null
+++ b/layout/style/crashtests/1264949.html
@@ -0,0 +1,23 @@
+<!doctype HTML>
+<html>
+  <head>
+    <style>
+      div {
+        background-image: linear-gradient(green, red);
+        background-clip: text;
+        width: 150px;
+        color:transparent;
+        overflow: hidden;
+        opacity:0.5;
+        text-overflow: ellipsis;
+      }
+    </style>
+  </head>
+  <body>
+    <div>
+      <span stype="font-size: 30px;">
+        ALongLongLongLongLongLongLongLongLongLongLongLongString
+      </span>
+    </div>
+  </body>
+</html>
diff --git a/layout/style/crashtests/1265611-1.html b/layout/style/crashtests/1265611-1.html
new file mode 100644
index 000000000..7685ad633
--- /dev/null
+++ b/layout/style/crashtests/1265611-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<!--
+  This test relies on triggering a transition on the 'color' property which,
+  at least when this test was written, would trigger a transition on the
+  -webkit-text-fill-color property since its default value is 'currentcolor'.
+
+  However, in crashtests.list we turn off layout.css.prefixes.webkit so
+  we should not trigger a transition on -webkit-test-fill-color.
+
+  This test exercises some code that, prior to this bug, would fail because we
+  would initially create the transition on -webkit-test-fill-color (because we
+  forgot to check if it was enabled or not) and then we would call other
+  methods that *do* check for the enabled-ness of the property leaving us
+  in an unexpected state.
+-->
+<body style="transition: all 4s" onload="document.body.style.color = 'green';"></body>
diff --git a/layout/style/crashtests/1270795.html b/layout/style/crashtests/1270795.html
new file mode 100644
index 000000000..c4262078e
--- /dev/null
+++ b/layout/style/crashtests/1270795.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <table style="background-image: linear-gradient(black, white); background-clip: text;">
+      <tr>
+        <td>Table 1</td>
+      </tr>
+    </table>
+    <table style="background-color: red; background-clip: text;">
+      <tr>
+        <td>Table 2</td>
+      </tr>
+    </table>
+  </body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1275026.html b/layout/style/crashtests/1275026.html
new file mode 100644
index 000000000..7960d2889
--- /dev/null
+++ b/layout/style/crashtests/1275026.html
@@ -0,0 +1,4 @@
+<!doctype HTML>
+<html style="background: linear-gradient(to right, red, blue); background-clip: text;">
+<body></body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1277908-1.html b/layout/style/crashtests/1277908-1.html
new file mode 100644
index 000000000..6f9ca3bd0
--- /dev/null
+++ b/layout/style/crashtests/1277908-1.html
@@ -0,0 +1,26 @@
+<script>
+window.onload = function () {
+  var root = document.documentElement; while(root.firstChild) { root.removeChild(root.firstChild); }
+  var a = document.createElementNS("http://www.w3.org/1999/xhtml", "link");
+  a.setAttributeNS(null, "href", "mailto:");
+  root.appendChild(a);
+  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  var c = document.createElementNS("http://www.w3.org/1999/xhtml", "p");
+  root.appendChild(b);
+  root.animate([{"opacity":1},
+                {"opacity":-64},
+                {"opacity":1024},
+                {"opacity":32},
+                {"opacity":3},
+                {"opacity":1024},
+                {"opacity":0.19310025712314532},
+                {"opacity":512}],
+                {"duration":1,"fill":"backwards"});
+  a.style.maskType = "alpha, luminance";
+  c.animate({}, 1);
+  root.style.position = "fixed";
+  b.getAnimations();
+  a.style.MozPerspectiveOrigin = "1rem bottom";
+  root.style.position = "static";
+};
+</script>
diff --git a/layout/style/crashtests/1277908-2.html b/layout/style/crashtests/1277908-2.html
new file mode 100644
index 000000000..4c5266826
--- /dev/null
+++ b/layout/style/crashtests/1277908-2.html
@@ -0,0 +1,19 @@
+<script>
+function start() {
+  o28=document.createElement('a');
+  o28.href='javascript:x()';
+  o115=document.createElement('tr');
+  o116=document.createElement('th');
+  o116.innerHTML="<style>{}\n*{ display: table;> </style><style>@keyframes key8 { from{ left; background-position-x: 128vw}to{}label}\n*{ animation-name: key8; animation-duration: 0.001s";
+  document.documentElement.appendChild(o28);
+  document.documentElement.appendChild(o115);
+  document.documentElement.appendChild(o116);
+  o213=document.createElement('input');
+  o115.appendChild(o213);
+  o216=document.createElement('style');
+  o217=document.createTextNode("*{ text-shadow: 196608rem -3px");
+  o216.appendChild(o217);
+  o213.appendChild(o216);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1278463-1.html b/layout/style/crashtests/1278463-1.html
new file mode 100644
index 000000000..da3b976d8
--- /dev/null
+++ b/layout/style/crashtests/1278463-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+ @keyframes c {
+     50% {
+         stroke-dasharray: context-value;
+     }
+ }
+
+ div {
+     animation-name: c;
+ }
+
+</style>
+</head>
+<body>
+<div></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/1282076-1.html b/layout/style/crashtests/1282076-1.html
new file mode 100644
index 000000000..d5d1f0c74
--- /dev/null
+++ b/layout/style/crashtests/1282076-1.html
@@ -0,0 +1,51 @@
+<script>
+function start() {
+  o0=document;
+  o24=document.createElement('table');
+  o35=window;
+  o60=document.createElement('input');
+  o24.appendChild(o60);
+  o62=document.body;
+  o66=document.createElement('input');
+  o62.appendChild(o66);
+  o60.innerHTML="<svg><color-profile><script><rect><animateColor><style><style>*{ all: unset<script><style>div<style>";
+  o93=o60.querySelectorAll('*')[5];
+  o97=o60.querySelectorAll('*')[9];
+  document.body.appendChild(o24);
+  o305=document.createTextNode("{}:first-line{");
+  o93.appendChild(o305);
+  o318=(new DOMParser()).parseFromString('','text/html');
+  o320=o318.all[1];
+  o355=document.createElement('style');
+  o356=document.createTextNode("@keyframes key2{ from{ opacity: 0}}#id2{ animation-name: key2; animation-duration: 0.01s");
+  o355.appendChild(o356);
+  o97.appendChild(o355);
+  o66.style.display='list-item';
+  o473=document.createElement('script');
+  o24.appendChild(o473);
+  o577=document.createElement('style');
+  o320.appendChild(o577);
+  o577.style.position='fixed';
+  document.replaceChild(o318.documentElement,document.documentElement);
+  o908=(new DOMParser()).parseFromString('','text/html');
+  o911=o908.all[2];
+  o911.style.display='inline';
+  o577.id='id2';
+  o1202=document.createElement('table');
+  document.body=o911;
+  document.body.appendChild(o1202);
+  document.replaceChild(o0.documentElement,document.documentElement);
+  o1232=o473.parentNode;
+  o1233=o1232.parentNode;
+  document.body=o1233;
+  o35.scrollByLines(1);
+  o577.style.position='absolute';
+  setTimeout(f2, 4);
+}
+
+function f2() {
+  o0.designMode='on';
+  o0.execCommand('insertparagraph',false,null);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1282076-2.html b/layout/style/crashtests/1282076-2.html
new file mode 100644
index 000000000..1c6f98639
--- /dev/null
+++ b/layout/style/crashtests/1282076-2.html
@@ -0,0 +1,46 @@
+<script>
+function start() {
+  o0=document;
+  o24=document.createElement('table');
+  o35=window;
+  o60=document.createElement('input');
+  o24.appendChild(o60);
+  o62=document.body;
+  o66=document.createElement('input');
+  o62.appendChild(o66);
+  o60.innerHTML="<svg><color-profile><script><rect><animateColor><style><style>*{ all: unset<script>";
+  o93=o60.querySelectorAll('*')[5];
+  document.body.appendChild(o24);
+  o305=document.createTextNode("{}:first-line{");
+  o93.appendChild(o305);
+  o318=(new DOMParser()).parseFromString('','text/html');
+  o320=o318.all[1];
+  o66.style.display='list-item';
+  o473=document.createElement('script');
+  o24.appendChild(o473);
+  o577=document.createElement('style');
+  o320.appendChild(o577);
+  o577.style.position='fixed';
+  document.replaceChild(o318.documentElement,document.documentElement);
+  o908=(new DOMParser()).parseFromString('','text/html');
+  o911=o908.all[2];
+  o911.style.display='inline';
+  o577.animate({ opacity: [0, 1] }, 100);
+  o1202=document.createElement('table');
+  document.body=o911;
+  document.body.appendChild(o1202);
+  document.replaceChild(o0.documentElement,document.documentElement);
+  o1232=o473.parentNode;
+  o1233=o1232.parentNode;
+  document.body=o1233;
+  o35.scrollByLines(1);
+  o577.style.position='absolute';
+  setTimeout(f2, 4);
+}
+
+function f2() {
+  o0.designMode='on';
+  o0.execCommand('insertparagraph',false,null);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1290994-1.html b/layout/style/crashtests/1290994-1.html
new file mode 100644
index 000000000..d9d99a5b0
--- /dev/null
+++ b/layout/style/crashtests/1290994-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+  var a = document.createElement("div");
+  document.documentElement.appendChild(a);
+  a.animate([{borderLeftColor:"black"},
+             {borderLeftColor:"hsl(0,0e309%,0%)"}]);
+};
+</script>
+</html>
diff --git a/layout/style/crashtests/1290994-2.html b/layout/style/crashtests/1290994-2.html
new file mode 100644
index 000000000..e592b84ee
--- /dev/null
+++ b/layout/style/crashtests/1290994-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+  var a = document.createElement("div");
+  document.documentElement.appendChild(a);
+  a.animate([{color:"rgb(0,0,0)"},
+             {color:"rgb(0e309%,0%,0%)"}]);
+};
+</script>
+</html>
diff --git a/layout/style/crashtests/1290994-3.html b/layout/style/crashtests/1290994-3.html
new file mode 100644
index 000000000..76589f5a6
--- /dev/null
+++ b/layout/style/crashtests/1290994-3.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+  var a = document.createElement("div");
+  document.documentElement.appendChild(a);
+  a.animate([{background: "-webkit-gradient(radial, 1 2, 8, 3 4, 9, from(lime))"},
+             {background: "-webkit-gradient(radial, 0e309 2, 8, 3 4, 9, from(lime))"}]);
+};
+</script>
+</html>
diff --git a/layout/style/crashtests/1290994-4.html b/layout/style/crashtests/1290994-4.html
new file mode 100644
index 000000000..4278856d0
--- /dev/null
+++ b/layout/style/crashtests/1290994-4.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<style>
+@keyframes anim {
+  0e309% {}
+}
+</style>
+</html>
diff --git a/layout/style/crashtests/1314531.html b/layout/style/crashtests/1314531.html
new file mode 100644
index 000000000..8e804643f
--- /dev/null
+++ b/layout/style/crashtests/1314531.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<style>::-moz-tree-row:hover {}</style>
diff --git a/layout/style/crashtests/1315889-1.html b/layout/style/crashtests/1315889-1.html
new file mode 100644
index 000000000..29186fac1
--- /dev/null
+++ b/layout/style/crashtests/1315889-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<style>
+.x { color: blue; }
+</style>
+<div class=x>hello</div>
+<script>
+document.body.offsetWidth;
+var x = document.querySelector(".x");
+x.className = "";
+x.remove();
+document.body.offsetWidth;
+</script>
diff --git a/layout/style/crashtests/1315894-1.html b/layout/style/crashtests/1315894-1.html
new file mode 100644
index 000000000..e0192460f
--- /dev/null
+++ b/layout/style/crashtests/1315894-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<div style="display: none"><span>x</span></div>
+<script>
+document.body.offsetWidth;
+document.querySelector("div").style.display = "inline";
+document.body.offsetWidth;
+document.querySelector("span").style.color = "blue";
+document.body.offsetWidth;
+</script>
diff --git a/layout/style/crashtests/1321357-1.html b/layout/style/crashtests/1321357-1.html
new file mode 100644
index 000000000..7b3a3c39c
--- /dev/null
+++ b/layout/style/crashtests/1321357-1.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html>
+<body onload="document.getElementById('containerA').pauseAnimations()">
+  <svg id="containerA">
+    <animate id="ia" end="50s"></animate>
+    <animate begin="60s" end="ic.end"></animate>
+  </svg>
+  <svg>
+    <animate id="ic" end="ia.end"></animate>
+  </svg>
+</body>
+</html>
diff --git a/layout/style/crashtests/1356601-1.html b/layout/style/crashtests/1356601-1.html
new file mode 100644
index 000000000..4fc28bd58
--- /dev/null
+++ b/layout/style/crashtests/1356601-1.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<html>
+<style>
+div::first-line {
+  --bar: left;
+}
+span {
+  animation: var(--bar) 5s infinite alternate;
+}
+@keyframes left {
+  from {left: 0;}
+  to {left: 30px;}
+}
+</style>
+<div>
+  <span>Crash</span>
+</div>
+</html>
diff --git a/layout/style/crashtests/147777-1.html b/layout/style/crashtests/147777-1.html
new file mode 100644
index 000000000..2500fae9f
--- /dev/null
+++ b/layout/style/crashtests/147777-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<title>crashtest for NS_ABORT_IF_FALSE during development of 147777</title>
+<style type="text/css">
+:link::before { content: "link: " }
+</style>
+<a href="http://www.example.com/">example</a>
diff --git a/layout/style/crashtests/187671-1.html b/layout/style/crashtests/187671-1.html
new file mode 100644
index 000000000..7395c23b4
--- /dev/null
+++ b/layout/style/crashtests/187671-1.html
@@ -0,0 +1,12 @@
+<a href="http://mozillazine.org/">Link text</a>
+
+<SPAN><p>Paragraph text</p></span>
+
+
+
+<!-- The styles have to be after the content.  (In the original, the styles were loaded using javascript, with the style sheet loaded depending on the browser.) -->
+
+<style>
+a    {font-size: 13px }
+span {position: relative;}
+</style>
diff --git a/layout/style/crashtests/192408-1.html b/layout/style/crashtests/192408-1.html
new file mode 100644
index 000000000..bb75e4401
--- /dev/null
+++ b/layout/style/crashtests/192408-1.html
@@ -0,0 +1,15 @@
+<html>
+   <head>
+      <title>bug 192408</title>
+   </head>
+   <body>
+      <span>
+         <embed src="foo.mid"></embed>
+         <script>
+            document;
+         </script>
+         <center></center>
+         <script src="bar.js"></script> 
+      </span>
+   </body>
+</html>
diff --git a/layout/style/crashtests/285727-1.html b/layout/style/crashtests/285727-1.html
new file mode 100644
index 000000000..db1d28d8d
--- /dev/null
+++ b/layout/style/crashtests/285727-1.html
@@ -0,0 +1,13 @@
+<BODY STYLE="display:table-row;">
+<SPAN>
+1
+</SPAN>
+<FORM>
+<DIV STYLE="float:left;">
+1
+<FONT>
+1
+</FONT>
+</DIV>
+</FORM>
+</BODY>
diff --git a/layout/style/crashtests/286707-1.html b/layout/style/crashtests/286707-1.html
new file mode 100644
index 000000000..7485a9644
--- /dev/null
+++ b/layout/style/crashtests/286707-1.html
@@ -0,0 +1,2 @@
+<html><body><p style="font-size:1px">hi<sup>1
+
diff --git a/layout/style/crashtests/317561-1.html b/layout/style/crashtests/317561-1.html
new file mode 100644
index 000000000..01335a17c
--- /dev/null
+++ b/layout/style/crashtests/317561-1.html
@@ -0,0 +1,104 @@
+<!doctype html>
+<html>
+<head>
+<style type="text/css">
+div:not([id^='img']) {
+ height: 20px; width: 20px; border: 1px solid #000;
+}
+#img1 {position:absolute; left:180px; top:17px;}
+#img2 {position:absolute; left:-72px; top:58px;}
+#img3 {position:absolute; left:2px; top:0px;}
+#img4 {position:absolute; left:25px; top:-3px;}
+#img5 {position:absolute; left:1px; top:-3px;}
+#img6 {position:absolute; left:27px; top:-1px;}
+#img7 {position:absolute; left:41px; top:14px;}
+#img8 {position:absolute; left:17px; top:3px;}
+#img9 {position:absolute; left:50px; top:42px;}
+#img11 {position:absolute; left:-265px; top:113px;}
+#img12 {position:absolute; left:25px; top:-57px;}
+#img13 {position:absolute; left:17px; top:-4px;}
+#img14 {position:absolute; left:8px; top:-13px;}
+#img15 {position:absolute; left:38px; top:0px;}
+#img16 {position:absolute; left:37px; top:8px;}
+#img17 {position:absolute; left:11px; top:12px;}
+#img18 {position:absolute; left:4px; top:12px;}
+#img19 {position:absolute; left:-7px; top:13px;}
+#img20 {position:absolute; left:17px; top:13px;}
+#img21 {position:absolute; left:7px; top:12px;}
+#img22 {position:absolute; left:32px; top:6px;}
+#img23 {position:absolute; left:20px; top:10px;}
+#img24 {position:absolute; left:22px; top:10px;}
+#img25 {position:absolute; left:81px; top:-27px;}
+#img26 {position:absolute; left:9px; top:-19px;}
+#img27 {position:absolute; left:0px; top:-15px;}
+#img28 {position:absolute; left:19px; top:63px;}
+#img29 {position:absolute; left:-68px; top:0px;}
+#img32 {position:absolute; left:42px; top:121px;}
+#img33 {position:absolute; left:21px; top:1px;}
+#img34 {position:absolute; left:29px; top:2px;}
+#img35 {position:absolute; left:25px; top:1px;}
+#img36 {position:absolute; left:-115px; top:16px;}
+#img37 {position:absolute; left:11px; top:-8px;}
+#img38 {position:absolute; left:-16px; top:-15px;}
+#img39 {position:absolute; left:-18px; top:-1px;}
+#img40 {position:absolute; left:-28px; top:-8px;}
+#img41 {position:absolute; left:-6px; top:-6px;}
+#img42 {position:absolute; left:-19px; top:-12px;}
+#img43 {position:absolute; left:-26px; top:-9px;}
+#img44 {position:absolute; left:1px; top:-23px;}
+#img45 {position:absolute; left:-10px; top:-22px;}
+#img46 {position:absolute; left:-59px; top:-39px;}
+#img47 {position:absolute; left:-28px; top:0px;}
+#img48 {position:absolute; left:-13px; top:4px;}
+#img49 {position:absolute; left:-21px; top:4px;}
+</style>
+</head>
+<body>
+<div id="img1"><div></div>
+<div id="img2"><div></div>
+<div id="img3"><div></div>
+<div id="img4"><div></div>
+<div id="img5"><div></div>
+<div id="img6"><div></div>
+<div id="img7"><div></div>
+<div id="img8"><div></div>
+<div id="img9"><div></div>
+<div id="img11"><div></div>
+<div id="img12"><div></div>
+<div id="img13"><div></div>
+<div id="img14"><div></div>
+<div id="img15"><div></div>
+<div id="img16"><div></div>
+<div id="img17"><div></div>
+<div id="img18"><div></div>
+<div id="img19"><div></div>
+<div id="img20"><div></div>
+<div id="img21"><div></div>
+<div id="img22"><div></div>
+<div id="img23"><div></div>
+<div id="img24"><div></div>
+<div id="img25"><div></div>
+<div id="img26"><div></div>
+<div id="img27"><div></div>
+<div id="img28"><div></div>
+<div id="img29"><div></div>
+<div id="img32"><div></div>
+<div id="img33"><div></div>
+<div id="img34"><div></div>
+<div id="img35"><div></div>
+<div id="img36"><div></div>
+<div id="img37"><div></div>
+<div id="img38"><div></div>
+<div id="img39"><div></div>
+<div id="img40"><div></div>
+<div id="img41"><div></div>
+<div id="img42"><div></div>
+<div id="img43"><div></div>
+<div id="img44"><div></div>
+<div id="img45"><div></div>
+<div id="img46"><div></div>
+<div id="img47"><div></div>
+<div id="img48"><div></div>
+<div id="img49"><div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/330998-1.html b/layout/style/crashtests/330998-1.html
new file mode 100644
index 000000000..46522094e
--- /dev/null
+++ b/layout/style/crashtests/330998-1.html
@@ -0,0 +1,30 @@
+<html>
+
+<head>
+
+<script>
+
+function init()
+{
+  var form1 = document.getElementById("form1");
+  var tr1 = document.getElementById("tr1");
+
+  tr1.appendChild(form1);
+  tr1.removeChild(form1);
+}
+
+window.addEventListener("load", init, false);
+
+</script>
+
+</head>
+
+<body>
+
+<table><tr id="tr1"><td></td></tr></table>
+
+<form id="form1"><span style="float:left"></span></form>
+
+</body>
+
+</html>
diff --git a/layout/style/crashtests/363950.html b/layout/style/crashtests/363950.html
new file mode 100644
index 000000000..46bfb2f9c
--- /dev/null
+++ b/layout/style/crashtests/363950.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<title>Testcase bug 363950 - crash [@ nsComputedDOMStyle::GetMarginWidthCoordFor]</title>
+</head>
+<body>
+This page should not crash Mozilla
+<script>
+var properties = ['margin-left','margin-right','margin-top','padding-bottom','padding-left','padding-right','padding-top'];
+
+function removestyles(i, j){
+if (j>=properties.length)
+   j = 0;
+document.defaultView.getComputedStyle(document.getElementsByTagName('head')[0], null).getPropertyValue(properties[j]);
+j++;
+setTimeout(removestyles,50,j);
+}
+setTimeout(removestyles,500,0,0);
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/368175-1.html b/layout/style/crashtests/368175-1.html
new file mode 100644
index 000000000..c7eeddf8c
--- /dev/null
+++ b/layout/style/crashtests/368175-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8">
+</head>
+<body>
+<div style="width: 300px; height: 200px; overflow: auto">
+ <div style='direction: rtl; -moz-column-width:1em; -moz-column-gap:1em; width: 500px;'>
+  <p>滾滾長江東逝水,浪花淘盡英雄。是非成敗轉頭空：青山依舊在,幾度夕陽紅。</p>
+  <p style='direction: rtl; -moz-column-width:1em; -moz-column-gap:1em;'>
+  滾滾長江東逝水,浪花淘盡英雄。是非成敗轉頭空：青山依舊在,幾度夕陽紅。</p>
+ </div>
+</div>
+</body>
+</html>
diff --git a/layout/style/crashtests/368740.html b/layout/style/crashtests/368740.html
new file mode 100644
index 000000000..ed315dd44
--- /dev/null
+++ b/layout/style/crashtests/368740.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<title>Testcase bug - Crash [@ nsIFrame::IsThemed] when trying to get the computed style of a button in iframe</title>
+
+<style>
+iframe {
+width: 800px;
+height: 400px;
+}
+</style>
+</head>
+<body>
+This page should not crash Mozilla<br>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%0A%3Cbutton%3E%3C/button%3E%0A%3C/body%3E%3C/html%3E"></iframe>
+
+<script>
+function getComputedStyles(){
+var x=document.getElementById('content').contentDocument.getElementsByTagName('button')[0];
+var style = document.defaultView.getComputedStyle(x, null).getPropertyValue('border-left-width');
+}
+setTimeout(getComputedStyles,300);
+</script>
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/379788-1.html b/layout/style/crashtests/379788-1.html
new file mode 100644
index 000000000..40e38a7cc
--- /dev/null
+++ b/layout/style/crashtests/379788-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('p2').style.position = 'fixed';">
+
+<p style="right: 1em; bottom: 1em; position: fixed;">Foo</p>
+<p id="p2">Bar</p>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/383979-1.xhtml b/layout/style/crashtests/383979-1.xhtml
new file mode 100644
index 000000000..9a3f8e673
--- /dev/null
+++ b/layout/style/crashtests/383979-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("div1").appendChild(document.getElementById("div2"));
+}
+
+</script>
+
+<style type="text/css">
+
+#s1, #s2 { 
+  font: 8pt arial;
+}
+
+#div1 #s1, #div1 #s2 {
+  font-size: 20pt;
+}
+
+</style>
+</head>
+
+<body onload="boom();">
+
+<div id="div1"></div>
+<div id="div2"><span id="s1"><span id="s2">foo</span></span></div>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/383979-2.html b/layout/style/crashtests/383979-2.html
new file mode 100644
index 000000000..06f900e12
--- /dev/null
+++ b/layout/style/crashtests/383979-2.html
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function run()
+{
+  var a = getComputedStyle(document.getElementById("s1"), "").listStyleType;
+  var b = getComputedStyle(document.getElementById("s3"), "").listStyleType;
+}
+
+</script>
+
+<style type="text/css">
+
+body { display: none } /* so we control the order of the ComputeListData calls */
+
+#s1, #s2, #s3 { 
+  -moz-image-region: auto;
+  list-style-image: none;
+  list-style-position: outside;
+  list-style-type: disc;
+}
+
+#s2, #s3 {
+  list-style-type: disc;
+}
+
+</style>
+</head>
+
+<body onload="run();">
+
+<div id="s1"><div id="s2"><div id="s3"></div></div></div>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/386939-1.html b/layout/style/crashtests/386939-1.html
new file mode 100644
index 000000000..679d2b27e
--- /dev/null
+++ b/layout/style/crashtests/386939-1.html
@@ -0,0 +1,24 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function rM(n)
+{
+  n.parentNode.removeChild(n);
+}
+
+function boom()
+{
+  rM(document.getElementById("f1"));
+  rM(document.getElementById("f2"));
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<frameset rows="170,*" onload="setTimeout(boom, 30);">
+<frame src="data:text/html,frame1" id="f1">
+<frame src="data:text/html,frame2" id="f2">
+</frameset>
+
+</html>
diff --git a/layout/style/crashtests/391034-1.xhtml b/layout/style/crashtests/391034-1.xhtml
new file mode 100644
index 000000000..315796d28
--- /dev/null
+++ b/layout/style/crashtests/391034-1.xhtml
@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var p = document.getElementById("p");
+  window.getComputedStyle(p, null).getPropertyValue("right");
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<p id="p" style="position: relative; left: 3ch;">foo</p>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/397022-1.html b/layout/style/crashtests/397022-1.html
new file mode 100644
index 000000000..ececc3fa5
--- /dev/null
+++ b/layout/style/crashtests/397022-1.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<style>
+
+div:before { content: counter(c); }
+
+.b:before { content: "x"; }
+
+</style>
+</head>
+
+<body onload="document.getElementById('v').setAttribute('class', 'b');">
+
+<div id="v"></div>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/399289-1.svg b/layout/style/crashtests/399289-1.svg
new file mode 100644
index 000000000..583de2c24
--- /dev/null
+++ b/layout/style/crashtests/399289-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="url(#x)">
+  <rect fill="url(#y)" />
+</svg>
diff --git a/layout/style/crashtests/404470-1.html b/layout/style/crashtests/404470-1.html
new file mode 100644
index 000000000..481ba4233
--- /dev/null
+++ b/layout/style/crashtests/404470-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var iframe = document.createElement("iframe");
+  document.body.appendChild(iframe);
+  iframe.setAttribute("src", 'data:application/vnd.mozilla.xul+xml,<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><script>window.parent.document.body.style.display="inline"; window.parent.document.body.offsetWidth;</' + 'script></window>');
+}
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/411603-1.html b/layout/style/crashtests/411603-1.html
new file mode 100644
index 000000000..596565fbc
--- /dev/null
+++ b/layout/style/crashtests/411603-1.html
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+<body onload="document.getElementById('ms').setAttribute('scriptminsize', '9em');">
+<math:mstyle id="ms" /><span />
+</body>
+</html>
diff --git a/layout/style/crashtests/412588-1.html b/layout/style/crashtests/412588-1.html
new file mode 100644
index 000000000..561aed564
--- /dev/null
+++ b/layout/style/crashtests/412588-1.html
@@ -0,0 +1,5 @@
+<html><head>
+<link rel="stylesheet" href="data:text/css;charset=utf-8,@media%20print%20%7B%7B%7D%0Aa%20%7B%20%7D%0Aa%7Bfont-size%3A%20200%25%3B%7D" type="text/css">
+<style>
+</style>
+</head><body></body></html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/413274-1.xhtml b/layout/style/crashtests/413274-1.xhtml
new file mode 100644
index 000000000..19d8fab0f
--- /dev/null
+++ b/layout/style/crashtests/413274-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+  <mstyle scriptsizemultiplier="8205" scriptlevel="15">
+    <mroot>
+      <mrow/>
+      <mrow>
+        <span xmlns="http://www.w3.org/1999/xhtml"/>
+      </mrow>
+    </mroot>
+  </mstyle>
+</math>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/416461-1.xul b/layout/style/crashtests/416461-1.xul
new file mode 100644
index 000000000..1986cda91
--- /dev/null
+++ b/layout/style/crashtests/416461-1.xul
@@ -0,0 +1,6 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <wizard>
+    <msqrt xmlns="http://www.w3.org/1998/Math/MathML"/>
+  </wizard>
+  <menupopup style="display: inline; -moz-box-ordinal-group: 2147483646;"/>
+</window>
+\ No newline at end of file
diff --git a/layout/style/crashtests/418007-1.xhtml b/layout/style/crashtests/418007-1.xhtml
new file mode 100644
index 000000000..f07a69344
--- /dev/null
+++ b/layout/style/crashtests/418007-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+  <ms fontsize="8179em">
+    <span xmlns="http://www.w3.org/1999/xhtml">
+      <span>
+        <td>
+          <mfrac xmlns="http://www.w3.org/1998/Math/MathML">
+            <mfrac>
+              <mrow/>
+              <mrow/>
+            </mfrac>
+            <mrow/>
+          </mfrac>
+        </td>
+      </span>
+    </span>
+  </ms>
+</math>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/431705-1.xul b/layout/style/crashtests/431705-1.xul
new file mode 100644
index 000000000..8b64d4b3b
--- /dev/null
+++ b/layout/style/crashtests/431705-1.xul
@@ -0,0 +1,6 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <span xmlns="http://www.w3.org/1999/xhtml" style="-moz-box-ordinal-group: 2;">
+    <mtext xmlns="http://www.w3.org/1998/Math/MathML" style="display: block;"/>
+  </span>
+  <div xmlns="http://www.w3.org/1999/xhtml" style="overflow: auto;"/>
+</window>
+\ No newline at end of file
diff --git a/layout/style/crashtests/432561-1.html b/layout/style/crashtests/432561-1.html
new file mode 100644
index 000000000..81bb082e4
--- /dev/null
+++ b/layout/style/crashtests/432561-1.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<title>Testcase, Bug 432561</title>
+</head>
+<body>
+<script>
+var str = '{';
+for (var i=0;i<22;i++)
+ str+=str;
+document.write('<style type="text/css">div '+str+'</style>');
+str = '{{[('
+for (var i=0;i<20;i++)
+ str+=str;
+document.write('<style type="text/css">div '+str+'</style>');
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/437170-1.html b/layout/style/crashtests/437170-1.html
new file mode 100644
index 000000000..af6fa1d66
--- /dev/null
+++ b/layout/style/crashtests/437170-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+html img { color: blue; }
+</style>
+<script>
+
+function boom()
+{
+  var r = document.createRange();
+  r.selectNodeContents(document.documentElement);
+  r.cloneContents();
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<img src="data:image/gif,GIF87a%02%00%02%00%B3%00%00%00%00%00%FF%FF%FF%00%00%00%00%00%00%FF%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%2C%00%00%00%00%02%00%02%00%00%04%03%90H%12%00%3B" onload="window.getComputedStyle(this, null).getPropertyValue('color');">
+
+</body>
+</html>
diff --git a/layout/style/crashtests/437532-1.html b/layout/style/crashtests/437532-1.html
new file mode 100644
index 000000000..52eefa530
--- /dev/null
+++ b/layout/style/crashtests/437532-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/csS">
+
+a\[href$=".pdf"\] { }
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/439184-1.html b/layout/style/crashtests/439184-1.html
new file mode 100644
index 000000000..f22660726
--- /dev/null
+++ b/layout/style/crashtests/439184-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"
+	"http://www.w3.org/TR/html4/strict.dtd">
+<html lang="en-US">
+<head>
+	<title>Testcase, bug 439184</title>
+	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+	<meta http-equiv="Content-Style-Type" content="text/css">
+	<meta http-equiv="Content-Script-Type" content="text/javascript">
+	<style type="text/css" id="style">
+
+	</style>
+	<script type="text/javascript">
+
+	var styleText = "p { color: green; }";
+	
+	// We want to end up with a million rules or so, so double this text
+	// 20 times to make it 2^20 rules:
+	for (var i = 0; i < 20; ++i) {
+	  styleText += styleText;
+	}
+
+	document.getElementById("style").firstChild.data = styleText;
+
+	</script>
+</head>
+<body>
+
+<p>This should be green.</p>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/444237-1.html b/layout/style/crashtests/444237-1.html
new file mode 100644
index 000000000..7eac32ed8
--- /dev/null
+++ b/layout/style/crashtests/444237-1.html
@@ -0,0 +1 @@
+<input style="box-shadow: initial;">
diff --git a/layout/style/crashtests/444848-1.html b/layout/style/crashtests/444848-1.html
new file mode 100644
index 000000000..d2c75d576
--- /dev/null
+++ b/layout/style/crashtests/444848-1.html
@@ -0,0 +1,9 @@
+<style>
+  [^=foo
+</style>
+<style>
+  [*=bar
+</style>
+<style>
+  [$=baz
+</style>
diff --git a/layout/style/crashtests/447776-1.html b/layout/style/crashtests/447776-1.html
new file mode 100644
index 000000000..dde700fae
--- /dev/null
+++ b/layout/style/crashtests/447776-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<title>Hang with zero width and word-wrap</title>
+</head><body>
+<div style="width: 0px; word-wrap: break-word;">abc</div>
+</body></html>
diff --git a/layout/style/crashtests/447783-1.html b/layout/style/crashtests/447783-1.html
new file mode 100644
index 000000000..05f12bf72
--- /dev/null
+++ b/layout/style/crashtests/447783-1.html
@@ -0,0 +1,8 @@
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<title>Hang with -moz-column-count and word-wrap</title>
+</head><body>
+<div style="border: 1px solid black; word-wrap: normal; -moz-column-count: 2; width: 110px;">
+a<span style="word-wrap: break-word;">abcde</span>
+</div>
+</body></html>
diff --git a/layout/style/crashtests/448161-1.html b/layout/style/crashtests/448161-1.html
new file mode 100644
index 000000000..ef200462b
--- /dev/null
+++ b/layout/style/crashtests/448161-1.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var r = document.createRange();
+  r.setStart(document.body, 0);
+  r.setEnd(document.getElementById("g"), 0);
+  r.deleteContents();
+
+  // Give spell-check a chance to run
+  setTimeout(function() { document.documentElement.className = ""; },
+             50);
+}
+
+</script>
+</head>
+
+<body onload="boom();" contenteditable="true"><span><span contenteditable="true"><a href="http://www.mozilla.org/">5</a></span></span><span id="g"></span></body>
+
+</html>
diff --git a/layout/style/crashtests/448161-2.html b/layout/style/crashtests/448161-2.html
new file mode 100644
index 000000000..41dc7800f
--- /dev/null
+++ b/layout/style/crashtests/448161-2.html
@@ -0,0 +1,9 @@
+<html>
+  <body>
+    <script>
+      var node = document.createElement("a");
+      node.href = "http://www.mozilla.org";
+      document.defaultView.getComputedStyle(node, "").color
+    </script>
+  </body>
+</html>
diff --git a/layout/style/crashtests/452150-1.xhtml b/layout/style/crashtests/452150-1.xhtml
new file mode 100644
index 000000000..4ff411c6d
--- /dev/null
+++ b/layout/style/crashtests/452150-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head></head>
+<body>
+<p><m:mo fontsize="268435456em"><m:mstyle scriptlevel="30"><m:mstyle scriptlevel="15"><span/></m:mstyle></m:mstyle></m:mo></p>
+</body>
+</html>
diff --git a/layout/style/crashtests/456196.html b/layout/style/crashtests/456196.html
new file mode 100644
index 000000000..ed82ca0d4
--- /dev/null
+++ b/layout/style/crashtests/456196.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+<title>Crash [@ nsCSSValueList::~nsCSSValueList] with adding a lot of values in css property</title>
+</head>
+<body>
+<div style="border: 1px solid black; width: 100px; height: 100px;"></div>
+<script>
+function forceFree() {
+  var str = ' rotate(1deg)';
+  for(var i=0;i<17;i++) {str += str;}
+ document.getElementsByTagName('div')[0].style.MozTransform = str;  
+}
+setTimeout(forceFree,100);
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/460209-1.html b/layout/style/crashtests/460209-1.html
new file mode 100644
index 000000000..d78235738
--- /dev/null
+++ b/layout/style/crashtests/460209-1.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<style>
+@import "404.css" s x
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/460217-1.html b/layout/style/crashtests/460217-1.html
new file mode 100644
index 000000000..e5918ad6e
--- /dev/null
+++ b/layout/style/crashtests/460217-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+@font-face
+{
+}
+@font-face
+{ font-family: 1;
+}
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/460323-1.html b/layout/style/crashtests/460323-1.html
new file mode 100644
index 000000000..0bae55aaf
--- /dev/null
+++ b/layout/style/crashtests/460323-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <head>
+    <script>
+      var expectedLoads = 3;
+      function load_done() {
+        --expectedLoads;
+        if (expectedLoads == 0) {
+          document.documentElement.className = "";
+        }
+      }
+      function addLink() {
+        var l = document.createElement("link");
+        l.rel = "stylesheet";
+        l.type = "text/css";
+        l.href = "data:text/css,some { random: data }";
+        l.onload = load_done;
+        document.getElementsByTagName("head")[0].appendChild(l);
+      }
+      function doIt() {
+        document.styleSheets[0].insertRule('a {}', 0)
+        addLink();
+        addLink();
+      }
+      addLink();
+    </script>
+  </head>
+  <body onload="doIt()">
+  <body>
+</body>
diff --git a/layout/style/crashtests/466845-1.html b/layout/style/crashtests/466845-1.html
new file mode 100644
index 000000000..f15c934f1
--- /dev/null
+++ b/layout/style/crashtests/466845-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<title>Crash [@ nsViewManager::CreateView] with ::first-line position: absolute and -moz-transform</title>
+<style>
+#a::first-line {  -moz-transform: translate(50px);}
+</style>
+</head>
+<body style="position: absolute;">
+<span style="position: absolute;" id="a">
+<span style="-moz-transform: translate(50px);">&#1593; &#1593; &#1593;
+</span>
+</span>
+</body>
+</html>
diff --git a/layout/style/crashtests/469432-1.xhtml b/layout/style/crashtests/469432-1.xhtml
new file mode 100644
index 000000000..9b11a88c4
--- /dev/null
+++ b/layout/style/crashtests/469432-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<xul:menuitem>
+<select/>
+<xul:tooltip/>
+<mathml:msup/>
+</xul:menuitem>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/472195-1.html b/layout/style/crashtests/472195-1.html
new file mode 100644
index 000000000..0eff97e46
--- /dev/null
+++ b/layout/style/crashtests/472195-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Copy of 473892-1.html for bug 472195</title>
+<style type="text/css">
+
+@media (min-width: 5rem) { body { color: green; } }
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/472237-1.html b/layout/style/crashtests/472237-1.html
new file mode 100644
index 000000000..0d0e273db
--- /dev/null
+++ b/layout/style/crashtests/472237-1.html
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+
+@font-face {
+      font-family: "Fontin-Sans SC";
+      /* the font url below is correct but won't be accessed due to cross-site restrictions */
+      src: url(../../reftests/fonts/markA.ttf) format("opentype");
+}
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("r").style.fontFamily = "'Fontin-Sans SC'";
+  document.documentElement.offsetHeight;
+  document.removeChild(document.documentElement);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div id="r">R</div></body>
+</html>
diff --git a/layout/style/crashtests/473720-1.html b/layout/style/crashtests/473720-1.html
new file mode 100644
index 000000000..a29316181
--- /dev/null
+++ b/layout/style/crashtests/473720-1.html
@@ -0,0 +1,15 @@
+<html><head><style>
+/* Recovery from an unparseable recognized @-rule is not the same thing
+   as recovery from an unrecognized @-rule.  */
+
+@charset # { }
+@import # { }
+@namespace # { }
+@media # { }
+@-moz-document # { }
+@font-face # { }
+@page # { }
+@-non-mozilla # { }
+@nonstandard # { }
+
+</style></head></html>
diff --git a/layout/style/crashtests/473892-1.html b/layout/style/crashtests/473892-1.html
new file mode 100644
index 000000000..362e38a6d
--- /dev/null
+++ b/layout/style/crashtests/473892-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+@media (width: 5ex) { }
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/473914-1.html b/layout/style/crashtests/473914-1.html
new file mode 100644
index 000000000..47a7a9898
--- /dev/null
+++ b/layout/style/crashtests/473914-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style id="s"></style>
+<script type="text/javascript">
+
+// Duplicates the string 2^n times
+function exp(s, n)
+{
+  for (var i = 0; i < n; ++i)
+    s += s;
+  return s;
+}
+
+var stylesheet = exp("/**/", 20);
+document.getElementById("s").textContent = stylesheet;
+
+</script>
+</head>
+<body>
+<div></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/474377-1.xhtml b/layout/style/crashtests/474377-1.xhtml
new file mode 100644
index 000000000..519a753cf
--- /dev/null
+++ b/layout/style/crashtests/474377-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+
+#q:after {
+  content: 'A';
+}
+
+</style>
+</head>
+<body>
+
+<mrow xmlns="http://www.w3.org/1998/Math/MathML"></mrow>
+<span id="q"><span><div></div></span></span>
+
+</body>
+</html>
+
diff --git a/layout/style/crashtests/478321-1.xhtml b/layout/style/crashtests/478321-1.xhtml
new file mode 100644
index 000000000..654e11c10
--- /dev/null
+++ b/layout/style/crashtests/478321-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="display: table; float: left; line-height: 1rem;"/>
diff --git a/layout/style/crashtests/495269-1.html b/layout/style/crashtests/495269-1.html
new file mode 100644
index 000000000..40090edc8
--- /dev/null
+++ b/layout/style/crashtests/495269-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <link rel="stylesheet" href="data:text/css,@font-face {}';">
+    <link rel="stylesheet" href="data:text/css,@font-face {}';">
+    <script>
+      // Force a unique inner for the second linked sheet
+      document.styleSheets[1].cssRules[0];
+    </script>
+  </head>
+</html>
+
diff --git a/layout/style/crashtests/495269-2.html b/layout/style/crashtests/495269-2.html
new file mode 100644
index 000000000..8deca08e8
--- /dev/null
+++ b/layout/style/crashtests/495269-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <link rel="stylesheet" href="data:text/css,@-moz-document domain(example.com) {}';">
+    <link rel="stylesheet" href="data:text/css,@-moz-document domain(example.com) {}';">
+    <script>
+      // Force a unique inner for the second linked sheet
+      document.styleSheets[1].cssRules[0];
+    </script>
+  </head>
+</html>
+
diff --git a/layout/style/crashtests/498036-1.html b/layout/style/crashtests/498036-1.html
new file mode 100644
index 000000000..0128be749
--- /dev/null
+++ b/layout/style/crashtests/498036-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<!-- bogus assertion when one stylesheet contains two @import rules
+     specifying malformed URIs -->
+<html>
+<head>
+<style type="text/css"> 
+
+@import 'data:css'; 
+@import 'data:css'; 
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/509155-1.html b/layout/style/crashtests/509155-1.html
new file mode 100644
index 000000000..d21137332
--- /dev/null
+++ b/layout/style/crashtests/509155-1.html
@@ -0,0 +1,4 @@
+<html style="outline-color: inherit;">
+<head></head>
+<body></body>
+</html>
diff --git a/layout/style/crashtests/509156-1.html b/layout/style/crashtests/509156-1.html
new file mode 100644
index 000000000..f75776a5d
--- /dev/null
+++ b/layout/style/crashtests/509156-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE HTML>
+<html>
+<head></head>
+<body><div style="text-align: -moz-right;"><div style="display: table;"></div></div></body>
+</html>
diff --git a/layout/style/crashtests/509569-1.html b/layout/style/crashtests/509569-1.html
new file mode 100644
index 000000000..41a3cc559
--- /dev/null
+++ b/layout/style/crashtests/509569-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html style="border-inline-start: inherit; border: none"><body></body></html>
diff --git a/layout/style/crashtests/512851-1.xhtml b/layout/style/crashtests/512851-1.xhtml
new file mode 100644
index 000000000..d772390cd
--- /dev/null
+++ b/layout/style/crashtests/512851-1.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<style type="text/css">
+mover { font-size: 326590449211mm; }
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("r").setAttribute("accentunder", "4");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<mover xmlns="http://www.w3.org/1998/Math/MathML" id="mover"><munderover id="r"><merror/><msqrt/></munderover></mover>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/524252-1.html b/layout/style/crashtests/524252-1.html
new file mode 100644
index 000000000..65686e818
--- /dev/null
+++ b/layout/style/crashtests/524252-1.html
@@ -0,0 +1,10 @@
+<html>
+<head><script>
+function boom()
+{
+  var f = document.getElementById("f");
+  window.getComputedStyle(f, null).getPropertyValue("text-decoration");
+}
+</script></head>
+<body onload="boom();"><font id="f" color="black">a</font></body>
+</html>
diff --git a/layout/style/crashtests/536789-1.html b/layout/style/crashtests/536789-1.html
new file mode 100644
index 000000000..86fcb344f
--- /dev/null
+++ b/layout/style/crashtests/536789-1.html
@@ -0,0 +1,11 @@
+<!-- Must be in quirks mode -->
+<html>
+  <body>
+  <script>
+    var docEl = document.documentElement;
+    var b = document.body;
+    docEl.removeChild(b);
+    docEl.appendChild(document.createElement("table"));
+    docEl.offsetWidth;
+  </script>
+</html>
diff --git a/layout/style/crashtests/539613-1.xhtml b/layout/style/crashtests/539613-1.xhtml
new file mode 100644
index 000000000..386d7e127
--- /dev/null
+++ b/layout/style/crashtests/539613-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<body>
+<m:ms fontsize="90071992547409pc"><span><m:mfrac><m:mtext fontsize="625%"><m:mfrac>f<m:mrow><m:mstyle scriptlevel="3"><m:msup/></m:mstyle></m:mrow></m:mfrac></m:mtext><m:malignmark/></m:mfrac></span></m:ms>
+</body>
+</html>
diff --git a/layout/style/crashtests/558943-1.xhtml b/layout/style/crashtests/558943-1.xhtml
new file mode 100644
index 000000000..e3d978fd3
--- /dev/null
+++ b/layout/style/crashtests/558943-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<style>
+.x:first-line { }
+.y { }
+</style>
+</head>
+<body onload="setTimeout(function(){  document.documentElement.className = 'y'; }, 0)">
+<td class="x"><a href="#">Link</a></td>
+</body>
+</html>
diff --git a/layout/style/crashtests/559491.html b/layout/style/crashtests/559491.html
new file mode 100644
index 000000000..19126e560
--- /dev/null
+++ b/layout/style/crashtests/559491.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  for (var i = 0; i < 200; ++i) {
+    //dump(i + "\n");
+    r1 = document.createElementNS("http://www.w3.org/1999/xhtml", "a");
+    r1.setAttributeNS(null, "href", "404");
+    r1.style.color = "green";
+    r2 = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+    r2.style.color = "red";
+    document.removeChild(document.documentElement);
+    document.appendChild(r1);
+    document.removeChild(document.documentElement);
+    document.appendChild(r2);
+    document.removeChild(document.documentElement);
+    document.appendChild(r1);
+    document.documentElement.offsetHeight;
+  }
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/565248-1.html b/layout/style/crashtests/565248-1.html
new file mode 100644
index 000000000..18c8add08
--- /dev/null
+++ b/layout/style/crashtests/565248-1.html
@@ -0,0 +1,2 @@
+<html><body style="font-size: 18014398509481984%"></body></html>
+
diff --git a/layout/style/crashtests/571105-1.xhtml b/layout/style/crashtests/571105-1.xhtml
new file mode 100644
index 000000000..4dce42dc8
--- /dev/null
+++ b/layout/style/crashtests/571105-1.xhtml
@@ -0,0 +1 @@
+<link xmlns="http://www.w3.org/1999/xhtml" href="http://www.mozilla.org/"/>
+\ No newline at end of file
diff --git a/layout/style/crashtests/573127-1.html b/layout/style/crashtests/573127-1.html
new file mode 100644
index 000000000..72fbaf63e
--- /dev/null
+++ b/layout/style/crashtests/573127-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var mspace = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mspace");
+  var emptyset = document.createElementNS("http://www.w3.org/1998/Math/MathML", "emptyset");
+  emptyset.setAttributeNS(null, "mathvariant", "3");
+  mspace.appendChild(emptyset);
+  document.body.appendChild(mspace);
+  emptyset.removeAttribute('mathvariant');
+}
+
+</script>
+</head>
+
+<body onload="boom()"></body>
+</html>
diff --git a/layout/style/crashtests/575464-1.html b/layout/style/crashtests/575464-1.html
new file mode 100644
index 000000000..e77649ed7
--- /dev/null
+++ b/layout/style/crashtests/575464-1.html
@@ -0,0 +1 @@
+<html><body style="font-size: 1823190rem;"><big><big><span style="text-shadow: 0pt 0pt 0.2em rgb(136, 255, 119);"></span></big></big></body></html>
diff --git a/layout/style/crashtests/580685.html b/layout/style/crashtests/580685.html
new file mode 100644
index 000000000..4cb015393
--- /dev/null
+++ b/layout/style/crashtests/580685.html
@@ -0,0 +1,10 @@
+<html>
+<head></head>
+<body style="outline-offset: 0.1rem; ">
+<script>
+var body = document.body;
+document.removeChild(document.documentElement);
+var compstyle = window.getComputedStyle(body, null).getPropertyValue('outline-offset');
+</script>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/585185-1.html b/layout/style/crashtests/585185-1.html
new file mode 100644
index 000000000..17eec73b3
--- /dev/null
+++ b/layout/style/crashtests/585185-1.html
@@ -0,0 +1 @@
+<a style="font: -2px Verdana;">
diff --git a/layout/style/crashtests/588627-1.html b/layout/style/crashtests/588627-1.html
new file mode 100644
index 000000000..04684950c
--- /dev/null
+++ b/layout/style/crashtests/588627-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="-moz-column-rule: 137438953471mozmm groove transparent"></body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/592698-1.html b/layout/style/crashtests/592698-1.html
new file mode 100644
index 000000000..9dcab0e32
--- /dev/null
+++ b/layout/style/crashtests/592698-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <iframe id="x"
+          src="data:text/html;charset=utf-8,%3Cdiv%20id%3D%22a%22%3Eaaa"></iframe>
+
+  <script>
+    window.onload = function() {
+      window.frames[0].document.getElementById("a").setAttribute("style",
+        '-moz-transition-property: color;' +
+        '-moz-transition-duration: 10s;' +
+        'transition-property: color;' +
+        'transition-duration: 10s; ' +
+        'color: red;');
+
+      // And start the transition
+      window.frames[0].document.documentElement.getBoundingClientRect();
+
+      // Now kill off the presshell
+      var frame = document.getElementById("x");
+      frame.style.display = "none";
+      document.documentElement.getBoundingClientRect();
+
+      // And wait for the refresh driver to fire
+      setTimeout(function() {
+          document.documentElement.className = "";
+      }, 100);
+    }
+  </script>
+</html>
diff --git a/layout/style/crashtests/601437-1.html b/layout/style/crashtests/601437-1.html
new file mode 100644
index 000000000..8b5efd6cc
--- /dev/null
+++ b/layout/style/crashtests/601437-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link id="s" rel="stylesheet" href="data:text/css,@font-face { font-family: 'F'; src: url('file:///404/'); }">
+</head>
+<body onload="document.getElementById('s').sheet.media.appendMedium('x');"></body>
+</html>
diff --git a/layout/style/crashtests/601439-1.html b/layout/style/crashtests/601439-1.html
new file mode 100644
index 000000000..e76e4520e
--- /dev/null
+++ b/layout/style/crashtests/601439-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var elt = document.createElement("span");
+elt.setAttribute("style", "color: red ! important;");
+elt.style.getPropertyPriority("foo");
+
+</script>
diff --git a/layout/style/crashtests/605689-1.html b/layout/style/crashtests/605689-1.html
new file mode 100644
index 000000000..be02ac2e7
--- /dev/null
+++ b/layout/style/crashtests/605689-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+  var r = document.documentElement;
+  r.style.display = "table-cell";
+  r.style.transitionProperty = "x";
+  window.getComputedStyle(r).transitionProperty;
+}
+
+</script>
+<body onload="boom();"></body>
diff --git a/layout/style/crashtests/611922-1.html b/layout/style/crashtests/611922-1.html
new file mode 100644
index 000000000..f6affa0de
--- /dev/null
+++ b/layout/style/crashtests/611922-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <body onload="setTimeout(boom, 100)">
+    <a id="x" href=""><span>This link starts out visited</span></a>
+    <script>
+      function boom() {
+        document.getElementById("x").removeAttribute("href");
+        document.body.offsetWidth;
+        document.documentElement.className = "";
+      }
+    </script>
+  </body>
+</body>
diff --git a/layout/style/crashtests/621596-1.html b/layout/style/crashtests/621596-1.html
new file mode 100644
index 000000000..8bfd68185
--- /dev/null
+++ b/layout/style/crashtests/621596-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.style.MozColumnWidth = "1px";
+  document.documentElement.style.MozOutlineRadiusBottomleft = "100%";
+  document.documentElement.style.padding = "2251799813685249em";
+  window.getComputedStyle(document.documentElement).MozOutlineRadiusBottomleft;
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/622314-1.xhtml b/layout/style/crashtests/622314-1.xhtml
new file mode 100644
index 000000000..4daf23169
--- /dev/null
+++ b/layout/style/crashtests/622314-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <div>
+    <body link="orange" style="position: absolute;"></body>
+    <body link="yellow" style="position: absolute;"></body>
+    
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+
+  </div>
+</html>
diff --git a/layout/style/crashtests/637242.xhtml b/layout/style/crashtests/637242.xhtml
new file mode 100644
index 000000000..a8d99a732
--- /dev/null
+++ b/layout/style/crashtests/637242.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style id="style">p { color: red; }</style>
+<script>
+<![CDATA[
+
+function boom()
+{
+	var styleText = "p { color: green; }";
+	
+	// Make 2^17 rules
+	for (var i = 0; i < 17; ++i) {
+	  styleText += styleText;
+	}
+
+	document.getElementById("style").firstChild.data = styleText;
+    
+    document.body.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"));
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><p>This should be green</p></body>
+
+</html>
diff --git a/layout/style/crashtests/645142.html b/layout/style/crashtests/645142.html
new file mode 100644
index 000000000..290355c18
--- /dev/null
+++ b/layout/style/crashtests/645142.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html><html>
+<head><title>Testcase for bug 645142</title></head>
+<body>
+<div style="font-size: 18446744073709552000mozmm"></div>
+<div style="font-size: 18446744073709552000px"></div>
+<div style="font-size: 18446744073709552000pc"></div>
+<div style="font-size: 18446744073709552000pt"></div>
+<div style="font-size: 18446744073709552000in"></div>
+<div style="font-size: 18446744073709552000mm"></div>
+<div style="font-size: 18446744073709552000cm"></div>
+</body></html>
diff --git a/layout/style/crashtests/645951-1-ref.html b/layout/style/crashtests/645951-1-ref.html
new file mode 100644
index 000000000..7259e9603
--- /dev/null
+++ b/layout/style/crashtests/645951-1-ref.html
@@ -0,0 +1,4 @@
+<!DOCTYPE HTML>
+<title>Test, bug 645951</title>
+<body>
+<p style="color: green">Should not crash, and should be green too.</p>
diff --git a/layout/style/crashtests/645951-1.css b/layout/style/crashtests/645951-1.css
new file mode 100644
index 000000000..25ccf7a26
--- /dev/null
+++ b/layout/style/crashtests/645951-1.css
@@ -0,0 +1 @@
+@import url(chrome:///browser/skin/);
diff --git a/layout/style/crashtests/645951-1.html b/layout/style/crashtests/645951-1.html
new file mode 100644
index 000000000..a977e1ed4
--- /dev/null
+++ b/layout/style/crashtests/645951-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE HTML>
+<title>Test, bug 645951</title>
+<link rel=stylesheet href="645951-1.css">
+<link id="two" rel=stylesheet href="645951-1.css">
+<body onload="run()">
+<script>
+function run() {
+  document.getElementById("two").sheet.insertRule("p { color: green}", 1);
+}
+</script>
+<p>Should not crash, and should be green too.</p>
diff --git a/layout/style/crashtests/652976-1.svg b/layout/style/crashtests/652976-1.svg
new file mode 100644
index 000000000..1ca6ee28e
--- /dev/null
+++ b/layout/style/crashtests/652976-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+window.addEventListener("load", function() {
+  setTimeout(function() { 
+    document.getElementById("a").style.MozAnimationName = "a";
+  }, 0);
+}, false);
+</script>
+<rect id="a"><animate attributeName="fill" by="#AAF573"/></rect>
+</svg>
diff --git a/layout/style/crashtests/665209-1.html b/layout/style/crashtests/665209-1.html
new file mode 100644
index 000000000..30e8055eb
--- /dev/null
+++ b/layout/style/crashtests/665209-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+  var w = '<div xmlns="http://www.w3.org/1999/xhtml" style="content: url(#);" />';
+  var v = 'url("data:image/svg+xml,' + encodeURIComponent(w) + '")';
+  document.documentElement.style.content = v;
+  document.documentElement.className = "";
+}
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/671799-1.html b/layout/style/crashtests/671799-1.html
new file mode 100644
index 000000000..cc89495b3
--- /dev/null
+++ b/layout/style/crashtests/671799-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<iframe src="data:text/html,<style>@font-face { font-family: 'x'; src: url(x.ttf); } :root { font-family: 'x'; }</style>"></iframe>
+</body>
+</html>
diff --git a/layout/style/crashtests/671799-2.html b/layout/style/crashtests/671799-2.html
new file mode 100644
index 000000000..a8398680e
--- /dev/null
+++ b/layout/style/crashtests/671799-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+@font-face {
+  font-family: foo;
+  src: url("http://spaces in hostname/");
+}
+body {
+  font-family: foo, monospace;
+}
+</style>
+</head>
+<body>
+foo bar
+</body>
+</html>
diff --git a/layout/style/crashtests/690990-1.html b/layout/style/crashtests/690990-1.html
new file mode 100644
index 000000000..19520e4f9
--- /dev/null
+++ b/layout/style/crashtests/690990-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+
+<link id="e" href="data:text/css,.ref { background-color: green; }" rel="stylesheet">
+
+<script>
+
+function boom()
+{
+  document.documentElement.appendChild(document.getElementById("e"));
+  document.styleSheets[0].cssRules[0];
+  // Remove reftest-wait async so we give the SheetComplete a chance to run
+  setTimeout(function() { document.documentElement.className = ""; }, 0);
+}
+
+</script>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/style/crashtests/696188-1.html b/layout/style/crashtests/696188-1.html
new file mode 100644
index 000000000..e52a26747
--- /dev/null
+++ b/layout/style/crashtests/696188-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<script>
+
+function boom()
+{
+  var e = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  document.body.appendChild(e);
+  e.setAttribute("style", "-moz-transform: rotate3d(2, 3, 4, 45deg) scale(10);");
+  e.offsetHeight;
+  e.setAttribute("style", "-moz-transition-duration: 1ms;");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/696869-1.html b/layout/style/crashtests/696869-1.html
new file mode 100644
index 000000000..e85a882a6
--- /dev/null
+++ b/layout/style/crashtests/696869-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<body style="-moz-transition: 4000000000000000s" onload="document.body.style.color = 'green';"></body>
+\ No newline at end of file
diff --git a/layout/style/crashtests/700116.html b/layout/style/crashtests/700116.html
new file mode 100644
index 000000000..de35ce702
--- /dev/null
+++ b/layout/style/crashtests/700116.html
@@ -0,0 +1,5 @@
+<head>
+  <script>
+    document.write('<link rel="stylesheet" href="#"><link rel="alternate stylesheet" title="x" href="data:text/css,"><link rel="stylesheet" title="x" href="data:text/css,">');
+  </script>
+</head>
diff --git a/layout/style/crashtests/729126-1.html b/layout/style/crashtests/729126-1.html
new file mode 100644
index 000000000..a5c50abd0
--- /dev/null
+++ b/layout/style/crashtests/729126-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body style="transition-duration: 1ms"></body>
+<script>
+var body = document.body;
+/* flush */ getComputedStyle(body, "").background;
+body.style.background = 'url(none.png), repeat';
+/* flush */ getComputedStyle(body, "").background;
+</script>
+</html>
diff --git a/layout/style/crashtests/729126-2.html b/layout/style/crashtests/729126-2.html
new file mode 100644
index 000000000..63533ee30
--- /dev/null
+++ b/layout/style/crashtests/729126-2.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body style="background-size: cover; transition-duration: 1ms"></body>
+<script>
+var body = document.body;
+/* flush */ getComputedStyle(body, "").backgroundSize;
+body.style.backgroundSize = 'contain';
+/* flush */ getComputedStyle(body, "").backgroundSize;
+</script>
+</html>
diff --git a/layout/style/crashtests/786108-1.html b/layout/style/crashtests/786108-1.html
new file mode 100644
index 000000000..2962e7117
--- /dev/null
+++ b/layout/style/crashtests/786108-1.html
@@ -0,0 +1,22 @@
+<html>
+  <head></head>
+  <body></body>
+  <script type="text/javascript">
+    // Detect severe performance and memory issues when large amounts of errors
+    // are reported from CSS embedded in a file with a long data URI. Addressed
+    // by 786108; should finish quickly with that patch and run for a very long
+    // time otherwise.
+
+    var img = new Array;
+    img.push('<img src="data:image/svg+xml,');
+    img.push(encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300px" height="300px">'));
+
+    for (var i = 0 ; i < 10000 ; i++)
+      img.push(encodeURIComponent('<circle cx="0" cy="0" r="1" style="xxx-invalid-property: 0;"/>'));
+
+    img.push(encodeURIComponent('</svg>'));
+    img.push('">');
+
+    document.getElementsByTagName('body')[0].innerHTML = img.join('');
+  </script>
+</html>
diff --git a/layout/style/crashtests/786108-2.html b/layout/style/crashtests/786108-2.html
new file mode 100644
index 000000000..1b2892040
--- /dev/null
+++ b/layout/style/crashtests/786108-2.html
@@ -0,0 +1,23 @@
+<html>
+  <head></head>
+  <body></body>
+  <script type="text/javascript">
+    // Detect severe performance and memory issues when large amounts of errors
+    // are reported from CSS embedded in a file with a long data URI. Addressed
+    // by 786108; should finish quickly with that patch and run for a very long
+    // time otherwise. This version is designed for slow / memory constrained
+    // platforms like Android.
+
+    var img = new Array;
+    img.push('<img src="data:image/svg+xml,');
+    img.push(encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300px" height="300px">'));
+
+    for (var i = 0 ; i < 2500 ; i++)
+      img.push(encodeURIComponent('<circle cx="0" cy="0" r="1" style="xxx-invalid-property: 0;"/>'));
+
+    img.push(encodeURIComponent('</svg>'));
+    img.push('">');
+
+    document.getElementsByTagName('body')[0].innerHTML = img.join('');
+  </script>
+</html>
diff --git a/layout/style/crashtests/788836.html b/layout/style/crashtests/788836.html
new file mode 100644
index 000000000..938c21675
--- /dev/null
+++ b/layout/style/crashtests/788836.html
@@ -0,0 +1,3 @@
+<style>@\</style>
+<style>@\
+</style>
diff --git a/layout/style/crashtests/806310-1.html b/layout/style/crashtests/806310-1.html
new file mode 100644
index 000000000..505b41076
--- /dev/null
+++ b/layout/style/crashtests/806310-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html lang="en-US" style="font: caption; font-size: 1rem;">
+<body></body>
+</html>
diff --git a/layout/style/crashtests/812824.html b/layout/style/crashtests/812824.html
new file mode 100644
index 000000000..5367b6c30
--- /dev/null
+++ b/layout/style/crashtests/812824.html
@@ -0,0 +1 @@
+<html style="border: inherit;"><div></div><style>html, div { border-image-source: url('border.png'); }</style></html>
diff --git a/layout/style/crashtests/822766-1.html b/layout/style/crashtests/822766-1.html
new file mode 100644
index 000000000..77bb1e25a
--- /dev/null
+++ b/layout/style/crashtests/822766-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+@-moz-keyframes togreen {
+    100% {
+        color: green;
+    }
+}
+
+.a:after {
+    animation-name: togreen;
+    animation-duration: 10s;
+}
+
+</style>
+<script>
+
+function boom()
+{
+  document.documentElement.setAttribute("class", "a");
+  document.documentElement.offsetHeight;
+  document.documentElement.appendChild(document.createElement("span"));
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/822842.html b/layout/style/crashtests/822842.html
new file mode 100644
index 000000000..a8c7acfbf
--- /dev/null
+++ b/layout/style/crashtests/822842.html
@@ -0,0 +1,13 @@
+<html>
+  <head></head>
+  <body></body>
+  <script type="text/javascript">
+    window.x = window.getComputedStyle(document.documentElement, null).getPropertyCSSValue("transition-timing-function");
+    window.x = window.getComputedStyle(document.documentElement, null).getPropertyCSSValue("color");
+    x.z = x.getRGBColorValue().blue;
+    x.getRGBColor().blue.d = x;
+    x= null;
+    SpecialPowers.forceGC();
+    SpecialPowers.forceCC();
+  </script>
+</html>
diff --git a/layout/style/crashtests/827591-1.html b/layout/style/crashtests/827591-1.html
new file mode 100644
index 000000000..a0ab10091
--- /dev/null
+++ b/layout/style/crashtests/827591-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+@page {}
+
+</style>
+<script>
+
+function boom()
+{
+  document.styleSheets[0].cssRules[0].style.paddingLeft = "initial";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/829817.html b/layout/style/crashtests/829817.html
new file mode 100644
index 000000000..a81fb6b79
--- /dev/null
+++ b/layout/style/crashtests/829817.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+@page {}
+
+</style>
+<script>
+
+function boom()
+{
+    // This shouldn't cause a shutdown leak.
+    document.styleSheets[0].cssRules[0].style.someExpando = "set an expando to preserve the wrapper";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/840898.html b/layout/style/crashtests/840898.html
new file mode 100644
index 000000000..352bf3c3d
--- /dev/null
+++ b/layout/style/crashtests/840898.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var styleDeclaration = window.getComputedStyle(document.createElement('div'), null);
+  var cursorValue = styleDeclaration.getPropertyCSSValue('cursor');
+  cursorValue.item(1000);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/842134.html b/layout/style/crashtests/842134.html
new file mode 100644
index 000000000..f5bab1214
--- /dev/null
+++ b/layout/style/crashtests/842134.html
@@ -0,0 +1 @@
+<!doctype html><style>body { marker: url(#m) url(#m); }</style>
diff --git a/layout/style/crashtests/861489-1.html b/layout/style/crashtests/861489-1.html
new file mode 100644
index 000000000..bb394cef5
--- /dev/null
+++ b/layout/style/crashtests/861489-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+
+@keyframes anim {
+  20% {
+    color: green;
+  }
+}
+
+a {
+  animation-name: anim;
+  animation-duration: 40s;
+}
+
+</style>
+<style>
+
+:link { background: red ! important; }
+
+</style>
+</head>
+
+<body onload="document.documentElement.style.border = 'initial';">
+<div><a href="data:text/html,unlikely to be visited"></a></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/862113.html b/layout/style/crashtests/862113.html
new file mode 100644
index 000000000..319132b78
--- /dev/null
+++ b/layout/style/crashtests/862113.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  window.getComputedStyle(document.documentElement, ":foo");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/867487.html b/layout/style/crashtests/867487.html
new file mode 100644
index 000000000..a259690d1
--- /dev/null
+++ b/layout/style/crashtests/867487.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="stylesheet" href="data:text/css,">
+<script>
+
+function boom()
+{
+    var s = document.styleSheets[0];
+    var n = s.ownerNode;
+    var p = n.parentNode;
+
+    s.insertRule("#a { }", 0);
+
+    for (var i = 0; i < 3; ++i) {
+        p.removeChild(n);
+        p.appendChild(n);
+    }
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/873222.html b/layout/style/crashtests/873222.html
new file mode 100644
index 000000000..1ffcc623a
--- /dev/null
+++ b/layout/style/crashtests/873222.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var r = document.documentElement;
+    r.style.font = "170% fantasy";
+    r.style.fontSynthesis = "none";
+    r.getAttribute("style");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/880862.html b/layout/style/crashtests/880862.html
new file mode 100644
index 000000000..d89e24d90
--- /dev/null
+++ b/layout/style/crashtests/880862.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  // This file tests if we create a shutdown leak.
+  document.getElementById("c").getContext("2d").fillText("x", 0, 0);
+  document.styleSheets[0].cssRules[0].style.whatever = "create an expando to preserve the wrapper";
+}
+
+</script>
+
+<style>
+
+@font-face {
+  font-family: missing;
+  src: local(missing);
+}
+
+</style>
+</head>
+
+<body onload="boom();">
+<canvas id="c"></canvas>
+</body>
+</html>
diff --git a/layout/style/crashtests/915440.html b/layout/style/crashtests/915440.html
new file mode 100644
index 000000000..f3a291f1f
--- /dev/null
+++ b/layout/style/crashtests/915440.html
@@ -0,0 +1,4 @@
+<!DOCTYPE HTML>
+<body>
+<iframe src="data:text/html,<!DOCTYPE HTML><style>@font-face { font-family: 'a'; src: url('not-found') format('woff'); }</style>"></iframe>
+</body>
diff --git a/layout/style/crashtests/927734-1.html b/layout/style/crashtests/927734-1.html
new file mode 100644
index 000000000..bd99f9b9e
--- /dev/null
+++ b/layout/style/crashtests/927734-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<table>
+  <tr>
+    <td>
+      <style scoped></style>
+      <span></span>
+    </td>
+  </tr>
+</table>
+<style>div {}</style>
diff --git a/layout/style/crashtests/930270-1.html b/layout/style/crashtests/930270-1.html
new file mode 100644
index 000000000..cbdf5a9e3
--- /dev/null
+++ b/layout/style/crashtests/930270-1.html
@@ -0,0 +1,6 @@
+<nobr>
+<form>
+<style scoped></style>
+<input required="required">
+<button>
+<nobr>
diff --git a/layout/style/crashtests/930270-2.html b/layout/style/crashtests/930270-2.html
new file mode 100644
index 000000000..6240ca20e
--- /dev/null
+++ b/layout/style/crashtests/930270-2.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+<style scoped>span { color: red; }</style>
+<div><span></span></div>
+<script>
+var div = document.querySelector("div");
+div.parentNode.removeChild(div);
+getComputedStyle(div.firstChild, "").color;
+</script>
diff --git a/layout/style/crashtests/945048-1.html b/layout/style/crashtests/945048-1.html
new file mode 100644
index 000000000..753efb66f
--- /dev/null
+++ b/layout/style/crashtests/945048-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<style>
+button::-moz-focus-inner:active { }
+</style>
+<button>hello</button>
diff --git a/layout/style/crashtests/972199-1.html b/layout/style/crashtests/972199-1.html
new file mode 100644
index 000000000..a4e0de0d8
--- /dev/null
+++ b/layout/style/crashtests/972199-1.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+  <style type="text/css">
+    @keyframes anim {
+       0% { transform: translate(0px) }
+       100% { transform: translate(100px) }
+    }
+    div {
+      width: 100px;
+      height: 100px;
+      background-color: white;
+    }
+  </style>
+</head>
+<body>
+<div></div>
+<script type="application/javascript">
+
+window.addEventListener("load", function() {
+  document.querySelector("div").setAttribute("style",
+    "animation: 100s 300s anim linear");
+  advance_clock(200000);
+  advance_clock(300000);
+
+  Promise.resolve().then(function() {
+    SpecialPowers.DOMWindowUtils.restoreNormalRefresh();
+  }).then(function() {
+    document.documentElement.className = "";
+  });
+});
+
+function advance_clock(milliseconds) {
+  SpecialPowers.DOMWindowUtils.advanceTimeAndRefresh(milliseconds);
+}
+</script>
+</html>
diff --git a/layout/style/crashtests/989965-1.html b/layout/style/crashtests/989965-1.html
new file mode 100644
index 000000000..a2879d973
--- /dev/null
+++ b/layout/style/crashtests/989965-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+<style>
+::placeholder { color: red; }
+::placeholder:focus { color: green; }
+</style>
+<script>
+window.getComputedStyle(document.body, "::placeholder").color;
+</script>
diff --git a/layout/style/crashtests/992333-1.html b/layout/style/crashtests/992333-1.html
new file mode 100644
index 000000000..86a1d57d7
--- /dev/null
+++ b/layout/style/crashtests/992333-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<style>
+p { --variable: value; transition: 1s --variable; }
+</style>
+<p>Hello.</p>
+<script>
+window.onload = function() {
+  document.querySelector("p").style.color = "green";
+};
+</script>
diff --git a/layout/style/crashtests/blue-32x32.png b/layout/style/crashtests/blue-32x32.png
new file mode 100644
index 000000000..deefd19b2
--- /dev/null
+++ b/layout/style/crashtests/blue-32x32.png
diff --git a/layout/style/crashtests/border-image-visited-link.html b/layout/style/crashtests/border-image-visited-link.html
new file mode 100644
index 000000000..b6e3ae5d7
--- /dev/null
+++ b/layout/style/crashtests/border-image-visited-link.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<title>border-image on link with visited styles</title>
+<style>
+
+:link { color: blue }
+:visited { color: purple }
+:link, :visited { border: medium solid; border-image: url(blue-32x32.png) 4 4 4 4; }
+
+</style>
+<a href="http://example.com/">test</a>
diff --git a/layout/style/crashtests/crashtests.list b/layout/style/crashtests/crashtests.list
new file mode 100644
index 000000000..1ddb01d6b
--- /dev/null
+++ b/layout/style/crashtests/crashtests.list
@@ -0,0 +1,166 @@
+load 105619-1.html
+load 147777-1.html
+load 187671-1.html
+load 192408-1.html
+load 285727-1.html
+load 286707-1.html
+load 317561-1.html
+load 330998-1.html
+load 363950.html
+load 368175-1.html
+load 368740.html
+load 379788-1.html
+load 383979-1.xhtml
+load 383979-2.html
+load 386939-1.html
+load 391034-1.xhtml
+load 397022-1.html
+load 399289-1.svg
+load 404470-1.html
+load 411603-1.html
+load 412588-1.html
+load 413274-1.xhtml
+load 416461-1.xul
+load 418007-1.xhtml
+load 431705-1.xul
+load 432561-1.html
+load 437170-1.html
+load 437532-1.html
+load 439184-1.html
+load 444237-1.html
+load 444848-1.html 
+load 447776-1.html
+load 447783-1.html
+load 448161-1.html
+load 448161-2.html
+load 452150-1.xhtml
+load 456196.html
+load 460209-1.html
+load 460217-1.html
+load 460323-1.html
+load 466845-1.html
+load 469432-1.xhtml
+load 472195-1.html
+load 472237-1.html # will fail, test for leak (474704)
+HTTP(..) load 472237-1.html
+load 473720-1.html
+load 473892-1.html
+load 473914-1.html
+load 474377-1.xhtml
+load 478321-1.xhtml
+load 495269-1.html
+load 495269-2.html
+load 498036-1.html
+load 509155-1.html
+load 509156-1.html
+load 509569-1.html
+load 512851-1.xhtml
+load 524252-1.html
+load 536789-1.html
+load 539613-1.xhtml
+load 558943-1.xhtml
+load 559491.html
+load 565248-1.html
+load 571105-1.xhtml
+load 573127-1.html
+load 575464-1.html
+load 580685.html
+load 585185-1.html
+load 588627-1.html
+load 592698-1.html
+load 601437-1.html
+load 601439-1.html
+load 605689-1.html
+load 611922-1.html
+load 621596-1.html
+load 622314-1.xhtml
+load 637242.xhtml
+load 645142.html
+== 645951-1.html 645951-1-ref.html
+load 652976-1.svg
+load 665209-1.html
+load 671799-1.html
+load 671799-2.html
+load 690990-1.html
+load 696188-1.html
+load 696869-1.html
+load 700116.html
+load 729126-1.html
+load 729126-2.html
+load 786108-1.html
+load 786108-2.html
+load 788836.html
+load 806310-1.html
+load 812824.html
+load 822766-1.html
+load 822842.html
+load 827591-1.html
+load 829817.html
+load 840898.html
+load 842134.html
+load 861489-1.html
+load 862113.html
+load 867487.html
+load 873222.html
+load 880862.html
+load 915440.html
+load 927734-1.html
+load 930270-1.html
+load 930270-2.html
+load 945048-1.html
+load 972199-1.html
+load 989965-1.html
+load 992333-1.html
+pref(dom.webcomponents.enabled,true) load 1017798-1.html
+load 1028514-1.html
+load 1066089-1.html
+load 1074651-1.html
+load 1135534.html
+pref(dom.webcomponents.enabled,true) load 1089463-1.html
+pref(layout.css.expensive-style-struct-assertions.enabled,true) load 1136010-1.html
+pref(layout.css.expensive-style-struct-assertions.enabled,true) load 1146101-1.html
+load 1153693-1.html
+load 1161320-1.html
+pref(dom.animations-api.core.enabled,true) load 1161320-2.html
+load 1161366-1.html
+load 1163446-1.html
+load 1164813-1.html
+load 1167782-1.html
+load 1186768-1.xhtml
+load 1200568-1.html
+load 1206105-1.html
+load 1223688-1.html
+load 1223694-1.html
+load 1226400-1.html
+load 1227501-1.html
+load 1230408-1.html
+load 1233135-1.html
+load 1233135-2.html
+load 1238660-1.html
+load 1245260-1.html
+load 1247865-1.html
+load 1264396-1.html
+# The following test relies on -webkit-text-fill-color being behind the
+# layout.css.prefixes.webkit pref
+pref(layout.css.prefixes.webkit,false) load 1265611-1.html
+load border-image-visited-link.html
+load font-face-truncated-src.html 
+load large_border_image_width.html
+load long-url-list-stack-overflow.html
+pref(layout.css.background-clip-text.enabled,true) load 1264949.html
+pref(layout.css.background-clip-text.enabled,true) load 1270795.html
+pref(layout.css.background-clip-text.enabled,true) load 1275026.html
+load 1278463-1.html
+pref(dom.animations-api.core.enabled,true) load 1277908-1.html
+load 1277908-2.html
+load 1282076-1.html
+pref(dom.animations-api.core.enabled,true) load 1282076-2.html
+pref(dom.animations-api.core.enabled,true) load 1290994-1.html
+pref(dom.animations-api.core.enabled,true) load 1290994-2.html
+pref(dom.animations-api.core.enabled,true) load 1290994-3.html
+load 1290994-4.html
+load 1314531.html
+load 1315889-1.html
+load 1315894-1.html
+load 1321357-1.html
+load 1356601-1.html
diff --git a/layout/style/crashtests/font-face-truncated-src.html b/layout/style/crashtests/font-face-truncated-src.html
new file mode 100644
index 000000000..c3d7dbda5
--- /dev/null
+++ b/layout/style/crashtests/font-face-truncated-src.html
@@ -0,0 +1,2 @@
+<!doctype html>
+<style>@font-face { src:</style>
diff --git a/layout/style/crashtests/large_border_image_width.html b/layout/style/crashtests/large_border_image_width.html
new file mode 100644
index 000000000..915d94eb1
--- /dev/null
+++ b/layout/style/crashtests/large_border_image_width.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<div style="border: 10px solid transparent; border-image-source: -moz-linear-gradient(0rad, blue 25px, green 25px); border-image-width: 5464618830153;"></div>
+</body>
+</html>
+
diff --git a/layout/style/crashtests/long-url-list-stack-overflow.html b/layout/style/crashtests/long-url-list-stack-overflow.html
new file mode 100644
index 000000000..899e858df
--- /dev/null
+++ b/layout/style/crashtests/long-url-list-stack-overflow.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style id="s"></style>
+<script type="text/javascript">
+
+// Duplicates the string 2^n times
+function exp(s, n)
+{
+  for (var i = 0; i < n; ++i)
+    s += s;
+  return s;
+}
+
+var stylesheet = "@-moz-document url(http://www.w3.org/)" + exp(", url-prefix(file:///)", 20) + " { }";
+document.getElementById("s").textContent = stylesheet;
+
+</script>
+</head>
+<body>
+<div></div>
+</body>
+</html>