From 5f8de423f190bbb79a62f804151bc24824fa32d8 Mon Sep 17 00:00:00 2001
From: "Matt A. Tobin" <mattatobin@localhost.localdomain>
Date: Fri, 2 Feb 2018 04:16:08 -0500
Subject: Add m-esr52 at 52.6.0

---
 layout/forms/crashtests/1102791.html       | 33 ++++++++++++++
 layout/forms/crashtests/1140216.html       | 20 +++++++++
 layout/forms/crashtests/1182414.html       | 17 ++++++++
 layout/forms/crashtests/1212688.html       | 27 ++++++++++++
 layout/forms/crashtests/1228670.xhtml      |  7 +++
 layout/forms/crashtests/1279354.html       | 21 +++++++++
 layout/forms/crashtests/166750-1.html      | 14 ++++++
 layout/forms/crashtests/200347-1.html      |  8 ++++
 layout/forms/crashtests/203041-1.html      | 24 +++++++++++
 layout/forms/crashtests/213390-1.html      | 23 ++++++++++
 layout/forms/crashtests/258101-1.html      | 18 ++++++++
 layout/forms/crashtests/266225-1.html      |  7 +++
 layout/forms/crashtests/310426-1.xhtml     |  9 ++++
 layout/forms/crashtests/310520-1.xhtml     | 19 ++++++++
 layout/forms/crashtests/315752-1.xhtml     | 21 +++++++++
 layout/forms/crashtests/317502-1.xhtml     | 13 ++++++
 layout/forms/crashtests/321894.html        | 17 ++++++++
 layout/forms/crashtests/323499-1.html      | 21 +++++++++
 layout/forms/crashtests/343510-1.html      |  4 ++
 layout/forms/crashtests/363696-1.xul       | 10 +++++
 layout/forms/crashtests/363696-2.html      |  2 +
 layout/forms/crashtests/363696-3.html      |  5 +++
 layout/forms/crashtests/366205-1.html      | 11 +++++
 layout/forms/crashtests/366537-1.xhtml     | 32 ++++++++++++++
 layout/forms/crashtests/367587-1.html      | 37 ++++++++++++++++
 layout/forms/crashtests/370703-1.html      | 30 +++++++++++++
 layout/forms/crashtests/370940-1.html      | 28 ++++++++++++
 layout/forms/crashtests/370967.html        | 13 ++++++
 layout/forms/crashtests/373586-1.xhtml     | 40 +++++++++++++++++
 layout/forms/crashtests/375299-binding.xml |  4 ++
 layout/forms/crashtests/375299.html        | 17 ++++++++
 layout/forms/crashtests/378369.html        | 19 ++++++++
 layout/forms/crashtests/378413-1.xhtml     | 16 +++++++
 layout/forms/crashtests/380116-1.xhtml     | 11 +++++
 layout/forms/crashtests/382212-1.xhtml     |  7 +++
 layout/forms/crashtests/382610-1.html      | 11 +++++
 layout/forms/crashtests/383887-1.html      | 20 +++++++++
 layout/forms/crashtests/386554-1.html      | 14 ++++++
 layout/forms/crashtests/388374-1.xhtml     | 22 ++++++++++
 layout/forms/crashtests/388374-2.html      | 25 +++++++++++
 layout/forms/crashtests/393656-1.xhtml     | 13 ++++++
 layout/forms/crashtests/393656-2.xhtml     | 22 ++++++++++
 layout/forms/crashtests/399262.html        | 50 ++++++++++++++++++++++
 layout/forms/crashtests/402852-1.html      |  2 +
 layout/forms/crashtests/403148-1.html      | 22 ++++++++++
 layout/forms/crashtests/404118-1.html      |  5 +++
 layout/forms/crashtests/404123-1.html      | 12 ++++++
 layout/forms/crashtests/407066.html        |  1 +
 layout/forms/crashtests/451316.html        |  7 +++
 layout/forms/crashtests/455451-1.html      | 17 ++++++++
 layout/forms/crashtests/457537-1.html      | 17 ++++++++
 layout/forms/crashtests/457537-2.html      | 17 ++++++++
 layout/forms/crashtests/478219-1.xhtml     |  7 +++
 layout/forms/crashtests/498698-1.html      |  6 +++
 layout/forms/crashtests/513113-1.html      |  6 +++
 layout/forms/crashtests/538062-1.xhtml     | 20 +++++++++
 layout/forms/crashtests/570624-1.html      | 15 +++++++
 layout/forms/crashtests/578604-1.html      | 17 ++++++++
 layout/forms/crashtests/590302-1.xhtml     |  4 ++
 layout/forms/crashtests/626014.xhtml       | 20 +++++++++
 layout/forms/crashtests/639733.xhtml       | 26 +++++++++++
 layout/forms/crashtests/669767.html        | 14 ++++++
 layout/forms/crashtests/682684-binding.xml |  4 ++
 layout/forms/crashtests/682684.xhtml       |  3 ++
 layout/forms/crashtests/865602.html        |  9 ++++
 layout/forms/crashtests/893332-1.html      | 10 +++++
 layout/forms/crashtests/944198.html        |  9 ++++
 layout/forms/crashtests/949891.xhtml       |  5 +++
 layout/forms/crashtests/959311.html        | 17 ++++++++
 layout/forms/crashtests/960277-2.html      | 14 ++++++
 layout/forms/crashtests/997709-1.html      |  5 +++
 layout/forms/crashtests/crashtests.list    | 69 ++++++++++++++++++++++++++++++
 72 files changed, 1162 insertions(+)
 create mode 100644 layout/forms/crashtests/1102791.html
 create mode 100644 layout/forms/crashtests/1140216.html
 create mode 100644 layout/forms/crashtests/1182414.html
 create mode 100644 layout/forms/crashtests/1212688.html
 create mode 100644 layout/forms/crashtests/1228670.xhtml
 create mode 100644 layout/forms/crashtests/1279354.html
 create mode 100644 layout/forms/crashtests/166750-1.html
 create mode 100644 layout/forms/crashtests/200347-1.html
 create mode 100644 layout/forms/crashtests/203041-1.html
 create mode 100644 layout/forms/crashtests/213390-1.html
 create mode 100644 layout/forms/crashtests/258101-1.html
 create mode 100644 layout/forms/crashtests/266225-1.html
 create mode 100644 layout/forms/crashtests/310426-1.xhtml
 create mode 100644 layout/forms/crashtests/310520-1.xhtml
 create mode 100644 layout/forms/crashtests/315752-1.xhtml
 create mode 100644 layout/forms/crashtests/317502-1.xhtml
 create mode 100644 layout/forms/crashtests/321894.html
 create mode 100644 layout/forms/crashtests/323499-1.html
 create mode 100644 layout/forms/crashtests/343510-1.html
 create mode 100644 layout/forms/crashtests/363696-1.xul
 create mode 100644 layout/forms/crashtests/363696-2.html
 create mode 100644 layout/forms/crashtests/363696-3.html
 create mode 100644 layout/forms/crashtests/366205-1.html
 create mode 100644 layout/forms/crashtests/366537-1.xhtml
 create mode 100644 layout/forms/crashtests/367587-1.html
 create mode 100644 layout/forms/crashtests/370703-1.html
 create mode 100644 layout/forms/crashtests/370940-1.html
 create mode 100644 layout/forms/crashtests/370967.html
 create mode 100644 layout/forms/crashtests/373586-1.xhtml
 create mode 100644 layout/forms/crashtests/375299-binding.xml
 create mode 100644 layout/forms/crashtests/375299.html
 create mode 100644 layout/forms/crashtests/378369.html
 create mode 100644 layout/forms/crashtests/378413-1.xhtml
 create mode 100644 layout/forms/crashtests/380116-1.xhtml
 create mode 100644 layout/forms/crashtests/382212-1.xhtml
 create mode 100644 layout/forms/crashtests/382610-1.html
 create mode 100644 layout/forms/crashtests/383887-1.html
 create mode 100644 layout/forms/crashtests/386554-1.html
 create mode 100644 layout/forms/crashtests/388374-1.xhtml
 create mode 100644 layout/forms/crashtests/388374-2.html
 create mode 100644 layout/forms/crashtests/393656-1.xhtml
 create mode 100644 layout/forms/crashtests/393656-2.xhtml
 create mode 100644 layout/forms/crashtests/399262.html
 create mode 100644 layout/forms/crashtests/402852-1.html
 create mode 100644 layout/forms/crashtests/403148-1.html
 create mode 100644 layout/forms/crashtests/404118-1.html
 create mode 100644 layout/forms/crashtests/404123-1.html
 create mode 100644 layout/forms/crashtests/407066.html
 create mode 100644 layout/forms/crashtests/451316.html
 create mode 100644 layout/forms/crashtests/455451-1.html
 create mode 100644 layout/forms/crashtests/457537-1.html
 create mode 100644 layout/forms/crashtests/457537-2.html
 create mode 100644 layout/forms/crashtests/478219-1.xhtml
 create mode 100644 layout/forms/crashtests/498698-1.html
 create mode 100644 layout/forms/crashtests/513113-1.html
 create mode 100644 layout/forms/crashtests/538062-1.xhtml
 create mode 100644 layout/forms/crashtests/570624-1.html
 create mode 100644 layout/forms/crashtests/578604-1.html
 create mode 100644 layout/forms/crashtests/590302-1.xhtml
 create mode 100644 layout/forms/crashtests/626014.xhtml
 create mode 100644 layout/forms/crashtests/639733.xhtml
 create mode 100644 layout/forms/crashtests/669767.html
 create mode 100644 layout/forms/crashtests/682684-binding.xml
 create mode 100644 layout/forms/crashtests/682684.xhtml
 create mode 100644 layout/forms/crashtests/865602.html
 create mode 100644 layout/forms/crashtests/893332-1.html
 create mode 100644 layout/forms/crashtests/944198.html
 create mode 100644 layout/forms/crashtests/949891.xhtml
 create mode 100644 layout/forms/crashtests/959311.html
 create mode 100644 layout/forms/crashtests/960277-2.html
 create mode 100644 layout/forms/crashtests/997709-1.html
 create mode 100644 layout/forms/crashtests/crashtests.list

(limited to 'layout/forms/crashtests')

diff --git a/layout/forms/crashtests/1102791.html b/layout/forms/crashtests/1102791.html
new file mode 100644
index 000000000..5bcdd80a6
--- /dev/null
+++ b/layout/forms/crashtests/1102791.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html class="reftest-print"><head>
+    <meta charset="utf-8">
+    <title>Testcase for bug 1102791</title>
+    <style type="text/css">
+
+html,body {
+    color:black; background-color:white; font-size:16px; padding:0; margin:0;
+}
+
+button {
+  position: absolute;
+  -moz-appearance: none;
+  background: transparent;
+  padding: 0;
+  border-style:none;
+}
+button::before {
+  position: absolute;
+  content: "::before";
+  width: 10px;
+  height: 200em;
+  border: 1px solid black;
+}
+
+    </style>
+</head>
+<body>
+
+<button></button>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/1140216.html b/layout/forms/crashtests/1140216.html
new file mode 100644
index 000000000..72612b8b3
--- /dev/null
+++ b/layout/forms/crashtests/1140216.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+input { -moz-appearance: textfield; }
+
+</style>
+<script>
+
+function boom()
+{
+    window.getComputedStyle(x, "::-moz-number-spin-down").getPropertyValue("color");
+}
+
+</script>
+<body onload="boom();">
+<input type="number" id="x">
+</body>
+</html>
diff --git a/layout/forms/crashtests/1182414.html b/layout/forms/crashtests/1182414.html
new file mode 100644
index 000000000..5d15f3905
--- /dev/null
+++ b/layout/forms/crashtests/1182414.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-print">
+<head>
+<meta charset="UTF-8">
+<style type="text/css">
+#menu { position: fixed; left: 0px; top: 0px; }
+</style>
+</head>
+<body>
+	<svg id="canvas" width="2427" height="2295.5" version="1.1" xmlns="http://www.w3.org/2000/svg"></svg>
+
+<div id="menu">
+	<input id="chooseSize" type="range">
+</div>
+</body>
+</html>
+
diff --git a/layout/forms/crashtests/1212688.html b/layout/forms/crashtests/1212688.html
new file mode 100644
index 000000000..68262d907
--- /dev/null
+++ b/layout/forms/crashtests/1212688.html
@@ -0,0 +1,27 @@
+<style type="text/css">
+	optgroup {overflow-x: hidden;}
+</style>
+<select>
+  <optgroup label="optgroup">
+  <option>1</option>
+  <option>2</option>
+  <option>3</option>
+  <option>4</option>
+  <option>5</option>
+  <option>6</option>
+  <option>7</option>
+  <option>8</option>
+  <option>9</option>
+  <option>10</option>
+  <option>11</option>
+  <option>12</option>
+  <option>13</option>
+  <option>14</option>
+  <option>15</option>
+  <option>16</option>
+  <option>17</option>
+  <option>18</option>
+  <option>19</option>
+  <option>20</option>
+</optgroup>
+</select>
diff --git a/layout/forms/crashtests/1228670.xhtml b/layout/forms/crashtests/1228670.xhtml
new file mode 100644
index 000000000..cc8d309c0
--- /dev/null
+++ b/layout/forms/crashtests/1228670.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <body>
+        <select>
+            <optgroup style="display: list-item; list-style: inside;"></optgroup>
+        </select>
+    </body>
+</html>
diff --git a/layout/forms/crashtests/1279354.html b/layout/forms/crashtests/1279354.html
new file mode 100644
index 000000000..1f4f40942
--- /dev/null
+++ b/layout/forms/crashtests/1279354.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html class="reftest-print"><head>
+  <meta charset="utf-8">
+  <title>Testcase for bug 1279354</title>
+</head>
+<body>
+
+<div style="position:fixed"><progress></progress></div>
+1
+<br style="page-break-after: always">
+2
+<br style="page-break-after: always">
+3
+<br style="page-break-after: always">
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/166750-1.html b/layout/forms/crashtests/166750-1.html
new file mode 100644
index 000000000..d873be1b2
--- /dev/null
+++ b/layout/forms/crashtests/166750-1.html
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head><title>Killer</title></head>
+<body>
+	<form style="overflow: auto;">
+		<select style="position: fixed;">
+			<option>First</option>
+			<option>Second</option>
+			<option>Third</option>
+		</select>
+	</form>
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/200347-1.html b/layout/forms/crashtests/200347-1.html
new file mode 100644
index 000000000..b41ec8365
--- /dev/null
+++ b/layout/forms/crashtests/200347-1.html
@@ -0,0 +1,8 @@
+<html>
+  <body>
+    <fieldset style="width: 300px; position: fixed">
+	<legend>Crash test</legend>
+  <div style="float: right; background-color: orange; border: 1px solid black">Hello, my name is Inigo Montoya.</div> hello world content  is the best content around, I love hello world content to death, especially when it wraps; that just gives me the chills.  Anything less than hello world content is uncivilized.
+  </fieldset>
+  </body>
+</html>
diff --git a/layout/forms/crashtests/203041-1.html b/layout/forms/crashtests/203041-1.html
new file mode 100644
index 000000000..32d95b40e
--- /dev/null
+++ b/layout/forms/crashtests/203041-1.html
@@ -0,0 +1,24 @@
+<html>
+
+<head></head>
+
+<body>
+<form method="post" action="#" enctype="multipart/form-data" name="content">
+
+	<div id="sshot" style="position:absolute; left:0; top:70; width:600;
+visibility:visible">
+	<input type="file" name="sshot-1"  size="20">
+	</div>
+
+	<div id="comment" style="position:absolute; left:0; top:70; width:600;
+visibility:hidden"></div>
+
+	<script language="JavaScript">
+	<!--
+    document.documentElement.offsetHeight;
+		document.getElementById('sshot').style.display = 'none';
+		document.getElementById('comment').style.display = 'none';
+	// -->
+	</script>
+</form>
+</body></html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/213390-1.html b/layout/forms/crashtests/213390-1.html
new file mode 100644
index 000000000..0ff94ec54
--- /dev/null
+++ b/layout/forms/crashtests/213390-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd">
+
+<HTML>
+	<BODY>
+
+		<EMBED>
+
+		<TABLE>
+			<TR>
+			  <TD STYLE="FONT: 10px Arial;">
+				<A STYLE="FONT: 11px Arial;">1</A>
+			  </TD>
+			</TR>
+		</TABLE>
+
+		<DIV STYLE="POSITION: absolute;">
+			<FORM>
+				<SELECT STYLE="FONT: 11px Arial;">
+			</FORM>
+		</DIV>
+
+	</BODY>
+</HTML>
diff --git a/layout/forms/crashtests/258101-1.html b/layout/forms/crashtests/258101-1.html
new file mode 100644
index 000000000..245917cbf
--- /dev/null
+++ b/layout/forms/crashtests/258101-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+  <meta content="text/html; charset=ISO-8859-1"
+ http-equiv="content-type">
+  <title>Crash Testcase</title>
+  <script type="text/javascript">
+function crash()
+{
+  var inp = document.getElementById("theinp");
+  inp.type = "file";
+}
+  </script>
+</head>
+<body onload="crash();">
+<input id="theinp" type="text">
+</body>
+</html>
diff --git a/layout/forms/crashtests/266225-1.html b/layout/forms/crashtests/266225-1.html
new file mode 100644
index 000000000..c714125dd
--- /dev/null
+++ b/layout/forms/crashtests/266225-1.html
@@ -0,0 +1,7 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<FIELDSET STYLE="float:right; text-indent:999px;">Test</FIELDSET>
+</BODY>
+</HTML>
diff --git a/layout/forms/crashtests/310426-1.xhtml b/layout/forms/crashtests/310426-1.xhtml
new file mode 100644
index 000000000..683dba679
--- /dev/null
+++ b/layout/forms/crashtests/310426-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<body>
+
+<select><span style="position: absolute;" /></select>	
+
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/310520-1.xhtml b/layout/forms/crashtests/310520-1.xhtml
new file mode 100644
index 000000000..5a76a6de1
--- /dev/null
+++ b/layout/forms/crashtests/310520-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script><![CDATA[ 
+
+function init()
+{
+  var select = document.getElementsByTagName("select")[0];
+  select.parentNode.removeChild(select);
+}
+
+window.addEventListener("load", init, 0);
+
+]]></script>
+
+
+</head>
+<body><select><input/></select></body>
+</html>
diff --git a/layout/forms/crashtests/315752-1.xhtml b/layout/forms/crashtests/315752-1.xhtml
new file mode 100644
index 000000000..66d3d793d
--- /dev/null
+++ b/layout/forms/crashtests/315752-1.xhtml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html lang="en" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" xmlns:xml="http://www.w3.org/XML/1998/namespace">
+<head>
+<title>Settings - Unclassified NewsBoard</title>
+
+
+</head>
+<body>
+
+<select name="Language">
+	<option value="" style="clear: right;">
+				Automatic 	</option>
+	<option value="de" style="clear: right;">
+		<span alt="" style="float: right; margin-top: 1px;">		Deutsch</span> <small>(de)</small>	</option>
+	<option value="en" selected="selected" style="clear: right;">
+		<span alt="" style="float: right; margin-top: 1px;">		English</span> <small>(en)</small>	</option>
+</select>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/317502-1.xhtml b/layout/forms/crashtests/317502-1.xhtml
new file mode 100644
index 000000000..7ef5f0b4c
--- /dev/null
+++ b/layout/forms/crashtests/317502-1.xhtml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+	"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
+<head>
+	<title>Testcase, bug 317502</title>
+</head>
+<body onload="document.getElementsByTagName('input')[0].style.width='200px'">
+
+<input type="file" style="position: fixed" />
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/321894.html b/layout/forms/crashtests/321894.html
new file mode 100644
index 000000000..0a82645ba
--- /dev/null
+++ b/layout/forms/crashtests/321894.html
@@ -0,0 +1,17 @@
+<html><head>
+<title>
+Testcase bug 321894 - ASSERTION: RemovedAsPrimaryFrame called after PreDestroy: 'PR_FALSE'
+</title>
+</head>
+<body>
+This shouldn't assert in a debug build
+<span> 
+  <script>var x=document.body.offsetHeight;</script>
+  <div>
+    <span style="float:left;">
+      <input type="text">
+    </span>
+  </div>
+</span>
+</body>
+</html>
diff --git a/layout/forms/crashtests/323499-1.html b/layout/forms/crashtests/323499-1.html
new file mode 100644
index 000000000..bc015aa76
--- /dev/null
+++ b/layout/forms/crashtests/323499-1.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+
+<style>
+select {
+  visibility: collapse;
+}
+
+body {
+  display: -moz-grid-group;
+}
+
+</style>
+</head>
+
+<body>
+
+<select><option>a</option></select>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/343510-1.html b/layout/forms/crashtests/343510-1.html
new file mode 100644
index 000000000..00cb94f21
--- /dev/null
+++ b/layout/forms/crashtests/343510-1.html
@@ -0,0 +1,4 @@
+<select style="position: absolute;">
+<meta>
+<option style="position: absolute;">
+<body style="display: block;">
diff --git a/layout/forms/crashtests/363696-1.xul b/layout/forms/crashtests/363696-1.xul
new file mode 100644
index 000000000..19f938deb
--- /dev/null
+++ b/layout/forms/crashtests/363696-1.xul
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body>
+
+<xul:hbox>
+  <input type="file" />
+</xul:hbox>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/363696-2.html b/layout/forms/crashtests/363696-2.html
new file mode 100644
index 000000000..40883b304
--- /dev/null
+++ b/layout/forms/crashtests/363696-2.html
@@ -0,0 +1,2 @@
+<div  style="display: -moz-grid-line;">
+<input type="file">
\ No newline at end of file
diff --git a/layout/forms/crashtests/363696-3.html b/layout/forms/crashtests/363696-3.html
new file mode 100644
index 000000000..e1d38076e
--- /dev/null
+++ b/layout/forms/crashtests/363696-3.html
@@ -0,0 +1,5 @@
+<html><head></head><body>
+
+<span style="display: -moz-box;"><input type="file"><textarea></textarea></span>
+
+</body></html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/366205-1.html b/layout/forms/crashtests/366205-1.html
new file mode 100644
index 000000000..2a3786afe
--- /dev/null
+++ b/layout/forms/crashtests/366205-1.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+</head>
+<body onload='var yar=document.getElementById("yar"); yar.parentNode.removeChild(yar); document.getElementById("foo").removeAttribute("multiple");'>
+
+<div id="yar">Clicking the button below should not trigger an assertion</div>
+
+<select id="foo" multiple><option>A</option></select>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/366537-1.xhtml b/layout/forms/crashtests/366537-1.xhtml
new file mode 100644
index 000000000..b799cd2ca
--- /dev/null
+++ b/layout/forms/crashtests/366537-1.xhtml
@@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+
+function boom()
+{
+  var fieldset = document.getElementById("fieldset");
+  var h3 = document.getElementById("h3");
+  var legend = document.getElementById("legend");
+
+  fieldset.appendChild(legend);
+  fieldset.appendChild(h3);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+
+<body onload="setTimeout(boom, 30);">
+
+<legend id="legend">legend</legend>
+
+<h3 id="h3">H3</h3>
+
+<select><option>option<fieldset id="fieldset"></fieldset></option></select>
+
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/367587-1.html b/layout/forms/crashtests/367587-1.html
new file mode 100644
index 000000000..8f55ec458
--- /dev/null
+++ b/layout/forms/crashtests/367587-1.html
@@ -0,0 +1,37 @@
+<html class="reftest-wait">
+<head>
+
+<style>
+
+#opt1 { display: table-footer-group; }
+#opt1 { visibility: collapse; }
+#opt1 { overflow: -moz-scrollbars-vertical; }
+
+#opt2 { display: table-cell; }
+#opt2 { clear: left; }
+
+select { width: 1px; }
+
+</style>
+
+<script>
+
+function boom()
+{
+  document.getElementById("opt2").style.clear = "none";
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<select multiple>
+<option id="opt1">A</option>
+<option id="opt2">B</option>
+</select>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/370703-1.html b/layout/forms/crashtests/370703-1.html
new file mode 100644
index 000000000..b447b180b
--- /dev/null
+++ b/layout/forms/crashtests/370703-1.html
@@ -0,0 +1,30 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("M").style.width = "6em";
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<body onload="setTimeout(boom, 30);">
+
+<div style="position:absolute; top: 50px; left: 50px; border: 2px solid orange;">
+
+  <select>
+    <option id="M">M</option>
+  </select>
+ 
+  <br>
+ 
+  <select style="width: 200%">
+    <option style="visibility: collapse; overflow: auto; display: table-footer-group;">X</option>
+  </select>
+ 
+</div>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/370940-1.html b/layout/forms/crashtests/370940-1.html
new file mode 100644
index 000000000..ccaeb9643
--- /dev/null
+++ b/layout/forms/crashtests/370940-1.html
@@ -0,0 +1,28 @@
+<html class="reftest-wait">
+<head>
+<script>
+  
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+
+function boom1()
+{
+  var newSpan = document.createElementNS(HTML_NS, "span");
+  document.body.appendChild(newSpan);
+  
+  setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+  var newDiv = document.createElementNS(HTML_NS, "div");
+  document.getElementById("s").appendChild(newDiv);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="setTimeout(boom1, 30);">
+ <p>العربي</p>
+ <span id="s"></span><input><select></select><isindex><span></span>
+</body>
+</html>
diff --git a/layout/forms/crashtests/370967.html b/layout/forms/crashtests/370967.html
new file mode 100644
index 000000000..be7854b41
--- /dev/null
+++ b/layout/forms/crashtests/370967.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+
+<html>
+<head>
+<title>Untitled</title>
+</head>
+<body>
+Focus the input of the isindex, then do a reload, Mozilla should not crash
+<isindex autofocus>
+</label>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/373586-1.xhtml b/layout/forms/crashtests/373586-1.xhtml
new file mode 100644
index 000000000..070315d15
--- /dev/null
+++ b/layout/forms/crashtests/373586-1.xhtml
@@ -0,0 +1,40 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="foo">
+    <content>
+      <children xmlns="http://www.mozilla.org/xbl" />
+    </content>
+  </binding>
+</bindings>
+
+<script>
+function boom()
+{
+  document.getElementById("div").style.MozBinding = "url('#foo')";
+
+  var opt1 = document.getElementById("opt1");
+  opt1.removeChild(opt1.firstChild);
+
+  document.getElementById("textarea").value += " ";
+  
+  document.documentElement.removeAttribute("class")
+}
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<div id="div">
+  <textarea rows="3" cols="5" id="textarea"></textarea>
+</div>
+
+<select>
+  <option id="opt1">opt1</option>
+</select>
+
+</body>
+</html>
+
diff --git a/layout/forms/crashtests/375299-binding.xml b/layout/forms/crashtests/375299-binding.xml
new file mode 100644
index 000000000..ca76a3389
--- /dev/null
+++ b/layout/forms/crashtests/375299-binding.xml
@@ -0,0 +1,4 @@
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a">
+<content><children/></content>
+</binding></bindings>
\ No newline at end of file
diff --git a/layout/forms/crashtests/375299.html b/layout/forms/crashtests/375299.html
new file mode 100644
index 000000000..fd43d1c63
--- /dev/null
+++ b/layout/forms/crashtests/375299.html
@@ -0,0 +1,17 @@
+<html><head>
+<title>Testcase bug - Crash [@ nsFileControlFrame::CreateAnonymousContent] when removing stylesheet with binding and removing file input</title>
+<style>
+body {-moz-binding:url("375299-binding.xml#a"); }
+</style>
+</head><body onload="doe()">
+<input type="file">
+
+<script>
+function doe() {
+var x=document.getElementsByTagName('input')[0];
+x.parentNode.removeChild(x);
+var y=document.getElementsByTagName('style')[0];
+y.parentNode.removeChild(y);
+}
+</script>
+</body></html>
diff --git a/layout/forms/crashtests/378369.html b/layout/forms/crashtests/378369.html
new file mode 100644
index 000000000..90327735e
--- /dev/null
+++ b/layout/forms/crashtests/378369.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<title>Testcase bug - Crash [@ nsEventListenerManager::FixContextMenuEvent] when firing contextmenu event in display: none iframe</title>
+</head>
+<body>
+This page should not crash Mozilla
+<iframe style="display: none;"></iframe>
+
+<script>
+function docontextmenu(i){
+var doc = window.frames[0].document;
+  var ev = doc.createEvent ('MouseEvents'); 
+  ev.initMouseEvent('contextmenu', true,true, window, 3,5, 5, 400, 400, 0, 0, 0,0,0,null);
+  doc.dispatchEvent(ev);
+}
+setTimeout(docontextmenu,0);
+</script>
+</body>
+</html>
diff --git a/layout/forms/crashtests/378413-1.xhtml b/layout/forms/crashtests/378413-1.xhtml
new file mode 100644
index 000000000..c9ca6990a
--- /dev/null
+++ b/layout/forms/crashtests/378413-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="direction: rtl;">
+
+<form style="display: -moz-deck; width: 1em;">
+<fieldset>
+  <legend>Your name</legend>
+  <input type="text" name="name" size="20"/>
+</fieldset>
+<fieldset>
+  <legend>Your E-mail address</legend>
+  <input type="text" name="email" size="25"/>
+</fieldset>
+</form>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/380116-1.xhtml b/layout/forms/crashtests/380116-1.xhtml
new file mode 100644
index 000000000..cb37ff079
--- /dev/null
+++ b/layout/forms/crashtests/380116-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.getElementById('t').style.display = 'block';">
+
+<table border="1" id="t">
+ <tr>
+  <td><select><option>foopy</option></select></td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/382212-1.xhtml b/layout/forms/crashtests/382212-1.xhtml
new file mode 100644
index 000000000..46c957989
--- /dev/null
+++ b/layout/forms/crashtests/382212-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <body>
+    <div>
+      <xul:textbox><select><option>foo</option></select></xul:textbox>
+    </div>
+  </body>
+</html>
diff --git a/layout/forms/crashtests/382610-1.html b/layout/forms/crashtests/382610-1.html
new file mode 100644
index 000000000..9fe9c5b5c
--- /dev/null
+++ b/layout/forms/crashtests/382610-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="position: absolute">
+  <input type="file" style="position: absolute; -moz-appearance: menulist;">
+</div>
+
+</body>
+</html>
+
diff --git a/layout/forms/crashtests/383887-1.html b/layout/forms/crashtests/383887-1.html
new file mode 100644
index 000000000..65d4751f7
--- /dev/null
+++ b/layout/forms/crashtests/383887-1.html
@@ -0,0 +1,20 @@
+<html>
+<body>
+
+<table>
+  <tr>
+    <td>
+      <select>
+        <option style="padding: 200%;">
+      </select>
+    </td>
+  </tr>
+  <tr>
+    <td>
+      <div style="padding: 200%"><span style="float: left; border: 1px solid red;"></span></div>
+    </td>
+  </tr>
+</table>
+ 
+</body>
+</html>
diff --git a/layout/forms/crashtests/386554-1.html b/layout/forms/crashtests/386554-1.html
new file mode 100644
index 000000000..585f1e5b5
--- /dev/null
+++ b/layout/forms/crashtests/386554-1.html
@@ -0,0 +1,14 @@
+<html>
+<head></head>
+
+<body>
+
+<div style="position: absolute"><input id="input" type="file" style="top: 100%"></div>
+
+<script>
+document.body.offsetHeight;
+document.getElementById("input").style.position = "absolute";
+</script>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/388374-1.xhtml b/layout/forms/crashtests/388374-1.xhtml
new file mode 100644
index 000000000..2a871f68b
--- /dev/null
+++ b/layout/forms/crashtests/388374-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var newText = document.createTextNode('x');
+  document.getElementById("a").parentNode.appendChild(newText);
+}
+</script>
+</head>
+
+<body onload="boom()">
+
+<table border="1">
+ <tr>
+  <td>1</td>
+  <td id="a" style="padding-left: 10%"><select style="padding-left: 20%; bottom: 10%;"><option style="padding: 0 0 10% 20%;">pppp</option></select></td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/388374-2.html b/layout/forms/crashtests/388374-2.html
new file mode 100644
index 000000000..81918c37c
--- /dev/null
+++ b/layout/forms/crashtests/388374-2.html
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var newDiv = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  newDiv.style.width = "100px";
+  newDiv.style.height = "8px";
+  newDiv.style.background = "lightgreen";
+  document.getElementById("tr").appendChild(newDiv);
+}
+</script>
+</head>
+
+<body onload="boom()">
+
+<table border="1">
+ <tr id="tr">
+  <td></td>
+  <td style="padding-left: 10%"><select style="padding-left: 20%; bottom: 10%;"><option style="padding: 0 0 10% 20%; width: 25px;"></option></select></td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/393656-1.xhtml b/layout/forms/crashtests/393656-1.xhtml
new file mode 100644
index 000000000..22a9326c5
--- /dev/null
+++ b/layout/forms/crashtests/393656-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+ <select style="float: right; clear: right;">
+    <option><a style="float: right;"></a></option>
+    <option style="margin: 100%;"></option>
+    <option><div style="clear: both"></div></option>
+  </select>
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/393656-2.xhtml b/layout/forms/crashtests/393656-2.xhtml
new file mode 100644
index 000000000..7d9adaf20
--- /dev/null
+++ b/layout/forms/crashtests/393656-2.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+  <div style="overflow: hidden;">
+    <div style="float: right;"><span>XXX</span></div>
+    <select style="float: right; clear: right;">
+      <option><a style="float: right;"></a></option>
+      <option style="margin: 100%;"></option>
+      <option><div style="clear: both"></div></option>
+    </select>
+    <dl style="float: left;"></dl>
+    <div>
+      <div style="float: left;"></div>
+      <div style="display: block; clear: both"></div>
+      <dl style="float: left;"></dl>
+    </div>
+  </div>
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/399262.html b/layout/forms/crashtests/399262.html
new file mode 100644
index 000000000..77bc0a16d
--- /dev/null
+++ b/layout/forms/crashtests/399262.html
@@ -0,0 +1,50 @@
+<style>
+select::first-letter, option::first-letter { color:green; }
+.block select, .block option{ display:block; }
+.scroll select, .scroll option{ display:block; overflow:hidden; }
+</style>
+
+<select></select>
+<select>F</select>
+<select>Ff</select>
+<select><option>F</select>
+<select><option>Ff</select>
+
+<div class="block">
+<select></select>
+<select>F</select>
+<select>Ff</select>
+<select><option>F</select>
+<select><option>Ff</select>
+</div>
+
+<div class="scroll">
+<select></select>
+<select>F</select>
+<select>Ff</select>
+<select><option>F</select>
+<select><option>Ff</select>
+</div>
+
+<select size=2></select>
+<select size=2>F</select>
+<select size=2>Ff</select>
+<select size=2><option>F</select>
+<select size=2><option>Ff</select>
+
+<div class="block">
+<select size=2></select>
+<select size=2>F</select>
+<select size=2>Ff</select>
+<select size=2><option>F</select>
+<select size=2><option>Ff</select>
+</div>
+
+<div class="scroll">
+<select size=2></select>
+<select size=2>F</select>
+<select size=2>Ff</select>
+<select size=2><option>F</select>
+<select size=2><option>Ff</select>
+</div>
+
diff --git a/layout/forms/crashtests/402852-1.html b/layout/forms/crashtests/402852-1.html
new file mode 100644
index 000000000..e5ba9adb1
--- /dev/null
+++ b/layout/forms/crashtests/402852-1.html
@@ -0,0 +1,2 @@
+<body style="text-indent: 99999999999999999999px;">
+<fieldset>
diff --git a/layout/forms/crashtests/403148-1.html b/layout/forms/crashtests/403148-1.html
new file mode 100644
index 000000000..cfb38fdb1
--- /dev/null
+++ b/layout/forms/crashtests/403148-1.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("ce").contentEditable = true;
+  document.documentElement.offsetHeight;
+  document.getElementById("finput").setAttribute("type", "");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<input id="finput" type="file" disabled>
+
+<span id="ce"></span>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/404118-1.html b/layout/forms/crashtests/404118-1.html
new file mode 100644
index 000000000..40a2ac72b
--- /dev/null
+++ b/layout/forms/crashtests/404118-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<input type="file" style="position: fixed; height: 0; width: 10px; white-space: normal;">
+</body>
+</html>
diff --git a/layout/forms/crashtests/404123-1.html b/layout/forms/crashtests/404123-1.html
new file mode 100644
index 000000000..73fbaa363
--- /dev/null
+++ b/layout/forms/crashtests/404123-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<fieldset>
+<legend style="padding: 0pt 100%;"></legend>
+</fieldset>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/407066.html b/layout/forms/crashtests/407066.html
new file mode 100644
index 000000000..64a3739ea
--- /dev/null
+++ b/layout/forms/crashtests/407066.html
@@ -0,0 +1 @@
+<div style="display: inline-block; -moz-column-count: 2;">text<input type="reset" style="float: right;">
diff --git a/layout/forms/crashtests/451316.html b/layout/forms/crashtests/451316.html
new file mode 100644
index 000000000..77f5d5517
--- /dev/null
+++ b/layout/forms/crashtests/451316.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="-moz-column-width: 1px;"><select style="height: 12em; display: block;"></select></div>
+<div style="-moz-column-width: 1px;"><select multiple style="height: 12em; display: block;"></select></div>
+</body>
+</html>
diff --git a/layout/forms/crashtests/455451-1.html b/layout/forms/crashtests/455451-1.html
new file mode 100644
index 000000000..09ee84aad
--- /dev/null
+++ b/layout/forms/crashtests/455451-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  window.addEventListener("DOMCharacterDataModified", function(){}, false);
+  document.body.appendChild(document.createElement("isindex"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/forms/crashtests/457537-1.html b/layout/forms/crashtests/457537-1.html
new file mode 100644
index 000000000..f6fa2fb05
--- /dev/null
+++ b/layout/forms/crashtests/457537-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html> 
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  window.addEventListener("DOMAttrModified", function(){}, false);
+  document.body.appendChild(document.createElement("input"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/forms/crashtests/457537-2.html b/layout/forms/crashtests/457537-2.html
new file mode 100644
index 000000000..48bf1e73e
--- /dev/null
+++ b/layout/forms/crashtests/457537-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html> 
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  window.addEventListener("DOMAttrModified", function(){}, false);
+  document.body.appendChild(document.createElement("isindex"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/forms/crashtests/478219-1.xhtml b/layout/forms/crashtests/478219-1.xhtml
new file mode 100644
index 000000000..47144e649
--- /dev/null
+++ b/layout/forms/crashtests/478219-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<div>
+<xul:textbox onDOMAttrModified="this.parentNode.removeChild(this)">
+<mathml:mathml/>
+</xul:textbox>
+</div>
+</html>
diff --git a/layout/forms/crashtests/498698-1.html b/layout/forms/crashtests/498698-1.html
new file mode 100644
index 000000000..fa8e2e17a
--- /dev/null
+++ b/layout/forms/crashtests/498698-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<select style="height: 3401091640591pc"></select>
+</body>
+</html>
diff --git a/layout/forms/crashtests/513113-1.html b/layout/forms/crashtests/513113-1.html
new file mode 100644
index 000000000..36f3974a1
--- /dev/null
+++ b/layout/forms/crashtests/513113-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html><body onload="document.body.style.display = 'table';" style="-moz-column-count: 1; white-space: pre-line; -moz-appearance: resizer; height: 23698324514pc;">
+
+
+
+<input></body></html>
diff --git a/layout/forms/crashtests/538062-1.xhtml b/layout/forms/crashtests/538062-1.xhtml
new file mode 100644
index 000000000..431f7ab84
--- /dev/null
+++ b/layout/forms/crashtests/538062-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  var option = document.getElementsByTagName("option")[0];
+  var b = option.firstChild;
+  option.appendChild(document.createTextNode("\u064A"));
+  document.documentElement.offsetHeight;
+  option.removeChild(b);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><select><option>B </option></select></body>
+</html>
diff --git a/layout/forms/crashtests/570624-1.html b/layout/forms/crashtests/570624-1.html
new file mode 100644
index 000000000..47a277728
--- /dev/null
+++ b/layout/forms/crashtests/570624-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var xt = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'textbox');
+  document.body.appendChild(xt);
+  xt.setAttribute('disabled', "true");
+  xt.setAttribute('value', "foo");
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/layout/forms/crashtests/578604-1.html b/layout/forms/crashtests/578604-1.html
new file mode 100644
index 000000000..d934c454d
--- /dev/null
+++ b/layout/forms/crashtests/578604-1.html
@@ -0,0 +1,17 @@
+<html class="reftest-print">
+<head>
+<style>
+   h2 { page-break-before: always; }
+   #reviewer { position: fixed;}
+</style>
+</head>
+
+<body>
+
+<h2>Crash Test Case</h2>
+<div>
+<input id='reviewer'>
+</div>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/590302-1.xhtml b/layout/forms/crashtests/590302-1.xhtml
new file mode 100644
index 000000000..339a424f7
--- /dev/null
+++ b/layout/forms/crashtests/590302-1.xhtml
@@ -0,0 +1,4 @@
+<html class="reftest-print" xmlns="http://www.w3.org/1999/xhtml" style=" float: left; white-space: pre; ">
+<div style="page-break-before: always;"></div>
+<textarea style="position: fixed;"></textarea>
+</html>
diff --git a/layout/forms/crashtests/626014.xhtml b/layout/forms/crashtests/626014.xhtml
new file mode 100644
index 000000000..05a2361d3
--- /dev/null
+++ b/layout/forms/crashtests/626014.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+  document.getElementById("i").selectionEnd;
+  document.getElementById("a").appendChild(document.getElementById("b"));
+}
+
+]]>
+</script>
+</head>
+<body onload="boom();">
+
+<mrow xmlns="http://www.w3.org/1998/Math/MathML" id="a"><mrow id="b"/><input xmlns="http://www.w3.org/1999/xhtml" id="i" /></mrow>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/639733.xhtml b/layout/forms/crashtests/639733.xhtml
new file mode 100644
index 000000000..51c46df6c
--- /dev/null
+++ b/layout/forms/crashtests/639733.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function remove(n)
+{
+  n.parentNode.removeChild(n);
+}
+
+function boom()
+{
+  
+  document.documentElement.offsetHeight;
+  remove(document.getElementById("s"));
+  remove(document.getElementById("e"));
+  document.documentElement.offsetHeight;
+}
+
+]]>
+</script>
+</head>
+<body onload="boom();">
+<embed id="e" src="data:text/html,A"></embed><span id="s"><div></div></span><isindex/>
+</body>
+</html>
diff --git a/layout/forms/crashtests/669767.html b/layout/forms/crashtests/669767.html
new file mode 100644
index 000000000..f41a9125c
--- /dev/null
+++ b/layout/forms/crashtests/669767.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<title>Untitled</title>
+
+
+</head>
+<body>
+<iframe src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%0A%3Ctextarea%3E%3C/textarea%3E%0A%0A%0A%3Cstyle%3E%0A@font-face%20%7B%0A%20%20%20%20%20%20font-family%3A%20%22cutabovetherest%22%3B%0A%20%20%20%20%20%20src%3A%20url%28%22http%3A//www.webpagepublicity.com/free-fonts/a/A%2520Cut%2520Above%2520The%2520Rest.ttf%22%29%3B%0A%7D%20%20%20%20%0A%0A%3C/style%3E%0A%0A%3Coptgroup%20contenteditable%3D%22true%22%20style%3D%22display%3A%20inline%3B%22%3E%3C/optgroup%3E%0A%0A%3C/body%3E%3C/html%3E"></iframe>
+<script>
+
+
+</script>
+</body>
+</html>
diff --git a/layout/forms/crashtests/682684-binding.xml b/layout/forms/crashtests/682684-binding.xml
new file mode 100644
index 000000000..910eec33c
--- /dev/null
+++ b/layout/forms/crashtests/682684-binding.xml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<style>html::before { content:"b"; }</style>
+<input contenteditable="true" spellcheck="true"/>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/682684.xhtml b/layout/forms/crashtests/682684.xhtml
new file mode 100644
index 000000000..2b7b2c83f
--- /dev/null
+++ b/layout/forms/crashtests/682684.xhtml
@@ -0,0 +1,3 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<span style="mask: url(682684-binding.xml#a);"/>
+</html>
diff --git a/layout/forms/crashtests/865602.html b/layout/forms/crashtests/865602.html
new file mode 100644
index 000000000..b7048d955
--- /dev/null
+++ b/layout/forms/crashtests/865602.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html><body>
+
+<div style="-moz-column-count: 2;"><fieldset style="transform-style: preserve-3d;"><fieldset style="white-space: pre-line; position: fixed;"><div style="position: fixed;">
+
+
+</div></fieldset></fieldset></div>
+
+</body></html>
diff --git a/layout/forms/crashtests/893332-1.html b/layout/forms/crashtests/893332-1.html
new file mode 100644
index 000000000..1cd17c0b1
--- /dev/null
+++ b/layout/forms/crashtests/893332-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="UTF-8">
+  </head>
+  <body>
+    <input min="-10" max="10" step="0.1" type="range" value="-5"/>
+    <input max="50" min="10" step="2" type="range" value="7"/>
+  </body>
+</html>
diff --git a/layout/forms/crashtests/944198.html b/layout/forms/crashtests/944198.html
new file mode 100644
index 000000000..0da7bc54d
--- /dev/null
+++ b/layout/forms/crashtests/944198.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body onload="c.removeAttribute('type'); c.removeAttribute('value');">
+<input id="c" type="color">
+</body>
+</html>
diff --git a/layout/forms/crashtests/949891.xhtml b/layout/forms/crashtests/949891.xhtml
new file mode 100644
index 000000000..8fbfe1e42
--- /dev/null
+++ b/layout/forms/crashtests/949891.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<input type="number"> </input>
+</body>
+</html>
diff --git a/layout/forms/crashtests/959311.html b/layout/forms/crashtests/959311.html
new file mode 100644
index 000000000..c646b84f7
--- /dev/null
+++ b/layout/forms/crashtests/959311.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-print">
+<head>
+<meta charset="utf-8">
+<style type="text/css">
+@page { size:5in 3in; margin:0in; }
+div { height: 2.5in; }
+select { height: 0.5in; display:block; padding:20px; page-break-inside:initial; }
+</style>
+</head>
+<body>
+    <div></div>
+    <select>
+      <option>Text</option>
+    </select>
+  </body>
+</html>
diff --git a/layout/forms/crashtests/960277-2.html b/layout/forms/crashtests/960277-2.html
new file mode 100644
index 000000000..ea771ae79
--- /dev/null
+++ b/layout/forms/crashtests/960277-2.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML>
+<style>
+#d { overflow:scroll; width:200px; height:200px; background:yellow; }
+#d2 { right:0; width:100px; height:100px; background:purple; }
+</style>
+<fieldset id="d">
+  <div id="d2"></div>
+</fieldset>
+<script>
+d.getBoundingClientRect();
+d.style.transform = "translateX(100px)";
+d.getBoundingClientRect();
+d2.style.position = "absolute";
+</script>
diff --git a/layout/forms/crashtests/997709-1.html b/layout/forms/crashtests/997709-1.html
new file mode 100644
index 000000000..31d048407
--- /dev/null
+++ b/layout/forms/crashtests/997709-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE HTML>
+<html class="reftest-print"><body><div style="position: fixed;">
+<div style="page-break-after: always"></div>
+<select style="display:flex; position: fixed;"><option>A</select>
+</div></body></html>
diff --git a/layout/forms/crashtests/crashtests.list b/layout/forms/crashtests/crashtests.list
new file mode 100644
index 000000000..462ff35cf
--- /dev/null
+++ b/layout/forms/crashtests/crashtests.list
@@ -0,0 +1,69 @@
+load 166750-1.html
+load 200347-1.html
+load 203041-1.html
+load 213390-1.html
+load 258101-1.html
+load 266225-1.html
+load 310426-1.xhtml
+load 310520-1.xhtml
+load 315752-1.xhtml
+load 317502-1.xhtml
+load 321894.html
+load 323499-1.html
+load 343510-1.html
+load 363696-1.xul
+load 363696-2.html
+load 363696-3.html
+load 366205-1.html
+load 366537-1.xhtml
+load 367587-1.html
+load 370703-1.html
+load 370940-1.html
+load 370967.html
+load 373586-1.xhtml
+load 375299.html
+load 378369.html
+asserts(4-10) load 378413-1.xhtml # bug 424225, bug 402850?
+load 380116-1.xhtml
+load 382212-1.xhtml
+load 382610-1.html
+load 383887-1.html
+load 386554-1.html
+load 388374-1.xhtml
+load 388374-2.html
+load 393656-1.xhtml
+load 393656-2.xhtml
+load 399262.html
+load 402852-1.html
+load 403148-1.html
+load 404118-1.html
+load 404123-1.html
+load 407066.html
+load 451316.html
+load 455451-1.html
+load 457537-1.html
+load 457537-2.html
+load 478219-1.xhtml
+load 498698-1.html
+load 513113-1.html
+load 538062-1.xhtml
+load 570624-1.html
+asserts(1) load 578604-1.html # bug 584564
+asserts(4-7) load 590302-1.xhtml # bug 584564
+load 626014.xhtml
+load 639733.xhtml
+load 669767.html
+load 682684.xhtml
+load 865602.html
+load 893332-1.html
+load 944198.html
+load 949891.xhtml
+load 959311.html
+load 960277-2.html
+load 997709-1.html
+load 1102791.html
+load 1140216.html
+load 1182414.html
+load 1212688.html
+load 1228670.xhtml
+load 1279354.html
-- 
cgit v1.2.3