From 5f8de423f190bbb79a62f804151bc24824fa32d8 Mon Sep 17 00:00:00 2001
From: "Matt A. Tobin" <mattatobin@localhost.localdomain>
Date: Fri, 2 Feb 2018 04:16:08 -0500
Subject: Add m-esr52 at 52.6.0

---
 layout/xul/crashtests/131008-1.xul           |  11 ++
 layout/xul/crashtests/137216-1.xul           |   4 +
 layout/xul/crashtests/140218-1.xml           |   4 +
 layout/xul/crashtests/151826-1.xul           |  27 +++
 layout/xul/crashtests/168724-1.xul           |  18 ++
 layout/xul/crashtests/189814-1.xul           |  21 +++
 layout/xul/crashtests/237787-1.xul           |   9 +
 layout/xul/crashtests/265161-1.xul           |   9 +
 layout/xul/crashtests/289410-1.xul           |  14 ++
 layout/xul/crashtests/290743.html            |   6 +
 layout/xul/crashtests/291702-1.xul           |  11 ++
 layout/xul/crashtests/291702-2.xul           |  11 ++
 layout/xul/crashtests/291702-3.xul           | 137 +++++++++++++++
 layout/xul/crashtests/294371-1.xul           |  53 ++++++
 layout/xul/crashtests/311457-1.html          |  12 ++
 layout/xul/crashtests/321056-1.xhtml         |  10 ++
 layout/xul/crashtests/322786-1.xul           |   6 +
 layout/xul/crashtests/325377.xul             |  16 ++
 layout/xul/crashtests/326834-1-inner.xul     |  17 ++
 layout/xul/crashtests/326834-1.html          |   9 +
 layout/xul/crashtests/326879-1.xul           |  31 ++++
 layout/xul/crashtests/327776-1.xul           |  24 +++
 layout/xul/crashtests/328135-1.xul           |  27 +++
 layout/xul/crashtests/329327-1.xul           |   2 +
 layout/xul/crashtests/329407-1.xml           |  14 ++
 layout/xul/crashtests/329477-1.xhtml         |  31 ++++
 layout/xul/crashtests/336962-1.xul           |  17 ++
 layout/xul/crashtests/344228-1.xul           |  27 +++
 layout/xul/crashtests/346083-1.xul           |  13 ++
 layout/xul/crashtests/346281-1.xul           |  17 ++
 layout/xul/crashtests/350460.xul             |   8 +
 layout/xul/crashtests/360642-1.xul           |   9 +
 layout/xul/crashtests/365151.xul             |  39 +++++
 layout/xul/crashtests/366112-1.xul           |   9 +
 layout/xul/crashtests/366203-1.xul           |  40 +++++
 layout/xul/crashtests/367185-1.xhtml         |  11 ++
 layout/xul/crashtests/369942-1.xhtml         |  36 ++++
 layout/xul/crashtests/374102-1.xul           |   5 +
 layout/xul/crashtests/376137-1.html          |  18 ++
 layout/xul/crashtests/376137-2.html          |  11 ++
 layout/xul/crashtests/377592-1.svg           |  27 +++
 layout/xul/crashtests/378961.html            |   9 +
 layout/xul/crashtests/381862.html            |  23 +++
 layout/xul/crashtests/382746-1.xul           |  15 ++
 layout/xul/crashtests/382899-1.xul           |   9 +
 layout/xul/crashtests/383236-1.xul           |   5 +
 layout/xul/crashtests/384037-1.xhtml         |   9 +
 layout/xul/crashtests/384105-1-inner.xul     |  21 +++
 layout/xul/crashtests/384105-1.html          |   9 +
 layout/xul/crashtests/384373-1.xul           |  10 ++
 layout/xul/crashtests/384373-2.xul           |   4 +
 layout/xul/crashtests/384373.html            |  23 +++
 layout/xul/crashtests/384491-1.xhtml         |   8 +
 layout/xul/crashtests/384871-1-inner.xul     |   9 +
 layout/xul/crashtests/384871-1.html          |   9 +
 layout/xul/crashtests/386642.xul             |  31 ++++
 layout/xul/crashtests/387033-1.xhtml         |  31 ++++
 layout/xul/crashtests/387080-1.xul           |   6 +
 layout/xul/crashtests/391974-1-inner.xul     |  19 +++
 layout/xul/crashtests/391974-1.html          |   9 +
 layout/xul/crashtests/394120-1.xhtml         |  19 +++
 layout/xul/crashtests/397293.xhtml           |  21 +++
 layout/xul/crashtests/397304-1.html          |   1 +
 layout/xul/crashtests/398326-1.xhtml         |  17 ++
 layout/xul/crashtests/399013.xul             |  31 ++++
 layout/xul/crashtests/400779-1.xhtml         |  16 ++
 layout/xul/crashtests/402912-1.xhtml         |   5 +
 layout/xul/crashtests/404192.xhtml           |  12 ++
 layout/xul/crashtests/407152.xul             |   7 +
 layout/xul/crashtests/408904-1.xul           |   1 +
 layout/xul/crashtests/412479-1.xhtml         |   4 +
 layout/xul/crashtests/415394-1.xhtml         |  28 ++++
 layout/xul/crashtests/417509.xul             |   7 +
 layout/xul/crashtests/420424-1.xul           |   6 +
 layout/xul/crashtests/430356-1.xhtml         |   5 +
 layout/xul/crashtests/431738.xhtml           |   7 +
 layout/xul/crashtests/432058-1.xul           |  31 ++++
 layout/xul/crashtests/432068-1.xul           |  31 ++++
 layout/xul/crashtests/432068-2.xul           |  24 +++
 layout/xul/crashtests/433296-1.xul           |   5 +
 layout/xul/crashtests/433429.xul             |  23 +++
 layout/xul/crashtests/434458-1.xul           |  20 +++
 layout/xul/crashtests/452185.html            |   3 +
 layout/xul/crashtests/452185.xml             |   5 +
 layout/xul/crashtests/460900-1.xul           |   3 +
 layout/xul/crashtests/464149-1.xul           |  24 +++
 layout/xul/crashtests/464407-1.xhtml         |   9 +
 layout/xul/crashtests/467080.xul             |  24 +++
 layout/xul/crashtests/467481-1.xul           |   6 +
 layout/xul/crashtests/470063-1.html          |  15 ++
 layout/xul/crashtests/470272.html            |  21 +++
 layout/xul/crashtests/472189.xul             |  13 ++
 layout/xul/crashtests/475133.html            |  20 +++
 layout/xul/crashtests/488210-1.xhtml         |  19 +++
 layout/xul/crashtests/495728-1.xul           | 239 +++++++++++++++++++++++++++
 layout/xul/crashtests/508927-1.xul           |   6 +
 layout/xul/crashtests/508927-2.xul           |   6 +
 layout/xul/crashtests/514300-1.xul           |  14 ++
 layout/xul/crashtests/536931-1.xhtml         |   4 +
 layout/xul/crashtests/538308-1.xul           |  32 ++++
 layout/xul/crashtests/557174-1.xml           |   1 +
 layout/xul/crashtests/564705-1.xul           |   6 +
 layout/xul/crashtests/583957-1.html          |  20 +++
 layout/xul/crashtests/617089.html            |   9 +
 layout/xul/crashtests/716503.html            |  11 ++
 layout/xul/crashtests/crashtests.list        |  99 +++++++++++
 layout/xul/crashtests/menulist-focused.xhtml |   5 +
 107 files changed, 2015 insertions(+)
 create mode 100644 layout/xul/crashtests/131008-1.xul
 create mode 100644 layout/xul/crashtests/137216-1.xul
 create mode 100644 layout/xul/crashtests/140218-1.xml
 create mode 100644 layout/xul/crashtests/151826-1.xul
 create mode 100644 layout/xul/crashtests/168724-1.xul
 create mode 100644 layout/xul/crashtests/189814-1.xul
 create mode 100644 layout/xul/crashtests/237787-1.xul
 create mode 100644 layout/xul/crashtests/265161-1.xul
 create mode 100644 layout/xul/crashtests/289410-1.xul
 create mode 100644 layout/xul/crashtests/290743.html
 create mode 100644 layout/xul/crashtests/291702-1.xul
 create mode 100644 layout/xul/crashtests/291702-2.xul
 create mode 100644 layout/xul/crashtests/291702-3.xul
 create mode 100644 layout/xul/crashtests/294371-1.xul
 create mode 100644 layout/xul/crashtests/311457-1.html
 create mode 100644 layout/xul/crashtests/321056-1.xhtml
 create mode 100644 layout/xul/crashtests/322786-1.xul
 create mode 100644 layout/xul/crashtests/325377.xul
 create mode 100644 layout/xul/crashtests/326834-1-inner.xul
 create mode 100644 layout/xul/crashtests/326834-1.html
 create mode 100644 layout/xul/crashtests/326879-1.xul
 create mode 100644 layout/xul/crashtests/327776-1.xul
 create mode 100644 layout/xul/crashtests/328135-1.xul
 create mode 100644 layout/xul/crashtests/329327-1.xul
 create mode 100644 layout/xul/crashtests/329407-1.xml
 create mode 100644 layout/xul/crashtests/329477-1.xhtml
 create mode 100644 layout/xul/crashtests/336962-1.xul
 create mode 100644 layout/xul/crashtests/344228-1.xul
 create mode 100644 layout/xul/crashtests/346083-1.xul
 create mode 100644 layout/xul/crashtests/346281-1.xul
 create mode 100644 layout/xul/crashtests/350460.xul
 create mode 100644 layout/xul/crashtests/360642-1.xul
 create mode 100644 layout/xul/crashtests/365151.xul
 create mode 100644 layout/xul/crashtests/366112-1.xul
 create mode 100644 layout/xul/crashtests/366203-1.xul
 create mode 100644 layout/xul/crashtests/367185-1.xhtml
 create mode 100644 layout/xul/crashtests/369942-1.xhtml
 create mode 100644 layout/xul/crashtests/374102-1.xul
 create mode 100644 layout/xul/crashtests/376137-1.html
 create mode 100644 layout/xul/crashtests/376137-2.html
 create mode 100644 layout/xul/crashtests/377592-1.svg
 create mode 100644 layout/xul/crashtests/378961.html
 create mode 100644 layout/xul/crashtests/381862.html
 create mode 100644 layout/xul/crashtests/382746-1.xul
 create mode 100644 layout/xul/crashtests/382899-1.xul
 create mode 100644 layout/xul/crashtests/383236-1.xul
 create mode 100644 layout/xul/crashtests/384037-1.xhtml
 create mode 100644 layout/xul/crashtests/384105-1-inner.xul
 create mode 100644 layout/xul/crashtests/384105-1.html
 create mode 100644 layout/xul/crashtests/384373-1.xul
 create mode 100644 layout/xul/crashtests/384373-2.xul
 create mode 100644 layout/xul/crashtests/384373.html
 create mode 100644 layout/xul/crashtests/384491-1.xhtml
 create mode 100644 layout/xul/crashtests/384871-1-inner.xul
 create mode 100644 layout/xul/crashtests/384871-1.html
 create mode 100644 layout/xul/crashtests/386642.xul
 create mode 100644 layout/xul/crashtests/387033-1.xhtml
 create mode 100644 layout/xul/crashtests/387080-1.xul
 create mode 100644 layout/xul/crashtests/391974-1-inner.xul
 create mode 100644 layout/xul/crashtests/391974-1.html
 create mode 100644 layout/xul/crashtests/394120-1.xhtml
 create mode 100644 layout/xul/crashtests/397293.xhtml
 create mode 100644 layout/xul/crashtests/397304-1.html
 create mode 100644 layout/xul/crashtests/398326-1.xhtml
 create mode 100644 layout/xul/crashtests/399013.xul
 create mode 100644 layout/xul/crashtests/400779-1.xhtml
 create mode 100644 layout/xul/crashtests/402912-1.xhtml
 create mode 100644 layout/xul/crashtests/404192.xhtml
 create mode 100644 layout/xul/crashtests/407152.xul
 create mode 100644 layout/xul/crashtests/408904-1.xul
 create mode 100644 layout/xul/crashtests/412479-1.xhtml
 create mode 100644 layout/xul/crashtests/415394-1.xhtml
 create mode 100644 layout/xul/crashtests/417509.xul
 create mode 100644 layout/xul/crashtests/420424-1.xul
 create mode 100644 layout/xul/crashtests/430356-1.xhtml
 create mode 100644 layout/xul/crashtests/431738.xhtml
 create mode 100644 layout/xul/crashtests/432058-1.xul
 create mode 100644 layout/xul/crashtests/432068-1.xul
 create mode 100644 layout/xul/crashtests/432068-2.xul
 create mode 100644 layout/xul/crashtests/433296-1.xul
 create mode 100644 layout/xul/crashtests/433429.xul
 create mode 100644 layout/xul/crashtests/434458-1.xul
 create mode 100644 layout/xul/crashtests/452185.html
 create mode 100644 layout/xul/crashtests/452185.xml
 create mode 100644 layout/xul/crashtests/460900-1.xul
 create mode 100644 layout/xul/crashtests/464149-1.xul
 create mode 100644 layout/xul/crashtests/464407-1.xhtml
 create mode 100644 layout/xul/crashtests/467080.xul
 create mode 100644 layout/xul/crashtests/467481-1.xul
 create mode 100644 layout/xul/crashtests/470063-1.html
 create mode 100644 layout/xul/crashtests/470272.html
 create mode 100644 layout/xul/crashtests/472189.xul
 create mode 100644 layout/xul/crashtests/475133.html
 create mode 100644 layout/xul/crashtests/488210-1.xhtml
 create mode 100644 layout/xul/crashtests/495728-1.xul
 create mode 100644 layout/xul/crashtests/508927-1.xul
 create mode 100644 layout/xul/crashtests/508927-2.xul
 create mode 100644 layout/xul/crashtests/514300-1.xul
 create mode 100644 layout/xul/crashtests/536931-1.xhtml
 create mode 100644 layout/xul/crashtests/538308-1.xul
 create mode 100644 layout/xul/crashtests/557174-1.xml
 create mode 100644 layout/xul/crashtests/564705-1.xul
 create mode 100644 layout/xul/crashtests/583957-1.html
 create mode 100644 layout/xul/crashtests/617089.html
 create mode 100644 layout/xul/crashtests/716503.html
 create mode 100644 layout/xul/crashtests/crashtests.list
 create mode 100644 layout/xul/crashtests/menulist-focused.xhtml

(limited to 'layout/xul/crashtests')

diff --git a/layout/xul/crashtests/131008-1.xul b/layout/xul/crashtests/131008-1.xul
new file mode 100644
index 000000000..d505f8696
--- /dev/null
+++ b/layout/xul/crashtests/131008-1.xul
@@ -0,0 +1,11 @@
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns:html="http://www.w3.org/1999/xhtml"
+	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+	xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+	id="MainWindow"
+	title="IWindow Test">
+<div style="position:absolute">abc</div>
+
+
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/137216-1.xul b/layout/xul/crashtests/137216-1.xul
new file mode 100644
index 000000000..a3fc043c8
--- /dev/null
+++ b/layout/xul/crashtests/137216-1.xul
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+	<iframe style="position:absolute;"/>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/140218-1.xml b/layout/xul/crashtests/140218-1.xml
new file mode 100644
index 000000000..311afc218
--- /dev/null
+++ b/layout/xul/crashtests/140218-1.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+      <treechildren style = " display: block; " />
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/151826-1.xul b/layout/xul/crashtests/151826-1.xul
new file mode 100644
index 000000000..1115dae72
--- /dev/null
+++ b/layout/xul/crashtests/151826-1.xul
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window
+   title      = "Arrowscrollbox->Splitter Crash Testcase"
+   xmlns      = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+   xmlns:html="http://www.w3.org/1999/xhtml"
+   width      = "300"
+   height     = "200"
+   orient     = "vertical"
+>
+<vbox flex="1">
+
+<scrollbox flex="1">
+<vbox flex="1">
+<vbox id="box_1">
+<hbox><label value="Test"/></hbox>
+</vbox>
+<splitter collapse="none"/>
+<vbox id="box_2">
+<hbox><label value="Test"/></hbox>
+</vbox>
+</vbox>
+</scrollbox>
+
+</vbox>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/168724-1.xul b/layout/xul/crashtests/168724-1.xul
new file mode 100644
index 000000000..8456406c2
--- /dev/null
+++ b/layout/xul/crashtests/168724-1.xul
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css" ?>
+
+<window
+  id="nodeCreator" title="Node Creator"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  >
+<description context="context">Right-click here, and expect a crash.</description>
+
+<popupset id="context-set">
+<popup id="context">
+<deck selectedItem="0">
+<menuitem label="You should never see this" />
+</deck>
+</popup>
+</popupset>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/189814-1.xul b/layout/xul/crashtests/189814-1.xul
new file mode 100644
index 000000000..79462348c
--- /dev/null
+++ b/layout/xul/crashtests/189814-1.xul
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+
+<window
+  id="sliderprint" title="Print These Sliders"
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  style="background-color: white">
+
+  <label>
+  With the Classic theme, printing causes the browser to crash. adding style="-moz-appearance: none" to the
+  thumb prevents the crash. The crash doesn't happen at all with Modern.
+  </label>
+  <spacer height="10"/>
+    <hbox>
+
+        <slider style="height: 174px; width: 24px" orient="vertical">
+            <thumb/>
+        </slider>
+
+    </hbox>
+
+</window>
diff --git a/layout/xul/crashtests/237787-1.xul b/layout/xul/crashtests/237787-1.xul
new file mode 100644
index 000000000..96cebca9f
--- /dev/null
+++ b/layout/xul/crashtests/237787-1.xul
@@ -0,0 +1,9 @@
+<?xml version="1.0"?>
+<window	xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+	<toolbar>
+		<arrowscrollbox>
+			<menulist editable="true">
+			</menulist>
+		</arrowscrollbox>
+	</toolbar>
+</window>
diff --git a/layout/xul/crashtests/265161-1.xul b/layout/xul/crashtests/265161-1.xul
new file mode 100644
index 000000000..75a995790
--- /dev/null
+++ b/layout/xul/crashtests/265161-1.xul
@@ -0,0 +1,9 @@
+<?xml version="1.0"?>
+<window
+	xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+	xmlns:html="http://www.w3.org/1999/xhtml">
+			<html:div>
+				<listitem>
+				</listitem>
+			</html:div>
+</window>
diff --git a/layout/xul/crashtests/289410-1.xul b/layout/xul/crashtests/289410-1.xul
new file mode 100644
index 000000000..0de792f2c
--- /dev/null
+++ b/layout/xul/crashtests/289410-1.xul
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window id="crash-window"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <scrollbox>
+    <tree id="crash-tree">
+      <treecols/>
+      <treechildren/>
+    </tree>
+  </scrollbox>
+
+</window>
diff --git a/layout/xul/crashtests/290743.html b/layout/xul/crashtests/290743.html
new file mode 100644
index 000000000..fd273d8bf
--- /dev/null
+++ b/layout/xul/crashtests/290743.html
@@ -0,0 +1,6 @@
+<html>
+<head><title>Testcase bug 290743 - This display:-moz-grid testcase freezes Mozilla</title></head>
+<body style="display:-moz-grid;">
+<input type="radio"><input type="radio">
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/xul/crashtests/291702-1.xul b/layout/xul/crashtests/291702-1.xul
new file mode 100644
index 000000000..4c052630d
--- /dev/null
+++ b/layout/xul/crashtests/291702-1.xul
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window title="Negative flex bug #2"
+		orient="horizontal"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <button label="Button" flex="2"/>
+  <label value="This is a label" flex="1"/>
+  <label value="This is the second label" flex="-2"/>
+  <label value="This is another label" flex="-1"/>
+</window>
diff --git a/layout/xul/crashtests/291702-2.xul b/layout/xul/crashtests/291702-2.xul
new file mode 100644
index 000000000..53d8a51f7
--- /dev/null
+++ b/layout/xul/crashtests/291702-2.xul
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window title="Negative flex bug #2"
+		orient="horizontal"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <button label="Button" flex="1073741824"/>
+  <label value="This is a label" flex="1073741824"/>
+  <label value="This is the second label" flex="1073741824"/>
+  <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+</window>
diff --git a/layout/xul/crashtests/291702-3.xul b/layout/xul/crashtests/291702-3.xul
new file mode 100644
index 000000000..b34404f36
--- /dev/null
+++ b/layout/xul/crashtests/291702-3.xul
@@ -0,0 +1,137 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window title="Negative flex bug #2"
+		orient="vertical"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+  </hbox>
+
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+  </hbox>
+
+
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="2"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="2"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="2"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+</window>
diff --git a/layout/xul/crashtests/294371-1.xul b/layout/xul/crashtests/294371-1.xul
new file mode 100644
index 000000000..ca5b54914
--- /dev/null
+++ b/layout/xul/crashtests/294371-1.xul
@@ -0,0 +1,53 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window
+  id    = "overflow crash"
+  title = "scrollbox crasher"
+  xmlns = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+	persist="sizemode width height screenX screenY"
+	width="320"
+	height="240">
+
+	<scrollbox flex="1">
+			<grid style="overflow: auto">
+				<columns>
+					<column flex="0"/>
+				</columns>
+				<rows>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+				</rows>
+			</grid>
+		</scrollbox>
+
+</window>
diff --git a/layout/xul/crashtests/311457-1.html b/layout/xul/crashtests/311457-1.html
new file mode 100644
index 000000000..e5b6ecdd6
--- /dev/null
+++ b/layout/xul/crashtests/311457-1.html
@@ -0,0 +1,12 @@
+<html><head>
+
+</head>
+
+<body>
+
+<div style="display: -moz-deck"><div style="display: -moz-popup"></div></div>
+
+<div style="position: relative">Y</div>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/xul/crashtests/321056-1.xhtml b/layout/xul/crashtests/321056-1.xhtml
new file mode 100644
index 000000000..a7ba11793
--- /dev/null
+++ b/layout/xul/crashtests/321056-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<xul:titlebar id="a"/>
+
+<script>
+var html = document.firstChild;
+var a = document.getElementById('a')
+document.removeChild(html)
+document.appendChild(a)
+</script>
+</html>
diff --git a/layout/xul/crashtests/322786-1.xul b/layout/xul/crashtests/322786-1.xul
new file mode 100644
index 000000000..79bb092c4
--- /dev/null
+++ b/layout/xul/crashtests/322786-1.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <foo style="display: inline;">
+    <scrollbox/>
+  </foo>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/325377.xul b/layout/xul/crashtests/325377.xul
new file mode 100644
index 000000000..8ea30473d
--- /dev/null
+++ b/layout/xul/crashtests/325377.xul
@@ -0,0 +1,16 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml"
+ title="Testcase bug 325377 - Crash on reload with evil xul textcase, using menulist and nested tooltips">
+<menulist style="display: table-cell;">
+<tooltip style="display: none;">
+    <tooltip/>
+</tooltip>
+</menulist>
+
+<html:script>
+function removestyles(){
+document.getElementsByTagName('tooltip')[0].removeAttribute('style');
+}
+try { document.getElementsByTagName('tooltip')[0].offsetHeight; } catch(e) {}
+setTimeout(removestyles,0);
+</html:script>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/326834-1-inner.xul b/layout/xul/crashtests/326834-1-inner.xul
new file mode 100644
index 000000000..0fbdca7ab
--- /dev/null
+++ b/layout/xul/crashtests/326834-1-inner.xul
@@ -0,0 +1,17 @@
+<window title="Testcase bug 326834 - Crash with evil xul testcase, using listbox/listitem and display: table-cell"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<listbox>
+  <listitem label="This page should not crash Mozilla"/>
+</listbox>
+<html:script>
+function doe() {
+var el=document.getElementsByTagName('*');
+document.getElementsByTagName('listbox')[0].style.display = 'table-cell';
+document.getElementsByTagName('listitem')[0].style.display = 'table-cell';
+window.getComputedStyle(document.getElementsByTagName('listitem')[0], '').getPropertyValue("height");
+document.getElementsByTagName('listitem')[0].style.display = '';
+}
+setTimeout(doe,500);
+</html:script>
+</window>
diff --git a/layout/xul/crashtests/326834-1.html b/layout/xul/crashtests/326834-1.html
new file mode 100644
index 000000000..ca531caa6
--- /dev/null
+++ b/layout/xul/crashtests/326834-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="326834-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/layout/xul/crashtests/326879-1.xul b/layout/xul/crashtests/326879-1.xul
new file mode 100644
index 000000000..84d74c30c
--- /dev/null
+++ b/layout/xul/crashtests/326879-1.xul
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+
+
+<script>
+
+
+function init() { 
+
+  var menupopup = document.getElementsByTagName("menupopup")[0];
+  menupopup.ordinal = null;
+};
+
+
+window.addEventListener("load", init, false);
+
+</script>
+
+
+<menulist>
+  <menupopup>
+    <menuitem label="Foo"/>
+  </menupopup>
+</menulist>
+
+        
+
+</window>
diff --git a/layout/xul/crashtests/327776-1.xul b/layout/xul/crashtests/327776-1.xul
new file mode 100644
index 000000000..af889493c
--- /dev/null
+++ b/layout/xul/crashtests/327776-1.xul
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<script>
+<![CDATA[
+function init()
+{ 
+  var span = document.getElementsByTagName("span")[0]; 
+  var boxobj = document.getBoxObjectFor(span);
+  try {
+    boxobj.setPropertyAsSupports(undefined, undefined);
+  } catch(e) {
+  }
+}
+window.addEventListener("load", init, false);
+]]>
+</script>
+
+<body xmlns="http://www.w3.org/1999/xhtml">
+
+<span></span>
+
+</body>
+</window>
diff --git a/layout/xul/crashtests/328135-1.xul b/layout/xul/crashtests/328135-1.xul
new file mode 100644
index 000000000..77a467909
--- /dev/null
+++ b/layout/xul/crashtests/328135-1.xul
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+
+
+<script>
+
+function init() { 
+  var pop = document.getElementsByTagName("popup")[0];
+  SpecialPowers.wrap(document).getAnonymousNodes(pop)[0];
+  eval.eee = document.documentElement;
+};
+
+
+window.addEventListener("load", init, false);
+
+</script>
+
+<popup/>
+
+
+<tabbox/>
+
+
+</window>
diff --git a/layout/xul/crashtests/329327-1.xul b/layout/xul/crashtests/329327-1.xul
new file mode 100644
index 000000000..fcfed07c4
--- /dev/null
+++ b/layout/xul/crashtests/329327-1.xul
@@ -0,0 +1,2 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><menulist equalsize="always"><y/> <z width="-444981589286"/> </menulist></window>
diff --git a/layout/xul/crashtests/329407-1.xml b/layout/xul/crashtests/329407-1.xml
new file mode 100644
index 000000000..0d41c0185
--- /dev/null
+++ b/layout/xul/crashtests/329407-1.xml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      >
+
+<body>
+
+  <xul:hbox>
+    <select/>
+    <select/>
+  </xul:hbox>
+
+</body>
+
+</html>
diff --git a/layout/xul/crashtests/329477-1.xhtml b/layout/xul/crashtests/329477-1.xhtml
new file mode 100644
index 000000000..fcbd3da87
--- /dev/null
+++ b/layout/xul/crashtests/329477-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+
+<![CDATA[
+
+
+function init() 
+{ 
+  var textbox = document.getElementsByTagName("textbox")[0];
+  var hbox = SpecialPowers.wrap(document).getAnonymousNodes(textbox)[0];
+  var menupopup = SpecialPowers.wrap(document).getAnonymousNodes(hbox)[1];
+
+  menupopup.click();
+}
+
+window.addEventListener("load", init, false);
+
+]]>
+</script>
+
+</head>
+
+<body>
+
+
+  <textbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/>
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/336962-1.xul b/layout/xul/crashtests/336962-1.xul
new file mode 100644
index 000000000..5ad4ad22b
--- /dev/null
+++ b/layout/xul/crashtests/336962-1.xul
@@ -0,0 +1,17 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script>
+
+function init() { 
+  document.getElementById("foopy").style.position = "absolute";   
+}
+
+window.addEventListener("load", init, 0);
+
+</script>
+
+
+<box id="foopy" />
+       
+
+</window>
diff --git a/layout/xul/crashtests/344228-1.xul b/layout/xul/crashtests/344228-1.xul
new file mode 100644
index 000000000..d6015707b
--- /dev/null
+++ b/layout/xul/crashtests/344228-1.xul
@@ -0,0 +1,27 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(boom, 30);" class="reftest-wait">
+
+<script>
+
+function remove(q1) { q1.parentNode.removeChild(q1); } 
+
+function boom()
+{
+  var x = document.getElementById("x");
+  var y = document.getElementById("y");
+  remove(x);
+  remove(y);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<tree>
+  <treechildren id="y"/>
+  <richlistbox>
+    <hbox id="x"/>
+    <menulist/>
+  </richlistbox>
+</tree>
+
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/346083-1.xul b/layout/xul/crashtests/346083-1.xul
new file mode 100644
index 000000000..e04d610a4
--- /dev/null
+++ b/layout/xul/crashtests/346083-1.xul
@@ -0,0 +1,13 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body xmlns="http://www.w3.org/1999/xhtml">
+
+<script>
+<![CDATA[
+document.getBoxObjectFor(document.getElementsByTagName("body")[0]).setProperty("foo", undefined);
+]]>
+</script>
+
+</body>
+</window>
diff --git a/layout/xul/crashtests/346281-1.xul b/layout/xul/crashtests/346281-1.xul
new file mode 100644
index 000000000..4ef670155
--- /dev/null
+++ b/layout/xul/crashtests/346281-1.xul
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body xmlns="http://www.w3.org/1999/xhtml">
+
+<script>
+<![CDATA[
+var boxy = document.getBoxObjectFor(document.getElementsByTagName("body")[0]);
+boxy.setPropertyAsSupports("zoink", undefined);
+try {
+  boxy.removeProperty(undefined);
+} catch(e) { }
+]]>
+</script>
+
+</body>
+</window>
diff --git a/layout/xul/crashtests/350460.xul b/layout/xul/crashtests/350460.xul
new file mode 100644
index 000000000..b13de6c97
--- /dev/null
+++ b/layout/xul/crashtests/350460.xul
@@ -0,0 +1,8 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ title="Crash [@ DoDeletingFrameSubtree] after reloading a xul page a few times with display: -moz-popup and menuitem">
+  <menuitem style="display: -moz-popup;">
+    <box style="display: -moz-popup;">
+      <box style="display: -moz-popup;"/>
+    </box>
+  </menuitem>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/360642-1.xul b/layout/xul/crashtests/360642-1.xul
new file mode 100644
index 000000000..5e37020a5
--- /dev/null
+++ b/layout/xul/crashtests/360642-1.xul
@@ -0,0 +1,9 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" 
+        class="reftest-wait"
+        onload="setTimeout(function() { var foo = document.getElementById('foo'); foo.parentNode.removeChild(foo); document.documentElement.removeAttribute('class'); }, 30);">
+        
+  <listboxbody>
+    <hbox id="foo"/>
+  </listboxbody>
+  
+</window>
diff --git a/layout/xul/crashtests/365151.xul b/layout/xul/crashtests/365151.xul
new file mode 100644
index 000000000..074c8d398
--- /dev/null
+++ b/layout/xul/crashtests/365151.xul
@@ -0,0 +1,39 @@
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="boom()" class="reftest-wait">
+
+
+<script>
+function boom()
+{
+ try {
+  var tree = document.getElementById("tree");
+  var col = tree.treeBoxObject.columns.getFirstColumn();
+  var treecols = document.getElementById("treecols");
+  treecols.parentNode.removeChild(treecols);
+  var x = col.x;
+ } finally {
+  document.documentElement.removeAttribute("class");
+ }
+}
+</script>
+
+
+<tree rows="6" id="tree">
+
+  <treecols id="treecols">
+      <treecol id="firstname" label="First Name"/>
+  </treecols>
+
+  <treechildren id="treechildren">
+    <treeitem>
+      <treerow>
+        <treecell label="Bob"/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+
+</tree>
+
+</window>
diff --git a/layout/xul/crashtests/366112-1.xul b/layout/xul/crashtests/366112-1.xul
new file mode 100644
index 000000000..4a03ea2cf
--- /dev/null
+++ b/layout/xul/crashtests/366112-1.xul
@@ -0,0 +1,9 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <nativescrollbar />
+
+</window>
diff --git a/layout/xul/crashtests/366203-1.xul b/layout/xul/crashtests/366203-1.xul
new file mode 100644
index 000000000..3e2b96d30
--- /dev/null
+++ b/layout/xul/crashtests/366203-1.xul
@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(boom, 500);">
+
+<script>
+function boom()
+{
+  tc1 = document.getElementById("tc1");
+  tc1.parentNode.removeChild(tc1);
+}
+</script>
+
+<tree rows="6">
+  <treecols>
+      <treecol id="firstname" label="First Name" primary="true" flex="3"/>
+      <treecol id="lastname" label="Last Name" flex="7"/>
+  </treecols>
+
+  <treechildren id="tc1">
+    <treeitem container="true" open="true">
+      <treerow>
+        <treecell label="Foo"/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+
+  <treechildren>
+    <treeitem container="true" open="true">
+      <treerow>
+        <treecell label="Bar"/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+</tree>
+
+
+</window>
+
diff --git a/layout/xul/crashtests/367185-1.xhtml b/layout/xul/crashtests/367185-1.xhtml
new file mode 100644
index 000000000..08fd39fa1
--- /dev/null
+++ b/layout/xul/crashtests/367185-1.xhtml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<title>Testcase bug - ASSERTION: shouldn't use unconstrained widths anymore with nested marquees</title>
+</head>
+<body>
+<xul:hbox style="margin: 0 100%;"><span><xul:hbox style="margin: 0 100%;"></xul:hbox></span></xul:hbox>
+</body>
+</html>
diff --git a/layout/xul/crashtests/369942-1.xhtml b/layout/xul/crashtests/369942-1.xhtml
new file mode 100644
index 000000000..a05705843
--- /dev/null
+++ b/layout/xul/crashtests/369942-1.xhtml
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      class="reftest-wait">
+<head>
+
+<script>
+function boom()
+{
+  var span = document.getElementById("span");
+  var radio = document.getElementById("radio");
+  
+  radio.appendChild(span);
+  
+  document.documentElement.removeAttribute("class");
+}
+</script>
+
+
+<style>
+body {
+	text-align: center;
+	font-size: 9px;
+}
+</style>
+
+</head>
+
+
+<body onload="setTimeout(boom, 30);">
+
+<span id="span"><xul:wizard/><div>Industries</div></span>
+
+<xul:radio id="radio"/>
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/374102-1.xul b/layout/xul/crashtests/374102-1.xul
new file mode 100644
index 000000000..7e85f0d21
--- /dev/null
+++ b/layout/xul/crashtests/374102-1.xul
@@ -0,0 +1,5 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<tabpanels>
+<treechildren style="display: -moz-deck;"/>
+</tabpanels>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/376137-1.html b/layout/xul/crashtests/376137-1.html
new file mode 100644
index 000000000..23b39d900
--- /dev/null
+++ b/layout/xul/crashtests/376137-1.html
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+span { display:block; outline: 10px solid yellow; }
+</style>
+</head>
+
+<body>
+
+<div>
+  <div style="display: -moz-inline-grid">
+    <span>M</span>
+    <span>N</span>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/376137-2.html b/layout/xul/crashtests/376137-2.html
new file mode 100644
index 000000000..160c61ed3
--- /dev/null
+++ b/layout/xul/crashtests/376137-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<title>Bug 376137</title>
+<style>
+p { width: 100%; border: solid 1px;}
+</style>
+
+<div style="display: -moz-inline-grid">
+  <div><p>M</p></div>
+  <div><p>N</p></div>
+</div>
+
diff --git a/layout/xul/crashtests/377592-1.svg b/layout/xul/crashtests/377592-1.svg
new file mode 100644
index 000000000..7371708f2
--- /dev/null
+++ b/layout/xul/crashtests/377592-1.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+     onload="setTimeout(boom, 30);"
+     class="reftest-wait">
+
+
+<script>
+
+var emptyBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%0A%20%20%20%20%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
+
+function boom()
+{
+  var foreignObject = document.getElementById("foreignObject")
+  foreignObject.style.MozBinding = emptyBinding;
+
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+
+<foreignObject width="500" height="500" transform="scale(.7,.7)" id="foreignObject" y="300">
+  <xul:menuitem />
+</foreignObject>
+
+
+</svg>
diff --git a/layout/xul/crashtests/378961.html b/layout/xul/crashtests/378961.html
new file mode 100644
index 000000000..b4da857ff
--- /dev/null
+++ b/layout/xul/crashtests/378961.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<title>Testcase bug 378961 - Crash [@ nsSplitterFrameInner::RemoveListener] when dragging splitter and DOMAttrModified event removing window</title>
+</head>
+<body>
+<iframe src="data:application/vnd.mozilla.xul+xml;charset=utf-8,%3C%3Fxml%20version%3D%221.0%22%3F%3E%0A%3C%3Fxml-stylesheet%20href%3D%22chrome%3A//global/skin%22%20type%3D%22text/css%22%3F%3E%0A%3Cwindow%20xmlns%3D%22http%3A//www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%22%20orient%3D%22horizontal%22%3E%0A%3Ctextbox/%3E%3Csplitter/%3E%3Cbox/%3E%0A%0A%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3E%0Afunction%20doe%28%29%20%7B%0Awindow.frameElement.parentNode.removeChild%28window.frameElement%29%3B%0A%7D%0Adocument.addEventListener%28%27DOMAttrModified%27%2C%20doe%2C%20true%29%3B%0A%3C/script%3E%0A%3C/window%3E" style="width: 500px;height:200px;"></iframe>
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/381862.html b/layout/xul/crashtests/381862.html
new file mode 100644
index 000000000..e26fa357e
--- /dev/null
+++ b/layout/xul/crashtests/381862.html
@@ -0,0 +1,23 @@
+<html><head>
+<title>Testcase bug - Crash [@ nsBoxFrame::BuildDisplayListForChildren] with tree stuff in iframe toggling display</title>
+</head>
+<body>
+<iframe src="data:application/vnd.mozilla.xul+xml;charset=utf-8,%3Cwindow%20xmlns%3D%22http%3A//www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%22%3E%0A%20%20%3Ctree%20style%3D%22display%3A%20block%3B%20position%3A%20absolute%3B%22%3E%0A%20%20%20%20%3Ctree%20style%3D%22display%3A%20table%3B%22%3E%0A%20%20%20%20%20%20%3Ctreeseparator%20style%3D%22display%3A%20block%3B%20position%3A%20absolute%3B%22%3E%0A%20%20%20%20%20%20%20%20%3Ctreechildren%20style%3D%22display%3A%20block%3B%22/%3E%0A%20%20%20%20%20%20%3C/treeseparator%3E%0A%20%20%20%20%20%20%3Ctreechildren%20style%3D%22display%3A%20none%3B%22/%3E%0A%20%20%20%20%3C/tree%3E%0A%20%20%3C/tree%3E%0A%3C/window%3E" id="content"></iframe>
+
+<script>
+function toggleIframe(){
+var x=document.getElementById('content');
+x.style.display = x.style.display == 'none' ? x.style.display = 'block' : x.style.display = 'none';
+setTimeout(toggleIframe,200);
+}
+setTimeout(toggleIframe,500);
+
+function removestyles(i){
+window.frames[0].document.getElementsByTagName('*')[1].removeAttribute('style');
+}
+
+setTimeout(removestyles,500,1);
+/*template*/
+</script>
+</body>
+</html>
diff --git a/layout/xul/crashtests/382746-1.xul b/layout/xul/crashtests/382746-1.xul
new file mode 100644
index 000000000..9bb14f24f
--- /dev/null
+++ b/layout/xul/crashtests/382746-1.xul
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<grid>
+  <rows>
+    <column>
+      <hbox/>
+      <hbox/>
+    </column>
+    <hbox/>
+  </rows>
+</grid>
+
+</window>
diff --git a/layout/xul/crashtests/382899-1.xul b/layout/xul/crashtests/382899-1.xul
new file mode 100644
index 000000000..7dab931f7
--- /dev/null
+++ b/layout/xul/crashtests/382899-1.xul
@@ -0,0 +1,9 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<hbox equalsize="always"><grid/>x</hbox>
+
+</window>
diff --git a/layout/xul/crashtests/383236-1.xul b/layout/xul/crashtests/383236-1.xul
new file mode 100644
index 000000000..244df65f1
--- /dev/null
+++ b/layout/xul/crashtests/383236-1.xul
@@ -0,0 +1,5 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<listbox><listhead>x</listhead></listbox>
+
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/384037-1.xhtml b/layout/xul/crashtests/384037-1.xhtml
new file mode 100644
index 000000000..04bac671c
--- /dev/null
+++ b/layout/xul/crashtests/384037-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" 
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body>
+
+<xul:splitter id="s" collapse="both" state="collapsed" />
+
+</body>
+</html>
+
diff --git a/layout/xul/crashtests/384105-1-inner.xul b/layout/xul/crashtests/384105-1-inner.xul
new file mode 100644
index 000000000..4ea6e0391
--- /dev/null
+++ b/layout/xul/crashtests/384105-1-inner.xul
@@ -0,0 +1,21 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">
+function doe(){
+document.getElementById('a').removeAttribute('style');
+}
+setTimeout(doe,100);
+</script>
+<box id="a" style="position: absolute;">
+  <menuitem sizetopopup="always">
+    <menupopup style="position: absolute;"/>
+  </menuitem>
+
+  <box style="position: fixed;">
+    <tree>
+      <treecol>
+        <treecol/>
+      </treecol>
+    </tree>
+  </box>
+</box>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/384105-1.html b/layout/xul/crashtests/384105-1.html
new file mode 100644
index 000000000..fe468a906
--- /dev/null
+++ b/layout/xul/crashtests/384105-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="384105-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/layout/xul/crashtests/384373-1.xul b/layout/xul/crashtests/384373-1.xul
new file mode 100644
index 000000000..603b53cde
--- /dev/null
+++ b/layout/xul/crashtests/384373-1.xul
@@ -0,0 +1,10 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" 
+onerror="var x=document.getElementsByTagName('*');x[Math.floor(Math.random()*x.length)].focus()"
+onblur="event.originalTarget.parentNode.parentNode.removeChild(event.originalTarget.parentNode)">
+<script xmlns="http://www.w3.org/1999/xhtml">setTimeout(function() {window.location.reload()}, 200);</script>
+
+<broadcasterset style="display: block;">
+  <broadcaster style="display: block;"></broadcaster>
+</broadcasterset>
+<preferences></preferences>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/384373-2.xul b/layout/xul/crashtests/384373-2.xul
new file mode 100644
index 000000000..1d56394e3
--- /dev/null
+++ b/layout/xul/crashtests/384373-2.xul
@@ -0,0 +1,4 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onerror="document.getElementsByTagName('*')[1].focus()" onfocus="event.target.parentNode.removeChild(event.target)">
+<broadcaster style="display: block;"/>
+<preferences/>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/384373.html b/layout/xul/crashtests/384373.html
new file mode 100644
index 000000000..c3bc92f16
--- /dev/null
+++ b/layout/xul/crashtests/384373.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+    <meta charset="utf-8">
+    <title>Testcase for bug 384373</title>
+<script>
+function reload() {
+  this.location.reload();
+}
+// Run the test for 1 second
+setTimeout(function() {
+    document.body.getBoundingClientRect();
+    document.documentElement.removeChild(document.body);
+    document.documentElement.className = "";
+  }, 2000);
+</script>
+</head>
+<body onload="document.body.getBoundingClientRect()">
+
+<iframe src="384373-1.xul"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,500)" src="384373-2.xul"></iframe>
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/384491-1.xhtml b/layout/xul/crashtests/384491-1.xhtml
new file mode 100644
index 000000000..2eb065f8d
--- /dev/null
+++ b/layout/xul/crashtests/384491-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml" 
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body>
+
+<xul:listboxbody style="overflow: hidden" />
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/384871-1-inner.xul b/layout/xul/crashtests/384871-1-inner.xul
new file mode 100644
index 000000000..62efdb260
--- /dev/null
+++ b/layout/xul/crashtests/384871-1-inner.xul
@@ -0,0 +1,9 @@
+<popup xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<script xmlns="http://www.w3.org/1999/xhtml">
+function doe(){
+document.documentElement.autoPosition = 'on';
+window.location.reload();
+}
+setTimeout(doe, 300);
+</script>
+</popup>
\ No newline at end of file
diff --git a/layout/xul/crashtests/384871-1.html b/layout/xul/crashtests/384871-1.html
new file mode 100644
index 000000000..6bb2a9e07
--- /dev/null
+++ b/layout/xul/crashtests/384871-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+<body>
+<iframe src="384871-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/layout/xul/crashtests/386642.xul b/layout/xul/crashtests/386642.xul
new file mode 100644
index 000000000..50db21a09
--- /dev/null
+++ b/layout/xul/crashtests/386642.xul
@@ -0,0 +1,31 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        title="Bug 386642 Crash [@ IsCanvasFrame] while opening context menu or changing styles">
+<toolbarbutton type="menu" id="a">
+<menupopup id="b"/>
+</toolbarbutton>
+
+<style xmlns="http://www.w3.org/1999/xhtml">
+.one image {
+display: -moz-box;
+}
+image{
+display: none;
+}
+
+</style>
+<script><![CDATA[
+var gg=0;
+function doe() {
+  var a = document.getElementById('a');
+  if (!a.hasAttribute('class')) {
+    a.setAttribute('class', 'one');
+  } else {
+    a.removeAttribute('class');
+  }
+document.getElementById('b').hidePopup();
+}
+
+doe();
+setInterval(doe, 200);
+]]></script>
+</window>
diff --git a/layout/xul/crashtests/387033-1.xhtml b/layout/xul/crashtests/387033-1.xhtml
new file mode 100644
index 000000000..58325b1a7
--- /dev/null
+++ b/layout/xul/crashtests/387033-1.xhtml
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xbl="http://www.mozilla.org/xbl"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <head>
+    <xbl:bindings>
+      <xbl:binding id="test" extends="chrome://global/content/bindings/text.xml#text-label">
+        <xbl:implementation>
+          <xbl:property name="accessKey">
+            <xbl:getter>
+              <![CDATA[
+                this.parentNode.parentNode.removeChild(this.parentNode);
+                return "";
+              ]]>
+            </xbl:getter>
+            <xbl:setter>
+              <![CDATA[
+                return val;
+              ]]>
+            </xbl:setter>
+          </xbl:property>
+        </xbl:implementation>
+      </xbl:binding>
+    </xbl:bindings>
+  </head>
+  <body>
+    <xul:hbox>
+      <xul:label value="foobar" style="-moz-binding: url(#test)"/>
+    </xul:hbox>
+  </body>
+</html>
diff --git a/layout/xul/crashtests/387080-1.xul b/layout/xul/crashtests/387080-1.xul
new file mode 100644
index 000000000..4eb9bd784
--- /dev/null
+++ b/layout/xul/crashtests/387080-1.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <description>
+    <foo height="1793689537164611773" width="20000238421986669650" />
+  </description>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/391974-1-inner.xul b/layout/xul/crashtests/391974-1-inner.xul
new file mode 100644
index 000000000..f13aa2110
--- /dev/null
+++ b/layout/xul/crashtests/391974-1-inner.xul
@@ -0,0 +1,19 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<menuitem>
+<tooltip/>
+<box/>
+</menuitem>
+
+<script xmlns="http://www.w3.org/1999/xhtml">
+function doe2() {
+document.getElementsByTagName('menuitem')[0].setAttribute('description', 'tetx');
+}
+
+function doe3() {
+document.getElementsByTagName('menuitem')[0].removeAttribute('description');
+document.getElementsByTagName('tooltip')[0].setAttribute('ordinal', '0');
+}
+setTimeout(doe2,150);
+setTimeout(doe3,200);
+</script>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/391974-1.html b/layout/xul/crashtests/391974-1.html
new file mode 100644
index 000000000..c72a1a73c
--- /dev/null
+++ b/layout/xul/crashtests/391974-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="391974-1-inner.xul"></iframe>
+</body>
+</html>
diff --git a/layout/xul/crashtests/394120-1.xhtml b/layout/xul/crashtests/394120-1.xhtml
new file mode 100644
index 000000000..9df447862
--- /dev/null
+++ b/layout/xul/crashtests/394120-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml" 
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<script>
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+  var xultext = document.createElementNS(XUL_NS, "text");
+  var hbox = document.getElementById("hbox")
+  hbox.appendChild(xultext);
+}
+</script>
+</head>
+<body onload="boom();">
+
+<xul:listboxbody><xul:hbox id="hbox" /></xul:listboxbody>
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/397293.xhtml b/layout/xul/crashtests/397293.xhtml
new file mode 100644
index 000000000..cfd181921
--- /dev/null
+++ b/layout/xul/crashtests/397293.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml"  
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      style="opacity: 0.2;">
+<head>
+<script>
+
+function x()
+{
+  document.documentElement.style.counterReset = "chicken";
+  
+  document.body.offsetHeight;
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(x, 0);">Foo</body>
+
+<xul:listbox/>
+
+</html>
diff --git a/layout/xul/crashtests/397304-1.html b/layout/xul/crashtests/397304-1.html
new file mode 100644
index 000000000..3501f0581
--- /dev/null
+++ b/layout/xul/crashtests/397304-1.html
@@ -0,0 +1 @@
+<html><body><listboxbody style="display: -moz-grid-group;"></listboxbody></body></html>
\ No newline at end of file
diff --git a/layout/xul/crashtests/398326-1.xhtml b/layout/xul/crashtests/398326-1.xhtml
new file mode 100644
index 000000000..a265ae4e0
--- /dev/null
+++ b/layout/xul/crashtests/398326-1.xhtml
@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+  var listbox = document.createElementNS(XUL_NS, 'listbox');
+  document.body.appendChild(listbox);
+  var listitem = document.createElementNS(XUL_NS, 'listitem');
+  listbox.appendChild(listitem);
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/layout/xul/crashtests/399013.xul b/layout/xul/crashtests/399013.xul
new file mode 100644
index 000000000..a2349aff8
--- /dev/null
+++ b/layout/xul/crashtests/399013.xul
@@ -0,0 +1,31 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<menulist id="b" style="display: -moz-groupbox;">
+<panel id="c" style=" position: absolute;">
+<popup onunderflow="document.getElementById('c').removeAttribute('style')"/>
+</panel>
+<menupopup id="a" style="display: -moz-stack;">
+<menulist/>
+</menupopup>
+<panel style="display: -moz-deck;" onoverflow="document.getElementById('b').removeAttribute('style')">
+<popup style="display: -moz-deck;"/>
+</panel>
+</menulist>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+function doe() {
+document.getElementById('c').removeAttribute('style');
+document.documentElement.boxObject.height;
+document.getElementById('b').removeAttribute('style');
+document.getElementById('a').setAttribute('selected', 'true');
+document.getElementById('a').setAttribute('style', 'position: fixed;');
+document.documentElement.boxObject.height;
+document.getElementById('a').removeAttribute('style');
+}
+
+function doe2() {
+window.location.reload();
+}
+setTimeout(doe2, 200);
+setTimeout(doe,100);
+]]></script>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/400779-1.xhtml b/layout/xul/crashtests/400779-1.xhtml
new file mode 100644
index 000000000..c0f5d493c
--- /dev/null
+++ b/layout/xul/crashtests/400779-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<script>
+
+function boom()
+{
+  var menulist = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "menulist");
+  document.getElementById("h").appendChild(menulist);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<xul:listboxbody><xul:hbox id="h"/></xul:listboxbody>
+</body>
+</html>
diff --git a/layout/xul/crashtests/402912-1.xhtml b/layout/xul/crashtests/402912-1.xhtml
new file mode 100644
index 000000000..b2cb98dc5
--- /dev/null
+++ b/layout/xul/crashtests/402912-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body>
+<xul:vbox equalsize="always"><xul:hbox flex="1"><span><xul:hbox width="10" height="10"/></span><xul:button /></xul:hbox><xul:hbox maxheight="0"/></xul:vbox>
+</body>
+</html>
diff --git a/layout/xul/crashtests/404192.xhtml b/layout/xul/crashtests/404192.xhtml
new file mode 100644
index 000000000..4ad5af348
--- /dev/null
+++ b/layout/xul/crashtests/404192.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait">
+<xul:titlebar id="a" style="overflow: auto;"/>
+
+<script>
+function doe() {
+document.getElementsByTagName('*')[1].focus();
+document.getElementsByTagName('*')[0].focus();
+document.documentElement.removeAttribute("class");
+}
+setTimeout(doe, 200);
+</script>
+</html>
diff --git a/layout/xul/crashtests/407152.xul b/layout/xul/crashtests/407152.xul
new file mode 100644
index 000000000..0a5adf69e
--- /dev/null
+++ b/layout/xul/crashtests/407152.xul
@@ -0,0 +1,7 @@
+<triple xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" style="display: block;">
+<box style="display: block; position: relative; -moz-binding: url(data:text/xml;charset=utf-8,%3Cbindings%20xmlns%3D%22http%3A//www.mozilla.org/xbl%22%3E%0A%3Cbinding%20id%3D%22a%22%3E%0A%3Cimplementation%3E%0A%3Cfield%20name%3D%22_field%22%3Ethis.ownerDocument.getBoxObjectFor%28this.ownerDocument.documentElement%29%3B%3C/field%3E%0A%3C/implementation%3E%0A%3Ccontent%3E%0A%3C/binding%3E%0A%3C/bindings%3E);">
+<box style="position: fixed; -moz-binding: url(data:text/xml;charset=utf-8,%3Cbindings%20xmlns%3D%22http%3A//www.mozilla.org/xbl%22%3E%0A%3Cbinding%20id%3D%22a%22%3E%0A%3Ccontent%3E%0A%3Cchildren%20xmlns%3D%22http%3A//www.mozilla.org/xbl%22/%3E%3C/content%3E%3C/binding%3E%3C/bindings%3E);"/>
+<iframe/>
+</box>
+<scrollbox onoverflow="document.documentElement.removeAttribute('style')"/>
+</triple>
\ No newline at end of file
diff --git a/layout/xul/crashtests/408904-1.xul b/layout/xul/crashtests/408904-1.xul
new file mode 100644
index 000000000..59f215c73
--- /dev/null
+++ b/layout/xul/crashtests/408904-1.xul
@@ -0,0 +1 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><grid><rows><label/></rows><columns><column><label/></column></columns></grid></window>
diff --git a/layout/xul/crashtests/412479-1.xhtml b/layout/xul/crashtests/412479-1.xhtml
new file mode 100644
index 000000000..b1086a816
--- /dev/null
+++ b/layout/xul/crashtests/412479-1.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head></head>
+<body><xul:menubar style="display: table-column; padding: 10px 3000px;"/></body>
+</html>
diff --git a/layout/xul/crashtests/415394-1.xhtml b/layout/xul/crashtests/415394-1.xhtml
new file mode 100644
index 000000000..7dc24dc9f
--- /dev/null
+++ b/layout/xul/crashtests/415394-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" 
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.execCommand("justifycenter", false, null);
+
+  var listboxbody = document.getElementById("lbb");
+  listboxbody.height = 9;
+  setTimeout(boom2, 0);
+
+  function boom2()
+  {
+    var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+    listboxbody.appendChild(td);
+    document.documentElement.removeAttribute("class");
+  }
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 0);" contenteditable="true"><xul:listboxbody id="lbb"><xul:hbox/><span><col style="width: 100px;" /></span></xul:listboxbody></body>
+
+</html>
diff --git a/layout/xul/crashtests/417509.xul b/layout/xul/crashtests/417509.xul
new file mode 100644
index 000000000..81703ada3
--- /dev/null
+++ b/layout/xul/crashtests/417509.xul
@@ -0,0 +1,7 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<span id="a" datasources="" xmlns="http://www.w3.org/1999/xhtml"/>
+<script xmlns="http://www.w3.org/1999/xhtml">
+document.documentElement.appendChild(document.getElementById('a'));
+
+</script>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/420424-1.xul b/layout/xul/crashtests/420424-1.xul
new file mode 100644
index 000000000..e60841706
--- /dev/null
+++ b/layout/xul/crashtests/420424-1.xul
@@ -0,0 +1,6 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="document.getElementById('a').ensureElementIsVisible(null);">
+
+<listbox id="a"/>
+
+</window>
diff --git a/layout/xul/crashtests/430356-1.xhtml b/layout/xul/crashtests/430356-1.xhtml
new file mode 100644
index 000000000..6e5717ae9
--- /dev/null
+++ b/layout/xul/crashtests/430356-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="visibility: collapse;">
+<tabpanels xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" style="width: -moz-max-content;"></tabpanels>
+</body>
+</html>
diff --git a/layout/xul/crashtests/431738.xhtml b/layout/xul/crashtests/431738.xhtml
new file mode 100644
index 000000000..9ce917a3f
--- /dev/null
+++ b/layout/xul/crashtests/431738.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body>
+<div>
+<span style="font-size: 0pt;"><xul:listboxbody><span style="border: 1px solid red;"/></xul:listboxbody></span>
+</div>
+</body>
+</html>
diff --git a/layout/xul/crashtests/432058-1.xul b/layout/xul/crashtests/432058-1.xul
new file mode 100644
index 000000000..a7f63adf8
--- /dev/null
+++ b/layout/xul/crashtests/432058-1.xul
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<script type="text/javascript">
+// <![CDATA[
+
+var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+  var lb = document.getElementById("lb");
+  var firstli = document.getElementById("firstli");
+  lb.appendChild(document.createElementNS(XUL_NS, "hbox"));
+  lb.appendChild(document.createElementNS(XUL_NS, "listitem"));
+  firstli.style.display = "none";
+
+  // Flush layout.
+  document.getBoxObjectFor(document.documentElement).height;
+
+  lb.removeChild(firstli);
+}
+
+// ]]>
+</script>
+
+<listbox id="lb"><listitem id="firstli"/></listbox>
+
+</window>
diff --git a/layout/xul/crashtests/432068-1.xul b/layout/xul/crashtests/432068-1.xul
new file mode 100644
index 000000000..02c3114e6
--- /dev/null
+++ b/layout/xul/crashtests/432068-1.xul
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<hbox style="display: none;">
+  <bindings xmlns="http://www.mozilla.org/xbl">
+    <binding id="x">
+      <content><listitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"/></content>
+    </binding>
+  </bindings>
+</hbox>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("b").style.MozBinding = "url('#x')";
+  
+  // Flush layout.
+  document.documentElement.boxObject.height;
+  
+  document.getElementById("listbox").removeChild(document.getElementById("c"));
+}
+
+</script>
+
+<listbox id="listbox"><listitem/><listitem id="b"/><listitem id="c"/></listbox>
+
+</window>
diff --git a/layout/xul/crashtests/432068-2.xul b/layout/xul/crashtests/432068-2.xul
new file mode 100644
index 000000000..c75984bae
--- /dev/null
+++ b/layout/xul/crashtests/432068-2.xul
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+  var l = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listitem");
+  l.style.display = "none";
+
+  var c = document.getElementById("c");
+  c.parentNode.insertBefore(l, c);
+  
+  document.getElementById("listbox").removeChild(document.getElementById("c"));
+}
+
+</script>
+
+<listbox id="listbox"><listitem/><listitem id="c"/></listbox>
+
+</window>
diff --git a/layout/xul/crashtests/433296-1.xul b/layout/xul/crashtests/433296-1.xul
new file mode 100644
index 000000000..10fd0ec7b
--- /dev/null
+++ b/layout/xul/crashtests/433296-1.xul
@@ -0,0 +1,5 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<hbox><listboxbody><listheader/><hbox><iframe/></hbox></listboxbody><tabpanels><tabpanels/></tabpanels></hbox>
+
+</window>
diff --git a/layout/xul/crashtests/433429.xul b/layout/xul/crashtests/433429.xul
new file mode 100644
index 000000000..a52bce68f
--- /dev/null
+++ b/layout/xul/crashtests/433429.xul
@@ -0,0 +1,23 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+  var listbox = document.getElementById("listbox");
+
+  listbox.removeChild(listbox.childNodes[1]);
+  document.documentElement.style.MozBinding = "url('data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%3Chbox%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fkeymaster%2Fgatekeeper%2Fthere.is.only.xul%22%2F%3E%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A')";
+  document.documentElement.boxObject.height;
+  listbox.removeChild(listbox.childNodes[0]);
+}
+
+</script>
+
+<listbox id="listbox" style="-moz-binding: url(data:text/xml,%3Cbindings%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%3E%3Cbinding%20id%3D%22foo%22%3E%3Ccontent%3E%0A%3Clistbox%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fkeymaster%2Fgatekeeper%2Fthere.is.only.xul%22%3E%3Cchildren%20xmlns%3D%22http%3A%2F%2Fwww.mozilla.org%2Fxbl%22%2F%3E%3C%2Flistbox%3E%0A%3C%2Fcontent%3E%3C%2Fbinding%3E%3C%2Fbindings%3E%0A);"><listitem/><listitem/></listbox>
+
+</window>
diff --git a/layout/xul/crashtests/434458-1.xul b/layout/xul/crashtests/434458-1.xul
new file mode 100644
index 000000000..fbec2a413
--- /dev/null
+++ b/layout/xul/crashtests/434458-1.xul
@@ -0,0 +1,20 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(boom, 30);" class="reftest-wait">
+
+<script>
+function boom() {
+  var a = document.getElementById('a');
+  var x = a.popupBoxObject;
+  a.parentNode.removeChild(a);
+  x.enableKeyboardNavigator(true);
+  x.openPopup(null, "after_start", 0, 0, false, false, null);
+  x.openPopupAtScreen(2, 2, false, null);
+  x.showPopup(document.documentElement, a, -1, -1, "popup", "topleft", "topleft");
+  x.hidePopup();
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<menupopup id="a"/>
+
+</window>
diff --git a/layout/xul/crashtests/452185.html b/layout/xul/crashtests/452185.html
new file mode 100644
index 000000000..d4981ffdf
--- /dev/null
+++ b/layout/xul/crashtests/452185.html
@@ -0,0 +1,3 @@
+<html><head></head><body><div style="position: absolute;"> </div>
+<style>div, head {-moz-binding:url(452185.xml#a);</style>
+</body></html>
diff --git a/layout/xul/crashtests/452185.xml b/layout/xul/crashtests/452185.xml
new file mode 100644
index 000000000..655c43a8d
--- /dev/null
+++ b/layout/xul/crashtests/452185.xml
@@ -0,0 +1,5 @@
+<bindings xmlns="http://www.mozilla.org/xbl" xmlns:xlink="http://www.w3.org/1999/xlink">
+<binding id="a">
+<content><tbody xmlns="http://www.w3.org/1999/xhtml"><style>*::before { content:"b"; }</style></tbody></content>
+
+</binding></bindings>
\ No newline at end of file
diff --git a/layout/xul/crashtests/460900-1.xul b/layout/xul/crashtests/460900-1.xul
new file mode 100644
index 000000000..bff7c5c36
--- /dev/null
+++ b/layout/xul/crashtests/460900-1.xul
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="document.getElementById('label').control='c';">
+<label id="label"><hbox><listboxbody><hbox/><tooltip/></listboxbody><autorepeatbutton/></hbox></label>
+</window>
diff --git a/layout/xul/crashtests/464149-1.xul b/layout/xul/crashtests/464149-1.xul
new file mode 100644
index 000000000..556656f02
--- /dev/null
+++ b/layout/xul/crashtests/464149-1.xul
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window onload="boom();" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="m"><content><xul:textbox type="text"><children/></xul:textbox></content></binding>
+</bindings>
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  document.getElementById("b").style.MozBinding = 'url("data:text/xml,' + encodeURIComponent("<bindings xmlns='http://www.mozilla.org/xbl'><binding id='foo'><content><hbox xmlns='http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul'><children xmlns='http://www.mozilla.org/xbl'/></hbox></content></binding></bindings>\n") + '")';
+}
+
+]]>
+</script>
+
+<listbox style="float: right;"><listitem/><listitem id="b"/><listitem><hbox style="-moz-binding: url(#m);"/></listitem></listbox>
+
+</window>
diff --git a/layout/xul/crashtests/464407-1.xhtml b/layout/xul/crashtests/464407-1.xhtml
new file mode 100644
index 000000000..83666a6a4
--- /dev/null
+++ b/layout/xul/crashtests/464407-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+</head>
+<body>
+
+<xul:radio style="overflow: auto; height: 72057594037927940pt; display: table-cell;"/>
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/467080.xul b/layout/xul/crashtests/467080.xul
new file mode 100644
index 000000000..bc579b0ee
--- /dev/null
+++ b/layout/xul/crashtests/467080.xul
@@ -0,0 +1,24 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML" style="-moz-binding:url(#a);" class="reftest-wait">
+
+<content xmlns="http://www.mozilla.org/xbl" ordinal="-1">
+<mathml:median style="display: block;"/>
+</content>
+
+<script xmlns="http://www.w3.org/1999/xhtml"><![CDATA[
+function finish() {
+  document.documentElement.removeAttribute("class");
+}
+function doe() {
+document.documentElement.removeAttribute('style');
+setTimeout(finish, 0);
+}
+setTimeout(doe, 100);
+]]></script>
+
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="a">
+<content><children/></content>
+</binding></bindings>
+</window>
diff --git a/layout/xul/crashtests/467481-1.xul b/layout/xul/crashtests/467481-1.xul
new file mode 100644
index 000000000..56fbd4441
--- /dev/null
+++ b/layout/xul/crashtests/467481-1.xul
@@ -0,0 +1,6 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="document.getElementById('a').setAttribute('ordinal', 30);">
+  <listbox>
+    <listitem id="a"/>
+    <listitem><iframe/></listitem>
+  </listbox>
+</window>
diff --git a/layout/xul/crashtests/470063-1.html b/layout/xul/crashtests/470063-1.html
new file mode 100644
index 000000000..11c01b30e
--- /dev/null
+++ b/layout/xul/crashtests/470063-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.removeChild(document.documentElement)
+  document.appendChild(document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox"));
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/xul/crashtests/470272.html b/layout/xul/crashtests/470272.html
new file mode 100644
index 000000000..f23de269b
--- /dev/null
+++ b/layout/xul/crashtests/470272.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+function doe2(i) {
+document.documentElement.offsetHeight;
+document.getElementById('a').setAttribute('style', 'display: -moz-inline-box;');
+document.documentElement.offsetHeight;
+}
+</script>
+</head>
+<body style="float: right; -moz-column-count: 2; height: 20%;" onload="setTimeout(doe2,0);">
+  <div style="display: none;"></div>
+  <ul style="display: -moz-inline-box;"></ul>
+  <span id="a">
+    <ul style="display: -moz-grid; overflow: scroll;"></ul>
+      <span style="display: -moz-inline-box; height: 10px;">
+        <span style="position: absolute;"></span>
+      </span>
+  </span>
+</body>
+</html>
diff --git a/layout/xul/crashtests/472189.xul b/layout/xul/crashtests/472189.xul
new file mode 100644
index 000000000..e276d8fc7
--- /dev/null
+++ b/layout/xul/crashtests/472189.xul
@@ -0,0 +1,13 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window id="yourwindow" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<script type="text/javascript">
+<![CDATA[
+function onload() {
+  document.addEventListener("DOMAttrModified", function() {}, true);
+  document.getElementById("test").setAttribute("value", "50");
+}
+]]>
+</script>
+<progressmeter id="test"/>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/475133.html b/layout/xul/crashtests/475133.html
new file mode 100644
index 000000000..ea4ee6325
--- /dev/null
+++ b/layout/xul/crashtests/475133.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+function x()
+{
+  document.removeEventListener("DOMAttrModified", x, false);
+  document.removeChild(document.documentElement);
+}
+
+function boom()
+{
+  var p = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "progressmeter");
+  document.addEventListener("DOMAttrModified", x, false);
+  document.documentElement.appendChild(p);
+}
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/xul/crashtests/488210-1.xhtml b/layout/xul/crashtests/488210-1.xhtml
new file mode 100644
index 000000000..9c8e2640c
--- /dev/null
+++ b/layout/xul/crashtests/488210-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+  var listbox = document.createElementNS(XUL_NS, 'listbox');
+  document.body.appendChild(listbox);
+  listbox.appendChild(document.createElementNS(XUL_NS, 'listitem'));
+  listbox.appendChild(document.createElementNS(XUL_NS, 'listboxbody'));
+  listbox.appendChild(document.createElementNS(XUL_NS, 'hbox'));
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/xul/crashtests/495728-1.xul b/layout/xul/crashtests/495728-1.xul
new file mode 100644
index 000000000..ee8498d05
--- /dev/null
+++ b/layout/xul/crashtests/495728-1.xul
@@ -0,0 +1,239 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window id="list-testcase" title="Testcase"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        class="reftest-wait">
+
+<script>
+function scrollup() {
+  var list = document.getElementById('list');
+  var firstindex = list.getIndexOfItem(document.getElementById('first'));
+  list.ensureIndexIsVisible(firstindex);
+  setTimeout("document.documentElement.removeAttribute('class')",1);
+}
+
+function scrolldown() {
+  var list = document.getElementById('list');
+  var lastindex = list.getIndexOfItem(document.getElementById('last'));
+  list.ensureIndexIsVisible(lastindex);
+  setTimeout("scrollup()",1);
+}
+
+window.addEventListener("load", scrolldown, false);
+</script>
+		
+<listbox id="list">
+<listitem label="Item x" id="first"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x"/>
+<listitem label="Item x" id="last"/>
+</listbox>
+
+</window>
diff --git a/layout/xul/crashtests/508927-1.xul b/layout/xul/crashtests/508927-1.xul
new file mode 100644
index 000000000..98faff4a6
--- /dev/null
+++ b/layout/xul/crashtests/508927-1.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><xul:listrows xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><xul:listboxbody/><children xmlns="http://www.mozilla.org/xbl"/></xul:listrows></content></binding></bindings>
+<hbox style="-moz-binding: url(#foo);"><listitem/><listitem/></hbox>
+</window>
diff --git a/layout/xul/crashtests/508927-2.xul b/layout/xul/crashtests/508927-2.xul
new file mode 100644
index 000000000..5bf4f9a0c
--- /dev/null
+++ b/layout/xul/crashtests/508927-2.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><xul:listrows xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><xul:listboxbody/><children xmlns="http://www.mozilla.org/xbl"/></xul:listrows></content></binding></bindings>
+<hbox style="-moz-binding: url(#foo);"><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/><listitem/></hbox>
+</window>
diff --git a/layout/xul/crashtests/514300-1.xul b/layout/xul/crashtests/514300-1.xul
new file mode 100644
index 000000000..d0d655011
--- /dev/null
+++ b/layout/xul/crashtests/514300-1.xul
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="document.getElementById('listbox').removeChild(document.getElementById('span'));">
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="foo">
+    <content><listitem xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listitem></content>
+  </binding>
+</bindings>
+
+<listbox id="listbox" style="-moz-binding: url(#foo)"><span xmlns="http://www.w3.org/1999/xhtml" id="span"/></listbox>
+
+</window>
diff --git a/layout/xul/crashtests/536931-1.xhtml b/layout/xul/crashtests/536931-1.xhtml
new file mode 100644
index 000000000..6f3fc1396
--- /dev/null
+++ b/layout/xul/crashtests/536931-1.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<listbox id="listbox" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><tab/></listbox>
+<script>window.addEventListener("load", function() { document.documentElement.appendChild(document.getElementById("listbox")); }, false);</script>
+</html>
diff --git a/layout/xul/crashtests/538308-1.xul b/layout/xul/crashtests/538308-1.xul
new file mode 100644
index 000000000..a96f3fa4e
--- /dev/null
+++ b/layout/xul/crashtests/538308-1.xul
@@ -0,0 +1,32 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        onload="run()">
+
+    <tree id="tr" flex="1">
+        <treecols>
+            <treecol/>
+        </treecols>
+        <treechildren>
+            <html:optgroup id="group">
+                <html:option id="victim" label="never see this"/>
+            </html:optgroup>
+        </treechildren>
+    </tree>
+
+    <script type="text/javascript"><![CDATA[
+    function run() {
+        group = document.getElementById("group");
+        tc = document.createElement("treechildren");
+        group.appendChild(tc);
+
+        v = document.getElementById("victim");
+        v.parentNode.removeChild(v);
+        v = null;
+
+        tree = document.getElementById("tr");
+        col = tree.columns[0];
+        alert(tree.view.getItemAtIndex(1, col)); 
+    }
+    ]]></script>
+</window>
diff --git a/layout/xul/crashtests/557174-1.xml b/layout/xul/crashtests/557174-1.xml
new file mode 100644
index 000000000..02850a2db
--- /dev/null
+++ b/layout/xul/crashtests/557174-1.xml
@@ -0,0 +1 @@
+<ther:window xmlns:ther="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" a="" e=""><HTML><ther:statusbar l="" c=""><ther:menulist d=""><ther:menu t="" i="" l=""><mat:h xmlns:mat="http://www.w3.org/1998/Math/MathML" w=""/></ther:menu><ther:menupopup p=""/><ther:menu a="" t="" l=""><ther:menuseparator u="" x=""><xht:html xmlns:xht="http://www.w3.org/1999/xhtml" x=""><xht:body d=""><xht:abbr d=""><xht:abbr p=""><xht:small s=""><xht:a s=""><xht:var e=""><xht:samp e=""><xht:code p=""><xht:b e=""><xht:b d=""><xht:del t=""><xht:h4 r=""><xht:var l=""><xht:i r=""><xht:em r=""><xht:em n=""><xht:map g=""><xht:isindex d=""/></xht:map></xht:em></xht:em></xht:i></xht:var></xht:h4></xht:del></xht:b></xht:b></xht:code></xht:samp></xht:var></xht:a></xht:small></xht:abbr></xht:abbr></xht:body></xht:html></ther:menuseparator></ther:menu></ther:menulist></ther:statusbar></HTML></ther:window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/564705-1.xul b/layout/xul/crashtests/564705-1.xul
new file mode 100644
index 000000000..b0f29bef7
--- /dev/null
+++ b/layout/xul/crashtests/564705-1.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><label value="&#x2026;" accesskey="b"></label></window>
+
diff --git a/layout/xul/crashtests/583957-1.html b/layout/xul/crashtests/583957-1.html
new file mode 100644
index 000000000..85b51bf0c
--- /dev/null
+++ b/layout/xul/crashtests/583957-1.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  window.addEventListener("DOMSubtreeModified", function(){}, false);
+
+  var m = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "menuitem");
+  document.body.appendChild(m);
+  m.setAttribute("type", "checkbox");
+  m.setAttribute("checked", "true");
+  m.removeAttribute("type");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/xul/crashtests/617089.html b/layout/xul/crashtests/617089.html
new file mode 100644
index 000000000..22e5f6d53
--- /dev/null
+++ b/layout/xul/crashtests/617089.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <div style="display: -moz-inline-box;">
+      <table style="height: 101%;"><tbody><tr><td><div></div></td></tr></tbody></table>
+      <table style="height: 101%;"><tbody><tr><td><div></div></td></tr></tbody></table>
+    </div>
+  </body>
+</html>
diff --git a/layout/xul/crashtests/716503.html b/layout/xul/crashtests/716503.html
new file mode 100644
index 000000000..250ad2ba4
--- /dev/null
+++ b/layout/xul/crashtests/716503.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+div::before {
+  content: "j";
+  display:-moz-inline-box;
+}
+</style>
+<body><div></div></body>
+</html>
diff --git a/layout/xul/crashtests/crashtests.list b/layout/xul/crashtests/crashtests.list
new file mode 100644
index 000000000..4ee6654c6
--- /dev/null
+++ b/layout/xul/crashtests/crashtests.list
@@ -0,0 +1,99 @@
+load 131008-1.xul
+load 137216-1.xul
+load 140218-1.xml
+load 151826-1.xul
+load 168724-1.xul
+load 189814-1.xul
+load 237787-1.xul
+load 265161-1.xul
+load 289410-1.xul
+load 290743.html
+load 291702-1.xul
+load 291702-2.xul
+load 291702-3.xul
+load 294371-1.xul
+load 311457-1.html
+load 321056-1.xhtml
+load 322786-1.xul
+load 325377.xul
+load 326834-1.html
+load 326879-1.xul
+load 327776-1.xul
+load 328135-1.xul
+load 329327-1.xul
+load 329407-1.xml
+load 329477-1.xhtml
+load 336962-1.xul
+load 344228-1.xul
+load 346083-1.xul
+load 346281-1.xul
+load 350460.xul
+load 360642-1.xul
+load 365151.xul
+load 366112-1.xul
+asserts(0-50) load 366203-1.xul # bug 1217984
+asserts(24) asserts-if(Android&&!asyncPan,9) load 367185-1.xhtml # bug 1220345
+load 369942-1.xhtml
+load 374102-1.xul
+load 376137-1.html
+load 376137-2.html
+load 377592-1.svg
+load 378961.html
+load 381862.html
+load 382746-1.xul
+load 382899-1.xul
+load 383236-1.xul
+load 384037-1.xhtml
+load 384105-1.html
+load 384373.html
+load 384491-1.xhtml
+load 384871-1.html
+load 386642.xul
+load 387033-1.xhtml
+load 387080-1.xul
+load 391974-1.html
+load 394120-1.xhtml
+load 397293.xhtml
+load 397304-1.html
+load 398326-1.xhtml
+load 399013.xul
+load 400779-1.xhtml
+load 402912-1.xhtml
+load 404192.xhtml
+load 407152.xul
+load 408904-1.xul
+load 412479-1.xhtml
+asserts(4) asserts-if(gtkWidget&&browserIsRemote,6) load 415394-1.xhtml # Bug 163838, bug 1195474
+load 417509.xul
+load 420424-1.xul
+load 430356-1.xhtml
+load 431738.xhtml
+load 432058-1.xul
+load 432068-1.xul
+load 432068-2.xul
+load 433296-1.xul
+load 433429.xul
+load 434458-1.xul
+load 452185.html
+load 460900-1.xul
+load 464149-1.xul
+asserts-if(winWidget,1) asserts-if(Android,0-1) load 464407-1.xhtml # Bug 450974 on win, Bug 1267054 on Android
+load 467080.xul
+load 467481-1.xul
+load 470063-1.html
+load 470272.html
+load 472189.xul
+load 475133.html
+load 488210-1.xhtml
+load 495728-1.xul
+load 508927-1.xul
+load 508927-2.xul
+load 514300-1.xul
+load 536931-1.xhtml
+asserts(1) load 538308-1.xul
+load 557174-1.xml
+load 564705-1.xul 
+load 583957-1.html
+load 617089.html
+load menulist-focused.xhtml
+load 716503.html
diff --git a/layout/xul/crashtests/menulist-focused.xhtml b/layout/xul/crashtests/menulist-focused.xhtml
new file mode 100644
index 000000000..7a09a838d
--- /dev/null
+++ b/layout/xul/crashtests/menulist-focused.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body>
+<xul:menulist focused="true"/>
+</body>
+</html>
-- 
cgit v1.2.3