Add crashtests

2024-09-13 09:24:08 -07:00 · 2009-08-27 19:48:20 -07:00 · 2009-08-27 19:48:20 -07:00 · 15e3a448a6
commit 15e3a448a6
parent 1fd8a8a3a4
49 changed files with 574 additions and 0 deletions
--- a/content/base/crashtests/418928-1.html
+++ b/content/base/crashtests/418928-1.html
@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.execCommand('selectAll', false, null);">
+
+<select><option contenteditable="true">A</option></select>
+
+</body>
+</html>
--- a/content/base/crashtests/420620-1.html
+++ b/content/base/crashtests/420620-1.html
@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var a = document.documentElement;
+  var b = document.body;
+
+  document.removeChild(a);
+  b.contentEditable = "true";
+  document.appendChild(a);
+
+  function t() {
+    document.removeEventListener("DOMAttrModified", t, false);
+    document.removeChild(a);
+  } 
+
+  document.addEventListener("DOMAttrModified", t, false);
+  document.execCommand("insertunorderedlist", false, "<h1>");
+  document.removeEventListener("DOMAttrModified", t, false);
+}
+
+</script>
+</head>
+
+<body onload="boom()"></body>
+</html>
--- a/content/base/crashtests/443538-1.svg
+++ b/content/base/crashtests/443538-1.svg
@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     onload="document.getElementById('use').removeChild(document.getElementById('s'));">
+
+  <use id="use" xlink:href="#s"><g id="s"/></use>
+
+</svg>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@ -42,8 +42,11 @@ load 400763-1.html
 load 407818.html
 load 410860-1.xml
 load 416734-1.html
+load 418928-1.html
+load 420620-1.html
 load 424276-1.html
 load 426987-1.html
+load 443538-1.svg
 skip load 458637-1.html # sporadically fails -- see bug 473680
 load 472593-1.html
 load 474041-1.svg
--- a/content/svg/content/src/crashtests/448244-1.svg
+++ b/content/svg/content/src/crashtests/448244-1.svg
@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<filter id="filter1">
+  <feTile/>
+</filter>
+
+<rect width="100%" height="100%" filter="url(#filter1)"/>
+
+</svg>
--- a/content/svg/content/src/crashtests/crashtests.list
+++ b/content/svg/content/src/crashtests/crashtests.list
@ -41,4 +41,5 @@ load 427325-1.svg
 load 428228-1.svg
 load 428841-1.svg
 load 435209-1.svg
+load 448244-1.svg
 load 466576-1.xhtml
--- a/docshell/base/crashtests/430124-1.html
+++ b/docshell/base/crashtests/430124-1.html
@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body onpagehide="document.getElementById('a').focus();"><div id="a"></div></body>
+</html>
--- a/docshell/base/crashtests/430628-1.html
+++ b/docshell/base/crashtests/430628-1.html
@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onpagehide="document.body.removeChild(document.getElementById('s'));">
+<span id="s" contenteditable="true"></span>
+</body>
+</html>
--- a/docshell/base/crashtests/crashtests.list
+++ b/docshell/base/crashtests/crashtests.list
@ -1,6 +1,8 @@
 load 40929-1.html
 load 369126-1.html
 load 403574-1.xhtml
+load 430124-1.html
+load 430628-1.html
 load 432114-1.html
 load 432114-2.html
 load 436900-1.html
--- a/editor/libeditor/html/crashtests/418923-1.html
+++ b/editor/libeditor/html/crashtests/418923-1.html
@ -0,0 +1,19 @@
+<html><head><script type="text/javascript">
+
+function boom()
+{
+  var dE = document.documentElement;
+  var head = document.getElementsByTagName("head")[0];
+  dE.removeChild(document.body);
+  dE.contentEditable = "true";
+  dE.focus();
+  dE.contentEditable = "false";
+  head.focus();
+  head.contentEditable = "true";
+  try {
+    document.execCommand("selectAll", false, "");
+  } catch(e) {
+  }
+}
+
+</script></head><body onload="boom();"></body></html>
--- a/editor/libeditor/html/crashtests/crashtests.list
+++ b/editor/libeditor/html/crashtests/crashtests.list
@ -2,6 +2,7 @@ load 336081-1.xhtml # asserts (no bug?)
 load 382778-1.html
 load 407074-1.html
 load 407277-1.html
+load 418923-1.html
 load 420439.html
 load 428489-1.html
 load 431086-1.xhtml
--- a/gfx/src/thebes/crashtests/423110-1.xhtml
+++ b/gfx/src/thebes/crashtests/423110-1.xhtml
@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="min-width: -moz-max-content; float: left;"><head style="padding: 200%; display: -moz-inline-box; float: inherit;"></head></html>
--- a/gfx/src/thebes/crashtests/crashtests.list
+++ b/gfx/src/thebes/crashtests/crashtests.list
@ -1,3 +1,4 @@
 load 306902-1.xml
 load 383872-1.svg
+load 423110-1.xhtml
 load 445711.html
--- a/layout/base/crashtests/414175-1.xul
+++ b/layout/base/crashtests/414175-1.xul
@ -0,0 +1,26 @@
+<xul xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+  var oldListbox = document.getElementById("oldListbox");
+  var listitem = document.getElementById("listitem");
+  var newListbox = document.createElementNS(XUL_NS, "listbox");
+  var newHbox = document.createElementNS(XUL_NS, "hbox");
+
+  oldListbox.appendChild(newListbox);
+  listitem.appendChild(newHbox);
+
+  newListbox.style.display = "inline";
+  oldListbox.style.display = "block";
+  newHbox.style.display = "inline";
+}
+
+</script>
+
+<listbox id="oldListbox"><listitem id="listitem" /></listbox>
+
+</xul>
--- a/layout/base/crashtests/428138-1.html
+++ b/layout/base/crashtests/428138-1.html
@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+  var fo  = document.createElementNS("http://www.w3.org/2000/svg", "foreignObject");
+  fo.style.padding = "10em";
+  svg.appendChild(fo);
+  document.body.appendChild(svg);
+  document.body.offsetHeight;
+
+  var opt = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+  fo.appendChild(opt);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
--- a/layout/base/crashtests/429780-1.xhtml
+++ b/layout/base/crashtests/429780-1.xhtml
@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head>
+<script>window.addEventListener("load", function() { document.getElementById("v").style.MozBinding = "url(#foo)"; }, false);</script>
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content></content></binding></bindings>
+</head>X<span><div id="v"></div></span></html>
--- a/layout/base/crashtests/444863-1.html
+++ b/layout/base/crashtests/444863-1.html
@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+#a {
+	float: left;
+	position: relative;
+	padding: 331890106943cm 0;
+}
+
+#b {
+	position: absolute;
+	top: 100%;
+}
+
+
+</style>
+</head>
+
+<body>
+<div id="a"><div id="b"></div></div>
+</body>
+
+</html>
--- a/layout/base/crashtests/444967-1.html
+++ b/layout/base/crashtests/444967-1.html
@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+body { 
+  margin: 0pt; direction: rtl; word-spacing: 68710545em;
+  background: url("data:image/png,%89PNG%0D%0A%1A%0A%00%00%00%0DIHDR%00%00%0A(%00%00%00(%08%02%00%00%00%E13w%BE%00%00%02'iCCPICC%20Profile%00%00x%9C%95%92%BFk%13a%18%C7%3F%97PZ%D4%86R%A3%88%22%DE%20%D6B%D43%E9%901m~H%92%23%9EIJ%9A%D0%25%B9K%93hr9.%97%F8%03%85n%AEN%BAfQ2tT%EA%24%01%17%3B%14%2C%15%5B%FC%0B%BAW%BAH%8D%C3y%17%10J%F1%81%17%3E%CF%C3%F3%3E%3F%BE%EF%0B%DE%9Fe%C3hz%80%96n%99%D9%7BK%E2J%B1%24N%EE3%C15%CEp%81%F9%B2%DA1%16%15E%E6D%3B%FA%8E%00%B0%7B%ABl%18%CD%99%D5W%5B%2FS%07%5B%1F~%BF%D9%BD%3Aw9p%F2%3D%00%7C%E6J%B1%04B%00%F0%D7l%8E%00%FE%8A%CDy%C0%FF%D82%2C%10%EA%80_%AD%975%10%9E%03%013%9F%8D%820%00%7C5%9B%3F%02%BE%8A%CD_%00_O%ADY%20%EC%03%92%AE5t%F0L%01a%AD%DAQ%C1%13%01jZGm%81g%00%02%ADV%5B%03%EF%00%B8%A9%1A%A6%05%DE%AF%C0%F5%95bI%B4G%EE%CB%90%DE%01%BE%8Dcw%A6%A1%FF%16%FC%A9ql%EE%05%9C%EF%C3%A7%A9q%ECp%1F%01%10.Nu%D6BA%00%84%B3%9B0%F1z4%3A%2C%C0%E4%3C%1C%EF%8DF%BF6G%A3%E3w%E0%FD%01%C3%23%B5k%F6%FE%EA%25%08%DBp%9Ao%EFl%FB%B0c9t%12%DB%BA%00%20%C1%C6%3A%3C%18%82%04%BC%1F%C2%8D%3D%98%BD%02J%04%F2%11%3C%A1%90sl%0D%01%98%8E%C5eY%0C.H%E1BB9%E5%CD%FF%DBZ%CD%AE%D3g%168%A7W2%F7%81K%C0%81a)y%87%3B%BD%5C%DC%E1%B5F%22%E9%B0V%8E%A5%1D~V%8Ff%DC%1C3%91u%F8a9%A58%5C%D5%97sn%FD%A6%22%8F%7B-%B9%F9%D5N%3C7%AE%99%2F8lv%B3%CB%0E%3Fj%A7%DD%7C%AD%1Asg%D3%9B%19%B7f%C3J%BA%F3%13%23%8E%8C%8CH%90%05%24%C2%14H%A0%D8%7F%12%60f%03%FA%F3w%A5P%EE%F3va%FD_%9D%AC%EA%13%0B%20%DA6%9E%9A%8DZ%DD%12%17%0D%A3Y%0D%88I%5D%BD%1D%10%83%92%14%E6%0Fy4%B1%B9%90%3E%3B%0B%00%00%02%FBIDATx%9C%ED%D9%3Br%DB%40%14E%C1%A1%F7%BFg%3Aq%E0R%D9%FA%10%001g%A6%3BR%22%88%AC%BAO%01%CEc%AC%E8%F1x%BC%FC%C3%91%DF%9D%E1%F9%CB%7C%11%CF_%FB%F9%CB%7C%11%CF%F7%FC%C4%1F%F2%FCi%9F%0F%00%00%00%00%B0%8C_w%7F%80%ED%3C%9F%CF%BB%3F%02%7C%CDPa8%04%00%00%00%00%00%F86%E1%F9%23%99%81%04C%85%E1%10%880T%00%00%00%00%60%07%C23%5CBf%80%E1%10%880T%00%00%00%00%80%E3%84g6%253%C0p%08D%18*%00%00%00%00%C0%FC%84g%80y%E9m%24%18*%00%00%00%00%00%C23%93%921H0T%12%0C%15%00%00%00%00%80%AB%09%CF%BCH%C6%20%C1PI0T%00%00%00%00%00%EA%84%E7e%C9%18%24%18*%09%86%0A%00%00%00%00%00%9F%13%9Eo%23c%90%60%A8%24%18*%09%86%0A%00%00%00%00%2CLx%FE%2Fo%87I0T%12%0C%95%04C%05%00%00%00%00x%99%F0%0C%D7%921H0T%12%0C%15%00%00%00%00%60Z%C23%BB%931H0T%12%0C%15%00%00%00%00%60%5B%C23%B3%931H0T%12%0C%15%00%00%00%00%80%8B%08%CF%1C%25c%90%60%A8%24%18*%00%00%00%00%00Q%C2%F3%FAd%0C%12%0C%95%04C%05%00%00%00%00%80%7F%12%9E%EF'c%90%60%A8%24%18*%09%86%0A%00%00%00%00%ACGx%FE%9A%B7%C3%24%18*%09%86%0A%00%00%00%00%00K%12%9E%E1M%F46%12%0C%15%86C%00%00%00%00%00%F89%E1%19%FE%90%19H0T%18%0E%01%00%00%00%00%60%3E%C23%192%03%09%86%0A%C3!%00%00%00%00%00%ECGx%E642%03%40%85%FF%D8%00%00%00%00%00%9CKx%DE%88%CC%00%C3!%10a%A8%00%00%00%00%00%B4%08%CF%13%91%19%608%04%22%0C%15%00%00%00%00%00%FE%26%3C%FF%80%CC%00%C3!%10a%A8%00%00%00%00%00%F0N%C23%ACFo%23%C1PI0T%00%00%00%00%80o%12%9E%E1%DDd%0C%12%0C%95%04C%05%00%00%00%00%98%84%F0%0C%1F%C9%18%24%18*%09%86%0A%00%00%00%00%B0%09%E1%99%1E%19%83%04C%25%C1P%01%00%00%00%008%85%F0%CC%F9d%0C%12%0C%95%04C%05%00%00%00%00%20Ax%DE%91%8CA%82%A1%92%60%A8%00%00%00%00%000%84%E79%C9%18%24%18*%09%86%0A%00%00%00%00%00o%20%3C%BFB%C6%20%C1PI0T%12%0C%15%00%00%00%00%E0sk%86go%87I0T%12%0C%95%04C%05%00%00%00%00%B8%D7%9A%E1%19N!c%90%60%A8%24%18*%00%00%00%00%C0%DA%84g%C2d%0C%12%0C%95%04C%05%00%00%00%00%E0%08%E1%99%0B%C9%18%24%18*%09%86%0A%00%00%00%00%C0%CC%84%E7%AD%C9%18%24%18*%00%00%00%00%00%C0%E4%84%E7%A9%E9m%24%18*%0C%87%00%00%00%00%00%C0%DE%84%E7Cd%06%12%0C%15%86C%00%00%00%00%00%80%2B%FD%06%ECHi%F4%A12%1A%B2%00%00%00%00IEND%AEB%60%82");
+}
+</style>
+</head>
+<body>A B </body>
+</html>
--- a/layout/base/crashtests/448488-1.html
+++ b/layout/base/crashtests/448488-1.html
@ -0,0 +1,4 @@
+<html>
+<head></head>
+<body style="width: 17179869184ch"></body>
+</html>
--- a/layout/base/crashtests/450319-1.xhtml
+++ b/layout/base/crashtests/450319-1.xhtml
@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML" class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var newSpan = document.createElement('span');
+  var mr = document.getElementById("mr");
+  mr.appendChild(newSpan);
+
+  var vv = document.getElementById("vv");
+  vv.parentNode.removeChild(vv);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<style type="text/css">
+
+body { background: url("data:image/gif,GIF89a1%00%3C%00%D5%FF%00%9D%B6%85%18%1C%14%8E%A4xz%8Dg%3AC1%9F%B6%86%A3%B8%89%1F%23%1A%9C%AD%85(%2C!%AD%BC%93%0A%0B%08bkP%BC%C2%A0PP%3E%C7%C5%A9%BD%B4%85%13%11%0C%CA%B8%8A%CE%B6%85%B7%A2v3.%24%D0%B7%88%9F%8Ch%82rU%D2%BA%8D%D8%BF%9B%A2%94%80%D7%C9%B5%26!%1AC9.%C7%AD%96%EB%C6%B5%E6%CB%BE%AD%8F%88%F1%CB%C2%C0%C0%C0%F6%CC%C7%BF%9B%99%D2%A9%A8%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00!%F9%04%01%00%00%24%00%2C%00%00%00%001%00%3C%00%00%06%FF%40%92pH%2C%1A%8F%C4%D2%A8%84l%3AI%A5(%D3Y%0A%3D%14%06%83%E2%11%9A%3E%8DU%0E%E7%F1h4%1E%9CPh%09%25%86%1A%06%80%1CP0%9CC%DFa%89%03%2F%CC%FFu%0Af%0D%1CL%23%0F%06~%7Fru%1Cy%24%1C%0As%03%94%95%03%07%98%07%04%0C%08gp%02%0C%15%09%A3%A3%15%0C%00%06xO%23%0D~%03%09%04%B1%B1%07%0B%A7r%03%B1u%05%A0%0C%02%8B%02%0E%0E%00%0D_%1Cq%B8%03%8B%09%C9%8B%0E%B6%CE%8B%93%09%00%0A%5EG%25%0D%A0%04%CC%7F%CB%D1%03%0E%A2%0B%A4%DB%8B(%A8%23N%23%0A%0C%E5%D1%DE%8B%ED%B6%93%04%E6%E8N!%02%F0%D1%FC%97%DC%DD%F6%14%A4k%12%02%1A%BF%83%B8%0EN%FBsNA%17%82%0B%0F%F2%13%F0%EF%8F0%00%95%CE%D9)%84%24DD%89%20%0F%3A%20%B0%60%5B%1D%03%8E%8Ex%0C%C9%12%24%B2%2C)%8B%1C%FA%D8%B2%E6%1Cg0eF2%F0%D1AE%FF%9B%08%094J%82HN%C4K%BE%80%86%C45t%88%B19%A6%7C%05S%CA%92)%CA!%EB%E48%40%C1U%DCO%AA%8B%12*%88%19%E2X%BDn%F3%C0%F2cp%D1%A1%90%B2%006%85%25%90%14%A3Z%06%A7%F0%26-%F0%40%08%079%07%EA%CEa%9B%F4%80Z%01%01%128%10%80%82Y5H%80E%1A%06%10%400P%C6%B7%CA%09%84%0C%60r%3F9l%D5%02%80%970%15%24%3F%9EA%5E%04%BB%CF%F0U%B8%A9EK%C4%3C%C70_%12Y%DD%C9%3E%08%2C%ED%E4%06Q%1A%00%60%40s%F7%9F%D0%7Flo~%3A%A0%B2qs4%05(%C7S%02Q%01%06%07%02%60%FA%FA%BC%1D%1D%B7%B8%AF%F8%D1%FD%FC%97%BB%CDB%F6H%22_%1E%B4w%3A%C4%88%16%60%DF%3E%163%D3E%CA%D2%07%E0%93Q%81%FF%00%D6%A4%5B%7C2)%B0_9%06%40%A0%E0%82Y(%F2%07Es%08%40%17*%0D%0Cd%C4%03%84E%B3%8D%01%1B%400%FF%C1%87%1FZ%20%01%0A%13%CA%01L%89xi%F1%80%85F%84%60%E0j%B5%09%A0%803%20%D6%88%C2T%A0%05%93%89%03%08p%C0%06%3E%08%8C%C4%CD%2B%09h%40%81%075%82%88%82%04%09%90h_%16*%B2%F8%84%8B%EDd'K%05%1ALPA%92%1F%A20%81%06%0Dl%B0%81%09j%A8!e%1Ea%5C!%E6%06%1D0p%C1%96%5Czy%E6%23Txq%82%08or9%81%97t%F6y%84%96z%F2%E9%E7%A0B%00%1A%A7%05%84%12jh%92(d%90%E8%A0%8B%DA%98%C1%9C%8F6%11%A9%92%93V%FA%C8%08G%06j%01%A5%9A%16%A1%01%5E%81N%00B%A8_P%E0%00%05%A5%9E%8Aj%13%20%60%E0%00%88%16%D4X%C1%05%1A%BCz%C4%08%20%A8z%C1%87%17%D4z%EB%04oZ%E0%EA%A0'%0Ct%82%09%CC6%CB%EC%05%0E%60%F0!%04%1D%7C%D8A%02%AC%B2u%81%AB%234%7B%C2%17%A1TPA0%E4%92%EBA%04%B3N%20%91k%BA%1D%60%80%E4%04%1E%5C%2B%EE%B8%C1T%E0%C1%BD%F8z%80A%1E%BC%C2%1B%01%B1%15D%F0.%BC%D0%FEJA%05%18%80%60%CD%A3%C4u%D0%81%BE%F6b%F0%26%AB%EA%3A%00-%AB%05%7F8%02%A8%AB%88%90%80%87%D0zpA%06%19X%80A%02%BFB%20%F2%C9%F7%BA%E9%E1%87%99%FA%99%A5%06%25%5B%AC%01%1B%BC%BEy%AB%AC%C0%5E%20%2B%0A%F3N%60A%AE%BA%0A1%82%05%17%24%20%B1%D0!f%A0%C1%9A%1Ahpl%D1%24%80%F0A%07NS%ED%A7%09%95%06%01%00%3B"); }
+
+</style> 
+</head>
+
+<div></div>
+
+<body onload="setTimeout(boom, 0);"><iframe /><m:mtd /><m:mrow id="mr" /></body>
+
+<span><div id="vv"></div></span>
+
+</html>
--- a/layout/base/crashtests/453894-1.xhtml
+++ b/layout/base/crashtests/453894-1.xhtml
@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="direction: rtl;">
+<head>
+<style type="text/css">
+
+.bg { background: url("data:image/gif,GIF89a1%00%3C%00%D5%FF%00%9D%B6%85%18%1C%14%8E%A4xz%8Dg%3AC1%9F%B6%86%A3%B8%89%1F%23%1A%9C%AD%85(%2C!%AD%BC%93%0A%0B%08bkP%BC%C2%A0PP%3E%C7%C5%A9%BD%B4%85%13%11%0C%CA%B8%8A%CE%B6%85%B7%A2v3.%24%D0%B7%88%9F%8Ch%82rU%D2%BA%8D%D8%BF%9B%A2%94%80%D7%C9%B5%26!%1AC9.%C7%AD%96%EB%C6%B5%E6%CB%BE%AD%8F%88%F1%CB%C2%C0%C0%C0%F6%CC%C7%BF%9B%99%D2%A9%A8%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00!%F9%04%01%00%00%24%00%2C%00%00%00%001%00%3C%00%00%06%FF%40%92pH%2C%1A%8F%C4%D2%A8%84l%3AI%A5(%D3Y%0A%3D%14%06%83%E2%11%9A%3E%8DU%0E%E7%F1h4%1E%9CPh%09%25%86%1A%06%80%1CP0%9CC%DFa%89%03%2F%CC%FFu%0Af%0D%1CL%23%0F%06~%7Fru%1Cy%24%1C%0As%03%94%95%03%07%98%07%04%0C%08gp%02%0C%15%09%A3%A3%15%0C%00%06xO%23%0D~%03%09%04%B1%B1%07%0B%A7r%03%B1u%05%A0%0C%02%8B%02%0E%0E%00%0D_%1Cq%B8%03%8B%09%C9%8B%0E%B6%CE%8B%93%09%00%0A%5EG%25%0D%A0%04%CC%7F%CB%D1%03%0E%A2%0B%A4%DB%8B(%A8%23N%23%0A%0C%E5%D1%DE%8B%ED%B6%93%04%E6%E8N!%02%F0%D1%FC%97%DC%DD%F6%14%A4k%12%02%1A%BF%83%B8%0EN%FBsNA%17%82%0B%0F%F2%13%F0%EF%8F0%00%95%CE%D9)%84%24DD%89%20%0F%3A%20%B0%60%5B%1D%03%8E%8Ex%0C%C9%12%24%B2%2C)%8B%1C%FA%D8%B2%E6%1Cg0eF2%F0%D1AE%FF%9B%08%094J%82HN%C4K%BE%80%86%C45t%88%B19%A6%7C%05S%CA%92)%CA!%EB%E48%40%C1U%DCO%AA%8B%12*%88%19%E2X%BDn%F3%C0%F2cp%D1%A1%90%B2%006%85%25%90%14%A3Z%06%A7%F0%26-%F0%40%08%079%07%EA%CEa%9B%F4%80Z%01%01%128%10%80%82Y5H%80E%1A%06%10%400P%C6%B7%CA%09%84%0C%60r%3F9l%D5%02%80%970%15%24%3F%9EA%5E%04%BB%CF%F0U%B8%A9EK%C4%3C%C70_%12Y%DD%C9%3E%08%2C%ED%E4%06Q%1A%00%60%40s%F7%9F%D0%7Flo~%3A%A0%B2qs4%05(%C7S%02Q%01%06%07%02%60%FA%FA%BC%1D%1D%B7%B8%AF%F8%D1%FD%FC%97%BB%CDB%F6H%22_%1E%B4w%3A%C4%88%16%60%DF%3E%163%D3E%CA%D2%07%E0%93Q%81%FF%00%D6%A4%5B%7C2)%B0_9%06%40%A0%E0%82Y(%F2%07Es%08%40%17*%0D%0Cd%C4%03%84E%B3%8D%01%1B%400%FF%C1%87%1FZ%20%01%0A%13%CA%01L%89xi%F1%80%85F%84%60%E0j%B5%09%A0%803%20%D6%88%C2T%A0%05%93%89%03%08p%C0%06%3E%08%8C%C4%CD%2B%09h%40%81%075%82%88%82%04%09%90h_%16*%B2%F8%84%8B%EDd'K%05%1ALPA%92%1F%A20%81%06%0Dl%B0%81%09j%A8!e%1Ea%5C!%E6%06%1D0p%C1%96%5Czy%E6%23Txq%82%08or9%81%97t%F6y%84%96z%F2%E9%E7%A0B%00%1A%A7%05%84%12jh%92(d%90%E8%A0%8B%DA%98%C1%9C%8F6%11%A9%92%93V%FA%C8%08G%06j%01%A5%9A%16%A1%01%5E%81N%00B%A8_P%E0%00%05%A5%9E%8Aj%13%20%60%E0%00%88%16%D4X%C1%05%1A%BCz%C4%08%20%A8z%C1%87%17%D4z%EB%04oZ%E0%EA%A0'%0Ct%82%09%CC6%CB%EC%05%0E%60%F0!%04%1D%7C%D8A%02%AC%B2u%81%AB%234%7B%C2%17%A1TPA0%E4%92%EBA%04%B3N%20%91k%BA%1D%60%80%E4%04%1E%5C%2B%EE%B8%C1T%E0%C1%BD%F8z%80A%1E%BC%C2%1B%01%B1%15D%F0.%BC%D0%FEJA%05%18%80%60%CD%A3%C4u%D0%81%BE%F6b%F0%26%AB%EA%3A%00-%AB%05%7F8%02%A8%AB%88%90%80%87%D0zpA%06%19X%80A%02%BFB%20%F2%C9%F7%BA%E9%E1%87%99%FA%99%A5%06%25%5B%AC%01%1B%BC%BEy%AB%AC%C0%5E%20%2B%0A%F3N%60A%AE%BA%0A1%82%05%17%24%20%B1%D0!f%A0%C1%9A%1Ahpl%D1%24%80%F0A%07NS%ED%A7%09%95%06%01%00%3B"); }
+
+</style>
+</head>
+
+<body>
+
+<table style="letter-spacing: 1300000px;"><tbody style="font-size: 9%;" class="bg"><tr><td>BBBBBBBBBBBBB BBBBBBBBBBBBB BBBBBBBBBBBBB BBBBBBBBBBBBB</td>X</tr></tbody></table>
+
+</body>
+</html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@ -196,20 +196,28 @@ load 410967.html
 load 411870-1.html
 load 412651-1.html
 load 414058-1.html
+load 414175-1.xul
 load 420031-1.html
 load 420213-1.html
 load 420651-1.xhtml
 load 421203-1.xul
 load 423107-1.xhtml
 load 425981-1.html
+load 428138-1.html
 load 428448-1.html
 load 429088-1.html
 load 429088-2.html
+load 429780-1.xhtml
 load 432752-1.svg
 load 433450-1.html
 load 437142-1.html
+load 444863-1.html
 load 444925-1.xul
+load 444967-1.html
 load 446328.html
+load 448488-1.html
+load 450319-1.xhtml
+load 453894-1.xhtml
 load 454751-1.xul
 load 455063-1.html
 load 455063-2.html
--- a/layout/forms/crashtests/378413-1.xhtml
+++ b/layout/forms/crashtests/378413-1.xhtml
@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="direction: rtl;">
+
+<form style="display: -moz-deck; width: 1em;">
+<fieldset>
+  <legend>Your name</legend>
+  <input type="text" name="name" size="20"/>
+</fieldset>
+<fieldset>
+  <legend>Your E-mail address</legend>
+  <input type="text" name="email" size="25"/>
+</fieldset>
+</form>
+
+</body>
+</html>
--- a/layout/forms/crashtests/crashtests.list
+++ b/layout/forms/crashtests/crashtests.list
@ -20,6 +20,7 @@ load 367587-1.html
 load 370703-1.html
 load 370940-1.html
 load 373586-1.xhtml
+load 378413-1.xhtml
 load 380116-1.xhtml
 load 382212-1.xhtml
 load 382610-1.html
--- a/layout/generic/crashtests/345617-1.html
+++ b/layout/generic/crashtests/345617-1.html
@ -0,0 +1,8 @@
+<html>
+<body style="line-height: 30760827em;">
+
+x
+<p>y
+
+</body>
+</html>
--- a/layout/generic/crashtests/413712-1.xhtml
+++ b/layout/generic/crashtests/413712-1.xhtml
@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="display: table">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var tr = document.getElementById("tr");
+  tr.contentEditable = "true";
+  tr.focus();
+  document.execCommand("selectAll", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><tr id="tr"><td></td></tr></body>
+
+</html>
--- a/layout/generic/crashtests/414180-1.xul
+++ b/layout/generic/crashtests/414180-1.xul
@ -0,0 +1,7 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<grid style="margin: -1px; display: inline;" />
+
+</window>
--- a/layout/generic/crashtests/417109-1.xhtml
+++ b/layout/generic/crashtests/417109-1.xhtml
@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="foo">
+    <content><html:span> &#x200F;&#x0643;&#xCA84;<children/></html:span></content>
+  </binding>
+  <binding id="empty">
+    <content></content>
+  </binding>
+</bindings>
+
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  document.getElementById("b").style.MozBinding = "url('#empty')";
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><table style="-moz-binding: url(#foo)"><td id="b"/></table></body>
+
+</html>
--- a/layout/generic/crashtests/420000-1.html
+++ b/layout/generic/crashtests/420000-1.html
@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="-moz-column-gap: 24000000em; -moz-column-count: 5;"></div>
+
+</body>
+</html>
--- a/layout/generic/crashtests/430344-1.html
+++ b/layout/generic/crashtests/430344-1.html
@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="width: 1px;"><span>e</span> <br style="clear: both;"></body>
+</html>
--- a/layout/generic/crashtests/436822-1.html
+++ b/layout/generic/crashtests/436822-1.html
@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body { font-size: 1600000px; }
+body * { font-size: 10em; }
+
+</style>
+</head>
+
+<body>
+  <div>
+    <div style="margin-top: 1em; margin-bottom: 1em;">A</div>
+  </div>
+  <div>
+    <div style="margin-top: 1em; margin-bottom: 1em;">B<div style="display: list-item; padding-left: 3px; float: left;"></div></div>
+  </div>
+  <div style="float: left;"></div>
+</body>
+
+</html>
--- a/layout/generic/crashtests/444230-1.html
+++ b/layout/generic/crashtests/444230-1.html
@ -0,0 +1 @@
+<html><body><span style="padding: 200%; vertical-align: top;">x<br></span></body></html>
--- a/layout/generic/crashtests/444484-1.html
+++ b/layout/generic/crashtests/444484-1.html
@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style type="text/css">
+
+body:first-letter { float: right; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var t = document.body.firstChild;
+  var se = document.getElementById("se");
+  se.appendChild(t); // !!!
+  document.body.appendChild(se);
+  se.appendChild(document.createTextNode(" "));
+}
+
+</script>
+</head>
+
+<body onload="boom();">&#xFEB7;
+<div id="se" style="display: none;"></div></body>
+</html>
--- a/layout/generic/crashtests/444861-1.html
+++ b/layout/generic/crashtests/444861-1.html
@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("a").style.padding = "4643853%";
+  document.getElementById("a").style.counterIncrement = "a";
+  document.documentElement.offsetHeight;
+  document.getElementById("a").style.width = "1px";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div style="width: 430px;"><div id="a"><img style="float: left; margin-right: 15px; margin-top: 5px;">A B</div><div><li style="width: 45%; float: left;"></li><div style="float: left;"><span style="padding-left: 22px;"></span></div></div></div></body>
+</html>
--- a/layout/generic/crashtests/453762-1.html
+++ b/layout/generic/crashtests/453762-1.html
@ -0,0 +1,4 @@
+<html style="text-indent: 3700px;">
+<head></head>
+<body><span style="position: relative;"> <div style="position: absolute;"></div></span></body>
+</html>
--- a/layout/generic/crashtests/477731-1.html
+++ b/layout/generic/crashtests/477731-1.html
@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">body:first-letter { float: left; }</style>
+</head>
+<body style="-moz-column-width: 100000px;" onload="document.body.style.MozColumnWidth='';"> &#x08D9;</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@ -31,6 +31,7 @@ load 337883-2.html
 load 342322-1.html
 load 343206-1.xhtml
 load 345139-1.xhtml
+load 345617-1.html
 load 348887-1.html
 load 348991-1.xhtml
 load 354458-1.html
@ -167,15 +168,19 @@ load 413085-1.html
 load 413085-2.html
 load 413582-1.xhtml
 load 413582-2.html
+load 413712-1.xhtml
 load 414061-1.html
+load 414180-1.xul
 load 414719-1.html
 load 415685-1.html
 load 416264-1.html
 load 416476-1.html
+load 417109-1.xhtml
 load 417902-1.html
 load 417902-2.html
 load 418532-1.html
 load 418932-1.html
+load 420000-1.html
 load 420785-1.xhtml
 load 421404-1.html
 load 421671.html
@ -189,6 +194,7 @@ load 426272-1.html
 load 428263-1.html
 load 429969-1.html
 load 429981-1.html
+load 430344-1.html
 load 430352-1.html
 load 430744-1.html
 load 431260-1.html
@ -196,6 +202,7 @@ load 431260-2.html
 load 435529.html
 load 436194-1.html
 load 436602-1.html
+load 436822-1.html
 load 436823.html
 load 436969-1.html
 load 437156-1.html
@ -204,7 +211,10 @@ load 438266-1.html
 load 438509-1.html
 load 442860-1.xul
 load 443528-1.html
+load 444230-1.html
+load 444484-1.html
 load 444726-1.xhtml
+load 444861-1.html
 load 445288.html
 load 448903-1.html
 load 448996-1.html
@ -214,6 +224,7 @@ load 451334-1.html
 load 452157-1.html
 load 452157-2.html
 load 452157-3.html
+load 453762-1.html
 load 455171-1.html
 load 455171-2.html
 load 455171-3.html
@ -234,6 +245,7 @@ load 472774-1.html
 load 472776-1.html
 load 472950-1.html
 load 473278-1.xhtml
+load 477731-1.html
 load 477928.html
 load 478170-1.html
 load 478185-1.html
--- a/layout/style/crashtests/418007-1.xhtml
+++ b/layout/style/crashtests/418007-1.xhtml
@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+  <ms fontsize="8179em">
+    <span xmlns="http://www.w3.org/1999/xhtml">
+      <span>
+        <td>
+          <mfrac xmlns="http://www.w3.org/1998/Math/MathML">
+            <mfrac>
+              <mrow/>
+              <mrow/>
+            </mfrac>
+            <mrow/>
+          </mfrac>
+        </td>
+      </span>
+    </span>
+  </ms>
+</math>
+
+</body>
+</html>
--- a/layout/style/crashtests/437532-1.html
+++ b/layout/style/crashtests/437532-1.html
@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/csS">
+
+a\[href$=".pdf"\] { }
+
+</style>
+</head>
+<body>
+</body>
+</html>
--- a/layout/style/crashtests/452150-1.xhtml
+++ b/layout/style/crashtests/452150-1.xhtml
@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head></head>
+<body>
+<p><m:mo fontsize="268435456em"><m:mstyle scriptlevel="30"><m:mstyle scriptlevel="15"><span/></m:mstyle></m:mstyle></m:mo></p>
+</body>
+</html>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@ -17,9 +17,11 @@ load 404470-1.html
 load 411603-1.html
 load 413274-1.xhtml
 load 416461-1.xul
+load 418007-1.xhtml
 load 431705-1.xul
 load 432561-1.html
 load 437170-1.html
+load 437532-1.html
 skip load 439184-1.html # skip until we figure out how to test this
 load 444237-1.html
 load 444848-1.html 
@ -27,6 +29,7 @@ load 447776-1.html
 load 447783-1.html
 load 448161-1.html
 load 448161-2.html
+load 452150-1.xhtml
 load 456196.html
 load 460217-1.html
 load 466845-1.html
--- a/layout/tables/crashtests/420654-1.xhtml
+++ b/layout/tables/crashtests/420654-1.xhtml
@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<style type="text/css">
+
+[class="wide"] { width: 100000000px }
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("targ").appendChild(document.getElementById("cm").cloneNode(true)); 
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<table>
+  <tbody>
+    <td><m:mrow class="wide" id="cm"></m:mrow></td>
+    <tr><m:mrow id="targ"></m:mrow></tr>
+  </tbody>
+</table>
+</body>
+
+</html>
--- a/layout/tables/crashtests/450311-1.html
+++ b/layout/tables/crashtests/450311-1.html
@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head><style type="text/css" id="s"></style>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("x").style.cssFloat = "";
+  document.getElementById("s").textContent = "span { margin: -9684px; word-spacing: 31851153225in; }";
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<table>
+  <tr><td colspan="2"></td></tr>
+  <tr><td><span>1 2 3</span></td><td id="x" style="float: right;"><span>4 5 6</span></td></tr>
+</table>
+
+</body>
+</html>
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@ -84,9 +84,11 @@ load 413180-1.html
 load 416845-1.xhtml
 load 416845-2.xhtml
 load 416845-3.html   
+load 420654-1.xhtml
 load 423514-1.xhtml
 load 430374.html
 load 448988-1.xhtml
+load 450311-1.html
 load 456041.html
 load 457115.html
 load 467141-1.html
--- a/layout/xul/base/src/crashtests/420424-1.xul
+++ b/layout/xul/base/src/crashtests/420424-1.xul
@ -0,0 +1,6 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="document.getElementById('a').ensureElementIsVisible(null);">
+
+<listbox id="a"/>
+
+</window>
--- a/layout/xul/base/src/crashtests/432058-1.xul
+++ b/layout/xul/base/src/crashtests/432058-1.xul
@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();">
+
+<script type="text/javascript">
+// <![CDATA[
+
+var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+  var lb = document.getElementById("lb");
+  var firstli = document.getElementById("firstli");
+  lb.appendChild(document.createElementNS(XUL_NS, "hbox"));
+  lb.appendChild(document.createElementNS(XUL_NS, "listitem"));
+  firstli.style.display = "none";
+
+  // Flush layout.
+  document.getBoxObjectFor(document.documentElement).height;
+
+  lb.removeChild(firstli);
+}
+
+// ]]>
+</script>
+
+<listbox id="lb"><listitem id="firstli"/></listbox>
+
+</window>
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@ -42,8 +42,10 @@ load 402912-1.xhtml
 load 408904-1.xul
 load 412479-1.xhtml
 load 415394-1.xhtml
+load 420424-1.xul
 load 430356-1.xhtml
 load 431738.xhtml
+load 432058-1.xul
 load 432068-1.xul
 load 432068-2.xul
 load 433296-1.xul
--- a/widget/src/cocoa/crashtests/435223-1.html
+++ b/widget/src/cocoa/crashtests/435223-1.html
@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<div style="min-width: -moz-max-content;"><div style="-moz-appearance: button;"><div style="margin: 0 100%;"></div></div></div>
+</body>
+</html>
--- a/widget/src/cocoa/crashtests/crashtests.list
+++ b/widget/src/cocoa/crashtests/crashtests.list
@ -2,6 +2,7 @@ load 373122-1.html
 load 397209-1.html
 load 403296-1.xhtml
 load 419737-1.html
+load 435223-1.html
 load 444260-1.xul
 load 444864-1.html
 load 449111-1.html
				`@ -0,0 +1 @@`
				`<html xmlns="http://www.w3.org/1999/xhtml" style="min-width: -moz-max-content; float: left;"><head style="padding: 200%; display: -moz-inline-box; float: inherit;"></head></html>`
				`@ -0,0 +1 @@`
				`<html><body><span style="padding: 200%; vertical-align: top;">x<br></span></body></html>`