Add a bunch of crashtests

2024-09-13 09:24:08 -07:00 · 2010-06-08 17:53:08 -07:00 · 2010-06-08 17:53:08 -07:00 · 3dbc6bd8c8
commit 3dbc6bd8c8
parent 880a9c89c8
49 changed files with 521 additions and 0 deletions
--- a/content/base/crashtests/448615-1.html
+++ b/content/base/crashtests/448615-1.html
@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div:first-letter { float: right; }
+
+</style>
+</head>
+
+<body><div>A</div></body>
+
+</html>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@ -49,6 +49,7 @@ load 420620-1.html
 asserts(2) load 424276-1.html # bug 462897
 load 426987-1.html
 load 443538-1.svg
+load 448615-1.html
 load 450383-1.html
 load 450385-1.html
 skip load 458637-1.html # sporadically times out (bug 473680)
--- a/content/html/content/crashtests/465466-1.xhtml
+++ b/content/html/content/crashtests/465466-1.xhtml
@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="u">
+<content><foopy><children xmlns="http://www.mozilla.org/xbl"/></foopy></content>
+</binding></bindings>
+
+
+<script type="text/javascript">
+
+function boom()
+{
+  var f = document.getElementById("f");
+  var anon = document.getAnonymousNodes(f)[0];
+  document.body.removeChild(f);
+  anon.appendChild(document.createElement("label"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"><form id="f" style="-moz-binding: url(#u);"><label></label></form></body>
+</html>
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@ -10,6 +10,7 @@ load 423371-1.html
 load 451123-1.html
 load 453406-1.html
 load 464197-1.html
+load 465466-1.xhtml
 load 504183-1.html
 load 515829-1.html
 load 515829-2.html
--- a/content/media/test/crashtests/481136-1.html
+++ b/content/media/test/crashtests/481136-1.html
@ -0,0 +1,3 @@
+<html>
+<div><object data='sound.ogg'></div>
+</html>
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@ -3,6 +3,7 @@ load 466607-1.html
 load 466945-1.html
 load 468763-1.html
 load 474744-1.html
+HTTP load 481136-1.html # needs to be HTTP to recognize the ogg as an audio file?
 load 493915-1.html
 load 495794-1.html
 load 492286-1.xhtml
--- a/content/smil/crashtests/551620-1.svg
+++ b/content/smil/crashtests/551620-1.svg
@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<animate id="x" begin="y.end"/>
+<animate id="y"/>
+
+<script>
+
+function boom()
+{
+  var x = document.getElementById("x");
+  var y = document.getElementById("y");
+  y.appendChild(x);
+  y.setAttributeNS(null, "dur", "0.5s");
+  y.removeAttributeNS(null, "dur");
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+</svg>
--- a/content/smil/crashtests/crashtests.list
+++ b/content/smil/crashtests/crashtests.list
@ -10,6 +10,7 @@ load 537157-1.svg
 load 541297-1.svg
 load 547333-1.svg
 load 548899-1.svg
+load 551620-1.svg
 load 554202-1.svg
 load 554202-2.svg
 load 554141-1.svg
--- a/content/xbl/crashtests/463511-1.xhtml
+++ b/content/xbl/crashtests/463511-1.xhtml
@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="foo"><content><listcell xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listcell></content></binding>
+</bindings>
+</head>
+
+<body onload="document.documentElement.innerHTML = 'x';"></body>
+</html>
--- a/content/xbl/crashtests/477878-1.html
+++ b/content/xbl/crashtests/477878-1.html
@ -0,0 +1,4 @@
+<html>
+<head></head>
+<body><iframe style="display:none" src="data:text/html,<marquee>Marquee</marquee>" onload="this.style.display = '';"></iframe></body>
+</html>
--- a/content/xbl/crashtests/493123-1.xhtml
+++ b/content/xbl/crashtests/493123-1.xhtml
@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="a"><content></content></binding>
+  <binding id="b"><content><style xmlns="http://www.w3.org/1999/xhtml" style="display: none;">* { overflow: hidden; }</style><children xmlns="http://www.mozilla.org/xbl"/></content></binding>
+</bindings>
+
+<script type="text/javascript" style="display: none">
+
+function one()
+{
+  while (document.documentElement.firstChild) document.documentElement.removeChild(document.documentElement.firstChild)
+  document.documentElement.style.MozBinding = 'url("#a")';
+  setTimeout(two, 1);
+}
+
+function two()
+{
+  document.documentElement.style.MozBinding = 'url("#b")';
+  setTimeout(three, 1);
+}
+
+function three()
+{
+  document.documentElement.style.MozBinding = 'url("#a")';
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="one();"></body>
+</html>
--- a/content/xbl/crashtests/crashtests.list
+++ b/content/xbl/crashtests/crashtests.list
@ -26,9 +26,12 @@ load 421997-1.xhtml
 load 432813-1.xhtml
 load 454820-1.html
 load 460665-1.xhtml
+load 463511-1.xhtml
 load 464863-1.xhtml
 load 472260-1.xhtml
+load 477878-1.html
 load 492978-1.xul
+load 493123-1.xhtml
 load 495354-1.xhtml
 load 507628-1.xhtml
 load 507991-1.xhtml
--- a/editor/txmgr/tests/crashtests/407072-1.html
+++ b/editor/txmgr/tests/crashtests/407072-1.html
@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var br = document.getElementById("br");
+  br.contentEditable = "true";
+  br.focus();
+
+  try { document.execCommand("justifyfull", false, null);  } catch(e) { }
+  try { document.execCommand("justifyfull", false, null);  } catch(e) { }
+        document.execCommand("underline",   false, null);
+        document.execCommand("insertimage", false, "foo");
+  try { document.execCommand("outdent",     false, null);  } catch(e) { }
+}
+
+</script>
+</head>
+
+<body onload="boom();"><br id="br"></body>
+</html>
--- a/editor/txmgr/tests/crashtests/crashtests.list
+++ b/editor/txmgr/tests/crashtests/crashtests.list
@ -1 +1,2 @@
+asserts(3) load 407072-1.html # bug 382210?
 load 449006-1.html
--- a/gfx/thebes/crashtests/419255-1.html
+++ b/gfx/thebes/crashtests/419255-1.html
@ -0,0 +1,4 @@
+<html>
+<head></head>
+<body><div style="text-transform: capitalize">&#x5426; &#x200C;</body>
+</html>
--- a/gfx/thebes/crashtests/474410-1.html
+++ b/gfx/thebes/crashtests/474410-1.html
@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div { -moz-transform: matrix(3, 1, 16.8, 5.6, 0, 0); }
+div > div { border: 1px dashed #9ab; }
+
+</style>
+</head>
+<body>
+
+<div><div></div></div>
+
+</body>
+</html>
--- a/gfx/thebes/crashtests/483120-1.xhtml
+++ b/gfx/thebes/crashtests/483120-1.xhtml
@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="font-family: monospace;">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="w"><content><div xmlns="http://www.w3.org/1999/xhtml"><children xmlns="http://www.mozilla.org/xbl"/></div></content></binding>
+  <binding id="empty"><content/></binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.createElementNS("http://www.w3.org/2000/svg", "rect");
+  document.getElementById("d").previousSibling.data += "C";
+  document.getElementById("d").style.MozBinding = "url('#empty')";
+}
+
+</script>
+
+</head>
+
+<body onload="boom();"><span>A&#x202E;<span style="-moz-binding: url('#w');"></span>B<span id="d" style="font-size: 80%; color: green;">D</span></span></body>
+</html>
--- a/gfx/thebes/crashtests/483120-2.xhtml
+++ b/gfx/thebes/crashtests/483120-2.xhtml
@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="font-family: monospace;">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="w"><content><div xmlns="http://www.w3.org/1999/xhtml"><children xmlns="http://www.mozilla.org/xbl"/></div></content></binding>
+  <binding id="empty"><content/></binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("d").previousSibling.data += "C";
+  document.getElementById("d").style.MozBinding = "url('#empty')";
+}
+
+</script>
+
+</head>
+
+<body onload="boom();"><span>A&#x202E;<span style="-moz-binding: url('#w');"></span>B<span id="d" style="font-size: 80%; color: green;">D</span></span></body>
+</html>
--- a/gfx/thebes/crashtests/532726-1.html
+++ b/gfx/thebes/crashtests/532726-1.html
@ -0,0 +1,5 @@
+<html>
+<body style="word-spacing: 10px">
+<div>X &#x0301;&#x0000;</div>
+</body>
+</html>
--- a/gfx/thebes/crashtests/546870-1.html
+++ b/gfx/thebes/crashtests/546870-1.html
@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('button').value='';">
+<input id="button" type="button" value="Should not crash" style="width: 1px; white-space: normal;">
+</body>
+</html>
--- a/gfx/thebes/crashtests/crashtests.list
+++ b/gfx/thebes/crashtests/crashtests.list
@ -50,6 +50,7 @@ load 408754-1.html
 load 410728-1.xml
 load 416637-1.html
 load 419095-1.html
+load 419255-1.html
 load 420945-1.html
 load 420962-1.html
 load 421393-1.html
@ -61,8 +62,13 @@ load 463307-1.html
 load 467703-1.xhtml
 load 467873-1.html
 load 470418-1.html
+load 474410-1.html
+load 483120-1.xhtml
+load 483120-2.xhtml
 load 487549-1.html
 load 487724-1.html
 load 490777-1.html
+load 532726-1.html
 load 538065-1.html
+load 546870-1.html
 load balinese-letter-spacing.html
--- a/layout/base/crashtests/369176-1.html
+++ b/layout/base/crashtests/369176-1.html
@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+
+<script>
+
+function boom()
+{
+  document.getElementById("f").className = 'q';
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<style>
+
+body {
+  width: 10em;
+}
+
+#f:after {
+  content: "TTT";
+}
+
+</style>
+
+</head>
+
+<body onload="setTimeout(boom, 0);">
+
+<span id="f">foo foo foo foo foo foo foo foo foo foo<span style="display: block"></span></span>
+
+
+</div>
+
+</body>
+</html>
--- a/layout/base/crashtests/455623-1.html
+++ b/layout/base/crashtests/455623-1.html
@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var i = document.getElementById("i");
+  i.contentDocument.designMode = "on";
+  i.previousSibling.data += "x\n";
+  i.style.counterReset = "c";
+}
+
+</script>
+</head>
+
+<body onload="boom();">&#x202E;<iframe id="i" src="data:text/html,a"></body>
+
+</html>
--- a/layout/base/crashtests/468555-1.xhtml
+++ b/layout/base/crashtests/468555-1.xhtml
@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+* { content: 'Y'; }
+table:after { content: inherit; }
+</style>
+</head>
+<body onload="document.getElementById('t').appendChild(document.createElement('span'));"><table id="t"></table></body>
+</html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@ -126,6 +126,7 @@ load 366271-1.html
 load 366967-1.html
 load 367015-1.html
 load 367243-1.html
+load 369176-1.html
 load 369945-1.xhtml
 load 371681-1.xhtml
 load 372237-1.html
@ -235,11 +236,13 @@ load 455063-1.html
 load 455063-2.html
 load 455063-3.html
 load 455171-4.html
+load 455623-1.html
 load 457362-1.xhtml
 load 466763-1.html
 load 467881-1.html
 load 468491-1.html
 load 468546-1.xhtml
+load 468555-1.xhtml
 load 468578-1.xhtml
 # These three didn't actually crash without the resizing that the
 # browser does when setting up print preview, but adding them anyway.
--- a/layout/forms/crashtests/498698-1.html
+++ b/layout/forms/crashtests/498698-1.html
@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<select style="height: 3401091640591pc"></select>
+</body>
+</html>
--- a/layout/forms/crashtests/crashtests.list
+++ b/layout/forms/crashtests/crashtests.list
@ -38,3 +38,4 @@ load 455451-1.html
 load 457537-1.html
 load 457537-2.html
 load 478219-1.xhtml
+load 498698-1.html
--- a/layout/generic/crashtests/323381-1.html
+++ b/layout/generic/crashtests/323381-1.html
@ -0,0 +1 @@
+<iframe src="data:text/html,foo" width="808080"></iframe>
--- a/layout/generic/crashtests/323381-2.html
+++ b/layout/generic/crashtests/323381-2.html
@ -0,0 +1 @@
+<div style="width: 808080px;">foo</div>
--- a/layout/generic/crashtests/339769-1.html
+++ b/layout/generic/crashtests/339769-1.html
@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function foo()
+{
+  var div = document.getElementById("div");
+  div.parentNode.removeChild(div);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(foo, 0);">
+
+  <div id="div" style="display: inline;"><p>x</p></div>
+
+  <iframe src='data:text/html,<html><body><input value="q">'></iframe>
+
+</body>
+</html>
--- a/layout/generic/crashtests/389635-1.html
+++ b/layout/generic/crashtests/389635-1.html
@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="position: fixed; overflow-x: scroll;">
+  <div style="padding: 0%;">
+    <div style="position: fixed;"></div>
+  </div>
+</div>
+
+</body>
+</html>
--- a/layout/generic/crashtests/460910-1.xml
+++ b/layout/generic/crashtests/460910-1.xml
@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<style type="text/css">
+
+[class~='t'] { display: table; }
+
+</style>
+</head>
+<body>
+
+<m:math><m:math class="t"/></m:math>
+
+</body>
+</html>
--- a/layout/generic/crashtests/467137-1.html
+++ b/layout/generic/crashtests/467137-1.html
@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function z()
+{
+  var q = document.getElementById("q");
+
+  for (var r = 0; r < 100; ++r) {
+    // dump(r + "\n");
+    q.style.width = r + "px";
+    document.documentElement.offsetHeight;
+  }
+}
+
+</script>
+</head>
+<body onload="z();">
+
+<div style="font-family: monospace;" id="q"><div id="w" style="word-spacing: 1px">AAA <span style="white-space: pre-line; font-weight: 500;">BB C 
+ </span></div></div>
+ 
+</body></html>
--- a/layout/generic/crashtests/467213-1.html
+++ b/layout/generic/crashtests/467213-1.html
@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body>
+
+<div style="direction: rtl;"><span style="direction: ltr;"><div></div><span style="position: absolute;"></span><span style="display: -moz-box;"></span></span></div>
+
+</body>
+</html>
--- a/layout/generic/crashtests/467875-1.xhtml
+++ b/layout/generic/crashtests/467875-1.xhtml
@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+<span style="direction: rtl;">
+  <span style="display: -moz-box"/>
+  <span style="position: fixed;"/>
+  <span style="display: -moz-box"/>
+</span>
+</body>
+</html>
--- a/layout/generic/crashtests/472617-1.xhtml
+++ b/layout/generic/crashtests/472617-1.xhtml
@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head></head>
+<body style="-moz-column-width: 2351490cm;"><div style="height: 0;"><xul:hbox/><xul:button/><span style="float: right;"/></div><xul:button/><div/><span style="float: right;"/></body>
+</html>
--- a/layout/generic/crashtests/473894-1.html
+++ b/layout/generic/crashtests/473894-1.html
@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="margin: -10000px">X</div>
+</body>
+</html>
--- a/layout/generic/crashtests/478131-1.html
+++ b/layout/generic/crashtests/478131-1.html
@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style id="s"></style>
+</head>
+<body onload="document.getElementById('s').textContent = '* { font-size: 8193%; }';" style="-moz-column-count: 2;"><div><div>A B C</div></div><div><p>D E F</p></div><p>G H I</p><div><p>.</p></div> <p>J K L</p></body>
+</html>
--- a/layout/generic/crashtests/489480-1.xhtml
+++ b/layout/generic/crashtests/489480-1.xhtml
@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-column-count: 2; width: 0pt;"><body style="height: 5003810179.579391in;"><br/><div style="direction: rtl;"><select style="float: right;"></select><option style="width: 0.6600934846211504px; margin: 22367196.5776782cm;"><option style="-moz-column-count: 2;"></option></option></div></body></html>
--- a/layout/generic/crashtests/499885-1.xhtml
+++ b/layout/generic/crashtests/499885-1.xhtml
@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="emptybinding"><content></content></binding></bindings>
+</head>
+<body style="-moz-column-width: 1px;"><select/><li/><select style="height: 1777px; padding: 8796093022208pt; display: inherit; -moz-binding: url(#emptybinding);"/></body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@ -12,6 +12,8 @@ load 302260-1.html
 load 307979-1.html
 load 310556-1.xhtml
 load 322780-1.xul
+load 323381-1.html
+load 323381-2.html
 asserts(2) asserts-if(MOZ_WIDGET_TOOLKIT=="gtk2",12) load 323386-1.html
 load 323389-1.html
 load 323389-2.html
@ -28,6 +30,7 @@ load 334602-1.html
 load 337412-1.html
 load 337883-1.html
 load 337883-2.html
+load 339769-1.html
 load 342322-1.html
 load 343206-1.xhtml
 load 345139-1.xhtml
@ -103,6 +106,7 @@ load 387233-2.html
 load 387282-1.html
 load 388175-1.html
 load 388709-1.html
+load 389635-1.html
 load 390050-1.html
 load 390050-2.html
 load 390050-3.html
@ -245,34 +249,42 @@ load 455171-3.html
 load 455643-1.xhtml
 load 457375.html
 load 457380-1.html
+load 460910-1.xml
 load 461294-1.html
 load 463350-1.html
 load 463350-2.html
 load 463350-3.html
 asserts(4) load 463741-1.html
 load 465651-1.html
+load 467137-1.html
+load 467213-1.html
 load 467487-1.html
 load 467493-1.html
 load 467493-2.html
+load 467875-1.xhtml
 load 467914-1.html
 load 468207-1.html
 load 468771-1.xhtml
 load 468771-2.xhtml
 load 469859-1.xhtml
 load 472587-1.xhtml
+load 472617-1.xhtml
 load 472774-1.html
 load 472776-1.html
 load 472950-1.html
 load 473278-1.xhtml
+load 473894-1.html
 load 476241-1.html
 load 477731-1.html
 load 477928.html
+load 478131-1.html
 load 478170-1.html
 load 478185-1.html
 asserts(1) load 479938-1.html
 load 480345-1.html
 load 481921.html
 load 489462-1.html
+load 489480-1.xhtml
 load 493111-1.html
 load 493118-1.html
 load 494300-1.xul
@ -281,6 +293,7 @@ load 495875-1.html
 load 495875-2.html
 load 499862-1.html
 load 499857-1.html
+asserts(15) asserts-if(MOZ_WIDGET_TOOLKIT=="windows",18) load 499885-1.xhtml # nscoord_MAX assertions, plus bug 570436 on windows
 load 501535-1.html
 load 503961-1.xhtml
 load 503961-2.html
--- a/layout/mathml/crashtests/431072-1.xhtml
+++ b/layout/mathml/crashtests/431072-1.xhtml
@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("math").setAttribute("class", "li");
+  document.documentElement.offsetHeight;
+  document.documentElement.appendChild(document.createTextNode("\n"));
+}
+
+</script>
+
+<style type="text/css">
+
+[class="li"] { display: list-item; }
+
+</style>
+
+</head>
+
+<body onload="boom();"><math xmlns="http://www.w3.org/1998/Math/MathML" id="math"/></body>
+
+</html>
--- a/layout/mathml/crashtests/477740-1.xhtml
+++ b/layout/mathml/crashtests/477740-1.xhtml
@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+
+<xbl:bindings><xbl:binding id="res"><xbl:content><xul:resizer><xbl:children/></xul:resizer></xbl:content></xbl:binding></xbl:bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var x = document.getElementById("x");
+
+  var r = document.createRange();
+  r.setEnd(x, 1);
+  r.extractContents();
+
+  x.appendChild(document.createElement('span'));
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<xul:rows id="x" style="-moz-binding: url(#res);"><math:ms/></xul:rows>
+</body>
+</html>
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@ -44,7 +44,9 @@ load 412237-1.xml
 load 413063-1.xhtml
 load 416907-1.xhtml
 load 420420-1.xhtml
+load 431072-1.xhtml
 load 443089-1.xhtml
 load 463763-1.xhtml
 load 463763-2.xhtml
 load 476547-1.xhtml
+load 477740-1.xhtml
--- a/layout/svg/crashtests/384499-1.svg
+++ b/layout/svg/crashtests/384499-1.svg
@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<html:style>
+  #mathy { display: table}
+</html:style>
+
+<foreignObject width="500" height="500" y="50">
+  <div xmlns="http://www.w3.org/1999/xhtml">
+    <p>Foo</p>
+    <div>
+      <math xmlns="http://www.w3.org/1998/Math/MathML" id="mathy" display="block">
+        <mrow>
+          <mi>x</mi>
+        </mrow>
+      </math>
+    </div>
+  </div>
+</foreignObject>
+
+</svg>
--- a/layout/svg/crashtests/478511-1.svg
+++ b/layout/svg/crashtests/478511-1.svg
@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" version="1.0">
+  <defs>
+    <pattern id="pattern"
+             x="0" y="0" width="200" height="200">
+      <circle fill="lime" r="100" cx="100" cy="100"/>
+    </pattern>
+  </defs>
+  <rect width="200" height="200" fill="url(#pattern)"/>
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@ -44,6 +44,7 @@ load 371563-1.xhtml
 load 375775-1.svg
 load 380691-1.svg
 load 384391-1.xhtml
+load 384499-1.svg
 load 384637-1.svg
 load 384728-1.svg
 load 385246-1.svg
@ -76,6 +77,7 @@ load 475181-1.svg
 load 475193-1.html
 load 477935-1.html
 load 478128-1.svg
+load 478511-1.svg
 load 492186-1.svg
 load 508247-1.svg
 load 512890-1.svg
--- a/layout/xul/base/src/crashtests/464407-1.xhtml
+++ b/layout/xul/base/src/crashtests/464407-1.xhtml
@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+</head>
+<body>
+
+<xul:radio style="overflow: auto; height: 72057594037927940pt; display: table-cell;"/>
+
+</body>
+</html>
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@ -60,6 +60,7 @@ load 433296-1.xul
 load 434458-1.xul
 load 460900-1.xul
 load 464149-1.xul
+load 464407-1.xhtml
 load 467481-1.xul
 load 470063-1.html
 load 472189.xul
				`@ -0,0 +1 @@`
				`<iframe src="data:text/html,foo" width="808080"></iframe>`
				`@ -0,0 +1 @@`
				`<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-column-count: 2; width: 0pt;"><body style="height: 5003810179.579391in;"><br/><div style="direction: rtl;"><select style="float: right;"></select><option style="width: 0.6600934846211504px; margin: 22367196.5776782cm;"><option style="-moz-column-count: 2;"></option></option></div></body></html>`