63 files changed, 1223 insertions, 0 deletions
diff --git a/dom/smil/crashtests/1010681-1.svg b/dom/smil/crashtests/1010681-1.svg
new file mode 100644
index 0000000000..882bcb53fe
--- /dev/null
+++ b/dom/smil/crashtests/1010681-1.svg
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait">
+<script>
+<![CDATA[
+
+function boom()
+{
+  var animate =
+    document.createElementNS("http://www.w3.org/2000/svg", "animate");
+  animate.setAttribute("dur", "2s");
+  document.documentElement.appendChild(animate);
+  animate.targetElement;
+  animate.requiredExtensions.insertItemBefore(0, 0);
+  document.documentElement.setCurrentTime(4);
+  document.documentElement.setCurrentTime(0);
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></svg>
diff --git a/dom/smil/crashtests/1322770-1.svg b/dom/smil/crashtests/1322770-1.svg
new file mode 100644
index 0000000000..405435184e
--- /dev/null
+++ b/dom/smil/crashtests/1322770-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animateMotion keyTimes='.1;.6;.6' path='m0,1l7,3' keyPoints='.6;1;.7'/>
+</svg>
diff --git a/dom/smil/crashtests/1322849-1.svg b/dom/smil/crashtests/1322849-1.svg
new file mode 100644
index 0000000000..ea3d629813
--- /dev/null
+++ b/dom/smil/crashtests/1322849-1.svg
@@ -0,0 +1,2 @@
+<svg>
+<set fill='freeze' dur='8' repeatCount='1844674737095516'>
diff --git a/dom/smil/crashtests/1343357-1.html b/dom/smil/crashtests/1343357-1.html
new file mode 100644
index 0000000000..8219c31221
--- /dev/null
+++ b/dom/smil/crashtests/1343357-1.html
@@ -0,0 +1,12 @@
+<svg>
+  <animateMotion to="500,500"></animateMotion>
+  <animateMotion to="10,40"></animateMotion>
+</svg>
+<svg width="100" height="100">
+  <rect width="100%" height="100%" />
+  <circle r="2" fill="red">
+    <animateMotion dur="1s" from="50,50" to="80,70" additive="sum"></animateMotion>
+    <animateMotion dur="1s" from="50,50" to="80,70" additive="sum"></animateMotion>
+    <animateMotion dur="3s" to="0,80"></animateMotion>
+  </circle>
+</svg>
diff --git a/dom/smil/crashtests/1375596-1.svg b/dom/smil/crashtests/1375596-1.svg
new file mode 100644
index 0000000000..69c1673d11
--- /dev/null
+++ b/dom/smil/crashtests/1375596-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="800" height="600">
+<animate by="2" min="5:45" calcMode="discrete" attributeName="height" />
+</svg>
diff --git a/dom/smil/crashtests/1402547-1.html b/dom/smil/crashtests/1402547-1.html
new file mode 100644
index 0000000000..28fa7ce185
--- /dev/null
+++ b/dom/smil/crashtests/1402547-1.html
@@ -0,0 +1,3 @@
+<svg>
+<animate id='a' calcMode='discrete' attributeName='height' by='-159'/>
+<animate id='a' calcMode='discrete' attributeName='height' by='-159'/>
diff --git a/dom/smil/crashtests/1411963-1.html b/dom/smil/crashtests/1411963-1.html
new file mode 100644
index 0000000000..cc61b73e2a
--- /dev/null
+++ b/dom/smil/crashtests/1411963-1.html
@@ -0,0 +1,10 @@
+<html>
+  <head>
+    <script>
+      const o1 = document.createElement('div');
+      document.querySelector('script').appendChild(o1);
+      document.writeln("<svg><animate to attributeName='width'>");
+      o1.innerHTML = "<meta http-equiv='Content-Security-Policy' content=default-src>";
+    </script>
+  </head>
+</html>
diff --git a/dom/smil/crashtests/1413319-1.html b/dom/smil/crashtests/1413319-1.html
new file mode 100644
index 0000000000..9bfeef3bdd
--- /dev/null
+++ b/dom/smil/crashtests/1413319-1.html
@@ -0,0 +1,2 @@
+<svg width=''>
+<animate dur='2ms' repeatCount='4611686018427387903' fill='freeze'/>
diff --git a/dom/smil/crashtests/1535388-1.html b/dom/smil/crashtests/1535388-1.html
new file mode 100644
index 0000000000..cdfaba4d90
--- /dev/null
+++ b/dom/smil/crashtests/1535388-1.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+<script>
+function start () {
+  document.location.assign('abc')
+  SpecialPowers.forceGC()
+  SpecialPowers.forceCC()
+  const XHR = new XMLHttpRequest()
+  XHR.open('GET', 'data:text/html,1', false)
+  XHR.send()
+}
+window.addEventListener('load', start)
+</script>
+</head>
+<body>
+<svg></svg>
+</body>
+</html>
diff --git a/dom/smil/crashtests/483584-1.svg b/dom/smil/crashtests/483584-1.svg
new file mode 100644
index 0000000000..b9ded113ef
--- /dev/null
+++ b/dom/smil/crashtests/483584-1.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+  <g id="s">
+    <circle/>
+    <animateTransform attributeName="transform"/>
+  </g>
+  <use xlink:href="#s"/>
+</svg>
diff --git a/dom/smil/crashtests/483584-2.svg b/dom/smil/crashtests/483584-2.svg
new file mode 100644
index 0000000000..f5cbd7d466
--- /dev/null
+++ b/dom/smil/crashtests/483584-2.svg
@@ -0,0 +1,133 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- =====================================================================-->
+<!-- animate-elem-30-t.svg                                                -->
+<!--                                                                      -->
+<!-- Tests various types of animations on referenced elements.            -->
+<!--                                                                      -->
+<!-- Author : Ola Andersson,  22-Sep-2003                                 -->
+<!--======================================================================-->
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Tiny//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" baseProfile="tiny" id="svg-root" width="480" height="360" viewBox="0 0 480 360" onload="go()" class="reftest-wait">
+   <script>
+     function go() {
+       var svg = document.documentElement;
+       svg.pauseAnimations();
+
+       // Note: Animations in this testcase have begin="100" dur="3".
+
+       // Jump to partway through animation...
+       svg.setCurrentTime(102);
+
+       // ...and then (if we didn't hang) jump back to a pre-animation time.
+       svg.setCurrentTime(50);
+
+       // Signal that the test is complete:
+       svg.removeAttribute("class");
+    }
+   </script>
+   <g transform="translate(20) scale(1.3)">   
+      <!-- SILHOUETTES-->
+      <path d="M210 40 C210 40 210 100 170 190" fill="none" stroke="#b4b4b4"/>
+      <path d="M 171 188 l 10 -10 l -10 -4 z" fill="#b4b4b4" stroke="none"/>
+      <polyline fill="none" stroke="#b4b4b4" stroke-width="2" points="200,20 200,40 220,40 220,60"/>
+      <polyline transform="rotate(15)" fill="none" stroke="#b4b4b4" stroke-width="9" points="200,120 200,140 220,140 220,160"/>
+  
+      <line x1="40" y1="50" x2="20" y2="10" stroke="#b4b4b4" stroke-width="3"/>
+      <line x1="160" y1="50" x2="80" y2="10" stroke="#b4b4b4" stroke-width="3"/>
+      <line x1="30" y1="30" x2="120" y2="30" stroke="#b4b4b4"/>
+      <path d="M 120 30 l -10 3 l 0 -6 z" fill="#b4b4b4" stroke="none"/>
+  
+      <line x1="70" y1="70" x2="145" y2="70" stroke="#b4b4b4"/>    
+      <rect x="10" y="60" width="60" height="20" fill="#b4b4b4" stroke="#b4b4b4" stroke-width="2"/>
+      <rect x="145" y="60" width="30" height="40" fill="#b4b4b4" stroke="#b4b4b4" stroke-width="2"/>
+      <path d="M 145 70 l -10 3 l 0 -6 z" fill="#b4b4b4" stroke="none"/>
+  
+      <circle cx="30" cy="100" r="10" fill="#b4b4b4" stroke="#b4b4b4"/>
+      <circle cx="100" cy="195" r="15" fill="#b4b4b4" stroke="#b4b4b4"/>
+      <line x1="37" y1="107" x2="89" y2="184" stroke="#b4b4b4"/>
+      <path d="M 90 185 l -3 -12 l -6 5 z" fill="#b4b4b4" stroke="none"/>
+   
+      <rect x="300" y="10" width="20" height="20" fill="#b4b4b4" stroke="#b4b4b4" stroke-width="2"/>
+      <rect x="300" y="170" width="20" height="40" fill="#b4b4b4" stroke="#b4b4b4" stroke-width="2"/>
+      <line x1="310" y1="30" x2="310" y2="170" stroke="#b4b4b4"/>
+      <path d="M 310 170 l -3 -10 l 6 0 z" fill="#b4b4b4" stroke="none"/>
+   
+      <rect x="230" y="7.5" width="40" height="7.5" fill="#b4b4b4" stroke="none"/>
+      <rect x="230" y="170" width="40" height="30" fill="#b4b4b4" stroke="none"/>
+      <line x1="250" y1="10" x2="250" y2="170" stroke="#b4b4b4"/>
+      <path d="M 250 170 l -3 -10 l 6 0 z" fill="#b4b4b4" stroke="none"/>
+      <!-- END OF SILHOUETTES-->
+      
+      <!-- DEFS-->
+      <defs>
+         <line id="lineID" x1="30" y1="50" x2="10" y2="10" stroke="rgb(16, 93, 140)" stroke-width="3">
+            <animate attributeName="x1" from="30" to="90" begin="100" dur="3" fill="freeze"/>
+         </line>
+      </defs>
+   
+      <defs>
+         <rect id="rectID" x="10" y="60" width="60" height="20" fill="blue" stroke="black" stroke-width="2">
+            <animateColor attributeName="fill" from="white" to="rgb(16, 93, 140)" begin="100" dur="3" fill="freeze"/>
+            <animate attributeName="height" from="20" to="40" begin="100" dur="3" fill="freeze"/>
+         </rect>
+      </defs>
+   
+      <defs>
+         <circle id="circleID" cx="20" cy="100" r="10" fill="rgb(16, 93, 140)" stroke="black" transform="">
+            <animate attributeName="cy" from="100" to="130" begin="100" dur="3" fill="freeze"/>
+            <animateTransform attributeName="transform" type="scale" from="1" to="1.5" additive="sum" begin="100" dur="3" fill="freeze"/>
+         </circle>
+      </defs>
+   
+      <defs>
+         <polyline id="polylineID" fill="none" stroke="rgb(16, 93, 140)" stroke-width="2" points="200,20 200,40 220,40 220,60">
+            <animateMotion path="M 0 0 l 0 100" begin="100" dur="3" fill="freeze"/>
+            <animate attributeName="stroke-width" from="2" to="9" begin="100" dur="3" fill="freeze"/>
+         </polyline>
+      </defs>
+   
+      <defs>
+         <polygon id="polygonID" fill="green" stroke="black" points="240,20 240,40 260,40 260,20" stroke-width="2">   
+            <animate attributeName="fill" from="white" to="rgb(16, 93, 140)" begin="100" dur="3" fill="freeze"/>
+         </polygon>
+      </defs>
+   
+      <defs>
+         <image id="imageID" x="230" y="20" width="40" height="80" xlink:href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAgEASABIAAD/4RX+RXhpZgAASUkqAAgAAAAJAA8BAgAGAAAAegAAABABAgAXAAAAgAAAABIBAwABAAAAAQAAABoBBQABAAAAoAAAABsBBQABAAAAqAAAACgBAwABAAAAAgAAADIBAgAUAAAAsAAAABMCAwABAAAAAQAAAGmHBAABAAAAxAAAAGYFAABDYW5vbgBDYW5vbiBESUdJVEFMIElYVVMgMzAwAAAAAAAAAAAAALQAAAABAAAAtAAAAAEAAAAyMDAyOjAxOjE1IDA0OjQyOjU4ABsAmoIFAAEAAABWAwAAnYIFAAEAAABeAwAAAJAHAAQAAAAwMjEwA5ACABQAAAAOAgAABJACABQAAAAiAgAAAZEHAAQAAAABAgMAApEFAAEAAAA+AwAAAZIKAAEAAABGAwAAApIFAAEAAABOAwAABJIKAAEAAABmAwAABZIFAAEAAABuAwAABpIFAAEAAAB2AwAAB5IDAAEAAAAFAAAACZIDAAEAAAAAAAAACpIFAAEAAAB+AwAAfJIHAJoBAACGAwAAhpIHAAgBAAA2AgAAAKAHAAQAAAAwMTAwAaADAAEAAAABAAAAAqADAAEAAABABgAAA6ADAAEAAACwBAAABaAEAAEAAAAwBQAADqIFAAEAAAAgBQAAD6IFAAEAAAAoBQAAEKIDAAEAAAACAAAAF6IDAAEAAAACAAAAAKMHAAEAAAADAAAAAAAAADIwMDI6MDE6MTUgMDQ6NDI6NTgAMjAwMjowMToxNSAwNDo0Mjo1OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAAQAAAPUAAAAgAAAA1QAAACAAAAABAAAAyAAAAGQAAAAKAAAAAAAAAAMAAACs3QIAAAABAP//AADoAwAAMAEAACAAAAAMAAEAAwAmAAAAHAQAAAIAAwAEAAAAaAQAAAMAAwAEAAAAcAQAAAQAAwAaAAAAeAQAAAAAAwAGAAAArAQAAAAAAwAEAAAAuAQAAAYAAgAgAAAAwAQAAAcAAgAYAAAA4AQAAAgABAABAAAAcVYQAAkAAgAgAAAA+AQAABAABAABAAAAAAAEAQ0AAwAEAAAAGAUAAAAAAABMAAIAAAADAAEAAAAAAAQAAAABAAAAAAAAAAAAAAAAAAAAAwABAAEwAAD/////BgKtACAAdADVAP//AAAAAAAAAAAAAP//AABABkAGAgAwAdMAngAAAAAAAAAAADQAAACPAD8B1QD1AAAAAAAAAAEAAwAAAAAAAAAHMAAAAAAAAAAA//8AANUA+QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAElNRzpESUdJVEFMIElYVVMgMzAwIEpQRUcAAAAAAAAARmlybXdhcmUgVmVyc2lvbiAxLjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAPQA9AD0AABqGADOAAAAgE8SAJsAAAAEAAEAAgAEAAAAUjk4AAIABwAEAAAAMDEwMAEQAwABAAAAQAYAAAIQAwABAAAAsAQAAAAAAAAGAAMBAwABAAAABgAAABoBBQABAAAAtAUAABsBBQABAAAAvAUAACgBAwABAAAAAgAAAAECBAABAAAA9AUAAAICBAABAAAA7g8AAAAAAAC0AAAAAQAAALQAAAABAAAA//////////////////////////////////////////////////9//////////////9j/2wCEAAkGBggGBQkIBwgKCQkLDRYPDQwMDRwTFRAWIR0jIiEcIB8kKTQsJCcxJx4fLT0tMTY3Ojo6Iio/RD44QjM3OTYBCQkJDAoMFAwMFA8KCgoPGhoKChoaTxoaGhoaT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT//AABEIAHgAoAMBIQACEQEDEQH/xAGiAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgsQAAIBAwMCBAMFBQQEAAABfQECAwAEEQUSITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9PX29/j5+gEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoLEQACAQIEBAMEBwUEBAABAncAAQIDEQQFITEGEkFRB2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery8/T19vf4+fr/2gAMAwEAAhEDEQA/AOxApcV7J5goUngDNIVweaBC80oYjvRYLseszAY60FjI3c1HLZ3L5r6DjG46jFRFjTVmJtoA5qW3j3vuIBAokuVNgnzOxpKVA5xUNyY3TB4Fc0b3Oh2sZbqAxx0pMV2pnG9xNtJincA20hWmBMBT1XJrJuxaLf7pU4wKqScuayp3vqaTtbQABjmnRJunQdiRVtuz8kQlsa0kUUg+ZFP4VVeyUNuiJB9DXn060oabx6o7Z0oy12l3I5pMDawwcVTIrupbX6PY46u9uq3ExT0kZBxWrV9DNOw4zue9MZi3U0lFIbm2NwKTFUIMUmKYgxSYoAmAFP2+9Z3NLCbaTbzRcmw9baR13KpIp8ETLcpuUjnvWcqsbNXXMk9DSNOV07aX3NInFNPTmvLO8iljWVcN19az2hZZNmMkniuzC1LXg9t0c2Ihe0lv1JZrGWEZIBX1FV8V1U6iqK6+aOacHB2fyYYorQkMUmKYgxSYoEGKTFAyYCnYrM0FCM33VJ+go8mQfwN+VS5xWjaTDlk9kzSRBHGq+gpoO6ZB6mvLk7tvuz0ErK3YlkIQVAz0hkZamhlWRXIztNCdtVuDV9zRDBlBGCCKz7uyO8NCuQeoHatqFTkld/C9zOrDnj5rYYunSn7xVfqaf/Zn/TTn/drpli4p6Lm89jnjhn1dvIo3TRWt5HbGQNNICwUdQB3NGK3pVPaR5tvIyqQ5HbfzDFJitDMMUYoAlxSgVmaGlAAkCjvjNKeTXlzd5N92ehFWSXZCHmoyQjBj2qGUMkn3GojJQA0yUKGf7ozQBbtd6x4fgZ4qxmhMGGcCsjxP4ktvDGiS39yQSPljjzy79hTEcN8P7y51mbUNd1KQGSZxGrHgDP8ACPyFdtivRw1vZ6dHqcNe/P6rQcIXPRGP4UxsLJ5bEB8Z298etbc8b2ur9jLkklezt3DFGKsRLQKzLNFJULiPeofGduecfSiR/wB4qD6mvIb/ADPSQuPWqt+3lxKfVgKT2AqmSk3E9KALUFkW+aTgelWtqhhGgx647Cj+kBI/3Pl7UwOCMijqBICGXNcj448Ax+MfLkN/NbyQqRGmA0fPcj+tMCPwz8PRpWnWcN/ePKYG83yovljL+p7nH4V1sjQWcLSyFIo0GWduAB9apSaVk7J7onlTd+q2Z5n4x+MKWxa08PKJW+610w4B/wBkd/rWr4Es7pdE/tDUpHlvb7EsjyHJ2/wj8j+tb4WN537IyxDtC3dnSYpMV6Jwkt8sktm6wSLFMynY5G7afpXkl3Y61qVyY7zVrkxkncN52kewBx+lediJuKWrSfQ76EVJvRO3Ut6zo0+p3Ed19rc3MUYRC3QADjGOhrofCGvz6bpPk61cyTXab9ryMWLDjA3f56VxKVzqcbGA/wAWdZtrly8CGLcdvm2xAx9Q2f0rc0P4lDxPKbae2t4XjXzN0UrENj/ZZRj86p/CQtzoZryKCJpZpFSNeSxPArk7z4iTC/UaMtkYUJ3SXT43n0AH86Fq7feGxq6Z8VbOWdLfVbY20zEKrwSCaMn8OR+VXbn4laFp9xLDJJcSzLkuIoSQvtk4FNiSuZU3xhtCT9i0i7nHrJIkf9TWx4Y8YxeIIpC8Is5g3+pMofH48UPa4Lsak3iTTbGyuJ7m6RI7Ztsp67T9PxqDTPG2ia7c/ZdMvBNMRu27COO55FF9ANHV9Zs9D097u+lEcSD8WPoBXhPjf4g6j4puWt4w9tYqflhBwW929aa19AMTw9aW93rlnDqEghtjMDIzdMelfREQR4lMJUxkfKV6Y9q7sK1Z9zkxKd12HbKPLrsucyRxsuuXeq25SOUKu8gPESpOPftWMblrWcLJueI/dmHI/E/1rw61R1Ja9NkevSgoR069TQVy6EoVbjiqsy3ZiO+GFXGNoEpIP47axNSgEvPNEF2trI0udqtKRkAc8bKbaaVGkpntbK383JV2W4ZcH0+7zVXttdE2vvZly4tLq8h8q5t4pIyeVN45H/oFVR4cjwB/Zdpjtm6f/wCJpKVurHy+SLFto2m7leK3iEqHBKMTtYe9OGmafcM8hgjkdnIdjzn1pOTGoortoMIkbytNsiueCzkE/wDjpp8FobWbZb2llE57JMQf/QafN5sXL5IfPo8l4jR3SoiH5iEkLZYdCQRin2tzc6FeR3S+XIkYwX+6Rn17VUZW03RMoX12Zj+JdQufEOprcXOr26LH/q4lOQtZc2keYd0uqQMQOpQZquZ9mRZdyGDRx5+WvbfAPH3Rmuy0XXLzw/A/2cG7gJ4QPuVfy71pTquDvYmcFNWbNmx+JFoqyfb4pyxclfLjXCr2H3ucetaVt4+0W4OPOkiP/TRMfrXbHFQe90zklhpLazRyMNxZ21v5K288aHPApIb3TbW0S2iSZUUbQCCePQ15soy6pps7ozj0asgtLnTbIsIXmVDzsIOF+lWDqliwO6duTkEjpUtd0ylLzRQ1KPS9TMZkvZImiyFaNtp5x/hViyfT9Ph8q3uiUzn5jk/nQ2rWBb3Lkd/bYybhT7U4X9sDj7SnHvU6FXZS8i3NvPHHqAjMzM+4EAqSe1Q6fNp+kWotZNTEzK2Q0jYNVvsTe2uyJW16yQEC+gbHvTtN8S6PaXsk1xHFdyOVKlwMIADkA571SjZ9/IHJNb2H3niawu7xpYpEgjzxGqggD65rOnbTjayQx3yqkyjOV3EHGOxH5UW12Fdd9jMtvDmhxXsdw140qoM+U0eVc+/tTNV8PWd/J5kV4kSseALfvgZ6DNac2mxHKu5WPgm23AW+qOwZQDut2Xn04zxnFT2ng9LEiSLWbm3nGdzRWz4Ht2zS5vIfL5mja2chB+33kF1nAz5Tow/HFOm0mFoSI7xAwPyoyEjHfnH9PWpv6jS80dK8cJGdwz9aiFvHnOBXqSVzzouwvkJnBVc/SnizQ/8ALMflXPKKNVJgbCIjmMflUf2C3brEpH+7kVm4ItSGtpdqRzBHj12CoG0mzbAMMeO3FR7MrmFGkWfCmEfhUM3hyykk3FXBPo5oVJBzsrt4QsHck+aPo/8A9aoz4K08E/vJP0P9Kr2fYnnI5PBViQQJZF/Af4VA3gi1B4nbp/cWj2TH7Qhk8GQAACZuneMCq0vhDYMpMufdf/r1SovuJ1UVz4WlLcNH9cH/ABqQeDLhjlZIPx3CmsPJ9SXWS6Cnwhfx/ceL8JmH9KP+Ea1ZD8s34i5Yf0p/Vp+TBYiPmd35eOgIoAJHBH511M50O29C4U47mnhQykBiT6BqxZqhwJTG4N9OtSrtY98+/Ws5eRcfMCgJzj2yKjaMZ64x6VCZTQ5VULyfxNIGRgR5gb2NUri0HeUj5GUcdhjpQzIBhlyvrkD+tUtfInReY37RbO2zcPTOajaKFXz5hI+uaaUkDcWRzRIVzge2BVaXYCBzitY/kZSsvmQmNQc5qSEAg7cH29K0iRIcSGGGcj2yKcANuA/Hck5NWQSzzKR8u/B6hRinIwAA+bH8qybNUSD/AH2A9MnFPDYXA5H51k0aIRkDMA0av6e1SCFduCij6VnJtFJJiGCI9ET64puVU4wc+oBqE2y7JApTdtXeD64OKcx6DJB9s1RIi5ZuCAMdQc0hWRELABiO3JNVdE2ZD+9UBinPcBj/AIUiXEj5DAoMd8mrsmTdr5jHBA+VcH1AzUTKyj69+laRsQ7kZXPynDe2KdHDGP8Alnj8K0RmxzBAOij0HSnxIsikMiqPUNVCHS28RxvJJ+tMEaRP8oOPUtmsWaIsIePf2pySgdT9NwrFo1TFNxs5YoR2waYssLO3mJHk9e+aVn0uO662BhCWyhUevz8flTiM/wCrOf8AgVRfv99i15fdcbmVcMUZiB0UgioJL64QkfZZAPUNVxSe1iJSa6MbHfSsQVtnXuS3FTfanYjfGoxxgfMavl8yObyHl02kLGcn/pkaYJJBn5MA+vGaSXdjv2RCbmYEqVXPs1NeUsvJXPrWkUlsQ5N76EQjycb2+meKsIDj1x6CtIoiV+o/eQvfHuKA/wAvYfhVkjC0gHVQfXFRkXDYO9GI6DFYNmthn+mZz8uP9lQamjmuVA/csffgVDsylddCdLhgp3oE79aie5lxhFWQexJqeW3Urm8vkVvt8gfbIoA/3CDVhJVxlCg+oNJx82ClforoZNdXce0pFGy/3gc5pq307H96kZB7KDQoIHN9kSf2gVOFXr2KkU7+1sAB1z9Oark8xe0EXU4n6RsD9KSd4WQFhz24zTUXHzE5KXkQOY9uMNjsNtIEj2/xfTbjNap+RnZdxu1edq7f6frT0hdlyJG/4C55ql9xLEMjxcBps/gc09LknO/cfZkH+NNaAOUTyjLsY19AaUzJHncWPrmsWro1TsC38J6tge4NONxBMAFc59FJrFprbU1Ti9HoD2sLJhmbHo3SmJZwA5Bj46dqqM7kygiVJkiB+YnPbPFMa9jfcFwSPek43dxqSSsNa7mUbvLVB7tSHUHWLcYmHtkHNCh5sXP5EB1p0TAtHx6g4/lU0OqQyLlrd93q4z+tVZ9G0LnXVCyXdw5/cBMf7uaga+uQwLxIT6gYqlHzZLl5KwNcs7ZljOT6UmYznkp+JFaIhjMRqM+ac/72aljDsR+/z9GqkTYk8uRTnex+rVIszIMfOSfamB//2apR82S5eSsDXLO2ZYzk+lJmM//Y/+0O2lBob3Rvc2hvcCAzLjAAOEJJTQPtClJlc29sdXRpb24AAAAAEABIAAAAAQACAEgAAAABAAI4QklNBA0YRlggR2xvYmFsIExpZ2h0aW5nIEFuZ2xlAAAAAAQAAAAeOEJJTQQZEkZYIEdsb2JhbCBBbHRpdHVkZQAAAAAEAAAAHjhCSU0D8wtQcmludCBGbGFncwAAAAkAAAAAAAAAAAEAOEJJTQQKDkNvcHlyaWdodCBGbGFnAAAAAAEAADhCSU0nEBRKYXBhbmVzZSBQcmludCBGbGFncwAAAAAKAAEAAAAAAAAAAjhCSU0D9RdDb2xvciBIYWxmdG9uZSBTZXR0aW5ncwAAAEgAL2ZmAAEAbGZmAAYAAAAAAAEAL2ZmAAEAoZmaAAYAAAAAAAEAMgAAAAEAWgAAAAYAAAAAAAEANQAAAAEALQAAAAYAAAAAAAE4QklNA/gXQ29sb3IgVHJhbnNmZXIgU2V0dGluZ3MAAABwAAD/////////////////////////////A+gAAAAA/////////////////////////////wPoAAAAAP////////////////////////////8D6AAAAAD/////////////////////////////A+gAADhCSU0ECAZHdWlkZXMAAAAAEAAAAAEAAAJAAAACQAAAAAA4QklNBB4NVVJMIG92ZXJyaWRlcwAAAAQAAAAAOEJJTQQaBlNsaWNlcwAAAAB3AAAABgAAAAAAAAAAAAAAWgAAAHgAAAALAG8AcABlAHIAYQBfAGgAbwB1AHMAZQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAeAAAAFoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOEJJTQQREUlDQyBVbnRhZ2dlZCBGbGFnAAAAAQEAOEJJTQQUF0xheWVyIElEIEdlbmVyYXRvciBCYXNlAAAABAAAAAE4QklNBAwVTmV3IFdpbmRvd3MgVGh1bWJuYWlsAAALLwAAAAEAAABwAAAAVAAAAVAAAG5AAAALEwAYAAH/2P/gABBKRklGAAECAQBIAEgAAP/uAA5BZG9iZQBkgAAAAAH/2wCEAAwICAgJCAwJCQwRCwoLERUPDAwPFRgTExUTExgRDAwMDAwMEQwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwBDQsLDQ4NEA4OEBQODg4UFA4ODg4UEQwMDAwMEREMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDP/AABEIAFQAcAMBIgACEQEDEQH/3QAEAAf/xAE/AAABBQEBAQEBAQAAAAAAAAADAAECBAUGBwgJCgsBAAEFAQEBAQEBAAAAAAAAAAEAAgMEBQYHCAkKCxAAAQQBAwIEAgUHBggFAwwzAQACEQMEIRIxBUFRYRMicYEyBhSRobFCIyQVUsFiMzRygtFDByWSU/Dh8WNzNRaisoMmRJNUZEXCo3Q2F9JV4mXys4TD03Xj80YnlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3EQACAgECBAQDBAUGBwcGBTUBAAIRAyExEgRBUWFxIhMFMoGRFKGxQiPBUtHwMyRi4XKCkkNTFWNzNPElBhaisoMHJjXC0kSTVKMXZEVVNnRl4vKzhMPTdePzRpSkhbSVxNTk9KW1xdXl9VZmdoaWprbG1ub2JzdHV2d3h5ent8f/2gAMAwEAAhEDEQA/AOmAU2VPf9ETHJSDURr7GCG6BaJJ6NMeKJzdpjwTahTMkkn5pnTGunx0SvZHdKKcoMDw0lrhIjXRRrrdZu1gjkHlX2yK2DwaPyKFjQ/nQ/vDlVvvGpsDzDY9nQUT5FoPBa6FGXcSiW1uY4h2s8HxTPrex217S13gdFZiYkDY2wGwTvo2an1VMiQh5F1VjdsSeyBCUICAu7KuM1VMITQiEJoT7WMNqbapwlCNqf/Q6sBTZW95hgkjUplZxPovI5JA+5Xck+GJLVhHikAiZjWCxu8DbMnVWbX+09/xTmAQO5/ImcNCfAKpPIZ1daNiEBG66snlrWD4D8iC53igesXAGeQITbydBr5JlrkhcJDiNxaQ4D4K48V31gO9zHag9xPcKqzGfAdZpOjWjklHawVAMBkfx5KVnTwVQa4wXk+54A7dynODW1pc63Y1oLnvdDWtaBue97ifaxjfpK0NeFx3+Md/1it6fX03peHc/DySPtmXUN8ydteJtq3W11bvfc9zP0v80pffyfvfgFnsw7Ovi5VGZQ3KxiXY9hd6NhEb2NcWNu2/mtt272fyEWFHpODlMxG0WUfZKMcMpxhbHqvrYxodfbSwv9H1Ld/p1P8A0npfzv6RR631PovQMcX9UyjW5wmrHrAddZH+ipn/AMEs2VKwM8BEXLWtdGA4ZWaGl90kJQhYN1uVh05N1P2Z17fUFBO5zGO91LbXQz9N6Wx9vt9n82jwpQbAPdjqi//R6D6xX9Qx+n+r0p9NWRuaHeqN52nT9CyW/pGrnas3602YRZZ1U15DrRcLamBpDWtLPs3t/wAE/wDnLPalaMzJqpdl0323k7R7txpDnH9J6jj9Gpuz6KakZlVjab632jtkMaQyR+bcyT6Lv/An/mJZcspHSxFOPGIjWiXSwfrP1LG6Re/qbftnWatwoZWw7Lmy30f5oNbvb+k9T+bVKr/GcW2DG6p0v7K+0hm8Pe0N3e3dtsbY13P76Fdhm1hrc/IIJgu0a4T+axzam+z+V/4IqdJtN/2V1GW2qpz2G+xrHVbBP2d9T3U/ztm36DvoKMSOui4xHd62/qfT8PGORk5NdWPUIdYXAzHthjQdz3Pj2LGx/wDGNg02usdjUuxjGwjIAytv77qXsON7/wDRttVduIwmRZYSNTLav/edK2Mf03tNl++xtRa4MhrX+19x9Khrv0aQl4JMPF23/wCMD6tsZRkOdkuGRW6yqsVDeGjcLH2TZsb/ADbm/SVGz/Gf0h5Apw7yyRNll1LC3X6fpNdY93/FrPx8pt2TkUV1PaKNgNjmQHEn3Gt30XMYpWFja33C+6QC8MYWdtdjG+kXJcfgrg8Xrx1/o7Ayx+ZWGW1WXNM/mVAWW7o+g/Z9Gt300uk/WPpfV7jX019zrGNFjvUpfUdjtGmsv/nNzv3Fy13S3041Vue4ltx/mTZVc2RB22Nqr/N3LPtycnp4fZgMymWAij7NW4hz2Wbv0mM/32VtRBO1I4eoL0H1w+u/7GZZhdJr+09Qb7brtu6nGJ/NsI9luV/wX0Kv8KvOul+n1P6wY9vX8hxquuD8vJvl5cGje2l+jttdzw2r9yqtWG4+O3Edl2dKvrq3loabbd5MbnvcyPo7js9T8+z/AItV2ZWDW8XO6blBp9zQXOLYafcR6gc16cCQQaWEWKt9iIL/AHghweNwc2C0g67mub7dqbYV5vifWTIxqaqsa+7Bqa8PrxcmpzWF8+r7bqf55tn+Eru9Nlq1/wDnn1+gzk4+PY0Qfax7ZB/PZayx9StDmY9QQ1zy8uhBf//SC/pmKPoOIJ7Ne7+9MOnVNH85aB4ixytuDWHbMHwCeAAZPPYj+KsSxw/dH2NeM5dz9rXHTTGl14/tlI4FjSP1rI8hvn8FbDARMRroSf4Byk3cCQWkjsY5CiOOPYMgnLuWj9iuDdMy6PEkEf8AUqIx8sGRnWgdx7T/AN9WkS3ktOneFGAHTB1TeCPZdxy7uZkYXUrdhZ1S1gHGgjy42qpZ0jrTy6OruI7BzT+UPW+Tydp2nvIj/NTzXzHuHiATHyThCKDOXd5odE6wyNnUmeGrXAfDlMenfWMBv+UK3bRDY3cf5hXSOuLCP0YduMl2g/6MlRc2ppLgzbPYnUf2DuR9sI9yXd5l+P8AWVp3DMa4wRydPL3M9qGLPrQ1wAu3RwHODm/9L81dHZsk7WwSBogOaOQ2T3AMpwwx8VpzScYH63kfzm4Dgeo0/wDVOSFv1tYI2jaeRLII/lAXLcZu2CA4eIOhUgNCdr4/OiSnfd4eP4f96t+8T8H/05PZkB28OboPzi7/AL6p1OJEz8Cf9qC4vBEPY13jAJj71HZlfmPZH9Uz+VWZFrC240tPmR2EGfkkHMaQBo4nUOEx+IVXfcwAWmrXncQD9wCT8qn6IDNwGo2kg/cmEWuum4TYCI2OB8AZ/wCqc1DLniR7te7SQNP5YZ7VUD73O2iljmd/T0Mf5zXf9FGDrhpWAHRoHgx83Nc5NqlwNsn5uMyA+yHd9Hc+b9j0qs3FfoHbxoZa0kT/AJqGLuonSxrXDuGz/wBUXKX2jJA1phvYOg/IJwH8rWkn+QZzjuJdIYXcgkA6eA9Ru1QYamglu93jALv836X/AFSTb8h3/aQx5QP+qTWixxaHVWb+4B0H4ohHl+SxdU7hrpI5cDz/AGoQvdOjRH3H7lElu73bh81DfXJDXAHydJ/KpAsJbQIiCSPiRP4p2BocXAy7xMfwQCS0Ai+Y/N3NEfDcFJj73HVu8eHt/wC+7U+1r//UGz0tvs/nO+6N0/20x+3bvZt2x7d0fjuXl6SsS2aw3/g+qV/bJHq7Nvlz89ym7kT6cfPn+wvKElGN/wDvWQ7f98+rH7Rr6e3nSP8AzJB/WIHr7v8Arcx5bvzti8vSTvs/7pb9v7H039N6b9vq+XO3+xv/ADkAftLc3Z9q/wCjt+Xqe1ecpIlH2vp1vrbB9t3bZ1mN3/R/QquPT3D0/V2eUxH/AFK85STo/RbL6/V9Lb638rbP50Qmd6kGfS51mV5qknrX0+v0tv5v9nd/FPp+bO3vG3/0Z7l5ekih/9kAOEJJTQQhGlZlcnNpb24gY29tcGF0aWJpbGl0eSBpbmZvAAAAAFUAAAABAQAAAA8AQQBkAG8AYgBlACAAUABoAG8AdABvAHMAaABvAHAAAAATAEEAZABvAGIAZQAgAFAAaABvAHQAbwBzAGgAbwBwACAANgAuADAAAAABADhCSU0EBgxKUEVHIFF1YWxpdHkAAAAAB//+AAAAAQEA/+4ADkFkb2JlAGSAAAAAAf/bAIQAFBERGhIaKRgYKTMnICczJxwcHBwnIhcXFxcXIhEMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAEVGhohHSEiGBgiFA4ODhQUDg4ODhQRDAwMDAwREQwMDAwMDBEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM/8AAEQgAWgB4AwEiAAIRAQMRAf/dAAQACP/EARsAAAMBAQEBAQEBAQEAAAAAAAEAAgMEBQYHCAkKCwEBAQEBAQEBAQEBAQEAAAAAAAECAwQFBgcICQoLEAACAgEDAgMEBwYDAwYCATUBAAIRAyESMQRBUSITYXEygZGxQqEF0cEU8FIjcjNi4YLxQzSSorIV0lMkc8JjBoOT4vKjRFRkJTVFFiZ0NlVls4TD03Xj80aUpIW0lcTU5PSltcXV5fVWZnaGlqa2xtbm9hEAAgIABQEGBgEDAQMFAwYvAAERAiEDMUESUWFxgZEiEzLwobEEwdHh8UJSI2JyFJIzgkMkorI0U0Rjc8LSg5OjVOLyBRUlBhYmNWRFVTZ0ZbOEw9N14/NGlKSFtJXE1OT0pbXF1eX1VmZ2hv/aAAwDAQACEQMRAD8A9dIiTwoDYJi+o85BjSGibVoDGMjqFN3RdsOgbIvl5O8M6Kso5pRIYt2yRPycqd1cow8CoanV33gPMrWpCcFZCJcOdNIaiApFNUtNITSppUD/0PaSrpiGtvpbhScEpcGdF32gCmigvG1pOqrAwAAQSyZVoxucGiyWsVAEON3w6RgQbUgGTF3j9DIwyL0WrtXaRjijlnD04mUiAByw+L1f4kOt6uOCEqwYzuyS+zOWP/31ifcx/wA2InEGiLelbTqZtWNCVay7cETPJIRiO8izCQnESHBFu009DDTQqmlaQ//R9bqs8elh6kgSP8IeDH+MmUZShilYraJfbXP1ks8KiAI9/wDE82OYlpwfB1a+yJWu7PV6L8Tj1tjaYGHxCTcfxXpJGvUA/qEovjysWQDfjfxPBLpISu47SNfJJ5ybg+p9SMyZRIMTwQ55epxYK9WQjfD5GCWXBAQjZA/i2f8AbcJdNOUjMynuPe4KRB9Thy4px3YpCQ8Ync2ckMY88gP6jtfk49NGN5BM2QYk2xL8Ph2s1/T/AO/VIg+rx9RjykjHKMq/gludgbflMEJdLLdCwT7YNZo5swAlI7QTLbu/i/8AKmFSIPo/2TD6nqbI7/4trxfif4xi/Dxt+LKeIfw/+PfNH4hk6bp/Rx0JjieSXwx/9+PiT6eWQ7pGJJ5lu+JskOnpZZvxjqonMbjHzyj9iMY/7v8A8yP1z8b0ccvTz3wkIn2S+J9+P4vGNDLEg/bl/wDAnrSyRztVs9OleWH4n009BOv6gVevJdTnxZ//0sSCAImAoeBWRMzZhqOPM9BJPKu3RGFdmXqS7wP0uOSEMkt08crHte0Jq3PE1yOYZa+zJP7QB9mX0PTtZMXPEvI4JjHKO0idXu0QevgNdsg+iIrsbxHI82H4nCE9+3cRp5wjJ+JY8hJmDR+yH0vT91olgHgD8m8ScjxcuTps/wAYkaG0fv6TOWXTZQBUogaAD/40+ueniR8I+hyl00DzEfQ3iycjyPR6Q95gfv8A+UnaEsGPSE5iP8JO+P8A7rez9kx3rEN/smH+FvBk5o5Tl6aX2iFen9ixfw/eVXtsvNH/06J1oNA+DBjE9liaezOKNBomrLIl4JJLk0VXtQdGdDoQgHwclLGq34MkS7EfNz/mX2+9pDY252Y66tDepvwpoBd6uZtJmfH7mTO3SMsFW1TAIDYmPEOkZDEX3VIKtB//1J0lwLX04ns19l55c93qzkb+mBxakyHA+lxj/qeg/P5MGBnsMvY3t2jU2svm49+6YRcowJ5+9aA03UiXbhwyc9vmgdIG74ZLu2nWX3PHj57fJ6u3b/V8TQEzB+0iz73Lx4SP3pqMlX4hom+AQx37uw4/N0QmMfaqnnsqB//Z">
+            <animate attributeName="y" from="5" to="145" begin="100" dur="3" fill="freeze"/>
+         </image>
+      </defs>      
+      <!-- END OF DEFS-->
+      
+      <!-- ACTUAL TEST CONTENT-->
+      <use xlink:href="#lineID">
+         <animate attributeName="x" from="10" to="70" begin="100" dur="3" fill="freeze"/>
+      </use>   
+      
+      <use xlink:href="#rectID" transform="">
+         <animateTransform attributeName="transform" type="translate" from="0 0" to="140 0" begin="100" dur="3" fill="freeze"/>
+         <animateTransform attributeName="transform" type="scale" from="1 1" to="0.5 1" begin="100" dur="3" additive="sum" fill="freeze"/>
+      </use>   
+   
+      <use xlink:href="#circleID">
+         <animate attributeName="x" from="10" to="70" begin="100" dur="3" fill="freeze"/>
+      </use>
+   
+      <use xlink:href="#polylineID" transform="">
+         <animateTransform attributeName="transform" type="rotate" from="0" to="15" additive="sum" begin="100" dur="3" fill="freeze"/>
+      </use>   
+   
+      <use x="60" y="-10" xlink:href="#polygonID" transform="">
+         <animateMotion path="M 0 0 l 0 150" begin="100" dur="3" fill="freeze"/>
+         <animateTransform attributeName="transform" type="scale" from="1 1" to="1 2" begin="100" dur="3" additive="sum" fill="freeze"/>
+      </use>
+   
+      <use xlink:href="#imageID" transform="">
+         <animateTransform attributeName="transform" type="scale" from="1 .25" to="1 1" begin="100" dur="3" additive="sum" fill="freeze"/>
+      </use>
+      <!-- END OF ACTUAL TEST CONTENT-->
+   </g>
+   
+   <text id="revision" x="10" y="340" font-size="40" stroke="none" fill="black">$Revision: 1.6 $</text>
+   <rect id="test-frame" x="1" y="1" width="478" height="358" fill="none" stroke="#000000"/>
+</svg>
diff --git a/dom/smil/crashtests/523188-1.svg b/dom/smil/crashtests/523188-1.svg
new file mode 100644
index 0000000000..c03cea4923
--- /dev/null
+++ b/dom/smil/crashtests/523188-1.svg
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait"
+     onload="setTimeout(removeNode, 0)">
+  <script>
+    function removeNode() {
+      var node = document.getElementById("myRect");
+      node.parentNode.removeChild(node);
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+  <rect id="myRect" x="20" y="20" height="50" width="50" stroke="blue">
+    <animate attributeName="stroke-width" from="1" to="9" begin="0s" dur="2s"/>
+  </rect>
+</svg>
diff --git a/dom/smil/crashtests/525099-1.svg b/dom/smil/crashtests/525099-1.svg
new file mode 100644
index 0000000000..8eed11489a
--- /dev/null
+++ b/dom/smil/crashtests/525099-1.svg
@@ -0,0 +1,7 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect x="20" y="20" height="50" width="50" fill="blue">
+    <animate attributeName="display" by="inline"
+             begin="0s" dur="1s"/>
+  </rect>
+</svg>
diff --git a/dom/smil/crashtests/526536-1.svg b/dom/smil/crashtests/526536-1.svg
new file mode 100644
index 0000000000..4fcf35d081
--- /dev/null
+++ b/dom/smil/crashtests/526536-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait"
+     onload="setTimeout('boom()', 0)">
+<script type="text/javascript">
+<![CDATA[
+function boom()
+{
+  document.getElementById("anim").setAttribute("fill", "freeze");
+  document.documentElement.removeAttribute("class");
+}
+]]>
+</script>
+  <g transform="translate(50 50)">
+    <circle r="40" style="fill: yellow; stroke: black; stroke-width: 1">
+      <animate id="anim" attributeName="cx" attributeType="XML"
+        values="0; 200" dur="2s" begin="-1s" repeatCount="0.5"/>
+    </circle>
+  </g>
+</svg>
diff --git a/dom/smil/crashtests/526875-1.svg b/dom/smil/crashtests/526875-1.svg
new file mode 100644
index 0000000000..281454bf61
--- /dev/null
+++ b/dom/smil/crashtests/526875-1.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animate attributeName="fill-opacity" by="-1"/>
+</svg>
diff --git a/dom/smil/crashtests/526875-2.svg b/dom/smil/crashtests/526875-2.svg
new file mode 100644
index 0000000000..73c229da5f
--- /dev/null
+++ b/dom/smil/crashtests/526875-2.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animate attributeName="fill-opacity" by="1"/>
+</svg>
diff --git a/dom/smil/crashtests/529387-1-helper.svg b/dom/smil/crashtests/529387-1-helper.svg
new file mode 100644
index 0000000000..7885ab71fd
--- /dev/null
+++ b/dom/smil/crashtests/529387-1-helper.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text y="20pt">abc
+    <animate attributeName="opacity" from="1" to="0" begin="0s" dur="2s"/>
+  </text>
+</svg>
diff --git a/dom/smil/crashtests/529387-1.xhtml b/dom/smil/crashtests/529387-1.xhtml
new file mode 100644
index 0000000000..de3dbec34c
--- /dev/null
+++ b/dom/smil/crashtests/529387-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <script>
+    var p = new XMLHttpRequest();
+    p.open("GET", "529387-1-helper.svg", false);
+    p.send();
+  </script>
+</html>
diff --git a/dom/smil/crashtests/531550-1.svg b/dom/smil/crashtests/531550-1.svg
new file mode 100644
index 0000000000..306f41702d
--- /dev/null
+++ b/dom/smil/crashtests/531550-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <g><animateTransform attributeName="transform" by="1"/></g>
+</svg>
diff --git a/dom/smil/crashtests/541297-1.svg b/dom/smil/crashtests/541297-1.svg
new file mode 100644
index 0000000000..4268232ba1
--- /dev/null
+++ b/dom/smil/crashtests/541297-1.svg
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg"><svg id="w"><animate/></svg><script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  anim = document.createElementNS("http://www.w3.org/2000/svg", "animate");
+  document.documentElement.appendChild(anim);
+  document.documentElement.removeChild(anim);
+  
+  setTimeout(t, 0);
+  
+  function t()
+  {
+    document.getElementById("w").appendChild(anim);
+  }
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></svg>
diff --git a/dom/smil/crashtests/547333-1.svg b/dom/smil/crashtests/547333-1.svg
new file mode 100644
index 0000000000..bac629b493
--- /dev/null
+++ b/dom/smil/crashtests/547333-1.svg
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait">
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  document.getElementsByTagName("animate")[0].setAttributeNS(null, "attributeName", "font-size");
+  document.getElementsByTagName("text")[0].setAttributeNS(null, "fill", "green");
+  document.documentElement.removeAttributeNS(null, "x");
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<text>abc<animate/></text>
+
+</svg>
diff --git a/dom/smil/crashtests/548899-1.svg b/dom/smil/crashtests/548899-1.svg
new file mode 100644
index 0000000000..c12ed27454
--- /dev/null
+++ b/dom/smil/crashtests/548899-1.svg
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+  <defs>
+    <circle id="circleID" cx="20" cy="100" r="10" fill="orange" stroke="black">
+      <animateTransform attributeName="transform" type="scale"
+                        from="1" to="2" begin="0" dur="3"/>
+    </circle>
+    <rect id="rectID" fill="green" stroke="black" height="100" width="100">
+      <animate attributeName="fill" from="white" to="blue" begin="0" dur="3"/>
+    </rect>
+  </defs>
+  <use xlink:href="#circleID"/>
+</svg>
diff --git a/dom/smil/crashtests/551620-1.svg b/dom/smil/crashtests/551620-1.svg
new file mode 100644
index 0000000000..2ea83e9c29
--- /dev/null
+++ b/dom/smil/crashtests/551620-1.svg
@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<animate id="x" begin="y.end"/>
+<animate id="y"/>
+
+<script>
+
+function boom()
+{
+  var x = document.getElementById("x");
+  var y = document.getElementById("y");
+  y.appendChild(x);
+  y.setAttributeNS(null, "dur", "0.5s");
+  y.removeAttributeNS(null, "dur");
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+</svg>
diff --git a/dom/smil/crashtests/554141-1.svg b/dom/smil/crashtests/554141-1.svg
new file mode 100644
index 0000000000..61ce419f53
--- /dev/null
+++ b/dom/smil/crashtests/554141-1.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     onload="
+        document.documentElement.pauseAnimations();
+        document.documentElement.setCurrentTime(0);
+        document.getElementById('b').removeAttribute('begin');
+        document.getElementById('a').setAttribute('dur', '1s')">
+  <rect>
+    <animate attributeName="y" attributeType="XML" id="a"/>
+    <animate attributeName="fill" attributeType="CSS" id="b"
+      begin="a.end" dur="2s"/>
+  </rect>
+</svg>
diff --git a/dom/smil/crashtests/554202-2.svg b/dom/smil/crashtests/554202-2.svg
new file mode 100644
index 0000000000..a3bbb3195c
--- /dev/null
+++ b/dom/smil/crashtests/554202-2.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     onload="
+        document.documentElement.pauseAnimations();
+        document.documentElement.setCurrentTime(0);
+        document.getElementById('a').beginElementAt(1);
+        document.documentElement.setCurrentTime(2)">
+  <!--
+    This test case sets up a cycle between simultaneous instance times such that
+    when the instance times are sorted if this cycle is not detected we will
+    crash.
+  -->
+  <rect width="100" height="100" fill="red">
+    <set attributeName="fill" to="blue" begin="a.begin" dur="4s"/>
+    <set attributeName="fill" to="green" id="a"
+      begin="b.begin; 3s" dur="4s"/>
+    <set attributeName="fill" to="red" id="b"
+      begin="a.begin" dur="4s"/>
+  </rect>
+</svg>
diff --git a/dom/smil/crashtests/555026-1.svg b/dom/smil/crashtests/555026-1.svg
new file mode 100644
index 0000000000..76b4cf0756
--- /dev/null
+++ b/dom/smil/crashtests/555026-1.svg
@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait"
+     onload="go()">
+  <script>
+    function go() {
+      // setCurrentTime to force a sample
+      document.documentElement.setCurrentTime(1);
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+  <rect id="myRect" fill="blue" height="40" width="40">
+    <!-- The "keyTimes" values below are invalid, but they should be ignored
+         (and definitely shouldn't trigger any assertion failures) since we're
+         in paced calcMode. -->
+    <animate attributeName="x" by="50" calcMode="paced" dur="2s"
+             keyTimes="0; -1"/>
+    <animate attributeName="x" by="50" calcMode="paced" dur="2s"
+             keyTimes=""/>
+    <animate attributeName="x" by="50" calcMode="paced" dur="2s"
+             keyTimes="abc"/>
+    <animate attributeName="x" by="50" calcMode="paced" dur="2s"
+             keyTimes="5"/>
+  </rect>
+</svg>
diff --git a/dom/smil/crashtests/556841-1.svg b/dom/smil/crashtests/556841-1.svg
new file mode 100644
index 0000000000..92712deaa9
--- /dev/null
+++ b/dom/smil/crashtests/556841-1.svg
@@ -0,0 +1,16 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait"
+     onload="go()">
+  <script>
+    function go() {
+      // setCurrentTime to force a sample
+      document.documentElement.setCurrentTime(2);
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+  <rect fill="teal" x="50" y="50" width="20" height="20">
+    <animateTransform attributeName="transform" type="rotate" by="30"
+                      calcMode="paced" dur="4s"/>
+  </rect>
+</svg>
diff --git a/dom/smil/crashtests/572938-1.svg b/dom/smil/crashtests/572938-1.svg
new file mode 100644
index 0000000000..d759944c7d
--- /dev/null
+++ b/dom/smil/crashtests/572938-1.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+  xmlns:xlink="http://www.w3.org/1999/xlink">
+  <defs>
+    <text id="myText">Used Text Element
+      <set attributeName="display" to="none"/>
+    </text>
+  </defs>
+  <use xlink:href="#myText" x="20" y="40"/>
+  <text x="20" y="60">Normal Text Element
+    <set attributeName="display" to="none"/>
+  </text>
+</svg>
diff --git a/dom/smil/crashtests/572938-2.svg b/dom/smil/crashtests/572938-2.svg
new file mode 100644
index 0000000000..8b9cf7b70e
--- /dev/null
+++ b/dom/smil/crashtests/572938-2.svg
@@ -0,0 +1,22 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+  xmlns:xlink="http://www.w3.org/1999/xlink"
+  class="reftest-wait">
+
+    <script>
+    function boom()
+    {
+      document.getElementById("circleID").removeChild(
+        document.getElementById("at"));
+      document.documentElement.removeAttribute("class");
+    }
+    window.addEventListener("load", boom, false);
+    </script>
+
+    <circle id="circleID">
+        <animate/>
+        <animateTransform id="at" attributeName="transform"/>
+    </circle>
+    <animate attributeName="stroke-width"/>
+    <use xlink:href="#circleID"/>
+
+</svg>
diff --git a/dom/smil/crashtests/572938-3.svg b/dom/smil/crashtests/572938-3.svg
new file mode 100644
index 0000000000..642ad32fba
--- /dev/null
+++ b/dom/smil/crashtests/572938-3.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+  xmlns:xlink="http://www.w3.org/1999/xlink">
+  <defs>
+    <text id="a">Text A</text>
+    <text id="b">Text B</text>
+  </defs>
+  <use xlink:href="#a" x="20" y="40">
+    <set attributeName="xlink:href" to="#b" dur="2s"/>
+  </use>
+</svg>
diff --git a/dom/smil/crashtests/572938-4.svg b/dom/smil/crashtests/572938-4.svg
new file mode 100644
index 0000000000..549d43dd62
--- /dev/null
+++ b/dom/smil/crashtests/572938-4.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+   xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="a">
+ <path d=""><animate/></path>
+</g>
+<g display="none">
+<use xlink:href="#a" x="80"/>
+<set attributeName="display" to="inline"/>
+</g>
+</svg>
diff --git a/dom/smil/crashtests/588287-1.svg b/dom/smil/crashtests/588287-1.svg
new file mode 100644
index 0000000000..cc35cf6b46
--- /dev/null
+++ b/dom/smil/crashtests/588287-1.svg
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+
+function boom()
+{
+  var animate = document.createElementNS("http://www.w3.org/2000/svg", "animate");
+  animate.setAttributeNS(null, "begin", "0.5s");
+  document.documentElement.appendChild(animate);
+  
+  setTimeout(function() {
+    var g = document.createElement("g");
+    var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    g.appendChild(svg);
+    document.documentElement.appendChild(g);
+    svg.appendChild(animate);
+    document.documentElement.removeAttribute("class");
+  }, 400);
+}
+
+window.addEventListener("load", function() { setTimeout(boom, 200) }, false);
+
+</script>
+</svg>
diff --git a/dom/smil/crashtests/588287-2.svg b/dom/smil/crashtests/588287-2.svg
new file mode 100644
index 0000000000..70d8e76391
--- /dev/null
+++ b/dom/smil/crashtests/588287-2.svg
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+
+function boom()
+{
+  var animate = document.createElementNS("http://www.w3.org/2000/svg", "animate");
+  animate.setAttributeNS(null, "begin", "0.5s");
+  document.documentElement.appendChild(animate);
+  
+  setTimeout(function() {
+    var g = document.createElement("g");
+    var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    g.appendChild(svg);
+    document.documentElement.appendChild(g);
+    svg.setCurrentTime(0.2);
+    svg.appendChild(animate);
+    svg.setCurrentTime(0.0); // Trigger backwards seek
+    document.documentElement.removeAttribute("class");
+  }, 400);
+}
+
+window.addEventListener("load", function() { setTimeout(boom, 200) }, false);
+
+</script>
+</svg>
diff --git a/dom/smil/crashtests/590425-1.html b/dom/smil/crashtests/590425-1.html
new file mode 100644
index 0000000000..906d348db2
--- /dev/null
+++ b/dom/smil/crashtests/590425-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  var frame = document.getElementById("frame")
+  var frameSVG = frame.contentDocument.getElementById('s');
+  var animate = frame.contentDocument.createElementNS("http://www.w3.org/2000/svg", "animate");
+  frame.remove();
+  frameSVG.appendChild(animate);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<iframe id="frame" srcdoc="<body><svg id=s>"></iframe>
+
+</body>
+</html>
diff --git a/dom/smil/crashtests/592477-1.xhtml b/dom/smil/crashtests/592477-1.xhtml
new file mode 100644
index 0000000000..c44a470a39
--- /dev/null
+++ b/dom/smil/crashtests/592477-1.xhtml
@@ -0,0 +1,26 @@
+<xht:table xmlns:xht="http://www.w3.org/1999/xhtml"
+           xmlns:xbl="http://www.mozilla.org/xbl">
+  <xht:script type="text/javascript">// <![CDATA[
+   function boom() {
+     var topRight = document.getElementById('topRight');
+     topRight.appendChild(document.createElement("g"));
+   }
+//]]> </xht:script>
+
+<xbl:bindings>
+  <xbl:binding>
+    <svg xmlns="http://www.w3.org/2000/svg"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         onload="setTimeout(boom, 0)">
+      <defs>
+        <g id="markerGroup">
+          <g id="topLeft"/>
+          <g id="topRight"/>
+          <set xlink:href="#topLeft" attributeName="fill" to="green" dur="1s"/>
+        </g>
+      </defs>
+      <use xlink:href="#markerGroup"/>
+    </svg>
+  </xbl:binding>
+</xbl:bindings>
+</xht:table>
diff --git a/dom/smil/crashtests/594653-1.svg b/dom/smil/crashtests/594653-1.svg
new file mode 100644
index 0000000000..76352ce30b
--- /dev/null
+++ b/dom/smil/crashtests/594653-1.svg
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+<![CDATA[
+
+window.addEventListener("load", boom, false);
+
+function boom()
+{
+  setTimeout(bang, 0);
+}
+
+function bang()
+{
+  document.documentElement.setCurrentTime(0);
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+<animate id="b"/>
+<animate end="b.end"/>
+
+</svg>
diff --git a/dom/smil/crashtests/596796-1.svg b/dom/smil/crashtests/596796-1.svg
new file mode 100644
index 0000000000..52a66fd582
--- /dev/null
+++ b/dom/smil/crashtests/596796-1.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+
+<script>
+function boom()
+{
+  document.documentElement.appendChild(document.getElementById("a"));
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+</script>
+
+<animate end="a.begin" id="a"/>
+
+</svg>
diff --git a/dom/smil/crashtests/605345-1.svg b/dom/smil/crashtests/605345-1.svg
new file mode 100644
index 0000000000..94887cf713
--- /dev/null
+++ b/dom/smil/crashtests/605345-1.svg
@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+<![CDATA[
+
+function boom()
+{
+  var anim = document.getElementById("a");
+  var newSvg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+  var oldSvg = document.removeChild(document.documentElement);
+  document.appendChild(newSvg);
+  document.removeChild(document.documentElement);
+  newSvg.pauseAnimations();
+  document.appendChild(newSvg);
+  newSvg.appendChild(anim);
+
+  oldSvg.removeAttribute("class");
+}
+
+window.addEventListener("load", function() { setTimeout(boom, 200); }, false);
+
+]]>
+</script>
+<animate id="a"/>
+</svg>
diff --git a/dom/smil/crashtests/606101-1.svg b/dom/smil/crashtests/606101-1.svg
new file mode 100644
index 0000000000..988c86fa33
--- /dev/null
+++ b/dom/smil/crashtests/606101-1.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait">
+<script>
+
+function boom()
+{
+  var origSVG = document.documentElement;
+
+  var a = document.createElementNS("http://www.w3.org/2000/svg", "animate");
+  var g = document.createElementNS("http://www.w3.org/2000/svg", "g");
+  var s = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+  document.removeChild(document.documentElement);
+  document.appendChild(g);
+  s.appendChild(a);
+  g.appendChild(s);
+
+  origSVG.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</svg>
diff --git a/dom/smil/crashtests/608295-1.html b/dom/smil/crashtests/608295-1.html
new file mode 100644
index 0000000000..354e6f9099
--- /dev/null
+++ b/dom/smil/crashtests/608295-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  // NB: <script src> is needed to trigger the bug. I'm being clever by also using it to remove reftest-wait.
+  var s = "<script src='data:text/javascript,parent.document.documentElement.className=null;'><\/script><svg>";
+  document.getElementById("f").contentDocument.write(s);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<iframe id="f"></iframe>
+</body>
+</html>
diff --git a/dom/smil/crashtests/608549-1.svg b/dom/smil/crashtests/608549-1.svg
new file mode 100644
index 0000000000..dd441e0135
--- /dev/null
+++ b/dom/smil/crashtests/608549-1.svg
@@ -0,0 +1,29 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+<![CDATA[
+
+function boom()
+{
+  try {
+    document.getElementById("set").beginElementAt(NaN);
+    return;
+  } catch (e) {}
+  try {
+    document.getElementById("set").endElementAt(NaN);
+    return;
+  } catch (e) {}
+
+  // If we got here we threw both exceptions and skipped both early-returns, as
+  // expected.
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<set id="set" attributeName="fill" to="green" begin="indefinite"/>
+
+</svg>
diff --git a/dom/smil/crashtests/611927-1.svg b/dom/smil/crashtests/611927-1.svg
new file mode 100644
index 0000000000..ea60f4ce1c
--- /dev/null
+++ b/dom/smil/crashtests/611927-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animate attributeName="stroke-width"/>
+  <animate attributeName="stroke-width" by="10em"/>
+</svg>
diff --git a/dom/smil/crashtests/615002-1.svg b/dom/smil/crashtests/615002-1.svg
new file mode 100644
index 0000000000..eb9a293199
--- /dev/null
+++ b/dom/smil/crashtests/615002-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+function boom()
+{
+  var a = document.getElementById("a");
+  a.removeAttribute('dur');
+  document.documentElement.appendChild(a);
+  // Force a sample
+  document.documentElement.setCurrentTime(0);
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+</script>
+<animate begin="-2s" dur="2s" id="a"/>
+</svg>
diff --git a/dom/smil/crashtests/615872-1.svg b/dom/smil/crashtests/615872-1.svg
new file mode 100644
index 0000000000..e0cdf21546
--- /dev/null
+++ b/dom/smil/crashtests/615872-1.svg
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg"><script>
+<![CDATA[
+
+function boom()
+{
+  var r = document.documentElement;
+  var s = document.createElementNS("http://www.w3.org/2000/svg", "set");
+  s.setAttributeNS(null, "begin", "1s");
+  r.appendChild(s);
+  r.setCurrentTime(2);
+  document.removeChild(r);
+  r.setCurrentTime(0);
+  s.beginElementAt(0);
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></svg>
diff --git a/dom/smil/crashtests/641388-1.html b/dom/smil/crashtests/641388-1.html
new file mode 100644
index 0000000000..25c941dedb
--- /dev/null
+++ b/dom/smil/crashtests/641388-1.html
@@ -0,0 +1,97 @@
+<script>
+
+var ar = new Array(100000);
+
+function fill() {
+        var s = unescape("%ubeef%udead%udead%udead%u0000%u0000%u3030%u3030");
+        while(s.length < 0x40000) {
+                for(var x=0; x<100; x++) ar.push(s+s);
+                s+=s;
+        }
+}
+
+
+function gc() {
+                var evt = document.createEvent("Events");
+                evt.initEvent("please-gc", true, false);
+                document.dispatchEvent(evt);
+		fill();
+}
+
+
+gc();
+function start(){
+tmp = document.createElement('iframe');
+tmp.src="data:image/svg+xml,"+escape("<?xml version='1.0' standalone='no'?><!DOCTYPE svg><svg xmlns='http://www.w3.org/2000/svg'><defs id='element1'></defs><g id='element5'></g></svg>");
+tmp.id = 'ifr23282';
+try{document.getElementById('store_div').appendChild(tmp);}catch(e){}
+window.setTimeout('startrly()', 100);
+} function startrly() {
+try{o6=document.createComment(null);}catch(e){}
+try{o9=document.getElementById('ifr23282').contentDocument.documentElement;;}catch(e){}
+try{o13=document.getElementById('ifr23282').contentDocument.getElementById('element1');;}catch(e){}
+try{o15=document.getElementById('ifr23282').contentDocument.getElementById('element5');;}catch(e){}
+try{tmp = document.createElement('iframe');}catch(e){}
+try{tmp.id = 'ifr6690';}catch(e){}
+try{o6.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+window.setTimeout('start_dataiframe0()',100);
+} function start_dataiframe0(){
+try{o19=o6.ownerDocument.getElementById('ifr6690').contentDocument.documentElement;;}catch(e){}
+try{o24=document.createElementNS('http://www.w3.org/1998/Math/MathML','annotation-xml');;}catch(e){}
+try{o35=document.createElementNS('http://www.w3.org/1998/Math/MathML','emptyset');;}catch(e){}
+try{o40=o19.cloneNode(false);;}catch(e){}
+try{o19.appendChild(o13);}catch(e){}
+try{o19.appendChild(o15);}catch(e){}
+try{o24.appendChild(o40);}catch(e){}
+try{tmp = document.createElement('iframe');}catch(e){}
+tmp.src="data:text/html,<article%20id='element1'></article><command%20id='element3'></command>";
+try{tmp.id = 'ifr17516';}catch(e){}
+try{o13.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+window.setTimeout('start_dataiframe4()',100);
+} function start_dataiframe4(){
+try{o62=o13.ownerDocument.getElementById('ifr17516').contentDocument.getElementById('element1');;}catch(e){}
+try{tmp.id = 'ifr2522';}catch(e){}
+try{o101=o15.ownerDocument.getElementById('ifr2522').contentDocument.getElementById('element3');;}catch(e){}
+try{o101.appendChild(o24);}catch(e){}
+try{o112=document.createElementNS('http://www.w3.org/1999/xhtml', 'script');;}catch(e){}
+try{o124=document.createElementNS('http://www.w3.org/1998/Math/MathML','root');;}catch(e){}
+try{o125=document.createElementNS('http://www.w3.org/2000/svg','font-face');;}catch(e){}
+gc()
+try{o150=o40;}catch(e){}
+try{tmp.id = 'ifr44501';}catch(e){}
+try{o124.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+window.setTimeout('start_dataiframe7()',100);
+} function start_dataiframe7(){
+try{o152=o124.ownerDocument.getElementById('ifr44501').contentDocument.documentElement;;}catch(e){}
+try{tmp = document.createElement('iframe');}catch(e){}
+try{tmp.src="data:text/html,<div%20id='element1'></div>";}catch(e){}
+try{tmp.id = 'ifr55543';}catch(e){}
+try{o125.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+window.setTimeout('start_dataiframe10()',100);
+} function start_dataiframe10(){
+try{o198=o125.ownerDocument.getElementById('ifr55543').contentDocument.getElementById('element1');;}catch(e){}
+try{o152.appendChild(o101);}catch(e){}
+try{o152.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+window.setTimeout('start_dataiframe17()',100);
+} function start_dataiframe17(){
+try{o286=o152.ownerDocument.getElementById('ifr55543').contentDocument.documentElement;;}catch(e){}
+try{o288=o152.ownerDocument.getElementById('ifr55543').contentDocument.getElementById('element1');;}catch(e){}
+try{o349=document.createElementNS('http://www.w3.org/2000/svg','animate');;}catch(e){}
+try{o150.appendChild(o349);}catch(e){}
+try{o288.appendChild(o150);}catch(e){}
+try{o198.appendChild(o349);}catch(e){}
+window.setTimeout('start_dataiframe24()',100);
+} function start_dataiframe24(){ 
+try{o286.appendChild(o9);}catch(e){}
+try{o62.appendChild(o152);}catch(e){}
+try{o112.appendChild(o286);}catch(e){}
+try{o534=o35.cloneNode(false);;}catch(e){}
+gc();
+o35 = null;
+gc();
+window.setTimeout("fill()",300);
+}
+</script>
+<body onload="start()">
+<div id="store_div"></div>
+</body>
diff --git a/dom/smil/crashtests/641388-2.html b/dom/smil/crashtests/641388-2.html
new file mode 100644
index 0000000000..f2ddead7e1
--- /dev/null
+++ b/dom/smil/crashtests/641388-2.html
@@ -0,0 +1,79 @@
+<script>
+function gc() {
+                var evt = document.createEvent("Events");
+                evt.initEvent("please-gc", true, false);
+                document.dispatchEvent(evt);
+        }
+var ar =new Array(100000);
+function fill() {
+        var s = unescape("%u0000%u0000%u3030%u3030");
+        while(s.length < 0x40000) {
+                for(var x=0; x<100; x++) ar.push(s+s);
+                s+=s;
+        }
+}
+
+
+function start(){
+tmp = document.createElement('iframe'); 'ifr16727';
+document.documentElement.appendChild(tmp);
+window.setTimeout('start_dataiframe0()',100);
+} function start_dataiframe0(){
+o20=document.createElement('iframe');
+tmp.id = 'ifr4446';;
+o68=o20;
+o101=document.getElementById('ifr4446').contentDocument.createElement('thead');;
+tmp.src="data:text/html," + escape("<html id='element0'><noscript id='element1'></html>");
+tmp.id = 'ifr49879';
+window.setTimeout('start_dataiframe6()',100);
+} function start_dataiframe6(){
+o104=document.getElementById('ifr49879').contentDocument.getElementById('element0');;
+o105=document.getElementById('ifr49879').contentDocument.getElementById('element1');;
+o120=document.getElementById('ifr49879').contentDocument.createElement('figure');;
+o105.appendChild(o120);
+o122=o105.lastElementChild;
+o140=document.getElementById('ifr49879').contentDocument.createElement('style');;
+o141=document.getElementById('ifr49879').contentDocument.createElementNS('http://www.w3.org/2000/svg','animate');;
+o151=o141.cloneNode(true);;
+tmp = document.createElement('iframe');
+tmp.src='data:text/html,%3Cform%20style%3B%27%20id%3D%27element3%27%3E%20%3Caside%20style%20id%3D%27element4%27%%3E';
+tmp.id = 'ifr13645';
+document.documentElement.appendChild(tmp);
+window.setTimeout('start_dataiframe8()',100);
+} function start_dataiframe8(){
+o154=document.getElementById('ifr13645').contentDocument.documentElement;;
+o158=document.getElementById('ifr13645').contentDocument.getElementById('element3');;
+o159=document.getElementById('ifr13645').contentDocument.getElementById('element4');;
+tmp.id = 'ifr17164';
+o120.ownerDocument.documentElement.appendChild(tmp);
+o171=o120.ownerDocument.getElementById('ifr17164').contentDocument.documentElement;;
+tmp = o158.ownerDocument.createElement('iframe');
+o101.appendChild(o151);
+o122.appendChild(o154);
+o68.appendChild(o171);
+o179=document.createElement('tbody');;
+o154.addEventListener('DOMNodeRemoved',function (event) { gc(); });
+tmp.src='data:text/html,%3Cs%27%20id%3D%27element0%27element4%27%3E%3Cs%20id%3D%27element5%27%20style%3D%27text-indent%3A%20-1%25%3Bmin-w%2C%20rgba%28255%2C0%2C0%2C0%29%20strict%3Bcolumn-count7element9%27%3E%s%3E';
+tmp.id = 'ifr35960';
+o154.ownerDocument.documentElement.appendChild(tmp);
+window.setTimeout('start_dataiframe13()',100);
+} function start_dataiframe13(){
+o217=o154.ownerDocument.getElementById('ifr35960').contentDocument.documentElement;;
+o218=o154.ownerDocument.getElementById('ifr35960').contentDocument.getElementById('element0');;
+o223=o154.ownerDocument.getElementById('ifr35960').contentDocument.getElementById('element5');;
+o223.appendChild(o101);
+o218.appendChild(o140);
+o140.appendChild(o151);
+o104.appendChild(o179);
+o230=o120.ownerDocument.getElementById('ifr17164').contentDocument.createElementNS('http://www.w3.org/2000/svg','svg');;
+window.setTimeout('start_dataiframe14()',100);
+} function start_dataiframe14(){
+gc();fill();
+o140.appendChild(o230);
+o171.appendChild(o104);
+o159.appendChild(o217);
+o158.appendChild(o218);
+}
+window.setTimeout("start()",100);
+</script>
+
diff --git a/dom/smil/crashtests/650732-1.svg b/dom/smil/crashtests/650732-1.svg
new file mode 100644
index 0000000000..95be31c16a
--- /dev/null
+++ b/dom/smil/crashtests/650732-1.svg
@@ -0,0 +1,46 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+  <rect fill="green" width="100" height="100">
+    <set id="a" attributeName="fill" to="blue"
+      begin="6s" end="986s"/>
+    <set id="b" attributeName="fill" to="orange"
+      begin="a.begin+69.3s;b.begin+700s" dur="700s" end="a.end"/>
+    <set id="c" attributeName="fill" to="yellow"
+      begin="0s;b.begin+700s"/>
+  </rect>
+  <script type="text/javascript">
+<![CDATA[
+const max_attempts = 100;
+var   attempts = 0;
+function attemptCrash()
+{
+  remove();
+  add();
+  if (++attempts >= max_attempts) {
+    document.documentElement.removeAttribute("class");
+  } else {
+    setTimeout(attemptCrash, 0);
+  }
+}
+function add()
+{
+  const svgns = "http://www.w3.org/2000/svg";
+  var elem = document.createElementNS(svgns, "set");
+  elem.setAttribute("id", "b");
+  elem.setAttribute("attributeName", "fill");
+  elem.setAttribute("to", "orange");
+  elem.setAttribute("begin", "a.begin+69.3s;b.begin+700s");
+  elem.setAttribute("dur", "700s");
+  elem.setAttribute("end", "a.end");
+  rect = document.getElementsByTagNameNS(svgns, "rect")[0];
+  rect.appendChild(elem);
+}
+function remove()
+{
+  var elem = document.getElementById('b');
+  elem.parentNode.removeChild(elem);
+  elem = null;
+}
+window.addEventListener("load", attemptCrash, false);
+]]>
+ </script>
+</svg>
diff --git a/dom/smil/crashtests/665334-1.svg b/dom/smil/crashtests/665334-1.svg
new file mode 100644
index 0000000000..94916d1e0e
--- /dev/null
+++ b/dom/smil/crashtests/665334-1.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+function boom()
+{
+  // Remove the first 'a'.
+  document.documentElement.removeChild(document.getElementById("a"));
+  document.documentElement.removeAttribute("class");
+}
+window.addEventListener("load", boom, false);
+</script>
+<animate id="a"/>
+<animate id="a" end="a.begin" />
+</svg>
diff --git a/dom/smil/crashtests/669225-1.svg b/dom/smil/crashtests/669225-1.svg
new file mode 100644
index 0000000000..9660105631
--- /dev/null
+++ b/dom/smil/crashtests/669225-1.svg
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  document.documentElement.appendChild(document.getElementById("a"));
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<animate end="a.begin" id="a"/>
+<animate end="a.begin" id="a"/>
+
+</svg>
diff --git a/dom/smil/crashtests/669225-2.svg b/dom/smil/crashtests/669225-2.svg
new file mode 100644
index 0000000000..00d52c1f4c
--- /dev/null
+++ b/dom/smil/crashtests/669225-2.svg
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  var a = document.getElementById("a");
+  a.removeAttribute("end");
+  a.setAttribute("end", "a.begin");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<animate end="0" id="a" onend="boom()"/>
+</svg>
diff --git a/dom/smil/crashtests/670313-1.svg b/dom/smil/crashtests/670313-1.svg
new file mode 100644
index 0000000000..97e12f35ac
--- /dev/null
+++ b/dom/smil/crashtests/670313-1.svg
@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait">
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  try {
+    document.getElementById("x").beginElementAt(36028797018963970);
+  } catch (e) { }
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+<animate id="x" begin="a" />
+</svg>
diff --git a/dom/smil/crashtests/678822-1.svg b/dom/smil/crashtests/678822-1.svg
new file mode 100644
index 0000000000..a5e81ee10f
--- /dev/null
+++ b/dom/smil/crashtests/678822-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animate repeatCount="2" dur="1s" accumulate="1" />
+</svg>
diff --git a/dom/smil/crashtests/678847-1.svg b/dom/smil/crashtests/678847-1.svg
new file mode 100644
index 0000000000..1fa2718cbb
--- /dev/null
+++ b/dom/smil/crashtests/678847-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<animate id="a" end="a.end+6s" />
+</svg>
diff --git a/dom/smil/crashtests/678938-1.svg b/dom/smil/crashtests/678938-1.svg
new file mode 100644
index 0000000000..f3f8308fa5
--- /dev/null
+++ b/dom/smil/crashtests/678938-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+<script>
+  window.addEventListener("load", function() {
+    setTimeout(function() {
+      document.documentElement.setCurrentTime(0);
+      document.documentElement.removeAttribute("class");
+    }, 0);
+  }, false);
+</script>
+<set id="c"/><set id="b" begin="c.begin; b.begin"/>
+</svg>
diff --git a/dom/smil/crashtests/690994-1.svg b/dom/smil/crashtests/690994-1.svg
new file mode 100644
index 0000000000..252fd2c264
--- /dev/null
+++ b/dom/smil/crashtests/690994-1.svg
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait" onload="go()">
+<script>
+<![CDATA[
+function go() {
+  document.documentElement.setCurrentTime(100);
+}
+function boom()
+{
+  document.documentElement.removeChild(document.getElementById("a"));
+  document.documentElement.removeAttribute("class");
+}
+]]>
+</script>
+<animate id="a" begin="a.end; 99.9s" end="a.begin+0.2s" onend="boom()"/>
+<animate id="a" begin="a.end; 99.9s" end="a.begin+0.2s"/>
+</svg>
diff --git a/dom/smil/crashtests/691337-1.svg b/dom/smil/crashtests/691337-1.svg
new file mode 100644
index 0000000000..c341faa6b2
--- /dev/null
+++ b/dom/smil/crashtests/691337-1.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
+  <rect width="100" height="100" fill="blue">
+    <animate attributeName="fill"
+      begin="999999999999999999999999999999999999999999999999999999999999999999999999999999999"
+      dur="5s" from="blue" to="red" repeatCount="indefinite" additive="sum"/>
+  </rect>
+</svg>
diff --git a/dom/smil/crashtests/691337-2.svg b/dom/smil/crashtests/691337-2.svg
new file mode 100644
index 0000000000..f4408ae5ee
--- /dev/null
+++ b/dom/smil/crashtests/691337-2.svg
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
+  <rect width="100" height="100" fill="blue">
+    <animate attributeName="fill" id="a"
+      begin="4999999999999999" dur="5s" from="blue" to="red"
+      repeatCount="indefinite" additive="sum"/>
+    <animate attributeName="fill"
+      begin="a.begin+4999999999999999"
+      dur="5s" from="blue" to="red" repeatCount="indefinite" additive="sum"/>
+  </rect>
+</svg>
diff --git a/dom/smil/crashtests/697640-1.svg b/dom/smil/crashtests/697640-1.svg
new file mode 100644
index 0000000000..c2e1b89fdb
--- /dev/null
+++ b/dom/smil/crashtests/697640-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animate id="b" end="b.end" dur="3s" />
+</svg>
diff --git a/dom/smil/crashtests/699325-1.svg b/dom/smil/crashtests/699325-1.svg
new file mode 100644
index 0000000000..7496c6ae21
--- /dev/null
+++ b/dom/smil/crashtests/699325-1.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect fill="blue" height="100" width="100">
+    <animate id="a" attributeName="x"  calcMode="paced" values="50; 50; 50"/>
+  </rect>
+</svg>
diff --git a/dom/smil/crashtests/709907-1.svg b/dom/smil/crashtests/709907-1.svg
new file mode 100644
index 0000000000..631911970c
--- /dev/null
+++ b/dom/smil/crashtests/709907-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <animate attributeName="stroke-dasharray" from="-3" />
+</svg>
diff --git a/dom/smil/crashtests/720103-1.svg b/dom/smil/crashtests/720103-1.svg
new file mode 100644
index 0000000000..a51a3bf0fc
--- /dev/null
+++ b/dom/smil/crashtests/720103-1.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+<animate id="a" begin="-3.1s" end="a.begin+0.2s"/>
+</svg>
diff --git a/dom/smil/crashtests/849593-1.xhtml b/dom/smil/crashtests/849593-1.xhtml
new file mode 100644
index 0000000000..95b9b2feb8
--- /dev/null
+++ b/dom/smil/crashtests/849593-1.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head class="reftest-wait">
+<meta charset="utf-8"/>
+<script>
+<![CDATA[
+
+function boom()
+{
+  var a = document.getElementById('a');
+  var b = document.getElementById('b');
+  var c = document.getElementById('c');
+  var d = document.getElementById('d');
+
+  b.setCurrentTime(1);
+
+  a.appendChild(c);
+  document.body.removeChild(a);
+  b.appendChild(c);
+  document.documentElement.offsetHeight;
+  d.appendChild(a);
+
+  document.documentElement.removeAttribute('class');
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(boom, 0);">
+<svg xmlns="http://www.w3.org/2000/svg" id="a"/>
+<svg xmlns="http://www.w3.org/2000/svg" id="b"/>
+<set xmlns="http://www.w3.org/2000/svg" begin="1s" id="c"><div xmlns="http://www.w3.org/1999/xhtml" id="d"></div></set>
+</body>
+</html>
diff --git a/dom/smil/crashtests/crashtests.list b/dom/smil/crashtests/crashtests.list
new file mode 100644
index 0000000000..844cfad672
--- /dev/null
+++ b/dom/smil/crashtests/crashtests.list
@@ -0,0 +1,61 @@
+load 483584-1.svg
+load 483584-2.svg
+load 523188-1.svg
+load 525099-1.svg
+load 526536-1.svg
+load 526875-1.svg
+load 526875-2.svg
+load 529387-1.xhtml
+load 531550-1.svg
+load 541297-1.svg
+load 547333-1.svg
+load 548899-1.svg
+load 551620-1.svg
+load 554141-1.svg
+load 554202-2.svg
+load 555026-1.svg
+load 556841-1.svg
+load 572938-1.svg
+load 572938-2.svg
+load 572938-3.svg
+load 572938-4.svg
+load 588287-1.svg
+load 588287-2.svg
+load 590425-1.html
+load 592477-1.xhtml
+load 594653-1.svg
+load 596796-1.svg
+load 605345-1.svg
+load 606101-1.svg
+load 608295-1.html
+load 608549-1.svg
+load 611927-1.svg
+load 615002-1.svg
+load 615872-1.svg
+load 641388-1.html
+load 641388-2.html
+load 650732-1.svg
+load 665334-1.svg
+load 669225-1.svg
+load 669225-2.svg
+load 670313-1.svg
+load 678822-1.svg
+load 678847-1.svg
+load 678938-1.svg
+load 690994-1.svg
+load 691337-1.svg
+load 691337-2.svg
+load 697640-1.svg
+load 699325-1.svg
+load 709907-1.svg
+load 720103-1.svg
+load 849593-1.xhtml
+load 1010681-1.svg
+load 1322770-1.svg
+load 1322849-1.svg
+load 1343357-1.html
+load 1375596-1.svg
+load 1402547-1.html
+load 1411963-1.html
+load 1413319-1.html
+load 1535388-1.html