8 files changed, 115 insertions, 0 deletions
diff --git a/dom/jsurl/crashtests/1018583.html b/dom/jsurl/crashtests/1018583.html
new file mode 100644
index 0000000000..8ede367c6b
--- /dev/null
+++ b/dom/jsurl/crashtests/1018583.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<!-- Make sure we don't go into an infinite loop -->
+<img src="javascript:while(true){}">
diff --git a/dom/jsurl/crashtests/1180389.html b/dom/jsurl/crashtests/1180389.html
new file mode 100644
index 0000000000..b6b6443cda
--- /dev/null
+++ b/dom/jsurl/crashtests/1180389.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+  window.location.protocol = "javascript";
+</script>
diff --git a/dom/jsurl/crashtests/341963-1.html b/dom/jsurl/crashtests/341963-1.html
new file mode 100644
index 0000000000..2cdb467d13
--- /dev/null
+++ b/dom/jsurl/crashtests/341963-1.html
@@ -0,0 +1,8 @@
+<script>
+
+location = "javascript:x.x.x";
+
+for(var i in {})
+  ;
+
+</script>
diff --git a/dom/jsurl/crashtests/344874-1.html b/dom/jsurl/crashtests/344874-1.html
new file mode 100644
index 0000000000..4df2723e40
--- /dev/null
+++ b/dom/jsurl/crashtests/344874-1.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+<script>
+
+var img;
+
+function boo()
+{
+  img = document.getElementById("img");
+  setScriptSrc();
+}
+
+function setScriptSrc()
+{
+  img.src = "javascript:setScriptSrc();";
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boo, 30);">
+
+<img src="../../../../testing/crashtest/images/tree.gif" id="img">
+
+</body>
+
+</html>
diff --git a/dom/jsurl/crashtests/344996-1.xhtml b/dom/jsurl/crashtests/344996-1.xhtml
new file mode 100644
index 0000000000..d9a5bbfccc
--- /dev/null
+++ b/dom/jsurl/crashtests/344996-1.xhtml
@@ -0,0 +1,41 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<script>
+<![CDATA[
+
+var a;
+var b;
+
+function foopy()
+{
+  a = document.getElementById("a");
+  b = document.getElementById("b");
+  
+  var img = document.getElementById("img");
+  var rx = document.getElementById("rx");
+
+  img.setAttribute('src', "javascript:aC(a, b);");
+  aC(rx, a);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+// This has to be a top-level function to avoid hitting bug 344890.
+function aC(q1, q2) { q1.appendChild(q2); }
+
+]]>
+</script>
+
+</head>
+
+<body onload="setTimeout(foopy, 30);">
+
+<span id="a" style="border: 1px solid green;">A<img src="../../../../testing/crashtest/images/tree.gif" id="img" /></span>
+
+<span id="b">B</span>
+
+<div data="text/plain,Hi!" style="border: 1px solid blue; display: block;" id="rx" />
+
+</body>
+</html>
diff --git a/dom/jsurl/crashtests/457050-1-inner.html b/dom/jsurl/crashtests/457050-1-inner.html
new file mode 100644
index 0000000000..54521c9a50
--- /dev/null
+++ b/dom/jsurl/crashtests/457050-1-inner.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<link rel="stylesheet" type="text/css" href="javascript:'p { color: green }'">
+</head>
+<body onload="parent.next(window);">
+<p>Hello</p>
+</body>
+</html>
diff --git a/dom/jsurl/crashtests/457050-1.html b/dom/jsurl/crashtests/457050-1.html
new file mode 100644
index 0000000000..17e3faf8e2
--- /dev/null
+++ b/dom/jsurl/crashtests/457050-1.html
@@ -0,0 +1,18 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+var i = 0;
+function next(w)
+{
+  ++i;
+  if (i == 1)
+    w.location.reload();
+  if (i == 2)
+    document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body>
+<iframe src="457050-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/dom/jsurl/crashtests/crashtests.list b/dom/jsurl/crashtests/crashtests.list
new file mode 100644
index 0000000000..73c36b6ac5
--- /dev/null
+++ b/dom/jsurl/crashtests/crashtests.list
@@ -0,0 +1,6 @@
+load 341963-1.html
+load 344874-1.html
+load 344996-1.xhtml
+load 457050-1.html
+load 1018583.html
+load 1180389.html