Merging upstream version 126.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

7 files changed, 75 insertions, 1 deletions

diff --git a/dom/base/crashtests/1697256.html b/dom/base/crashtests/1697256.html
index 25024083e3..3d6634e952 100644
--- a/dom/base/crashtests/1697256.html
+++ b/dom/base/crashtests/1697256.html
@@ -4,8 +4,9 @@
 <script>
   window.onload = () => {
     window.requestIdleCallback(() => {
-      SpecialPowers.wrap(self).printPreview()
+      let pp = SpecialPowers.wrap(self).printPreview()
       setTimeout(() => {
+        try { pp.close(); } catch (e) { }
         document.documentElement.classList.remove("reftest-wait");
       }, 250)
     })
diff --git a/dom/base/crashtests/1887930.html b/dom/base/crashtests/1887930.html
new file mode 100644
index 0000000000..04a89de8d2
--- /dev/null
+++ b/dom/base/crashtests/1887930.html
@@ -0,0 +1,7 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  document.getSelection().extend(a)
+})
+</script>
+<dialog id="a"></dialog>
+<input type="datetime-local" autofocus="autofocus">
diff --git a/dom/base/crashtests/1887963_1.html b/dom/base/crashtests/1887963_1.html
new file mode 100644
index 0000000000..fbc30dc587
--- /dev/null
+++ b/dom/base/crashtests/1887963_1.html
@@ -0,0 +1,15 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  let c = a.attachShadow({mode: "open"})
+  let b = document.getElementById("host").shadowRoot.getElementById("b");
+  window.parent.getSelection().setBaseAndExtent(b, 0, c, 0)
+})
+</script>
+<div id="a">A</div>
+<video>
+  <div id="host">
+    <template shadowrootmode="open">
+      <video id="b">
+    </template>
+  </div>
+</video>
diff --git a/dom/base/crashtests/1887963_2.html b/dom/base/crashtests/1887963_2.html
new file mode 100644
index 0000000000..53f512173b
--- /dev/null
+++ b/dom/base/crashtests/1887963_2.html
@@ -0,0 +1,15 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  let c = a.attachShadow({mode: "open"})
+  let b = document.getElementById("not-slotted");
+  window.parent.getSelection().setBaseAndExtent(b, 0, c, 0)
+})
+</script>
+<div id="a">A</div>
+<video>
+  <div id="host">
+    <template shadowrootmode="open">
+    </template>
+    <span id="not-slotted">NotSlotted</span>
+  </div>
+</video>
diff --git a/dom/base/crashtests/1887974.html b/dom/base/crashtests/1887974.html
new file mode 100644
index 0000000000..85ffd2b02a
--- /dev/null
+++ b/dom/base/crashtests/1887974.html
@@ -0,0 +1,18 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  c.add(d, 1)
+  b.addEventListener("DOMNodeRemoved", () => {
+    a.appendChild(f)
+  })
+  let r = document.createRange()
+  r.setEndBefore(d)
+  r.deleteContents()
+})
+</script>
+<audio>
+<canvas id="b">
+</canvas>
+<select id="c">
+<option id="d">A</option>
+<optgroup id="f">
+<input id="a">
diff --git a/dom/base/crashtests/1890888.html b/dom/base/crashtests/1890888.html
new file mode 100644
index 0000000000..006768ae14
--- /dev/null
+++ b/dom/base/crashtests/1890888.html
@@ -0,0 +1,13 @@
+<script>
+window.addEventListener("DOMContentLoaded", () => {
+  o1.prepend(o4)
+  document.getSelection().setBaseAndExtent(o5.attachShadow({mode: "closed"}), 0, o3, 0)
+  o5.replaceWith(o2)
+  setTimeout(window.close, 500)
+})
+</script>
+<iframe id="o1"></iframe>
+<picture id="o2"></picture>
+<area id="o3">
+<meter id="o4">
+<p id="o5">
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index 864538ddf5..22aaf50e6b 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -271,3 +271,8 @@ load 1835886.html
 load 1836824.html
 skip-if(Android) load 1838484.html
 load 1840191.html
+load 1887930.html
+load 1887963_1.html
+load 1887963_2.html
+asserts(0-1) load 1887974.html
+load 1890888.html