summaryrefslogtreecommitdiffstats
path: root/dom/html/crashtests
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-19 00:47:55 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-19 00:47:55 +0000
commit26a029d407be480d791972afb5975cf62c9360a6 (patch)
treef435a8308119effd964b339f76abb83a57c29483 /dom/html/crashtests
parentInitial commit. (diff)
downloadfirefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz
firefox-26a029d407be480d791972afb5975cf62c9360a6.zip
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'dom/html/crashtests')
-rw-r--r--dom/html/crashtests/1032654.html1
-rw-r--r--dom/html/crashtests/1141260.html4
-rw-r--r--dom/html/crashtests/1228876.html21
-rw-r--r--dom/html/crashtests/1230110.html19
-rw-r--r--dom/html/crashtests/1237633.html1
-rw-r--r--dom/html/crashtests/1281972-1.html5
-rw-r--r--dom/html/crashtests/1282894.html17
-rw-r--r--dom/html/crashtests/1290904.html37
-rw-r--r--dom/html/crashtests/1343886-1.html14
-rw-r--r--dom/html/crashtests/1343886-2.xml3
-rw-r--r--dom/html/crashtests/1343886-3.xml3
-rw-r--r--dom/html/crashtests/1350972.html22
-rw-r--r--dom/html/crashtests/1386905.html13
-rw-r--r--dom/html/crashtests/1401726.html17
-rw-r--r--dom/html/crashtests/1412173.html18
-rw-r--r--dom/html/crashtests/1429783.html19
-rw-r--r--dom/html/crashtests/1440523.html13
-rw-r--r--dom/html/crashtests/1440827.html6
-rw-r--r--dom/html/crashtests/1547057.html11
-rw-r--r--dom/html/crashtests/1550524.html7
-rw-r--r--dom/html/crashtests/1550881-1.html13
-rw-r--r--dom/html/crashtests/1550881-2.html14
-rw-r--r--dom/html/crashtests/1667493.html13
-rw-r--r--dom/html/crashtests/1667493_1.html7
-rw-r--r--dom/html/crashtests/1680418.html17
-rw-r--r--dom/html/crashtests/1704660.html17
-rw-r--r--dom/html/crashtests/1724816.html14
-rw-r--r--dom/html/crashtests/1785933-inner.html28
-rw-r--r--dom/html/crashtests/1785933.html10
-rw-r--r--dom/html/crashtests/1787671.html19
-rw-r--r--dom/html/crashtests/1789475.html10
-rw-r--r--dom/html/crashtests/1801380.html1
-rw-r--r--dom/html/crashtests/1840088.html2
-rw-r--r--dom/html/crashtests/257818-1.html82
-rw-r--r--dom/html/crashtests/285166-1.html3
-rw-r--r--dom/html/crashtests/294235-1.html14
-rw-r--r--dom/html/crashtests/307616-1.html8
-rw-r--r--dom/html/crashtests/324918-1.xhtml26
-rw-r--r--dom/html/crashtests/338649-1.xhtml22
-rw-r--r--dom/html/crashtests/339501-1.xhtml33
-rw-r--r--dom/html/crashtests/339501-2.xhtml33
-rw-r--r--dom/html/crashtests/378993-1.xhtml7
-rw-r--r--dom/html/crashtests/382568-1-inner.xhtml52
-rw-r--r--dom/html/crashtests/382568-1.html9
-rw-r--r--dom/html/crashtests/383137.xhtml13
-rw-r--r--dom/html/crashtests/388183-1.html8
-rw-r--r--dom/html/crashtests/395340-1.html28
-rw-r--r--dom/html/crashtests/399694-1.html20
-rw-r--r--dom/html/crashtests/407053.html6
-rw-r--r--dom/html/crashtests/423371-1.html9
-rw-r--r--dom/html/crashtests/448564.html7
-rw-r--r--dom/html/crashtests/451123-1.html7
-rw-r--r--dom/html/crashtests/453406-1.html34
-rw-r--r--dom/html/crashtests/464197-1.html23
-rw-r--r--dom/html/crashtests/468562-1.html6
-rw-r--r--dom/html/crashtests/468562-2.html6
-rw-r--r--dom/html/crashtests/494225.html10
-rw-r--r--dom/html/crashtests/495543.svg16
-rw-r--r--dom/html/crashtests/495546-1.html19
-rw-r--r--dom/html/crashtests/504183-1.html12
-rw-r--r--dom/html/crashtests/515829-1.html7
-rw-r--r--dom/html/crashtests/515829-2.html7
-rw-r--r--dom/html/crashtests/570566-1.html2
-rw-r--r--dom/html/crashtests/571428-1.html14
-rw-r--r--dom/html/crashtests/580507-1.xhtml18
-rw-r--r--dom/html/crashtests/590387.html8
-rw-r--r--dom/html/crashtests/596785-1.html9
-rw-r--r--dom/html/crashtests/596785-2.html9
-rw-r--r--dom/html/crashtests/602117.html8
-rw-r--r--dom/html/crashtests/604807.html9
-rw-r--r--dom/html/crashtests/605264.html8
-rw-r--r--dom/html/crashtests/606430-1.html31
-rw-r--r--dom/html/crashtests/613027.html21
-rw-r--r--dom/html/crashtests/614279.html18
-rw-r--r--dom/html/crashtests/614988-1.html5
-rw-r--r--dom/html/crashtests/616401.html8
-rw-r--r--dom/html/crashtests/620078-1.html20
-rw-r--r--dom/html/crashtests/620078-2.html6
-rw-r--r--dom/html/crashtests/631421.html34
-rw-r--r--dom/html/crashtests/631421.pngbin0 -> 38661 bytes
-rw-r--r--dom/html/crashtests/673853.html20
-rw-r--r--dom/html/crashtests/682058.xhtml11
-rw-r--r--dom/html/crashtests/682460.html21
-rw-r--r--dom/html/crashtests/68912-1.html24
-rw-r--r--dom/html/crashtests/738744.xhtml4
-rw-r--r--dom/html/crashtests/741218.json1
-rw-r--r--dom/html/crashtests/741218.json^headers^1
-rw-r--r--dom/html/crashtests/741250.xhtml9
-rw-r--r--dom/html/crashtests/768344.html22
-rw-r--r--dom/html/crashtests/795221-1.html7
-rw-r--r--dom/html/crashtests/795221-2.html9
-rw-r--r--dom/html/crashtests/795221-3.html14
-rw-r--r--dom/html/crashtests/795221-4.html9
-rw-r--r--dom/html/crashtests/795221-5.xml6
-rw-r--r--dom/html/crashtests/798802-1.html18
-rw-r--r--dom/html/crashtests/811226.html6
-rw-r--r--dom/html/crashtests/819745.html5
-rw-r--r--dom/html/crashtests/828180.html5
-rw-r--r--dom/html/crashtests/828472.html6
-rw-r--r--dom/html/crashtests/837033.html4
-rw-r--r--dom/html/crashtests/838256-1.html20
-rw-r--r--dom/html/crashtests/862084.html9
-rw-r--r--dom/html/crashtests/865147.html7
-rw-r--r--dom/html/crashtests/877910.html1
-rw-r--r--dom/html/crashtests/903106.html3
-rw-r--r--dom/html/crashtests/916322-1.html10
-rw-r--r--dom/html/crashtests/916322-2.html10
-rw-r--r--dom/html/crashtests/978644.xhtml11
-rw-r--r--dom/html/crashtests/crashtests.list99
109 files changed, 1543 insertions, 0 deletions
diff --git a/dom/html/crashtests/1032654.html b/dom/html/crashtests/1032654.html
new file mode 100644
index 0000000000..3067e10770
--- /dev/null
+++ b/dom/html/crashtests/1032654.html
@@ -0,0 +1 @@
+<template>&#x000d;#
diff --git a/dom/html/crashtests/1141260.html b/dom/html/crashtests/1141260.html
new file mode 100644
index 0000000000..c5ced3a447
--- /dev/null
+++ b/dom/html/crashtests/1141260.html
@@ -0,0 +1,4 @@
+<img src="foo" srcset="bar">
+<script>
+ document.querySelector("img").removeAttribute('src');
+</script>
diff --git a/dom/html/crashtests/1228876.html b/dom/html/crashtests/1228876.html
new file mode 100644
index 0000000000..b7beb645cf
--- /dev/null
+++ b/dom/html/crashtests/1228876.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var a = document.createElement("select");
+ var f = document.createElement("optgroup");
+ var g = document.createElement("optgroup");
+ a.appendChild(f);
+ g.appendChild(document.createElement("option"));
+ f.appendChild(g);
+ a.appendChild(document.createElement("option"));
+ document.body.appendChild(a);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/1230110.html b/dom/html/crashtests/1230110.html
new file mode 100644
index 0000000000..4654641874
--- /dev/null
+++ b/dom/html/crashtests/1230110.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+// This test case should not leak.
+function leak()
+{
+ var img = document.createElement("img");
+ var iframe = document.createElement("iframe");
+ img.appendChild(iframe);
+ document.body.appendChild(img);
+
+ document.addEventListener('Foo', function(){});
+}
+</script>
+</head>
+<body onload="leak();"></body>
+</html>
diff --git a/dom/html/crashtests/1237633.html b/dom/html/crashtests/1237633.html
new file mode 100644
index 0000000000..c235f03158
--- /dev/null
+++ b/dom/html/crashtests/1237633.html
@@ -0,0 +1 @@
+<img srcset="data:,a 2400w" sizes="(min-width: 1px) calc(300px - 100vw)">
diff --git a/dom/html/crashtests/1281972-1.html b/dom/html/crashtests/1281972-1.html
new file mode 100644
index 0000000000..6fa5bb250b
--- /dev/null
+++ b/dom/html/crashtests/1281972-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<body onload="window[0].document.forms[0].submit();">
+<iframe src="data:text/html;charset=UTF-8,<form accept-charset=HZ-GB-2312>"></iframe>
+</body>
diff --git a/dom/html/crashtests/1282894.html b/dom/html/crashtests/1282894.html
new file mode 100644
index 0000000000..456a4541fd
--- /dev/null
+++ b/dom/html/crashtests/1282894.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+ var table = document.createElement("table");
+ var cap = document.createElement("caption");
+ cap.appendChild(table)
+ table.caption = cap;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/1290904.html b/dom/html/crashtests/1290904.html
new file mode 100644
index 0000000000..5ea23ba3b6
--- /dev/null
+++ b/dom/html/crashtests/1290904.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+ <body>
+ <fieldset id="outer">
+ <fieldset id="inner">
+ </fieldset>
+ </fieldset>
+ </body>
+</html>
+<script>
+function appendTextareaToFieldset(fieldset) {
+ var textarea = document.createElement("textarea");
+ textarea.setAttribute("required", "");
+ fieldset.appendChild(textarea);
+}
+
+var innerFieldset = document.getElementById('inner');
+var outerFieldset = document.getElementById('outer');
+
+var fieldset = document.createElement('fieldset');
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+
+// Adding a fieldset to a nested fieldset.
+innerFieldset.appendChild(fieldset);
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+// This triggers mInvalidElementsCount checks in outer fieldset.
+appendTextareaToFieldset(outerFieldset);
+
+// Removing a fieldset from a nested fieldset.
+innerFieldset.removeChild(fieldset);
+// This triggers mInvalidElementsCount checks in outer fieldset.
+appendTextareaToFieldset(outerFieldset);
+</script>
diff --git a/dom/html/crashtests/1343886-1.html b/dom/html/crashtests/1343886-1.html
new file mode 100644
index 0000000000..fe84959ac2
--- /dev/null
+++ b/dom/html/crashtests/1343886-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script>
+ document.documentElement.scrollTop = "500";
+ o1 = document.createRange();
+ o2 = document.createElement('input');
+ o1.selectNode(document.documentElement);
+ o1.surroundContents(o2);
+ o2.selectionStart;
+ </script>
+ </head>
+ <body></body>
+</html> \ No newline at end of file
diff --git a/dom/html/crashtests/1343886-2.xml b/dom/html/crashtests/1343886-2.xml
new file mode 100644
index 0000000000..91ddae103d
--- /dev/null
+++ b/dom/html/crashtests/1343886-2.xml
@@ -0,0 +1,3 @@
+<input xmlns="http://www.w3.org/1999/xhtml">
+ <script>document.documentElement.selectionStart</script>
+</input>
diff --git a/dom/html/crashtests/1343886-3.xml b/dom/html/crashtests/1343886-3.xml
new file mode 100644
index 0000000000..a579a5e074
--- /dev/null
+++ b/dom/html/crashtests/1343886-3.xml
@@ -0,0 +1,3 @@
+<textarea xmlns="http://www.w3.org/1999/xhtml">
+ <script>document.documentElement.selectionStart</script>
+</textarea>
diff --git a/dom/html/crashtests/1350972.html b/dom/html/crashtests/1350972.html
new file mode 100644
index 0000000000..7af7f9e174
--- /dev/null
+++ b/dom/html/crashtests/1350972.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+ try { o1 = document.createElement('tr'); } catch(e) {};
+ try { o2 = document.createElement('div'); } catch(e) {};
+ try { o3 = document.createElement('hr'); } catch(e) {};
+ try { o4 = document.createElement('textarea'); } catch(e) {};
+ try { o5 = document.getSelection(); } catch(e) {};
+ try { o6 = document.createRange(); } catch(e) {};
+ try { document.documentElement.appendChild(o2); } catch(e) {};
+ try { document.documentElement.appendChild(o3); } catch(e) {};
+ try { o2.appendChild(o4); } catch(e) {};
+ try { o3.outerHTML = "<noscript contenteditable='true'>"; } catch(e) {};
+ try { o4.select(); } catch(e) {};
+ try { o5.addRange(o6); } catch(e) {};
+ try { document.documentElement.appendChild(o1); } catch(e) {};
+ try { o5.selectAllChildren(o1); } catch(e) {};
+ try { o6.selectNode(o1); } catch(e) {};
+</script>
+</head>
+</html> \ No newline at end of file
diff --git a/dom/html/crashtests/1386905.html b/dom/html/crashtests/1386905.html
new file mode 100644
index 0000000000..6ecc59e23b
--- /dev/null
+++ b/dom/html/crashtests/1386905.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+document.documentElement.getBoundingClientRect()
+document.documentElement.innerHTML = "<input placeholder=e type=number readonly>"
+document.designMode = "on"
+document.execCommand("inserttext", false, "")
+document.designMode = "off"
+document.documentElement.style.display = 'none'
+</script>
+</head>
+</html>
diff --git a/dom/html/crashtests/1401726.html b/dom/html/crashtests/1401726.html
new file mode 100644
index 0000000000..bf4b4918ab
--- /dev/null
+++ b/dom/html/crashtests/1401726.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script>
+ try { o1 = document.createElement('button') } catch(e) { }
+ try { o2 = document.createElement('p') } catch(e) { }
+ try { o3 = o1.labels } catch(e) { }
+ try { o4 = document.createNSResolver(document.documentElement) } catch(e) { }
+ try { o5 = document.createRange(); } catch(e) { }
+ try { document.documentElement.appendChild(o1) } catch(e) { }
+ try { o5.selectNode(o4); } catch(e) { }
+ try { o5.surroundContents(o2) } catch(e) { }
+ try { o5.surroundContents(o2) } catch(e) { }
+ try { o1.labels.length } catch(e) { }
+</script>
+</head>
+</html>
diff --git a/dom/html/crashtests/1412173.html b/dom/html/crashtests/1412173.html
new file mode 100644
index 0000000000..6989260cc7
--- /dev/null
+++ b/dom/html/crashtests/1412173.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+let f = document.createElement('frame');
+f.onload = function() {
+ let frameDocument = f.contentDocument;
+ frameDocument.body.onbeforeunload = function () { frameDocument.write('<p>beforeUnload</p>') };
+ frameDocument.write('<p>trigger unload</p>')
+ window.stop();
+ document.documentElement.className = '';
+};
+document.documentElement.appendChild(f);
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/html/crashtests/1429783.html b/dom/html/crashtests/1429783.html
new file mode 100644
index 0000000000..211f9e7ee2
--- /dev/null
+++ b/dom/html/crashtests/1429783.html
@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<html>
+ <head>
+ <script>
+ try { o2 = document.createElement('textarea') } catch(e) { }
+ try { o3 = document.getSelection() } catch(e) { }
+ try { document.documentElement.appendChild(o2) } catch(e) { }
+ try { o2.select() } catch(e) { }
+ try { o4 = o3.getRangeAt(0) } catch(e) { }
+ try { o5 = o4.commonAncestorContainer } catch(e) { }
+ try { o6 = o4.commonAncestorContainer } catch(e) { }
+ try { document.documentElement.after("", o5, "") } catch(e) { }
+ try { o4 = document.createElement('t') } catch(e) { }
+ try { document.appendChild(o4); } catch(e) { }
+ try { document.write(atob("PHNjcmlwdCBzcmM9Jyc+PC9zY3JpcHQ+Cg==")) } catch(e) { }
+ try { document.replaceChild(o6, document.documentElement); } catch(e) { }
+ </script>
+ </head>
+</html>
diff --git a/dom/html/crashtests/1440523.html b/dom/html/crashtests/1440523.html
new file mode 100644
index 0000000000..11ce699781
--- /dev/null
+++ b/dom/html/crashtests/1440523.html
@@ -0,0 +1,13 @@
+<html>
+ <head>
+ <script>
+ try { frame = document.createElement('frame') } catch(e) { }
+ try { document.documentElement.appendChild(frame) } catch(e) { }
+ try { contentDocument = frame.contentDocument } catch(e) { }
+ try { contentDocument.writeln("<p contenteditable='true'>") } catch(e) { }
+ try { anotherDocument = document.implementation.createHTMLDocument(); } catch(e) { }
+ try { rootOfAnotherDocument = anotherDocument.documentElement; } catch(e) { }
+ try { document.replaceChild(rootOfAnotherDocument, document.documentElement); } catch(e) { }
+ </script>
+ </head>
+</html>
diff --git a/dom/html/crashtests/1440827.html b/dom/html/crashtests/1440827.html
new file mode 100644
index 0000000000..ee204212ff
--- /dev/null
+++ b/dom/html/crashtests/1440827.html
@@ -0,0 +1,6 @@
+<html>
+<head>
+<meta charset="UTF-8">
+>
+<meta content='referrer no-referrer;manifest-src self http:' http-equiv='Content-Security-Policy'>
+<script src='http://zzzzzz.z'></script>
diff --git a/dom/html/crashtests/1547057.html b/dom/html/crashtests/1547057.html
new file mode 100644
index 0000000000..89f48b5344
--- /dev/null
+++ b/dom/html/crashtests/1547057.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+ <script>
+ function start() {
+ const iframe = document.createElement('iframe')
+ iframe.policy.allowedFeatures()
+ }
+ window.addEventListener('load', start)
+ </script>
+</head>
+</html>
diff --git a/dom/html/crashtests/1550524.html b/dom/html/crashtests/1550524.html
new file mode 100644
index 0000000000..1b41f527dc
--- /dev/null
+++ b/dom/html/crashtests/1550524.html
@@ -0,0 +1,7 @@
+<iframe></iframe>
+<script>
+ var doc = frames[0].document;
+ doc.open();
+ doc.open();
+ doc.close();
+</script>
diff --git a/dom/html/crashtests/1550881-1.html b/dom/html/crashtests/1550881-1.html
new file mode 100644
index 0000000000..b9d73df957
--- /dev/null
+++ b/dom/html/crashtests/1550881-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<iframe srcdoc="<iframe></iframe>"></iframe>
+<script>
+ onload = function() {
+ parent = frames[0];
+ child = parent[0];
+ child.onunload = function() {
+ parent.document.open();
+ }
+ parent.document.open();
+ parent.document.write("Hello");
+ }
+</script>
diff --git a/dom/html/crashtests/1550881-2.html b/dom/html/crashtests/1550881-2.html
new file mode 100644
index 0000000000..97bf5ef350
--- /dev/null
+++ b/dom/html/crashtests/1550881-2.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<iframe srcdoc="<iframe></iframe>"></iframe>
+<script>
+ onload = function() {
+ parent = frames[0];
+ child = parent[0];
+ child.onunload = function() {
+ parent.document.open();
+ parent.document.write("Nested");
+ }
+ parent.document.open();
+ parent.document.write("Hello");
+ }
+</script>
diff --git a/dom/html/crashtests/1667493.html b/dom/html/crashtests/1667493.html
new file mode 100644
index 0000000000..d7cf6c6174
--- /dev/null
+++ b/dom/html/crashtests/1667493.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+function runTest() {
+ let win = window.open("1667493_1.html");
+ win.finish = function() {
+ document.documentElement.removeAttribute("class");
+ };
+}
+</script>
+<body onload="runTest()">
+</body>
+</html>
diff --git a/dom/html/crashtests/1667493_1.html b/dom/html/crashtests/1667493_1.html
new file mode 100644
index 0000000000..9b1a5fc047
--- /dev/null
+++ b/dom/html/crashtests/1667493_1.html
@@ -0,0 +1,7 @@
+<script>
+window.requestIdleCallback(() => {
+ window.close();
+ finish();
+});
+</script>
+<input required="" value="r" type="number">
diff --git a/dom/html/crashtests/1680418.html b/dom/html/crashtests/1680418.html
new file mode 100644
index 0000000000..ccebe0ed33
--- /dev/null
+++ b/dom/html/crashtests/1680418.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+window.addEventListener("hashchange", function() {
+ document.documentElement.removeAttribute("class");
+});
+
+async function runTest() {
+ document.getElementById("a").click();
+ await new Promise(resolve => setTimeout(resolve, 0));
+ document.location.hash = "#foo";
+}
+</script>
+<body onload="runTest()">
+<a id='a' type='text/html' href='telnet://'>
+</body>
+</html>
diff --git a/dom/html/crashtests/1704660.html b/dom/html/crashtests/1704660.html
new file mode 100644
index 0000000000..01497975df
--- /dev/null
+++ b/dom/html/crashtests/1704660.html
@@ -0,0 +1,17 @@
+<html>
+ <head>
+ <script>
+ function test() {
+ var ifr = document.getElementsByTagName("iframe")[0];
+ var form = ifr.contentDocument.getElementsByTagName("form")[0];
+ form.onsubmit = function() {
+ ifr.remove()
+ }
+ form.lastChild.click();
+ }
+ </script>
+ </head>
+ <body onload="test()">
+ <iframe srcdoc="<form><input name=f type=file><button></button></form>"></iframe>
+ </body>
+</html>
diff --git a/dom/html/crashtests/1724816.html b/dom/html/crashtests/1724816.html
new file mode 100644
index 0000000000..9264a5225f
--- /dev/null
+++ b/dom/html/crashtests/1724816.html
@@ -0,0 +1,14 @@
+<script>
+window.onload = () => {
+ window[0].focus()
+ a.close()
+ a.showModal()
+ document.execCommand("selectAll", false)
+}
+function go() {
+ document.onselectstart = document.createElement("frameset").onload
+}
+</script>
+<details open="true" ontoggle="go()">a</details>
+<iframe></iframe>
+<dialog id="a" tabindex="3">a</dialog>
diff --git a/dom/html/crashtests/1785933-inner.html b/dom/html/crashtests/1785933-inner.html
new file mode 100644
index 0000000000..8c97da8a8e
--- /dev/null
+++ b/dom/html/crashtests/1785933-inner.html
@@ -0,0 +1,28 @@
+<style>
+* {
+ image-rendering: pixelated;
+}
+</style>
+<script>
+window.requestIdleCallback(() => {
+ a.setSelectionRange(-1, 1)
+ document.head.innerHTML = undefined
+})
+</script>
+<embed src="data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs="></embed>
+<textarea id="a">aaaaaaaaaaaaaaaa</textarea>
+<script>
+ const embed = document.querySelector("embed");
+ embed.onload = function() {
+ var countdown = 20;
+ if (location.search) {
+ countdown = parseInt(location.search.slice(1)) - 1;
+ }
+
+ if (countdown > 0) {
+ location.search = countdown;
+ } else {
+ window.parent.postMessage("done", "*");
+ }
+ }
+</script>
diff --git a/dom/html/crashtests/1785933.html b/dom/html/crashtests/1785933.html
new file mode 100644
index 0000000000..e73395faea
--- /dev/null
+++ b/dom/html/crashtests/1785933.html
@@ -0,0 +1,10 @@
+<html class="reftest-wait">
+<body>
+ <iframe src="./1785933-inner.html"></iframe>
+ <script>
+ window.onmessage = function() {
+ document.documentElement.removeAttribute("class");
+ }
+ </script>
+</body>
+</html>
diff --git a/dom/html/crashtests/1787671.html b/dom/html/crashtests/1787671.html
new file mode 100644
index 0000000000..1b4106435e
--- /dev/null
+++ b/dom/html/crashtests/1787671.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+let pp;
+window.addEventListener("MozReftestInvalidate", finish);
+document.addEventListener('DOMContentLoaded', () => {
+ pp = SpecialPowers.wrap(self).printPreview();
+ pp?.print();
+ setTimeout(window.close, 250);
+});
+function finish() {
+ setTimeout(function() {
+ pp.close();
+ document.documentElement.className = "";
+ }, 0);
+}
+</script>
+<img srcset="#"></img>
+</html>
diff --git a/dom/html/crashtests/1789475.html b/dom/html/crashtests/1789475.html
new file mode 100644
index 0000000000..f12924a742
--- /dev/null
+++ b/dom/html/crashtests/1789475.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<script>
+window.addEventListener('load', () => {
+ let a = document.createElement("img");
+ a.srcset = "1";
+ let b = new DOMParser()
+ let c = b.parseFromString("<div></div>", "text/html")
+ c.adoptNode(a)
+})
+</script>
diff --git a/dom/html/crashtests/1801380.html b/dom/html/crashtests/1801380.html
new file mode 100644
index 0000000000..f4ce3e109f
--- /dev/null
+++ b/dom/html/crashtests/1801380.html
@@ -0,0 +1 @@
+<input dir="auto" type="tel">
diff --git a/dom/html/crashtests/1840088.html b/dom/html/crashtests/1840088.html
new file mode 100644
index 0000000000..826b465b01
--- /dev/null
+++ b/dom/html/crashtests/1840088.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<table cellpadding="-129">
diff --git a/dom/html/crashtests/257818-1.html b/dom/html/crashtests/257818-1.html
new file mode 100644
index 0000000000..27929fd793
--- /dev/null
+++ b/dom/html/crashtests/257818-1.html
@@ -0,0 +1,82 @@
+<html><head>
+<script type="text/javascript">
+function cE (v) {
+ return document.createElement(v)
+}
+function cTN (v) {
+ return document.createTextNode(v)
+}
+
+function OSXBarIcon(elt) {
+ this.element = elt;
+ this.labelNode = this.element.firstChild;
+ this.labelNodeParent = this.element;
+ this.labelNodeParent.removeChild(this.labelNode);
+
+ this.contents = [];
+ var kids = this.element.childNodes;
+ for(var i=0; i<kids.length; i++) this.contents[this.contents.length] = this.element.removeChild(kids[i]);
+ this.popupSubmenu = new OSXBarSubmenu(this);
+}
+
+function OSXBarSubmenu(icon) {
+ this.parentIcon = icon;
+ this.create();
+ this.addContent();
+}
+OSXBarSubmenu.prototype = {
+ create : function() {
+ var p = this.popupNode = document.createElement("div");
+ var b = document.getElementsByTagName("body").item(0);
+ if(b) b.appendChild(p);
+ this.popupNode.style.display = "none";
+ // Uncomment next line to fix the problem
+// var v = document.body.offsetWidth;
+ }
+};
+OSXBarSubmenu.prototype.addContent = function() {
+
+ // add popup label:
+ var label = document.createElement("div");
+ label.appendChild(document.createTextNode(this.parentIcon.label));
+ this.popupNode.appendChild(label);
+
+ // add <li> children to the popup:
+ var contents = this.parentIcon.contents;
+ for(var i=0; i<contents.length; i++) {
+ this.popupNode.appendChild(contents[i]);
+
+ }
+};
+
+</script>
+
+<script type="text/javascript">
+function createControlPanel() {
+ var bar = document.getElementById("navigation");
+ var item = cE("li");
+ item.appendChild(cTN("aaa"));
+ var textfield = cE("input");
+ textfield.value = 0;
+ item.appendChild(textfield);
+ bar.insertBefore(item, bar.firstChild);
+}
+
+window.addEventListener("load", createControlPanel);
+</script>
+
+<script type="text/javascript">
+function ssload() {
+ new OSXBarIcon(document.getElementById("navigation").childNodes[0]);
+}
+window.addEventListener("load",ssload);
+
+
+</script>
+</head>
+
+<body>
+<ul id="navigation"></ul>
+</body></html>
+
+
diff --git a/dom/html/crashtests/285166-1.html b/dom/html/crashtests/285166-1.html
new file mode 100644
index 0000000000..8a73d7d74e
--- /dev/null
+++ b/dom/html/crashtests/285166-1.html
@@ -0,0 +1,3 @@
+<script>
+document.createElement("#text");
+</script>
diff --git a/dom/html/crashtests/294235-1.html b/dom/html/crashtests/294235-1.html
new file mode 100644
index 0000000000..00eed38f4e
--- /dev/null
+++ b/dom/html/crashtests/294235-1.html
@@ -0,0 +1,14 @@
+<html>
+ <head>
+ <title>bug 294235</title>
+ <script>
+ function countdown(){
+ count2.innerHTML="foo";
+ }
+ document.links.length;
+ </script>
+ </head>
+ <body>
+ <strong><div id="count2"><script>countdown();</script><noscript>bar</noscript></div></strong>
+ </body>
+</html>
diff --git a/dom/html/crashtests/307616-1.html b/dom/html/crashtests/307616-1.html
new file mode 100644
index 0000000000..8f28ddd6e8
--- /dev/null
+++ b/dom/html/crashtests/307616-1.html
@@ -0,0 +1,8 @@
+<html>
+<head><title>Testcase for assertion</title></head>
+<body>
+
+<input type="image" src="./nosuch.gif" alt="Search">
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/html/crashtests/324918-1.xhtml b/dom/html/crashtests/324918-1.xhtml
new file mode 100644
index 0000000000..921714cff3
--- /dev/null
+++ b/dom/html/crashtests/324918-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+
+function init()
+{
+ var sel = document.getElementById("sel");
+ var div = document.getElementById("div");
+ var newo = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+
+ sel.appendChild(div);
+ div.appendChild(newo);
+ sel.removeChild(div);
+}
+
+</script>
+</head>
+<body onload="init();">
+
+<div id="div"><option></option></div>
+
+<select id="sel"></select>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/338649-1.xhtml b/dom/html/crashtests/338649-1.xhtml
new file mode 100644
index 0000000000..b0bf3186fc
--- /dev/null
+++ b/dom/html/crashtests/338649-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>ASSERTION: Options collection broken</title>
+</head>
+
+<body>
+
+<div>
+
+<select>
+ <option id="n29">B
+ <optgroup label="middle" id="n20">
+ <option>N</option>
+ </optgroup>
+ </option>
+ <option>M</option>
+</select>
+
+</div>
+
+</body>
+</html> \ No newline at end of file
diff --git a/dom/html/crashtests/339501-1.xhtml b/dom/html/crashtests/339501-1.xhtml
new file mode 100644
index 0000000000..1a231ee645
--- /dev/null
+++ b/dom/html/crashtests/339501-1.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+
+function boom()
+{
+ document.addEventListener("DOMNodeRemoved", foo, false);
+ remove(document.getElementById("A"));
+ document.removeEventListener("DOMNodeRemoved", foo, false);
+
+ function foo()
+ {
+ document.removeEventListener("DOMNodeRemoved", foo, false);
+ remove(document.getElementById("B"));
+ }
+}
+
+
+window.addEventListener("load", boom, false);
+
+function remove(q1) { q1.parentNode.removeChild(q1); }
+
+</script>
+
+</head>
+
+<body>
+
+<select><option id="A">A</option><option id="B">B</option></select>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/339501-2.xhtml b/dom/html/crashtests/339501-2.xhtml
new file mode 100644
index 0000000000..6a1835fb71
--- /dev/null
+++ b/dom/html/crashtests/339501-2.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+
+function boom()
+{
+ document.addEventListener("DOMNodeRemoved", foo, false);
+ remove(document.getElementById("B"));
+ document.removeEventListener("DOMNodeRemoved", foo, false);
+
+ function foo()
+ {
+ document.removeEventListener("DOMNodeRemoved", foo, false);
+ remove(document.getElementById("A"));
+ }
+}
+
+
+window.addEventListener("load", boom, false);
+
+function remove(q1) { q1.parentNode.removeChild(q1); }
+
+</script>
+
+</head>
+
+<body>
+
+<select><option id="A">A</option><option id="B">B</option></select>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/378993-1.xhtml b/dom/html/crashtests/378993-1.xhtml
new file mode 100644
index 0000000000..99cbb01dae
--- /dev/null
+++ b/dom/html/crashtests/378993-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<script>
+document.createElement('AREA');
+</script>
+</body>
+</html>
diff --git a/dom/html/crashtests/382568-1-inner.xhtml b/dom/html/crashtests/382568-1-inner.xhtml
new file mode 100644
index 0000000000..67d7427582
--- /dev/null
+++ b/dom/html/crashtests/382568-1-inner.xhtml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<!DOCTYPE html
+PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml"> <head>
+<title>Test</title>
+<script type="text/javascript"><![CDATA[
+
+function onAttrModified(evt) {
+// window.alert("Mutation event fired within the frame code.");
+// evt.target.focus();
+// evt.target.blur();
+ evt.target.style.background = 'green';
+ bounce(evt.target);
+// evt.target.normalize();
+// bounce(evt.target.parentNode);
+}
+function die(n) {
+ p = n.parentNode;
+ p.removeChild(n);
+}
+
+function bounce(n) {
+ p = n.parentNode;
+ p.removeChild(n);
+ p.appendChild(n);
+}
+
+
+function test_AttrModified() {
+ var x = document.getElementById("x");
+ x.addEventListener("DOMAttrModified", onAttrModified);
+ bounce(x);
+}
+
+function test() {
+ setTimeout(test_AttrModified, 3000);
+}
+]]></script>
+</head>
+
+<body onload="test()">
+<h1>TestCase for unsafe mutable events from textarea</h1>
+<p>Please wait for 3 seconds after document was loaded,
+if your browser is vulnerable, it may stop responding
+to keyboard and mouse event
+and most likely it will eventually crash (may take a
+while for debug builds).</p>
+<p>
+<textarea id="x"></textarea>
+</p>
+</body> </html>
diff --git a/dom/html/crashtests/382568-1.html b/dom/html/crashtests/382568-1.html
new file mode 100644
index 0000000000..c10c71fd14
--- /dev/null
+++ b/dom/html/crashtests/382568-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 3500);
+</script>
+<body>
+<iframe src="382568-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/dom/html/crashtests/383137.xhtml b/dom/html/crashtests/383137.xhtml
new file mode 100644
index 0000000000..87d853c035
--- /dev/null
+++ b/dom/html/crashtests/383137.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">//<![CDATA[
+function doe(){
+document.documentElement.setAttribute('style', '');
+}
+
+setTimeout(doe,100);
+//]]></script>
+
+<style style="overflow: scroll; display: block;">
+style::before {content: counter(section); }
+</style>
+</html> \ No newline at end of file
diff --git a/dom/html/crashtests/388183-1.html b/dom/html/crashtests/388183-1.html
new file mode 100644
index 0000000000..fcca410e93
--- /dev/null
+++ b/dom/html/crashtests/388183-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+</head>
+<body>
+<div contenteditable="true"></div>
+</body>
+</html>
diff --git a/dom/html/crashtests/395340-1.html b/dom/html/crashtests/395340-1.html
new file mode 100644
index 0000000000..ddbccfe968
--- /dev/null
+++ b/dom/html/crashtests/395340-1.html
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var div1 = document.createElement("div");
+ div1.style.counterIncrement = "chicken";
+ div1.contentEditable = "true";
+
+ var div2 = document.createElement("div");
+ div2.style.counterIncrement = "chicken";
+
+ document.body.style.content = "'A'";
+
+ div1.appendChild(div2);
+ document.body.appendChild(div1);
+ div1.removeChild(div2);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+</body>
+</html>
diff --git a/dom/html/crashtests/399694-1.html b/dom/html/crashtests/399694-1.html
new file mode 100644
index 0000000000..e6db2342b5
--- /dev/null
+++ b/dom/html/crashtests/399694-1.html
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+ var legend = document.createElementNS("http://www.w3.org/1999/xhtml", "legend")
+ var input = document.getElementById("input");
+ input.appendChild(legend);
+ legend.focus();
+
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(boom, 3);" contenteditable="true">
+
+<input contenteditable="false"><input id="input"><q><div></div></q>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/407053.html b/dom/html/crashtests/407053.html
new file mode 100644
index 0000000000..b80a231722
--- /dev/null
+++ b/dom/html/crashtests/407053.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.execCommand('copy', false, '');">
+<div contenteditable="true"></div>
+</body>
+</html>
diff --git a/dom/html/crashtests/423371-1.html b/dom/html/crashtests/423371-1.html
new file mode 100644
index 0000000000..0069cf95db
--- /dev/null
+++ b/dom/html/crashtests/423371-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<div style="position:fixed; top:100px;" id="d">hello</div>
+<script>
+document.write(document.getElementById("d").offsetTop);
+</script>
+</body>
+</html>
diff --git a/dom/html/crashtests/448564.html b/dom/html/crashtests/448564.html
new file mode 100644
index 0000000000..f31830afa1
--- /dev/null
+++ b/dom/html/crashtests/448564.html
@@ -0,0 +1,7 @@
+<s>
+<form>a</form>
+<iframe></iframe>
+<script src=a></script>
+<form></form>
+<table>
+<optgroup>
diff --git a/dom/html/crashtests/451123-1.html b/dom/html/crashtests/451123-1.html
new file mode 100644
index 0000000000..abf23c1e73
--- /dev/null
+++ b/dom/html/crashtests/451123-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<input type="file" type="file">
+</body>
+</html>
diff --git a/dom/html/crashtests/453406-1.html b/dom/html/crashtests/453406-1.html
new file mode 100644
index 0000000000..bf75686553
--- /dev/null
+++ b/dom/html/crashtests/453406-1.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+<script type="text/javascript">
+function boom()
+{
+ var r = document.documentElement;
+ while (r.firstChild)
+ r.firstChild.remove();
+
+ var b = document.createElement("BODY");
+ var s = document.createElement("SCRIPT");
+ var f1 = document.createElement("FORM");
+ var i = document.createElement("INPUT");
+ var br = document.createElement("BR");
+ var f2 = document.createElement("FORM");
+ var span = document.createElement("SPAN");
+ f1.appendChild(i);
+ f1.appendChild(br);
+ s.appendChild(f1);
+ b.appendChild(s);
+ f2.appendChild(span);
+ b.appendChild(f2)
+ document.documentElement.appendChild(b);
+ b.contentEditable = "true";
+ document.execCommand("indent", false, null);
+ b.contentEditable = "false";
+ span.appendChild(i);
+ i.remove();
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/html/crashtests/464197-1.html b/dom/html/crashtests/464197-1.html
new file mode 100644
index 0000000000..785686023e
--- /dev/null
+++ b/dom/html/crashtests/464197-1.html
@@ -0,0 +1,23 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+var i = 0;
+
+function boom()
+{
+ var s = document.createElement("span");
+ s.innerHTML = "<audio src='javascript:5'><\/audio>";
+ s.innerHTML = "";
+
+ if (++i < 10)
+ setTimeout(boom, 0);
+ else
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/html/crashtests/468562-1.html b/dom/html/crashtests/468562-1.html
new file mode 100644
index 0000000000..81123fe2ea
--- /dev/null
+++ b/dom/html/crashtests/468562-1.html
@@ -0,0 +1,6 @@
+<html>
+<head></head>
+<body>
+<table><script>document.write("Q");</script><link>
+</body>
+</html>
diff --git a/dom/html/crashtests/468562-2.html b/dom/html/crashtests/468562-2.html
new file mode 100644
index 0000000000..e0db5cd974
--- /dev/null
+++ b/dom/html/crashtests/468562-2.html
@@ -0,0 +1,6 @@
+<html>
+<head></head>
+<body>
+<table><script>document.write("Q");</script><link></table>
+</body>
+</html>
diff --git a/dom/html/crashtests/494225.html b/dom/html/crashtests/494225.html
new file mode 100644
index 0000000000..a78051d2a1
--- /dev/null
+++ b/dom/html/crashtests/494225.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html><head><script>
+ var x = "f: '" + document.fgColor +
+ "' b: '" + document.bgColor +
+ "' l: '" + document.linkColor +
+ "' a: '" + document.alinkColor +
+ "' v: '" + document.vlinkColor + "'";
+</script></head><body
+onload="document.body.appendChild(document.createTextNode(x))"
+></body></html>
diff --git a/dom/html/crashtests/495543.svg b/dom/html/crashtests/495543.svg
new file mode 100644
index 0000000000..b795796ad4
--- /dev/null
+++ b/dom/html/crashtests/495543.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script type="text/javascript">
+
+function boom()
+{
+ var htmlBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ document.documentElement.appendChild(htmlBody);
+ htmlBody.setAttribute('vlink', "transparent");
+ document.height;
+ document.vlinkColor;
+}
+
+window.addEventListener("load", boom, false);
+</script>
+
+</svg>
diff --git a/dom/html/crashtests/495546-1.html b/dom/html/crashtests/495546-1.html
new file mode 100644
index 0000000000..0547b98674
--- /dev/null
+++ b/dom/html/crashtests/495546-1.html
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var video = document.createElement("video");
+ var source = document.createElement("source");
+ source.setAttributeNS(null, "src", "http://127.0.0.1/");
+ video.appendChild(source);
+ document.body.appendChild(video);
+ setTimeout(function() { document.body.removeChild(video); }, 20);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/504183-1.html b/dom/html/crashtests/504183-1.html
new file mode 100644
index 0000000000..e44db41520
--- /dev/null
+++ b/dom/html/crashtests/504183-1.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait">
+<input id="a" type="file">
+<script>
+function doe() {
+var elem = document.getElementById('a');
+elem.style.display = "none";
+elem.focus();
+document.documentElement.className = "";
+}
+setTimeout(doe, 0);
+</script>
+</html>
diff --git a/dom/html/crashtests/515829-1.html b/dom/html/crashtests/515829-1.html
new file mode 100644
index 0000000000..e2fc655c01
--- /dev/null
+++ b/dom/html/crashtests/515829-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body onload="document.getElementById('x').innerHTML = '<button></button>';">
+<form><div id="x"><button></button></div><button></button></form>
+</body>
+</html>
diff --git a/dom/html/crashtests/515829-2.html b/dom/html/crashtests/515829-2.html
new file mode 100644
index 0000000000..6de6d5986c
--- /dev/null
+++ b/dom/html/crashtests/515829-2.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body onload="document.getElementById('x').innerHTML = '<button></button>';">
+<form><div id="x"><button></button></div><button></button><input type="image"></form>
+</body>
+</html>
diff --git a/dom/html/crashtests/570566-1.html b/dom/html/crashtests/570566-1.html
new file mode 100644
index 0000000000..70ec003a68
--- /dev/null
+++ b/dom/html/crashtests/570566-1.html
@@ -0,0 +1,2 @@
+<body onload="document.getElementById('i').removeAttribute('type')"><input id=i type=image></body>
+
diff --git a/dom/html/crashtests/571428-1.html b/dom/html/crashtests/571428-1.html
new file mode 100644
index 0000000000..ae2b960cac
--- /dev/null
+++ b/dom/html/crashtests/571428-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ var i = document.getElementById("i");
+ i.setAttribute("type", "button");
+ i.removeAttribute("type");
+}
+</script>
+</head>
+<body onload="boom();"><input id="i"></body>
+</html>
diff --git a/dom/html/crashtests/580507-1.xhtml b/dom/html/crashtests/580507-1.xhtml
new file mode 100644
index 0000000000..eff3fb255d
--- /dev/null
+++ b/dom/html/crashtests/580507-1.xhtml
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var input = document.getElementById("i");
+ input.setAttribute('type', "image");
+ input.removeAttribute('type');
+ input.placeholder = "Y";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><input id="i" /></body>
+</html>
diff --git a/dom/html/crashtests/590387.html b/dom/html/crashtests/590387.html
new file mode 100644
index 0000000000..50cd05ac9e
--- /dev/null
+++ b/dom/html/crashtests/590387.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+document.createElement("div").innerHTML = "<output form=x>";
+</script>
+</head>
+</html>
diff --git a/dom/html/crashtests/596785-1.html b/dom/html/crashtests/596785-1.html
new file mode 100644
index 0000000000..5d830628b0
--- /dev/null
+++ b/dom/html/crashtests/596785-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <body onload="document.getElementById('i').type = 'image';
+ document.documentElement.className = '';">
+ <form>
+ <input id='i' required>
+ </form>
+ </body>
+</html>
diff --git a/dom/html/crashtests/596785-2.html b/dom/html/crashtests/596785-2.html
new file mode 100644
index 0000000000..18cfe2788d
--- /dev/null
+++ b/dom/html/crashtests/596785-2.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+ <body onload="document.getElementById('i').type = 'text';
+ document.documentElement.className = '';">
+ <form>
+ <input id='i' type='image' required>
+ </form>
+ </body>
+</html>
diff --git a/dom/html/crashtests/602117.html b/dom/html/crashtests/602117.html
new file mode 100644
index 0000000000..0d1818b2a9
--- /dev/null
+++ b/dom/html/crashtests/602117.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+ <script>
+ var isindex = document.createElement("isindex");
+ isindex.setAttribute("form", "f");
+ isindex.form;
+ </script>
+</html>
diff --git a/dom/html/crashtests/604807.html b/dom/html/crashtests/604807.html
new file mode 100644
index 0000000000..bec4012e5c
--- /dev/null
+++ b/dom/html/crashtests/604807.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<script>
+try {
+ var selectElem = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
+ selectElem.QueryInterface(Ci.nsISelectElement);
+ selectElem.getOptionIndex(null, 0, true);
+} catch (e) {
+}
+</script>
diff --git a/dom/html/crashtests/605264.html b/dom/html/crashtests/605264.html
new file mode 100644
index 0000000000..782720a9d6
--- /dev/null
+++ b/dom/html/crashtests/605264.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var v = document.createElementNS("http://www.w3.org/1999/xhtml", "video");
+v.QueryInterface(Ci.nsIObserver);
+v.observe(null, null, null);
+
+</script>
diff --git a/dom/html/crashtests/606430-1.html b/dom/html/crashtests/606430-1.html
new file mode 100644
index 0000000000..c347e3c9f1
--- /dev/null
+++ b/dom/html/crashtests/606430-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var r = document.documentElement;
+ var i = document.getElementById("i");
+
+ document.removeChild(r);
+ document.appendChild(r);
+ w("dump('A\\n')");
+ document.removeChild(r);
+ w("dump('B\\n')");
+ document.appendChild(r);
+
+ function w(s)
+ {
+ var ns = document.createElement("script");
+ var nt = document.createTextNode(s);
+ ns.appendChild(nt);
+ i.appendChild(ns);
+ }
+}
+
+</script>
+</head>
+
+<body onload="boom();"><input id="i"></body>
+</html>
diff --git a/dom/html/crashtests/613027.html b/dom/html/crashtests/613027.html
new file mode 100644
index 0000000000..a866860f10
--- /dev/null
+++ b/dom/html/crashtests/613027.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var a = document.createElementNS("http://www.w3.org/1999/xhtml", "fieldset");
+ var b = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");
+ var c = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+
+ a.appendChild(b);
+ a.appendChild(c);
+ a.removeChild(b);
+ c.expandoQ = a;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/614279.html b/dom/html/crashtests/614279.html
new file mode 100644
index 0000000000..ff1c505167
--- /dev/null
+++ b/dom/html/crashtests/614279.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var a = document.createElementNS("http://www.w3.org/1999/xhtml", "datalist");
+ var b = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+
+ a.appendChild(b);
+ b.expando = a.options;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/614988-1.html b/dom/html/crashtests/614988-1.html
new file mode 100644
index 0000000000..931f83ac73
--- /dev/null
+++ b/dom/html/crashtests/614988-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head><script>window.addEventListener("load", function() { var t = document.getElementById("t"); t.appendChild(t.previousSibling); }, false);</script></head>
+<body><fieldset><legend></legend><textarea id="t"></textarea></fieldset></body>
+</html>
diff --git a/dom/html/crashtests/616401.html b/dom/html/crashtests/616401.html
new file mode 100644
index 0000000000..eb5a0bcf4c
--- /dev/null
+++ b/dom/html/crashtests/616401.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<script>
+var c = document.createElement("canvas");
+c.getContext("experimental-webgl", {
+ get a() { throw 7; },
+ get b() { throw 8; }
+});
+</script>
diff --git a/dom/html/crashtests/620078-1.html b/dom/html/crashtests/620078-1.html
new file mode 100644
index 0000000000..39462706c1
--- /dev/null
+++ b/dom/html/crashtests/620078-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var frame = document.getElementById("f");
+ var frameRoot = frame.contentDocument.documentElement;
+ document.body.removeChild(frame);
+ var i = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+ i.setAttribute("autofocus", "true");
+ frameRoot.appendChild(i);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body>
+</html>
diff --git a/dom/html/crashtests/620078-2.html b/dom/html/crashtests/620078-2.html
new file mode 100644
index 0000000000..1be23fa1f2
--- /dev/null
+++ b/dom/html/crashtests/620078-2.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+ <body onload='document.cloneNode(1)'>
+ <button autofocus></button>
+ </body>
+</html>
diff --git a/dom/html/crashtests/631421.html b/dom/html/crashtests/631421.html
new file mode 100644
index 0000000000..e4a7b9192b
--- /dev/null
+++ b/dom/html/crashtests/631421.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+"use strict";
+
+var f2;
+
+function newIframe()
+{
+ var f = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ f.setAttributeNS(null, "src", "631421.png");
+ document.body.appendChild(f);
+ return f;
+}
+
+function b1()
+{
+ void newIframe();
+ f2 = newIframe();
+ setTimeout(b2, 0);
+}
+
+function b2()
+{
+ document.body.removeChild(f2);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="b1();"></body>
+</html>
diff --git a/dom/html/crashtests/631421.png b/dom/html/crashtests/631421.png
new file mode 100644
index 0000000000..ef350c4678
--- /dev/null
+++ b/dom/html/crashtests/631421.png
Binary files differ
diff --git a/dom/html/crashtests/673853.html b/dom/html/crashtests/673853.html
new file mode 100644
index 0000000000..1325fa9ed6
--- /dev/null
+++ b/dom/html/crashtests/673853.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var otherDoc = document.implementation.createDocument('', '', null);
+ var input = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "input");
+ var form = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "form");
+ input.setAttributeNS(null, "form", "x");
+ form.setAttributeNS(null, "id", "x");
+ input.appendChild(form);
+ otherDoc.appendChild(input);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/682058.xhtml b/dom/html/crashtests/682058.xhtml
new file mode 100644
index 0000000000..95e7da98fc
--- /dev/null
+++ b/dom/html/crashtests/682058.xhtml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body onload="test()">
+ <script>
+ function test() {
+ document.body.innerHTML = "Foobar";
+ }
+ document.addEventListener("DOMNodeRemoved", function() {});
+ </script>
+ </body>
+</html>
diff --git a/dom/html/crashtests/682460.html b/dom/html/crashtests/682460.html
new file mode 100644
index 0000000000..91306be71d
--- /dev/null
+++ b/dom/html/crashtests/682460.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var f = function() {
+ document.documentElement.offsetHeight;
+ };
+ window.addEventListener("DOMSubtreeModified", f, true);
+
+ document.getElementsByTagName("table")[0].setAttribute("cellpadding", "2");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<table><tr><td></td></tr></table>
+</body>
+</html>
diff --git a/dom/html/crashtests/68912-1.html b/dom/html/crashtests/68912-1.html
new file mode 100644
index 0000000000..bdd2ab4614
--- /dev/null
+++ b/dom/html/crashtests/68912-1.html
@@ -0,0 +1,24 @@
+<html>
+<head>
+<title>Crash TR.cells = null</title>
+<script language="javascript">
+function crashme()
+{
+ var elm = document.createElement('tr');
+
+ elm.cells = null;
+}
+
+</script>
+</head>
+<body onload="crashme()">
+
+<p>
+This test case creates a TR element then tries to assign to the cells property
+</p>
+<p>
+Crash
+</p>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/738744.xhtml b/dom/html/crashtests/738744.xhtml
new file mode 100644
index 0000000000..7f91d0149b
--- /dev/null
+++ b/dom/html/crashtests/738744.xhtml
@@ -0,0 +1,4 @@
+<input xmlns="http://www.w3.org/1999/xhtml" form="f">
+ <form id="f" />
+ <input form="f" />
+</input>
diff --git a/dom/html/crashtests/741218.json b/dom/html/crashtests/741218.json
new file mode 100644
index 0000000000..0967ef424b
--- /dev/null
+++ b/dom/html/crashtests/741218.json
@@ -0,0 +1 @@
+{}
diff --git a/dom/html/crashtests/741218.json^headers^ b/dom/html/crashtests/741218.json^headers^
new file mode 100644
index 0000000000..7b5e82d4b7
--- /dev/null
+++ b/dom/html/crashtests/741218.json^headers^
@@ -0,0 +1 @@
+Content-Type: application/json
diff --git a/dom/html/crashtests/741250.xhtml b/dom/html/crashtests/741250.xhtml
new file mode 100644
index 0000000000..e18a9409fe
--- /dev/null
+++ b/dom/html/crashtests/741250.xhtml
@@ -0,0 +1,9 @@
+<input form="f" id="x" xmlns="http://www.w3.org/1999/xhtml">
+<form id="f"></form>
+<script>
+window.addEventListener("load", function() {
+ var x = document.getElementById("x");
+ x.appendChild(x.cloneNode(true));
+}, false);
+</script>
+</input>
diff --git a/dom/html/crashtests/768344.html b/dom/html/crashtests/768344.html
new file mode 100644
index 0000000000..4830e6674d
--- /dev/null
+++ b/dom/html/crashtests/768344.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ function f() {
+ document.removeEventListener("DOMSubtreeModified", f, true);
+ document.documentElement.setAttributeNS(null, "contenteditable", "false");
+ }
+
+ document.addEventListener("DOMSubtreeModified", f, true);
+
+ document.documentElement.contentEditable = "true";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/795221-1.html b/dom/html/crashtests/795221-1.html
new file mode 100644
index 0000000000..70e400bed9
--- /dev/null
+++ b/dom/html/crashtests/795221-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<style>
+ div { }
+</style>
+<script>
+ document.styleSheets[0].cssRules[0].style.foo = document;
+</script>
diff --git a/dom/html/crashtests/795221-2.html b/dom/html/crashtests/795221-2.html
new file mode 100644
index 0000000000..fc2aa7d506
--- /dev/null
+++ b/dom/html/crashtests/795221-2.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<style>
+ @media all {
+ div { }
+ }
+</style>
+<script>
+ document.styleSheets[0].cssRules[0].cssRules[0].style.foo = document;
+</script>
diff --git a/dom/html/crashtests/795221-3.html b/dom/html/crashtests/795221-3.html
new file mode 100644
index 0000000000..93348af0bd
--- /dev/null
+++ b/dom/html/crashtests/795221-3.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+<script>
+ // Create the stylesheet via script, so that the parser's preloading doesn't
+ // make the CSS loader hold on to the sheet we're _not_ trying to form a
+ // cycle through, thus accidentally avoiding the cycle
+ var link = document.createElement("link");
+ link.setAttribute("rel", "stylesheet");
+ link.setAttribute("href", "data:text/css,div { }");
+ link.onload = function () {
+ document.styleSheets[0].cssRules[0].style.foo = document;
+ }
+ document.body.appendChild(link);
+</script>
diff --git a/dom/html/crashtests/795221-4.html b/dom/html/crashtests/795221-4.html
new file mode 100644
index 0000000000..476dd34672
--- /dev/null
+++ b/dom/html/crashtests/795221-4.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<svg>
+ <style>
+ div { }
+ </style>
+</svg>
+<script>
+ document.styleSheets[0].cssRules[0].style.foo = document;
+</script>
diff --git a/dom/html/crashtests/795221-5.xml b/dom/html/crashtests/795221-5.xml
new file mode 100644
index 0000000000..286dcff0d4
--- /dev/null
+++ b/dom/html/crashtests/795221-5.xml
@@ -0,0 +1,6 @@
+<?xml-stylesheet href="data:text/css,div {}"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <script>
+ document.styleSheets[0].cssRules[0].style.foo = document;
+ </script>
+</html>
diff --git a/dom/html/crashtests/798802-1.html b/dom/html/crashtests/798802-1.html
new file mode 100644
index 0000000000..92ab50fd87
--- /dev/null
+++ b/dom/html/crashtests/798802-1.html
@@ -0,0 +1,18 @@
+<html>
+ <head>
+ <script>
+ onload = function() {
+ var canvas2d = document.createElement('canvas')
+ canvas2d.setAttribute('width', 0)
+ document.body.appendChild(canvas2d)
+ var ctx2d = canvas2d.getContext('2d')
+ ctx2d.fillStyle = 'black'
+ var gl = document.createElement('canvas').getContext('experimental-webgl')
+ gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, canvas2d)
+ ctx2d.fillRect(0, 0, 1, 1)
+ }
+ </script>
+ </head>
+ <body>
+ </body>
+</html>
diff --git a/dom/html/crashtests/811226.html b/dom/html/crashtests/811226.html
new file mode 100644
index 0000000000..990ef9af53
--- /dev/null
+++ b/dom/html/crashtests/811226.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('s').onerror;">
+<span id="s" onerror="0;"></span>
+</body>
+</html>
diff --git a/dom/html/crashtests/819745.html b/dom/html/crashtests/819745.html
new file mode 100644
index 0000000000..389e6b8c13
--- /dev/null
+++ b/dom/html/crashtests/819745.html
@@ -0,0 +1,5 @@
+<!doctype="html">
+<body>
+<script>
+ document.body.onerror = null;
+</script>
diff --git a/dom/html/crashtests/828180.html b/dom/html/crashtests/828180.html
new file mode 100644
index 0000000000..055c8a34ba
--- /dev/null
+++ b/dom/html/crashtests/828180.html
@@ -0,0 +1,5 @@
+<script>
+var table = document.createElement("table");
+table.tHead = null;
+table.tFoot = null;
+</script>
diff --git a/dom/html/crashtests/828472.html b/dom/html/crashtests/828472.html
new file mode 100644
index 0000000000..59ce4d280b
--- /dev/null
+++ b/dom/html/crashtests/828472.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<input type='date' value='2013-01-01'>
+</body>
+</html>
diff --git a/dom/html/crashtests/837033.html b/dom/html/crashtests/837033.html
new file mode 100644
index 0000000000..772d24014c
--- /dev/null
+++ b/dom/html/crashtests/837033.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.createElement('button').validity.x = null;"></body>
+</html>
diff --git a/dom/html/crashtests/838256-1.html b/dom/html/crashtests/838256-1.html
new file mode 100644
index 0000000000..e1cdc588e8
--- /dev/null
+++ b/dom/html/crashtests/838256-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<style>
+
+::-moz-range-track {
+ display: none ! important;
+}
+
+::-moz-range-thumb {
+ display: none ! important;
+}
+
+</style>
+</head>
+<body>
+<input type="range">
+</body>
+</html>
diff --git a/dom/html/crashtests/862084.html b/dom/html/crashtests/862084.html
new file mode 100644
index 0000000000..d6d04f74de
--- /dev/null
+++ b/dom/html/crashtests/862084.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<select></select>
+<script>
+var select = document.getElementsByTagName("select");
+select.item(0);
+select[0];
+select.namedItem("x")
+select["x"]
+</script>
diff --git a/dom/html/crashtests/865147.html b/dom/html/crashtests/865147.html
new file mode 100644
index 0000000000..841cf8b6d8
--- /dev/null
+++ b/dom/html/crashtests/865147.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<select></select>
+<script>
+var select = document.getElementsByTagName("select")[0];
+var newOpt = document.createElement("option");
+select.add(newOpt, newOpt);
+</script>
diff --git a/dom/html/crashtests/877910.html b/dom/html/crashtests/877910.html
new file mode 100644
index 0000000000..d454c4478b
--- /dev/null
+++ b/dom/html/crashtests/877910.html
@@ -0,0 +1 @@
+<select><option id="foo"><script>document.querySelector("select").namedItem("foo")</script>
diff --git a/dom/html/crashtests/903106.html b/dom/html/crashtests/903106.html
new file mode 100644
index 0000000000..fceaf4761a
--- /dev/null
+++ b/dom/html/crashtests/903106.html
@@ -0,0 +1,3 @@
+<script>
+ document.createElement("tr").sectionRowIndex;
+</script>
diff --git a/dom/html/crashtests/916322-1.html b/dom/html/crashtests/916322-1.html
new file mode 100644
index 0000000000..56b43d6394
--- /dev/null
+++ b/dom/html/crashtests/916322-1.html
@@ -0,0 +1,10 @@
+<canvas height=16 id=gl>
+<script>
+// Without the fix, this would trigger an assertion in the debug build
+document.addEventListener("DOMContentLoaded", DifferentSizes);
+function DifferentSizes() {
+ gl.getContext("2d");
+ gl.removeAttribute('height');
+ gl.toBlob(function() { }, false)
+}
+</script>
diff --git a/dom/html/crashtests/916322-2.html b/dom/html/crashtests/916322-2.html
new file mode 100644
index 0000000000..c2e5c29205
--- /dev/null
+++ b/dom/html/crashtests/916322-2.html
@@ -0,0 +1,10 @@
+<canvas height=200 id=gl>
+<script>
+// Without the fix, this would trigger an assertion in the debug build
+document.addEventListener("DOMContentLoaded", DifferentSizes);
+function DifferentSizes() {
+ gl.getContext("2d");
+ gl.removeAttribute('height');
+ gl.toBlob(function() { }, false)
+}
+</script>
diff --git a/dom/html/crashtests/978644.xhtml b/dom/html/crashtests/978644.xhtml
new file mode 100644
index 0000000000..0fd9043a28
--- /dev/null
+++ b/dom/html/crashtests/978644.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<body onload="document.getElementById('b').appendChild(document.getElementById('v'));">
+
+<fieldset><fieldset id="b"></fieldset></fieldset>
+
+<div id="v"><fieldset><input required="" /><input required="" /></fieldset></div>
+
+</body>
+
+</html>
diff --git a/dom/html/crashtests/crashtests.list b/dom/html/crashtests/crashtests.list
new file mode 100644
index 0000000000..be51d248f0
--- /dev/null
+++ b/dom/html/crashtests/crashtests.list
@@ -0,0 +1,99 @@
+load 68912-1.html
+load 257818-1.html
+load 285166-1.html
+load 294235-1.html
+load 307616-1.html
+load 324918-1.xhtml
+load 338649-1.xhtml
+load 339501-1.xhtml
+load 339501-2.xhtml
+load 378993-1.xhtml
+load 382568-1.html
+load 383137.xhtml
+load 388183-1.html
+load 395340-1.html
+load 399694-1.html
+load 407053.html
+load 423371-1.html
+load 448564.html
+load 451123-1.html
+load 453406-1.html
+load 464197-1.html
+load 468562-1.html
+load 468562-2.html
+load 494225.html
+load 495543.svg
+load 495546-1.html
+load 504183-1.html
+load 515829-1.html
+load 515829-2.html
+load 570566-1.html
+load 571428-1.html
+load 580507-1.xhtml
+load 590387.html
+load 596785-1.html
+load 596785-2.html
+load 602117.html
+load 604807.html
+load 605264.html
+load 606430-1.html
+load 613027.html
+load 614279.html
+load 614988-1.html
+load 620078-1.html
+load 620078-2.html
+load 631421.html
+load 673853.html
+load 682058.xhtml
+load 682460.html
+load 738744.xhtml
+load 741218.json
+load 741250.xhtml
+load 768344.html
+load 795221-1.html
+load 795221-2.html
+load 795221-3.html
+load 795221-4.html
+load 795221-5.xml
+load 811226.html
+load 819745.html
+load 828180.html
+load 828472.html
+load 837033.html
+load 838256-1.html
+load 862084.html
+load 865147.html
+load 877910.html
+load 903106.html
+load 916322-1.html
+load 916322-2.html
+load 978644.xhtml
+load 1032654.html
+load 1141260.html
+load 1228876.html
+load 1230110.html
+load 1237633.html
+load 1281972-1.html
+load 1282894.html
+load 1290904.html
+load 1343886-1.html
+load 1343886-2.xml
+load 1343886-3.xml
+load 1350972.html
+load 1386905.html
+asserts(0-4) load 1401726.html
+load 1412173.html
+load 1440523.html
+load 1547057.html
+load 1550524.html
+load 1550881-1.html
+load 1550881-2.html
+skip-if(Android) pref(dom.disable_open_during_load,false) load 1667493.html
+load 1680418.html
+load 1704660.html
+load 1724816.html
+load 1785933.html
+skip-if(Android) load 1787671.html # printPreview doesn't work on android
+load 1789475.html
+load 1801380.html
+load 1840088.html