6 files changed, 115 insertions, 0 deletions
diff --git a/layout/generic/crashtests/1410243-1.html b/layout/generic/crashtests/1410243-1.html
new file mode 100644
index 0000000000..42a005e85b
--- /dev/null
+++ b/layout/generic/crashtests/1410243-1.html
@@ -0,0 +1,26 @@
+<!-- //DDBEGIN -->
+<style>
+* { margin-bottom: -1em; font-size: xx-large; }
+.cl1 { Max-height: 93; column-width: 0; position: fixed; }
+</style>
+<script>
+function eventhandler1() {
+try { htmlvar0002.style.setProperty("display", "grid"); } catch(e) { }
+try { svgvar0001.clientWidth; } catch(e) { }
+try { htmlvar0002.style.setProperty("grid-template", "0px/0px"); } catch(e) { }
+}
+</script>
+<details class="cl1" open="" ontoggle="eventhandler1()">
+<summary id="svgvar0001"/></summary>
+<a>
+<ol id="htmlvar0002">
+<keygen>
+>
+A
+AA
+A
+A
+A
+A
+<a>
+<!-- //DDEND -->
diff --git a/layout/generic/crashtests/1741488-1.html b/layout/generic/crashtests/1741488-1.html
new file mode 100644
index 0000000000..74d7c49feb
--- /dev/null
+++ b/layout/generic/crashtests/1741488-1.html
@@ -0,0 +1,23 @@
+<html class="reftest-wait">
+<style>
+#b {
+  writing-mode: vertical-rl;
+  content: url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=);
+}
+</style>
+<script>
+let pp;
+document.addEventListener("MozReftestInvalidate", () => {
+  a.after("1")
+  a.insertAdjacentHTML("afterEnd", b.outerHTML);
+  pp = SpecialPowers.wrap(self).printPreview();
+  setTimeout(function() {
+    pp.close();
+    document.documentElement.className = "";
+  }, 400);
+})
+</script>
+<math>
+<munder>
+<mn id="a">2</mn>
+<dl id="b"></dl>
diff --git a/layout/generic/crashtests/1881375-1-helper.html b/layout/generic/crashtests/1881375-1-helper.html
new file mode 100644
index 0000000000..5c79e4981f
--- /dev/null
+++ b/layout/generic/crashtests/1881375-1-helper.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<script>
+// Notify our parent and reload ourselves.
+function notifyAndReload() {
+  if (window.parent) {
+    window.parent.postMessage("reloaded", "*");
+  }
+  window.location.reload(true)
+}
+</script>
+<style>
+*:nth-child(even) {
+  height: 16em;
+  list-style-image: url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=);
+}
+#a {
+  display: inline-grid;
+  grid-auto-flow: column dense;
+}
+#b {
+  padding-top: 8192vmax;
+}
+* {
+  align-content: center;
+  column-width: 1em;
+  float: inline-end;
+}
+</style>
+<body onload="setTimeout(notifyAndReload, 0)">
+<picture></picture>
+<iframe></iframe>
+<isindex>
+<svg></svg>
+<samp id="a">
+<q>
+<a id="b">
+</q>
+<li>
diff --git a/layout/generic/crashtests/1881375-1.html b/layout/generic/crashtests/1881375-1.html
new file mode 100644
index 0000000000..8cef260433
--- /dev/null
+++ b/layout/generic/crashtests/1881375-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+// Loop count for the handler below. This value seems to be enough for the
+// crashtest to be likely to trigger the crash.
+const MAX_LOADS = 3;
+let loadCount = 0;
+
+// Handler which gets invoked by the iframe whenever it completes a load
+// (and dynamically reloads itself). This lets us allow the testcase to
+// reload over and over (as seems to be required to trigger the crash),
+// while also keeping the test duration reasonably bounded.
+window.addEventListener(
+  "message",
+  (event) => {
+    if (loadCount++ == MAX_LOADS) {
+      // After MAX_LOADS reloads of the iframe, call ourselves done.
+      myIframe.remove();
+      document.documentElement.className = "";
+    }
+  }
+);
+
+</script>
+<iframe id="myIframe" src="1881375-1-helper.html"></iframe>
diff --git a/layout/generic/crashtests/481921.ogg b/layout/generic/crashtests/481921.ogg
deleted file mode 100644
index 0c41c3cd6b..0000000000
--- a/layout/generic/crashtests/481921.ogg
+++ /dev/null
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index 1c184739d7..2aea090a6f 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -678,6 +678,7 @@ load 1405443.html
 load 1405813.html
 load 1405896.html
 load 1406252-1.html
+asserts(2) load 1410243-1.html # assertion is bug 574889
 load 1415185.html
 load 1416544.html
 load 1427824.html
@@ -804,6 +805,7 @@ load 1728319.html
 asserts(2-8) load 1730506.html # asserts from integer overflow & bogus sizes
 asserts(1-4) load 1730570.html # asserts from integer overflow & bogus sizes
 load 1734015.html
+skip-if(Android) load 1741488-1.html # printPreview doesn't work on android
 load 1776079.html
 asserts(0-2) load 1791606.html
 load 1799749.html
@@ -812,3 +814,4 @@ load 1816574.html
 load 1821603.html
 load 1822118.html
 load 1825434.html
+asserts(0-85) load 1881375-1.html # bug 1890687 - assertions about fragmentation invariants, failing many times because the test runs in a loop