summaryrefslogtreecommitdiffstats
path: root/testing/web-platform/tests/mathml/crashtests/mozilla
diff options
context:
space:
mode:
Diffstat (limited to 'testing/web-platform/tests/mathml/crashtests/mozilla')
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/1092053.html20
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/1140268-1.html18
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/1397439-1.html6
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/1403465.html24
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/1435015.html9
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/1555757-1.html16
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/1555757-2.html27
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/1701975-1.html20
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml25
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/306902-1.xml14
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/347506-1.xhtml23
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/355993-1.xhtml26
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/364686-1.xhtml11
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/368461-1.xhtml11
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/370884-1.xhtml14
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/382208-1.xhtml7
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/382396-1.xhtml7
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/384649-1.xhtml31
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/385265-1.xhtml13
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/385289-1.xhtml30
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/394150-1.xhtml27
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/395450-1.xhtml28
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/399676-1.xhtml7
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/400445-1.xhtml22
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/400904-1.xhtml20
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/410728-1.xml14
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/411603-1.html7
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/413274-1.xhtml18
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/418007-1.xhtml24
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/467914-1.html3
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/547843-1.xhtml1
-rw-r--r--testing/web-platform/tests/mathml/crashtests/mozilla/700031.xhtml9
32 files changed, 532 insertions, 0 deletions
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1092053.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1092053.html
new file mode 100644
index 0000000000..51b5858b6f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1092053.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <title>Largeop stretching</title>
+ <meta charset="utf-8"/>
+ </head>
+ <body>
+ <p>
+ <!-- &bigotimes; allows to check for an assertion involving
+ the direction of the largeop pre-stretch -->
+ <math displaystyle="true">
+ <mrow>
+ <mo id="mo4">(</mo>
+ <mo>&bigotimes;</mo>
+ <mo id="mo5">)</mo>
+ </mrow>
+ </math>
+ </p>
+ </body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1140268-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1140268-1.html
new file mode 100644
index 0000000000..5e5510ba7f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1140268-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset=utf-8>
+<script>
+function boom()
+{
+ var e = document.getElementsByTagName("mo")[0];
+ e.setAttribute("style", "position: absolute; top: 0px;");
+ document.documentElement.offsetHeight;
+ e.setAttribute("style", "position: absolute; top: 100px;");
+}
+</script>
+</head>
+<body onload="boom();">
+<math><mo>boom!</mo></math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1397439-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1397439-1.html
new file mode 100644
index 0000000000..b617f8e0ed
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1397439-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<math>
+<mstyle scriptlevel=101>
+<mstyle scriptlevel=-204>
+</math>
+
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1403465.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1403465.html
new file mode 100644
index 0000000000..924392757b
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1403465.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<body>
+ <math class="hidden">
+ <mi>x</mi>
+ <mo>=</mo>
+ </math>
+<script>
+window.onload = function() {
+ let s = document.createElement("style");
+ s.textContent = `
+ body {
+ line-height: 1.42857143;
+ }
+
+ .hidden {
+ display: none;
+ }
+ `;
+ document.body.appendChild(s);
+};
+</script>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1435015.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1435015.html
new file mode 100644
index 0000000000..329aaca22f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1435015.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<style>
+ div { display: contents; }
+</style>
+<math></math>
+<script>
+ let div = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'div');
+ document.querySelector('math').appendChild(div);
+</script>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-1.html
new file mode 100644
index 0000000000..04f2b27a60
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-1.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+ <style>
+ .class_1 {
+ transition-delay: 2129ms;
+ contain: strict;
+ }
+ </style>
+</head>
+<math>
+ <mover>
+ <ms></ms>
+ <mtable class="class_1"></mtable>
+ </mover>
+</math>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-2.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-2.html
new file mode 100644
index 0000000000..eff048784a
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-2.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ #testElem {
+ border: 1px solid black;
+ background: yellow;
+ contain: layout size;
+ width: 300px;
+ }
+ </style>
+ <script>
+ function go() {
+ /* trigger an incremental reflow.
+ * Note: elem.style is undefined for MathML elements, so we have
+ * to use setAttribute().
+ */
+ testElem.setAttribute("style", "width:150px");
+ }
+ </script>
+</head>
+<body onload="go()">
+ <math>
+ <mtable id="testElem">Change my size</mtable>
+ </math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1701975-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1701975-1.html
new file mode 100644
index 0000000000..c7d54ca996
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1701975-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ #id_0 {
+ font-size: 10000% ! important
+ }
+
+ * {
+ border-top-style: groove;
+ }
+ </style>
+
+</head>
+<math>
+ <semantics style='border-inline: 1000000em outset !important'>
+ <mmultiscripts id='id_0'></mmultiscripts>
+ </semantics>
+</math>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml
new file mode 100644
index 0000000000..ff0326816d
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+ <body onload="run()">
+ <mathml:math id="test" style="display: block">
+ </mathml:math>
+<script>
+ function run() {
+ var t1 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+ "mtable");
+ var t2 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+ "mtable");
+ var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+ "mtr");
+ var r2 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+ "mtr");
+ var test =
+ document.getElementsByTagNameNS("http://www.w3.org/1998/Math/MathML", "math")[0];
+ t1.appendChild(r1);
+ test.appendChild(t1);
+ test.appendChild(t2);
+ t2.appendChild(r2);
+ }
+</script>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/306902-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/306902-1.xml
new file mode 100644
index 0000000000..24e8c068a0
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/306902-1.xml
@@ -0,0 +1,14 @@
+<?xml version='1.0'?>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<body>
+
+<math xmlns='http://www.w3.org/1998/Math/MathML' display='block'><msup>
+
+XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+</msup></math>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347506-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/347506-1.xhtml
new file mode 100644
index 0000000000..4119389a56
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347506-1.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<body>
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+
+ <mtable>
+ <mtr>
+ <mtd><mi>x</mi></mtd>
+ <mtd rowspan="4" columnspan="4"><mi>y</mi></mtd>
+ </mtr>
+ <mtr>
+ <mtd rowspan="0" columnspan="0"><mi>z</mi></mtd>
+ <mtd><mi>w</mi></mtd>
+ </mtr>
+ </mtable>
+
+
+</math></div>
+
+</body>
+
+</html> \ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/355993-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/355993-1.xhtml
new file mode 100644
index 0000000000..cbbddf013a
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/355993-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<style>
+body, body * { position: fixed; }
+</style>
+</head>
+
+<body>
+
+
+<div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+
+ <mtable>
+ <mtr>
+ <mtd>
+ <mn>1</mn>
+ </mtd>
+ </mtr>
+ </mtable>
+ </math>
+</div>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/364686-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/364686-1.xhtml
new file mode 100644
index 0000000000..add9238d8f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/364686-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<body>
+
+<math:merror>
+ <img/>
+</math:merror>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/368461-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/368461-1.xhtml
new file mode 100644
index 0000000000..d5baccf523
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/368461-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<head>
+</head>
+
+<body>
+
+<p><math:msubsup><span>Foo bar baz<td></td></span></math:msubsup></p>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/370884-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/370884-1.xhtml
new file mode 100644
index 0000000000..3959d4b178
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/370884-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+
+<body>
+
+<math:mroot>
+ <div>
+ <div style="position: fixed;">Y</div>
+ </div>
+</math:mroot>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/382208-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/382208-1.xhtml
new file mode 100644
index 0000000000..88d2728bfe
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/382208-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<body>
+
+<div><math:mfrac><math:mmultiscripts/><math:mi/></math:mfrac></div>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/382396-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/382396-1.xhtml
new file mode 100644
index 0000000000..89af7ea18d
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/382396-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<body>
+
+<p style="text-indent: 0%">a<math:ms/></p>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/384649-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/384649-1.xhtml
new file mode 100644
index 0000000000..e2ba50cdee
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/384649-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+
+/* use attribute selector instead of the .class shorthand to work around bug 379178 */
+
+*[class="fixed"] { position: fixed; }
+
+math, mtable, mtr { position: inherit; }
+
+</style>
+</head>
+
+<body>
+
+<div class="fixed">
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <mtable>
+ <mtr class="fixed">
+ <mtd><mi>x</mi></mtd>
+ </mtr>
+ <mtr>
+ <mtd><mi>y</mi></mtd>
+ </mtr>
+ </mtable>
+ </math>
+</div>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/385265-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/385265-1.xhtml
new file mode 100644
index 0000000000..7994653ffa
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/385265-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <mtable>
+ <mtr>
+ <mtd><mi>x</mi></mtd>
+ </mtr>
+ </mtable>
+</math>
+
+</body>
+</html> \ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/385289-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/385289-1.xhtml
new file mode 100644
index 0000000000..8f0e871aaf
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/385289-1.xhtml
@@ -0,0 +1,30 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+ var mss = document.getElementById("mss");
+
+ var j = document.createTextNode("j");
+ var comb = document.createTextNode("\u0302");
+
+ mss.appendChild(j);
+ mss.appendChild(comb);
+}
+</script>
+</head>
+
+<body onload="boom()">
+
+<div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <msub id="mss">
+ <mi>v</mi>
+ <mn>1</mn>
+ </msub>
+ </math>
+</div>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/394150-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/394150-1.xhtml
new file mode 100644
index 0000000000..ee54a8dd3b
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/394150-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+<script>
+
+function boom()
+{
+ var ms = document.createElementNS("http://www.w3.org/1998/Math/MathML", "ms");
+ var textNode = document.getElementById("emptyset").firstChild;
+ var mrow = document.getElementById("mrow");
+
+ ms.appendChild(textNode); // *move* the text node from one place to another!
+ mrow.appendChild(ms);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+<merror><emptyset id="emptyset">
+ <mrow id="mrow"></mrow></emptyset></merror>
+</math>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/395450-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/395450-1.xhtml
new file mode 100644
index 0000000000..79510267ba
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/395450-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<head>
+<style>
+
+/*
+ This testcase uses [class~="foo"] instead of .foo to work around bug 276267
+ (see bug 379178 comment 78)
+*/
+
+[class~="abs"] { position: absolute; }
+[class~="marg"] { margin: 1em; }
+[class="noheight"] { height: 0; }
+
+</style>
+</head>
+
+<body>
+
+<math:mrow class="noheight">
+ <span class="abs">
+ <math:mroot class="abs marg" />
+ <span class="abs" />
+ </span>
+</math:mrow>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/399676-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/399676-1.xhtml
new file mode 100644
index 0000000000..82b547e5ea
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/399676-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+<body>
+<math:mtd><span style="float: right;" /></math:mtd>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/400445-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/400445-1.xhtml
new file mode 100644
index 0000000000..9cb71dbbd6
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/400445-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+<script>
+
+function boom()
+{
+ var mtd1 = document.getElementById("mtd1");
+ var mtd2 = document.getElementById("mtd2");
+ var newSpan = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+
+ mtd1.appendChild(newSpan);
+ mtd1.removeAttribute("columnspan");
+ mtd2.setAttribute("columnspan", 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<math:mtd id="mtd1" columnspan="5" /><math:mtd id="mtd2" />
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/400904-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/400904-1.xhtml
new file mode 100644
index 0000000000..a00f42fd02
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/400904-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var MATHML_NS = "http://www.w3.org/1998/Math/MathML";
+ var mtd = document.getElementById("mtd");
+ var n = document.createElementNS(MATHML_NS, 'mrow');
+ mtd.appendChild(n);
+ mtd.setAttribute('rowspan', 7);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<math:mtd id="mtd"></math:mtd><math:mtr><math:mrow></math:mrow></math:mtr>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/410728-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/410728-1.xml
new file mode 100644
index 0000000000..deaeb8fc55
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/410728-1.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC
+ "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN"
+ "http://www.w3.org/TR/MathML2/dtd/xhtml-math11-f.dtd"
+[
+ <!ENTITY mathml "http://www.w3.org/1998/Math/MathML">
+]>
+<math display="block" xmlns="&mathml;">
+ <mi>f &#x0332;</mi>
+ <mi>-</mi>
+ <mo>+</mo>
+ <mo> -</mo>
+ <mo>&#x0332;</mo>
+</math>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/411603-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/411603-1.html
new file mode 100644
index 0000000000..596565fbc3
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/411603-1.html
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+<body onload="document.getElementById('ms').setAttribute('scriptminsize', '9em');">
+<math:mstyle id="ms" /><span />
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/413274-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/413274-1.xhtml
new file mode 100644
index 0000000000..19d8fab0fd
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/413274-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+ <mstyle scriptsizemultiplier="8205" scriptlevel="15">
+ <mroot>
+ <mrow/>
+ <mrow>
+ <span xmlns="http://www.w3.org/1999/xhtml"/>
+ </mrow>
+ </mroot>
+ </mstyle>
+</math>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/418007-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/418007-1.xhtml
new file mode 100644
index 0000000000..f07a693444
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/418007-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+ <ms fontsize="8179em">
+ <span xmlns="http://www.w3.org/1999/xhtml">
+ <span>
+ <td>
+ <mfrac xmlns="http://www.w3.org/1998/Math/MathML">
+ <mfrac>
+ <mrow/>
+ <mrow/>
+ </mfrac>
+ <mrow/>
+ </mfrac>
+ </td>
+ </span>
+ </span>
+ </ms>
+</math>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/467914-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/467914-1.html
new file mode 100644
index 0000000000..4f518f09df
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/467914-1.html
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<mathml:munder style="transform: translate(50px);clip-path: url(#h);"/>
+</window>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/547843-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/547843-1.xhtml
new file mode 100644
index 0000000000..0ad086d90c
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/547843-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body><math xmlns="http://www.w3.org/1998/Math/MathML" style="display: table;"/><div style="position: fixed;"></div></body></html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/700031.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/700031.xhtml
new file mode 100644
index 0000000000..70f924279e
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/700031.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body>
+
+<div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML"><mover>abcdef</mover></math>
+
+</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
+
+</body></html>