From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 02:47:55 +0200
Subject: Adding upstream version 124.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 dom/html/crashtests/1032654.html         |   1 +
 dom/html/crashtests/1141260.html         |   4 ++
 dom/html/crashtests/1228876.html         |  21 +++++++
 dom/html/crashtests/1230110.html         |  19 ++++++
 dom/html/crashtests/1237633.html         |   1 +
 dom/html/crashtests/1281972-1.html       |   5 ++
 dom/html/crashtests/1282894.html         |  17 ++++++
 dom/html/crashtests/1290904.html         |  37 ++++++++++++
 dom/html/crashtests/1343886-1.html       |  14 +++++
 dom/html/crashtests/1343886-2.xml        |   3 +
 dom/html/crashtests/1343886-3.xml        |   3 +
 dom/html/crashtests/1350972.html         |  22 +++++++
 dom/html/crashtests/1386905.html         |  13 ++++
 dom/html/crashtests/1401726.html         |  17 ++++++
 dom/html/crashtests/1412173.html         |  18 ++++++
 dom/html/crashtests/1429783.html         |  19 ++++++
 dom/html/crashtests/1440523.html         |  13 ++++
 dom/html/crashtests/1440827.html         |   6 ++
 dom/html/crashtests/1547057.html         |  11 ++++
 dom/html/crashtests/1550524.html         |   7 +++
 dom/html/crashtests/1550881-1.html       |  13 ++++
 dom/html/crashtests/1550881-2.html       |  14 +++++
 dom/html/crashtests/1667493.html         |  13 ++++
 dom/html/crashtests/1667493_1.html       |   7 +++
 dom/html/crashtests/1680418.html         |  17 ++++++
 dom/html/crashtests/1704660.html         |  17 ++++++
 dom/html/crashtests/1724816.html         |  14 +++++
 dom/html/crashtests/1785933-inner.html   |  28 +++++++++
 dom/html/crashtests/1785933.html         |  10 ++++
 dom/html/crashtests/1787671.html         |  19 ++++++
 dom/html/crashtests/1789475.html         |  10 ++++
 dom/html/crashtests/1801380.html         |   1 +
 dom/html/crashtests/1840088.html         |   2 +
 dom/html/crashtests/257818-1.html        |  82 +++++++++++++++++++++++++
 dom/html/crashtests/285166-1.html        |   3 +
 dom/html/crashtests/294235-1.html        |  14 +++++
 dom/html/crashtests/307616-1.html        |   8 +++
 dom/html/crashtests/324918-1.xhtml       |  26 ++++++++
 dom/html/crashtests/338649-1.xhtml       |  22 +++++++
 dom/html/crashtests/339501-1.xhtml       |  33 +++++++++++
 dom/html/crashtests/339501-2.xhtml       |  33 +++++++++++
 dom/html/crashtests/378993-1.xhtml       |   7 +++
 dom/html/crashtests/382568-1-inner.xhtml |  52 ++++++++++++++++
 dom/html/crashtests/382568-1.html        |   9 +++
 dom/html/crashtests/383137.xhtml         |  13 ++++
 dom/html/crashtests/388183-1.html        |   8 +++
 dom/html/crashtests/395340-1.html        |  28 +++++++++
 dom/html/crashtests/399694-1.html        |  20 +++++++
 dom/html/crashtests/407053.html          |   6 ++
 dom/html/crashtests/423371-1.html        |   9 +++
 dom/html/crashtests/448564.html          |   7 +++
 dom/html/crashtests/451123-1.html        |   7 +++
 dom/html/crashtests/453406-1.html        |  34 +++++++++++
 dom/html/crashtests/464197-1.html        |  23 +++++++
 dom/html/crashtests/468562-1.html        |   6 ++
 dom/html/crashtests/468562-2.html        |   6 ++
 dom/html/crashtests/494225.html          |  10 ++++
 dom/html/crashtests/495543.svg           |  16 +++++
 dom/html/crashtests/495546-1.html        |  19 ++++++
 dom/html/crashtests/504183-1.html        |  12 ++++
 dom/html/crashtests/515829-1.html        |   7 +++
 dom/html/crashtests/515829-2.html        |   7 +++
 dom/html/crashtests/570566-1.html        |   2 +
 dom/html/crashtests/571428-1.html        |  14 +++++
 dom/html/crashtests/580507-1.xhtml       |  18 ++++++
 dom/html/crashtests/590387.html          |   8 +++
 dom/html/crashtests/596785-1.html        |   9 +++
 dom/html/crashtests/596785-2.html        |   9 +++
 dom/html/crashtests/602117.html          |   8 +++
 dom/html/crashtests/604807.html          |   9 +++
 dom/html/crashtests/605264.html          |   8 +++
 dom/html/crashtests/606430-1.html        |  31 ++++++++++
 dom/html/crashtests/613027.html          |  21 +++++++
 dom/html/crashtests/614279.html          |  18 ++++++
 dom/html/crashtests/614988-1.html        |   5 ++
 dom/html/crashtests/616401.html          |   8 +++
 dom/html/crashtests/620078-1.html        |  20 +++++++
 dom/html/crashtests/620078-2.html        |   6 ++
 dom/html/crashtests/631421.html          |  34 +++++++++++
 dom/html/crashtests/631421.png           | Bin 0 -> 38661 bytes
 dom/html/crashtests/673853.html          |  20 +++++++
 dom/html/crashtests/682058.xhtml         |  11 ++++
 dom/html/crashtests/682460.html          |  21 +++++++
 dom/html/crashtests/68912-1.html         |  24 ++++++++
 dom/html/crashtests/738744.xhtml         |   4 ++
 dom/html/crashtests/741218.json          |   1 +
 dom/html/crashtests/741218.json^headers^ |   1 +
 dom/html/crashtests/741250.xhtml         |   9 +++
 dom/html/crashtests/768344.html          |  22 +++++++
 dom/html/crashtests/795221-1.html        |   7 +++
 dom/html/crashtests/795221-2.html        |   9 +++
 dom/html/crashtests/795221-3.html        |  14 +++++
 dom/html/crashtests/795221-4.html        |   9 +++
 dom/html/crashtests/795221-5.xml         |   6 ++
 dom/html/crashtests/798802-1.html        |  18 ++++++
 dom/html/crashtests/811226.html          |   6 ++
 dom/html/crashtests/819745.html          |   5 ++
 dom/html/crashtests/828180.html          |   5 ++
 dom/html/crashtests/828472.html          |   6 ++
 dom/html/crashtests/837033.html          |   4 ++
 dom/html/crashtests/838256-1.html        |  20 +++++++
 dom/html/crashtests/862084.html          |   9 +++
 dom/html/crashtests/865147.html          |   7 +++
 dom/html/crashtests/877910.html          |   1 +
 dom/html/crashtests/903106.html          |   3 +
 dom/html/crashtests/916322-1.html        |  10 ++++
 dom/html/crashtests/916322-2.html        |  10 ++++
 dom/html/crashtests/978644.xhtml         |  11 ++++
 dom/html/crashtests/crashtests.list      |  99 +++++++++++++++++++++++++++++++
 109 files changed, 1543 insertions(+)
 create mode 100644 dom/html/crashtests/1032654.html
 create mode 100644 dom/html/crashtests/1141260.html
 create mode 100644 dom/html/crashtests/1228876.html
 create mode 100644 dom/html/crashtests/1230110.html
 create mode 100644 dom/html/crashtests/1237633.html
 create mode 100644 dom/html/crashtests/1281972-1.html
 create mode 100644 dom/html/crashtests/1282894.html
 create mode 100644 dom/html/crashtests/1290904.html
 create mode 100644 dom/html/crashtests/1343886-1.html
 create mode 100644 dom/html/crashtests/1343886-2.xml
 create mode 100644 dom/html/crashtests/1343886-3.xml
 create mode 100644 dom/html/crashtests/1350972.html
 create mode 100644 dom/html/crashtests/1386905.html
 create mode 100644 dom/html/crashtests/1401726.html
 create mode 100644 dom/html/crashtests/1412173.html
 create mode 100644 dom/html/crashtests/1429783.html
 create mode 100644 dom/html/crashtests/1440523.html
 create mode 100644 dom/html/crashtests/1440827.html
 create mode 100644 dom/html/crashtests/1547057.html
 create mode 100644 dom/html/crashtests/1550524.html
 create mode 100644 dom/html/crashtests/1550881-1.html
 create mode 100644 dom/html/crashtests/1550881-2.html
 create mode 100644 dom/html/crashtests/1667493.html
 create mode 100644 dom/html/crashtests/1667493_1.html
 create mode 100644 dom/html/crashtests/1680418.html
 create mode 100644 dom/html/crashtests/1704660.html
 create mode 100644 dom/html/crashtests/1724816.html
 create mode 100644 dom/html/crashtests/1785933-inner.html
 create mode 100644 dom/html/crashtests/1785933.html
 create mode 100644 dom/html/crashtests/1787671.html
 create mode 100644 dom/html/crashtests/1789475.html
 create mode 100644 dom/html/crashtests/1801380.html
 create mode 100644 dom/html/crashtests/1840088.html
 create mode 100644 dom/html/crashtests/257818-1.html
 create mode 100644 dom/html/crashtests/285166-1.html
 create mode 100644 dom/html/crashtests/294235-1.html
 create mode 100644 dom/html/crashtests/307616-1.html
 create mode 100644 dom/html/crashtests/324918-1.xhtml
 create mode 100644 dom/html/crashtests/338649-1.xhtml
 create mode 100644 dom/html/crashtests/339501-1.xhtml
 create mode 100644 dom/html/crashtests/339501-2.xhtml
 create mode 100644 dom/html/crashtests/378993-1.xhtml
 create mode 100644 dom/html/crashtests/382568-1-inner.xhtml
 create mode 100644 dom/html/crashtests/382568-1.html
 create mode 100644 dom/html/crashtests/383137.xhtml
 create mode 100644 dom/html/crashtests/388183-1.html
 create mode 100644 dom/html/crashtests/395340-1.html
 create mode 100644 dom/html/crashtests/399694-1.html
 create mode 100644 dom/html/crashtests/407053.html
 create mode 100644 dom/html/crashtests/423371-1.html
 create mode 100644 dom/html/crashtests/448564.html
 create mode 100644 dom/html/crashtests/451123-1.html
 create mode 100644 dom/html/crashtests/453406-1.html
 create mode 100644 dom/html/crashtests/464197-1.html
 create mode 100644 dom/html/crashtests/468562-1.html
 create mode 100644 dom/html/crashtests/468562-2.html
 create mode 100644 dom/html/crashtests/494225.html
 create mode 100644 dom/html/crashtests/495543.svg
 create mode 100644 dom/html/crashtests/495546-1.html
 create mode 100644 dom/html/crashtests/504183-1.html
 create mode 100644 dom/html/crashtests/515829-1.html
 create mode 100644 dom/html/crashtests/515829-2.html
 create mode 100644 dom/html/crashtests/570566-1.html
 create mode 100644 dom/html/crashtests/571428-1.html
 create mode 100644 dom/html/crashtests/580507-1.xhtml
 create mode 100644 dom/html/crashtests/590387.html
 create mode 100644 dom/html/crashtests/596785-1.html
 create mode 100644 dom/html/crashtests/596785-2.html
 create mode 100644 dom/html/crashtests/602117.html
 create mode 100644 dom/html/crashtests/604807.html
 create mode 100644 dom/html/crashtests/605264.html
 create mode 100644 dom/html/crashtests/606430-1.html
 create mode 100644 dom/html/crashtests/613027.html
 create mode 100644 dom/html/crashtests/614279.html
 create mode 100644 dom/html/crashtests/614988-1.html
 create mode 100644 dom/html/crashtests/616401.html
 create mode 100644 dom/html/crashtests/620078-1.html
 create mode 100644 dom/html/crashtests/620078-2.html
 create mode 100644 dom/html/crashtests/631421.html
 create mode 100644 dom/html/crashtests/631421.png
 create mode 100644 dom/html/crashtests/673853.html
 create mode 100644 dom/html/crashtests/682058.xhtml
 create mode 100644 dom/html/crashtests/682460.html
 create mode 100644 dom/html/crashtests/68912-1.html
 create mode 100644 dom/html/crashtests/738744.xhtml
 create mode 100644 dom/html/crashtests/741218.json
 create mode 100644 dom/html/crashtests/741218.json^headers^
 create mode 100644 dom/html/crashtests/741250.xhtml
 create mode 100644 dom/html/crashtests/768344.html
 create mode 100644 dom/html/crashtests/795221-1.html
 create mode 100644 dom/html/crashtests/795221-2.html
 create mode 100644 dom/html/crashtests/795221-3.html
 create mode 100644 dom/html/crashtests/795221-4.html
 create mode 100644 dom/html/crashtests/795221-5.xml
 create mode 100644 dom/html/crashtests/798802-1.html
 create mode 100644 dom/html/crashtests/811226.html
 create mode 100644 dom/html/crashtests/819745.html
 create mode 100644 dom/html/crashtests/828180.html
 create mode 100644 dom/html/crashtests/828472.html
 create mode 100644 dom/html/crashtests/837033.html
 create mode 100644 dom/html/crashtests/838256-1.html
 create mode 100644 dom/html/crashtests/862084.html
 create mode 100644 dom/html/crashtests/865147.html
 create mode 100644 dom/html/crashtests/877910.html
 create mode 100644 dom/html/crashtests/903106.html
 create mode 100644 dom/html/crashtests/916322-1.html
 create mode 100644 dom/html/crashtests/916322-2.html
 create mode 100644 dom/html/crashtests/978644.xhtml
 create mode 100644 dom/html/crashtests/crashtests.list

(limited to 'dom/html/crashtests')

diff --git a/dom/html/crashtests/1032654.html b/dom/html/crashtests/1032654.html
new file mode 100644
index 0000000000..3067e10770
--- /dev/null
+++ b/dom/html/crashtests/1032654.html
@@ -0,0 +1 @@
+<template>&#x000d;#
diff --git a/dom/html/crashtests/1141260.html b/dom/html/crashtests/1141260.html
new file mode 100644
index 0000000000..c5ced3a447
--- /dev/null
+++ b/dom/html/crashtests/1141260.html
@@ -0,0 +1,4 @@
+<img src="foo" srcset="bar">
+<script>
+  document.querySelector("img").removeAttribute('src');
+</script>
diff --git a/dom/html/crashtests/1228876.html b/dom/html/crashtests/1228876.html
new file mode 100644
index 0000000000..b7beb645cf
--- /dev/null
+++ b/dom/html/crashtests/1228876.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var a = document.createElement("select");
+    var f = document.createElement("optgroup");
+    var g = document.createElement("optgroup");
+    a.appendChild(f);
+    g.appendChild(document.createElement("option"));
+    f.appendChild(g);
+    a.appendChild(document.createElement("option"));
+    document.body.appendChild(a);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/1230110.html b/dom/html/crashtests/1230110.html
new file mode 100644
index 0000000000..4654641874
--- /dev/null
+++ b/dom/html/crashtests/1230110.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+// This test case should not leak.
+function leak()
+{
+    var img = document.createElement("img");
+    var iframe = document.createElement("iframe");
+    img.appendChild(iframe);
+    document.body.appendChild(img);
+
+    document.addEventListener('Foo', function(){});
+}
+</script>
+</head>
+<body onload="leak();"></body>
+</html>
diff --git a/dom/html/crashtests/1237633.html b/dom/html/crashtests/1237633.html
new file mode 100644
index 0000000000..c235f03158
--- /dev/null
+++ b/dom/html/crashtests/1237633.html
@@ -0,0 +1 @@
+<img srcset="data:,a 2400w" sizes="(min-width: 1px) calc(300px - 100vw)">
diff --git a/dom/html/crashtests/1281972-1.html b/dom/html/crashtests/1281972-1.html
new file mode 100644
index 0000000000..6fa5bb250b
--- /dev/null
+++ b/dom/html/crashtests/1281972-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<body onload="window[0].document.forms[0].submit();">
+<iframe src="data:text/html;charset=UTF-8,<form accept-charset=HZ-GB-2312>"></iframe>
+</body>
diff --git a/dom/html/crashtests/1282894.html b/dom/html/crashtests/1282894.html
new file mode 100644
index 0000000000..456a4541fd
--- /dev/null
+++ b/dom/html/crashtests/1282894.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    var table = document.createElement("table");
+    var cap = document.createElement("caption");
+    cap.appendChild(table)
+    table.caption = cap;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/1290904.html b/dom/html/crashtests/1290904.html
new file mode 100644
index 0000000000..5ea23ba3b6
--- /dev/null
+++ b/dom/html/crashtests/1290904.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <fieldset id="outer">
+      <fieldset id="inner">
+      </fieldset>
+    </fieldset>
+  </body>
+</html>
+<script>
+function appendTextareaToFieldset(fieldset) {
+  var textarea = document.createElement("textarea");
+  textarea.setAttribute("required", "");
+  fieldset.appendChild(textarea);
+}
+
+var innerFieldset = document.getElementById('inner');
+var outerFieldset = document.getElementById('outer');
+
+var fieldset = document.createElement('fieldset');
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+
+// Adding a fieldset to a nested fieldset.
+innerFieldset.appendChild(fieldset);
+appendTextareaToFieldset(fieldset);
+appendTextareaToFieldset(fieldset);
+// This triggers mInvalidElementsCount checks in outer fieldset.
+appendTextareaToFieldset(outerFieldset);
+
+// Removing a fieldset from a nested fieldset.
+innerFieldset.removeChild(fieldset);
+// This triggers mInvalidElementsCount checks in outer fieldset.
+appendTextareaToFieldset(outerFieldset);
+</script>
diff --git a/dom/html/crashtests/1343886-1.html b/dom/html/crashtests/1343886-1.html
new file mode 100644
index 0000000000..fe84959ac2
--- /dev/null
+++ b/dom/html/crashtests/1343886-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <script>
+            document.documentElement.scrollTop = "500";
+            o1 = document.createRange();
+            o2 = document.createElement('input'); 
+            o1.selectNode(document.documentElement);
+            o1.surroundContents(o2);
+            o2.selectionStart;
+        </script>
+    </head>
+    <body></body>
+</html>
\ No newline at end of file
diff --git a/dom/html/crashtests/1343886-2.xml b/dom/html/crashtests/1343886-2.xml
new file mode 100644
index 0000000000..91ddae103d
--- /dev/null
+++ b/dom/html/crashtests/1343886-2.xml
@@ -0,0 +1,3 @@
+<input xmlns="http://www.w3.org/1999/xhtml">
+  <script>document.documentElement.selectionStart</script>
+</input>
diff --git a/dom/html/crashtests/1343886-3.xml b/dom/html/crashtests/1343886-3.xml
new file mode 100644
index 0000000000..a579a5e074
--- /dev/null
+++ b/dom/html/crashtests/1343886-3.xml
@@ -0,0 +1,3 @@
+<textarea xmlns="http://www.w3.org/1999/xhtml">
+  <script>document.documentElement.selectionStart</script>
+</textarea>
diff --git a/dom/html/crashtests/1350972.html b/dom/html/crashtests/1350972.html
new file mode 100644
index 0000000000..7af7f9e174
--- /dev/null
+++ b/dom/html/crashtests/1350972.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+    try { o1 = document.createElement('tr'); } catch(e) {};
+    try { o2 = document.createElement('div'); } catch(e) {};
+    try { o3 = document.createElement('hr'); } catch(e) {};
+    try { o4 = document.createElement('textarea'); } catch(e) {};
+    try { o5 = document.getSelection(); } catch(e) {};
+    try { o6 = document.createRange(); } catch(e) {};
+    try { document.documentElement.appendChild(o2); } catch(e) {};
+    try { document.documentElement.appendChild(o3); } catch(e) {};
+    try { o2.appendChild(o4); } catch(e) {};
+    try { o3.outerHTML = "<noscript contenteditable='true'>"; } catch(e) {};
+    try { o4.select(); } catch(e) {};
+    try { o5.addRange(o6); } catch(e) {};
+    try { document.documentElement.appendChild(o1); } catch(e) {};
+    try { o5.selectAllChildren(o1); } catch(e) {};
+    try { o6.selectNode(o1); } catch(e) {};
+</script>
+</head>
+</html>
\ No newline at end of file
diff --git a/dom/html/crashtests/1386905.html b/dom/html/crashtests/1386905.html
new file mode 100644
index 0000000000..6ecc59e23b
--- /dev/null
+++ b/dom/html/crashtests/1386905.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+document.documentElement.getBoundingClientRect()
+document.documentElement.innerHTML = "<input placeholder=e type=number readonly>"
+document.designMode = "on"
+document.execCommand("inserttext", false, "")
+document.designMode = "off"
+document.documentElement.style.display = 'none'
+</script>
+</head>
+</html>
diff --git a/dom/html/crashtests/1401726.html b/dom/html/crashtests/1401726.html
new file mode 100644
index 0000000000..bf4b4918ab
--- /dev/null
+++ b/dom/html/crashtests/1401726.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script>
+    try { o1 = document.createElement('button') } catch(e) { }
+    try { o2 = document.createElement('p') } catch(e) { }
+    try { o3 = o1.labels } catch(e) { }
+    try { o4 = document.createNSResolver(document.documentElement) } catch(e) { }
+    try { o5 = document.createRange(); } catch(e) { }
+    try { document.documentElement.appendChild(o1) } catch(e) { }
+    try { o5.selectNode(o4); } catch(e) { }
+    try { o5.surroundContents(o2) } catch(e) { }
+    try { o5.surroundContents(o2) } catch(e) { }
+    try { o1.labels.length } catch(e) { }
+</script>
+</head>
+</html>
diff --git a/dom/html/crashtests/1412173.html b/dom/html/crashtests/1412173.html
new file mode 100644
index 0000000000..6989260cc7
--- /dev/null
+++ b/dom/html/crashtests/1412173.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+let f = document.createElement('frame');
+f.onload = function() {
+  let frameDocument = f.contentDocument;
+  frameDocument.body.onbeforeunload = function () { frameDocument.write('<p>beforeUnload</p>') };
+  frameDocument.write('<p>trigger unload</p>')
+  window.stop();
+  document.documentElement.className = '';
+};
+document.documentElement.appendChild(f);
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/html/crashtests/1429783.html b/dom/html/crashtests/1429783.html
new file mode 100644
index 0000000000..211f9e7ee2
--- /dev/null
+++ b/dom/html/crashtests/1429783.html
@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<html>
+  <head>
+    <script>
+      try { o2 = document.createElement('textarea') } catch(e) { }
+      try { o3 = document.getSelection() } catch(e) { }
+      try { document.documentElement.appendChild(o2) } catch(e) { }
+      try { o2.select() } catch(e) { }
+      try { o4 = o3.getRangeAt(0) } catch(e) { }
+      try { o5 = o4.commonAncestorContainer } catch(e) { }
+      try { o6 = o4.commonAncestorContainer } catch(e) { }
+      try { document.documentElement.after("", o5, "") } catch(e) { }
+      try { o4 = document.createElement('t') } catch(e) { }
+      try { document.appendChild(o4); } catch(e) { }
+      try { document.write(atob("PHNjcmlwdCBzcmM9Jyc+PC9zY3JpcHQ+Cg==")) } catch(e) { }
+      try { document.replaceChild(o6, document.documentElement); } catch(e) { }
+    </script>
+  </head>
+</html>
diff --git a/dom/html/crashtests/1440523.html b/dom/html/crashtests/1440523.html
new file mode 100644
index 0000000000..11ce699781
--- /dev/null
+++ b/dom/html/crashtests/1440523.html
@@ -0,0 +1,13 @@
+<html>
+  <head>
+    <script>
+      try { frame = document.createElement('frame') } catch(e) { }
+      try { document.documentElement.appendChild(frame) } catch(e) { }
+      try { contentDocument = frame.contentDocument } catch(e) { }
+      try { contentDocument.writeln("<p contenteditable='true'>") } catch(e) { }
+      try { anotherDocument = document.implementation.createHTMLDocument(); } catch(e) { }
+      try { rootOfAnotherDocument = anotherDocument.documentElement; } catch(e) { }
+      try { document.replaceChild(rootOfAnotherDocument, document.documentElement); } catch(e) { }
+   </script>
+  </head>
+</html>
diff --git a/dom/html/crashtests/1440827.html b/dom/html/crashtests/1440827.html
new file mode 100644
index 0000000000..ee204212ff
--- /dev/null
+++ b/dom/html/crashtests/1440827.html
@@ -0,0 +1,6 @@
+<html>
+<head>
+<meta charset="UTF-8">
+>
+<meta content='referrer no-referrer;manifest-src self http:' http-equiv='Content-Security-Policy'>
+<script src='http://zzzzzz.z'></script>
diff --git a/dom/html/crashtests/1547057.html b/dom/html/crashtests/1547057.html
new file mode 100644
index 0000000000..89f48b5344
--- /dev/null
+++ b/dom/html/crashtests/1547057.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+    <script>
+      function start() {
+        const iframe = document.createElement('iframe')
+        iframe.policy.allowedFeatures()
+      }
+      window.addEventListener('load', start)
+    </script>
+</head>
+</html>
diff --git a/dom/html/crashtests/1550524.html b/dom/html/crashtests/1550524.html
new file mode 100644
index 0000000000..1b41f527dc
--- /dev/null
+++ b/dom/html/crashtests/1550524.html
@@ -0,0 +1,7 @@
+<iframe></iframe>
+<script>
+  var doc = frames[0].document;
+  doc.open();
+  doc.open();
+  doc.close();
+</script>
diff --git a/dom/html/crashtests/1550881-1.html b/dom/html/crashtests/1550881-1.html
new file mode 100644
index 0000000000..b9d73df957
--- /dev/null
+++ b/dom/html/crashtests/1550881-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<iframe srcdoc="<iframe></iframe>"></iframe>
+<script>
+  onload = function() {
+      parent = frames[0];
+      child = parent[0];
+      child.onunload = function() {
+          parent.document.open();
+      }
+      parent.document.open();
+      parent.document.write("Hello");
+  }
+</script>
diff --git a/dom/html/crashtests/1550881-2.html b/dom/html/crashtests/1550881-2.html
new file mode 100644
index 0000000000..97bf5ef350
--- /dev/null
+++ b/dom/html/crashtests/1550881-2.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<iframe srcdoc="<iframe></iframe>"></iframe>
+<script>
+  onload = function() {
+      parent = frames[0];
+      child = parent[0];
+      child.onunload = function() {
+          parent.document.open();
+          parent.document.write("Nested");
+      }
+      parent.document.open();
+      parent.document.write("Hello");
+  }
+</script>
diff --git a/dom/html/crashtests/1667493.html b/dom/html/crashtests/1667493.html
new file mode 100644
index 0000000000..d7cf6c6174
--- /dev/null
+++ b/dom/html/crashtests/1667493.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+function runTest() {
+  let win = window.open("1667493_1.html");
+  win.finish = function() {
+    document.documentElement.removeAttribute("class");
+  };
+}
+</script>
+<body onload="runTest()">
+</body>
+</html>
diff --git a/dom/html/crashtests/1667493_1.html b/dom/html/crashtests/1667493_1.html
new file mode 100644
index 0000000000..9b1a5fc047
--- /dev/null
+++ b/dom/html/crashtests/1667493_1.html
@@ -0,0 +1,7 @@
+<script>
+window.requestIdleCallback(() => {
+  window.close();
+  finish();
+});
+</script>
+<input required="" value="r" type="number">
diff --git a/dom/html/crashtests/1680418.html b/dom/html/crashtests/1680418.html
new file mode 100644
index 0000000000..ccebe0ed33
--- /dev/null
+++ b/dom/html/crashtests/1680418.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+window.addEventListener("hashchange", function() {
+  document.documentElement.removeAttribute("class");
+});
+
+async function runTest() {
+  document.getElementById("a").click();
+  await new Promise(resolve => setTimeout(resolve, 0));
+  document.location.hash = "#foo";
+}
+</script>
+<body onload="runTest()">
+<a id='a' type='text/html' href='telnet://'>
+</body>
+</html>
diff --git a/dom/html/crashtests/1704660.html b/dom/html/crashtests/1704660.html
new file mode 100644
index 0000000000..01497975df
--- /dev/null
+++ b/dom/html/crashtests/1704660.html
@@ -0,0 +1,17 @@
+<html>
+  <head>
+    <script>
+      function test() {
+        var ifr = document.getElementsByTagName("iframe")[0];
+        var form = ifr.contentDocument.getElementsByTagName("form")[0];
+        form.onsubmit = function() {
+          ifr.remove()
+        }
+        form.lastChild.click();
+      }
+    </script>
+  </head>
+  <body onload="test()">
+    <iframe srcdoc="<form><input name=f type=file><button></button></form>"></iframe>
+  </body>
+</html>
diff --git a/dom/html/crashtests/1724816.html b/dom/html/crashtests/1724816.html
new file mode 100644
index 0000000000..9264a5225f
--- /dev/null
+++ b/dom/html/crashtests/1724816.html
@@ -0,0 +1,14 @@
+<script>
+window.onload = () => {
+  window[0].focus()
+  a.close()
+  a.showModal()
+  document.execCommand("selectAll", false)
+}
+function go() {
+  document.onselectstart = document.createElement("frameset").onload
+}
+</script>
+<details open="true" ontoggle="go()">a</details>
+<iframe></iframe>
+<dialog id="a" tabindex="3">a</dialog>
diff --git a/dom/html/crashtests/1785933-inner.html b/dom/html/crashtests/1785933-inner.html
new file mode 100644
index 0000000000..8c97da8a8e
--- /dev/null
+++ b/dom/html/crashtests/1785933-inner.html
@@ -0,0 +1,28 @@
+<style>
+* {
+  image-rendering: pixelated;
+}
+</style>
+<script>
+window.requestIdleCallback(() => {
+  a.setSelectionRange(-1, 1)
+  document.head.innerHTML = undefined
+})
+</script>
+<embed src="data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs="></embed>
+<textarea id="a">aaaaaaaaaaaaaaaa</textarea>
+<script>
+  const embed = document.querySelector("embed");
+  embed.onload = function() {
+    var countdown = 20;
+    if (location.search) {
+        countdown = parseInt(location.search.slice(1)) - 1;
+	  }
+
+    if (countdown > 0) {
+      location.search = countdown;
+    } else {
+      window.parent.postMessage("done", "*");
+    }
+  }
+</script>
diff --git a/dom/html/crashtests/1785933.html b/dom/html/crashtests/1785933.html
new file mode 100644
index 0000000000..e73395faea
--- /dev/null
+++ b/dom/html/crashtests/1785933.html
@@ -0,0 +1,10 @@
+<html class="reftest-wait">
+<body>
+  <iframe src="./1785933-inner.html"></iframe>
+  <script>
+    window.onmessage = function() {
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+</body>
+</html>
diff --git a/dom/html/crashtests/1787671.html b/dom/html/crashtests/1787671.html
new file mode 100644
index 0000000000..1b4106435e
--- /dev/null
+++ b/dom/html/crashtests/1787671.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+let pp;
+window.addEventListener("MozReftestInvalidate", finish);
+document.addEventListener('DOMContentLoaded', () => {
+  pp = SpecialPowers.wrap(self).printPreview();
+  pp?.print();
+  setTimeout(window.close, 250);
+});
+function finish() {
+  setTimeout(function() {
+    pp.close();
+    document.documentElement.className = "";
+  }, 0);
+}
+</script>
+<img srcset="#"></img>
+</html>
diff --git a/dom/html/crashtests/1789475.html b/dom/html/crashtests/1789475.html
new file mode 100644
index 0000000000..f12924a742
--- /dev/null
+++ b/dom/html/crashtests/1789475.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<script>
+window.addEventListener('load', () => {
+  let a = document.createElement("img");
+  a.srcset = "1";
+  let b = new DOMParser()
+  let c = b.parseFromString("<div></div>", "text/html")
+  c.adoptNode(a)
+})
+</script>
diff --git a/dom/html/crashtests/1801380.html b/dom/html/crashtests/1801380.html
new file mode 100644
index 0000000000..f4ce3e109f
--- /dev/null
+++ b/dom/html/crashtests/1801380.html
@@ -0,0 +1 @@
+<input dir="auto" type="tel">
diff --git a/dom/html/crashtests/1840088.html b/dom/html/crashtests/1840088.html
new file mode 100644
index 0000000000..826b465b01
--- /dev/null
+++ b/dom/html/crashtests/1840088.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<table cellpadding="-129">
diff --git a/dom/html/crashtests/257818-1.html b/dom/html/crashtests/257818-1.html
new file mode 100644
index 0000000000..27929fd793
--- /dev/null
+++ b/dom/html/crashtests/257818-1.html
@@ -0,0 +1,82 @@
+<html><head>
+<script type="text/javascript">
+function cE (v) {
+ return document.createElement(v)
+}
+function cTN (v) {
+  return document.createTextNode(v)
+}
+
+function OSXBarIcon(elt) {
+	this.element = elt; 
+	this.labelNode = this.element.firstChild;
+	this.labelNodeParent = this.element;
+	this.labelNodeParent.removeChild(this.labelNode);
+	
+	this.contents = [];
+	var kids = this.element.childNodes;
+	for(var i=0; i<kids.length; i++) this.contents[this.contents.length] = this.element.removeChild(kids[i]); 
+	this.popupSubmenu = new OSXBarSubmenu(this);
+}
+
+function OSXBarSubmenu(icon) {
+	this.parentIcon = icon;
+	this.create();
+	this.addContent();
+}
+OSXBarSubmenu.prototype = {
+	create : function() {
+		var p = this.popupNode = document.createElement("div");
+		var b = document.getElementsByTagName("body").item(0);
+		if(b) b.appendChild(p);
+		this.popupNode.style.display = "none";
+                // Uncomment next line to fix the problem
+//                var v = document.body.offsetWidth;
+	}
+};
+OSXBarSubmenu.prototype.addContent = function() {
+
+	// add popup label:
+	var label = document.createElement("div");
+		label.appendChild(document.createTextNode(this.parentIcon.label));
+	this.popupNode.appendChild(label);
+	
+	// add <li> children to the popup:	
+	var contents = this.parentIcon.contents;
+	for(var i=0; i<contents.length; i++) {
+		this.popupNode.appendChild(contents[i]);
+		
+	}
+};
+
+</script>
+
+<script type="text/javascript">
+function createControlPanel() {
+	var bar = document.getElementById("navigation");
+	var item = cE("li");
+        item.appendChild(cTN("aaa"));
+        var textfield = cE("input");
+        textfield.value = 0;
+        item.appendChild(textfield);
+	bar.insertBefore(item, bar.firstChild);
+}
+
+window.addEventListener("load", createControlPanel);
+</script>
+
+<script type="text/javascript">
+function ssload() {
+  new OSXBarIcon(document.getElementById("navigation").childNodes[0]);
+}
+window.addEventListener("load",ssload);
+
+
+</script>
+</head>
+
+<body>
+<ul id="navigation"></ul>
+</body></html>
+
+
diff --git a/dom/html/crashtests/285166-1.html b/dom/html/crashtests/285166-1.html
new file mode 100644
index 0000000000..8a73d7d74e
--- /dev/null
+++ b/dom/html/crashtests/285166-1.html
@@ -0,0 +1,3 @@
+<script>
+document.createElement("#text");
+</script>
diff --git a/dom/html/crashtests/294235-1.html b/dom/html/crashtests/294235-1.html
new file mode 100644
index 0000000000..00eed38f4e
--- /dev/null
+++ b/dom/html/crashtests/294235-1.html
@@ -0,0 +1,14 @@
+<html>
+   <head>
+      <title>bug 294235</title>
+      <script>
+         function countdown(){
+            count2.innerHTML="foo";
+         }
+         document.links.length;
+      </script>
+   </head>
+   <body>
+      <strong><div id="count2"><script>countdown();</script><noscript>bar</noscript></div></strong>
+   </body>
+</html>
diff --git a/dom/html/crashtests/307616-1.html b/dom/html/crashtests/307616-1.html
new file mode 100644
index 0000000000..8f28ddd6e8
--- /dev/null
+++ b/dom/html/crashtests/307616-1.html
@@ -0,0 +1,8 @@
+<html>
+<head><title>Testcase for assertion</title></head>
+<body>
+
+<input type="image" src="./nosuch.gif" alt="Search">
+
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/html/crashtests/324918-1.xhtml b/dom/html/crashtests/324918-1.xhtml
new file mode 100644
index 0000000000..921714cff3
--- /dev/null
+++ b/dom/html/crashtests/324918-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+
+function init()
+{ 
+  var sel = document.getElementById("sel");
+  var div = document.getElementById("div");
+  var newo = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+
+  sel.appendChild(div);
+  div.appendChild(newo);
+  sel.removeChild(div);
+}
+
+</script>
+</head>
+<body onload="init();">
+
+<div id="div"><option></option></div>
+
+<select id="sel"></select>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/338649-1.xhtml b/dom/html/crashtests/338649-1.xhtml
new file mode 100644
index 0000000000..b0bf3186fc
--- /dev/null
+++ b/dom/html/crashtests/338649-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>ASSERTION: Options collection broken</title>
+</head>
+
+<body>
+
+<div>
+
+<select>
+  <option id="n29">B
+    <optgroup label="middle" id="n20">
+      <option>N</option>
+    </optgroup>
+  </option>
+  <option>M</option>
+</select>
+
+</div>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/html/crashtests/339501-1.xhtml b/dom/html/crashtests/339501-1.xhtml
new file mode 100644
index 0000000000..1a231ee645
--- /dev/null
+++ b/dom/html/crashtests/339501-1.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+
+function boom()
+{
+  document.addEventListener("DOMNodeRemoved", foo, false);
+  remove(document.getElementById("A"));
+  document.removeEventListener("DOMNodeRemoved", foo, false);
+
+  function foo()
+  {
+    document.removeEventListener("DOMNodeRemoved", foo, false);
+    remove(document.getElementById("B"));
+  }
+}
+
+
+window.addEventListener("load", boom, false);
+
+function remove(q1) { q1.parentNode.removeChild(q1); }
+
+</script>
+
+</head>
+
+<body>
+
+<select><option id="A">A</option><option id="B">B</option></select>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/339501-2.xhtml b/dom/html/crashtests/339501-2.xhtml
new file mode 100644
index 0000000000..6a1835fb71
--- /dev/null
+++ b/dom/html/crashtests/339501-2.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+
+function boom()
+{
+  document.addEventListener("DOMNodeRemoved", foo, false);
+  remove(document.getElementById("B"));
+  document.removeEventListener("DOMNodeRemoved", foo, false);
+
+  function foo()
+  {
+    document.removeEventListener("DOMNodeRemoved", foo, false);
+    remove(document.getElementById("A"));
+  }
+}
+
+
+window.addEventListener("load", boom, false);
+
+function remove(q1) { q1.parentNode.removeChild(q1); }
+
+</script>
+
+</head>
+
+<body>
+
+<select><option id="A">A</option><option id="B">B</option></select>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/378993-1.xhtml b/dom/html/crashtests/378993-1.xhtml
new file mode 100644
index 0000000000..99cbb01dae
--- /dev/null
+++ b/dom/html/crashtests/378993-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<script>
+document.createElement('AREA');
+</script>
+</body>
+</html>
diff --git a/dom/html/crashtests/382568-1-inner.xhtml b/dom/html/crashtests/382568-1-inner.xhtml
new file mode 100644
index 0000000000..67d7427582
--- /dev/null
+++ b/dom/html/crashtests/382568-1-inner.xhtml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<!DOCTYPE html
+PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html  xmlns="http://www.w3.org/1999/xhtml"> <head>
+<title>Test</title>
+<script type="text/javascript"><![CDATA[
+
+function onAttrModified(evt) {
+//  window.alert("Mutation event fired within the frame code.");
+//  evt.target.focus();
+//  evt.target.blur();
+  evt.target.style.background = 'green';
+  bounce(evt.target);
+//  evt.target.normalize();
+//  bounce(evt.target.parentNode);
+}
+function die(n) {
+  p = n.parentNode;
+  p.removeChild(n);
+}
+
+function bounce(n) {
+  p = n.parentNode;
+  p.removeChild(n);
+  p.appendChild(n);
+}
+
+
+function test_AttrModified() {
+  var x = document.getElementById("x");
+  x.addEventListener("DOMAttrModified", onAttrModified);
+  bounce(x);
+}
+
+function test() {
+  setTimeout(test_AttrModified, 3000);
+}
+]]></script>
+</head>
+
+<body onload="test()">
+<h1>TestCase for unsafe mutable events from textarea</h1>
+<p>Please wait for 3 seconds after document was loaded,
+if your browser is vulnerable, it may stop responding
+to keyboard and mouse event
+and most likely it will eventually crash (may take a
+while for debug builds).</p>
+<p>
+<textarea id="x"></textarea>
+</p>
+</body> </html>
diff --git a/dom/html/crashtests/382568-1.html b/dom/html/crashtests/382568-1.html
new file mode 100644
index 0000000000..c10c71fd14
--- /dev/null
+++ b/dom/html/crashtests/382568-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 3500);
+</script>
+<body>
+<iframe src="382568-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/dom/html/crashtests/383137.xhtml b/dom/html/crashtests/383137.xhtml
new file mode 100644
index 0000000000..87d853c035
--- /dev/null
+++ b/dom/html/crashtests/383137.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">//<![CDATA[
+function doe(){
+document.documentElement.setAttribute('style', '');
+}
+
+setTimeout(doe,100);
+//]]></script>
+
+<style style="overflow: scroll; display: block;">
+style::before {content: counter(section); }
+</style>
+</html>
\ No newline at end of file
diff --git a/dom/html/crashtests/388183-1.html b/dom/html/crashtests/388183-1.html
new file mode 100644
index 0000000000..fcca410e93
--- /dev/null
+++ b/dom/html/crashtests/388183-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html contenteditable="true">
+<head>
+</head>
+<body>
+<div contenteditable="true"></div>
+</body>
+</html>
diff --git a/dom/html/crashtests/395340-1.html b/dom/html/crashtests/395340-1.html
new file mode 100644
index 0000000000..ddbccfe968
--- /dev/null
+++ b/dom/html/crashtests/395340-1.html
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var div1 = document.createElement("div");
+  div1.style.counterIncrement = "chicken";
+  div1.contentEditable = "true";
+
+  var div2 = document.createElement("div");
+  div2.style.counterIncrement = "chicken";
+
+  document.body.style.content = "'A'";
+
+  div1.appendChild(div2);
+  document.body.appendChild(div1);
+  div1.removeChild(div2);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+</body>
+</html>
diff --git a/dom/html/crashtests/399694-1.html b/dom/html/crashtests/399694-1.html
new file mode 100644
index 0000000000..e6db2342b5
--- /dev/null
+++ b/dom/html/crashtests/399694-1.html
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+  var legend = document.createElementNS("http://www.w3.org/1999/xhtml", "legend")
+  var input = document.getElementById("input");
+  input.appendChild(legend);
+  legend.focus();
+
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(boom, 3);" contenteditable="true">
+
+<input contenteditable="false"><input id="input"><q><div></div></q>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/407053.html b/dom/html/crashtests/407053.html
new file mode 100644
index 0000000000..b80a231722
--- /dev/null
+++ b/dom/html/crashtests/407053.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.execCommand('copy', false, '');">
+<div contenteditable="true"></div>
+</body>
+</html>
diff --git a/dom/html/crashtests/423371-1.html b/dom/html/crashtests/423371-1.html
new file mode 100644
index 0000000000..0069cf95db
--- /dev/null
+++ b/dom/html/crashtests/423371-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<div style="position:fixed; top:100px;" id="d">hello</div>
+<script>
+document.write(document.getElementById("d").offsetTop);
+</script>
+</body>
+</html>
diff --git a/dom/html/crashtests/448564.html b/dom/html/crashtests/448564.html
new file mode 100644
index 0000000000..f31830afa1
--- /dev/null
+++ b/dom/html/crashtests/448564.html
@@ -0,0 +1,7 @@
+<s>
+<form>a</form>
+<iframe></iframe>
+<script src=a></script>
+<form></form>
+<table>
+<optgroup>
diff --git a/dom/html/crashtests/451123-1.html b/dom/html/crashtests/451123-1.html
new file mode 100644
index 0000000000..abf23c1e73
--- /dev/null
+++ b/dom/html/crashtests/451123-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<input type="file" type="file">
+</body>
+</html>
diff --git a/dom/html/crashtests/453406-1.html b/dom/html/crashtests/453406-1.html
new file mode 100644
index 0000000000..bf75686553
--- /dev/null
+++ b/dom/html/crashtests/453406-1.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+<script type="text/javascript">
+function boom()
+{
+  var r = document.documentElement;
+  while (r.firstChild)
+    r.firstChild.remove();
+
+  var b    = document.createElement("BODY");
+  var s    = document.createElement("SCRIPT");
+  var f1   = document.createElement("FORM");
+  var i    = document.createElement("INPUT");
+  var br   = document.createElement("BR");
+  var f2   = document.createElement("FORM");
+  var span = document.createElement("SPAN");
+  f1.appendChild(i);
+  f1.appendChild(br);
+  s.appendChild(f1);
+  b.appendChild(s);
+  f2.appendChild(span);
+  b.appendChild(f2)
+  document.documentElement.appendChild(b);
+  b.contentEditable = "true";
+  document.execCommand("indent", false, null);
+  b.contentEditable = "false";
+  span.appendChild(i);
+  i.remove();
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/html/crashtests/464197-1.html b/dom/html/crashtests/464197-1.html
new file mode 100644
index 0000000000..785686023e
--- /dev/null
+++ b/dom/html/crashtests/464197-1.html
@@ -0,0 +1,23 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+var i = 0;
+
+function boom()
+{
+  var s = document.createElement("span");
+  s.innerHTML = "<audio src='javascript:5'><\/audio>";
+  s.innerHTML = "";
+
+  if (++i < 10)
+    setTimeout(boom, 0);
+  else
+    document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/html/crashtests/468562-1.html b/dom/html/crashtests/468562-1.html
new file mode 100644
index 0000000000..81123fe2ea
--- /dev/null
+++ b/dom/html/crashtests/468562-1.html
@@ -0,0 +1,6 @@
+<html>
+<head></head>
+<body>
+<table><script>document.write("Q");</script><link>
+</body>
+</html>
diff --git a/dom/html/crashtests/468562-2.html b/dom/html/crashtests/468562-2.html
new file mode 100644
index 0000000000..e0db5cd974
--- /dev/null
+++ b/dom/html/crashtests/468562-2.html
@@ -0,0 +1,6 @@
+<html>
+<head></head>
+<body>
+<table><script>document.write("Q");</script><link></table>
+</body>
+</html>
diff --git a/dom/html/crashtests/494225.html b/dom/html/crashtests/494225.html
new file mode 100644
index 0000000000..a78051d2a1
--- /dev/null
+++ b/dom/html/crashtests/494225.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<html><head><script>
+  var x = "f: '" + document.fgColor +
+        "' b: '" + document.bgColor +
+        "' l: '" + document.linkColor +
+        "' a: '" + document.alinkColor +
+        "' v: '" + document.vlinkColor + "'";
+</script></head><body
+onload="document.body.appendChild(document.createTextNode(x))"
+></body></html>
diff --git a/dom/html/crashtests/495543.svg b/dom/html/crashtests/495543.svg
new file mode 100644
index 0000000000..b795796ad4
--- /dev/null
+++ b/dom/html/crashtests/495543.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script type="text/javascript">
+
+function boom()
+{
+  var htmlBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  document.documentElement.appendChild(htmlBody);
+  htmlBody.setAttribute('vlink', "transparent");
+  document.height;
+  document.vlinkColor;
+}
+
+window.addEventListener("load", boom, false);
+</script>
+
+</svg>
diff --git a/dom/html/crashtests/495546-1.html b/dom/html/crashtests/495546-1.html
new file mode 100644
index 0000000000..0547b98674
--- /dev/null
+++ b/dom/html/crashtests/495546-1.html
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var video = document.createElement("video");
+  var source = document.createElement("source");
+  source.setAttributeNS(null, "src", "http://127.0.0.1/");
+  video.appendChild(source);
+  document.body.appendChild(video);
+  setTimeout(function() { document.body.removeChild(video); }, 20);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/504183-1.html b/dom/html/crashtests/504183-1.html
new file mode 100644
index 0000000000..e44db41520
--- /dev/null
+++ b/dom/html/crashtests/504183-1.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait">
+<input id="a" type="file">
+<script>
+function doe() {
+var elem = document.getElementById('a');
+elem.style.display = "none";
+elem.focus();
+document.documentElement.className = "";
+}
+setTimeout(doe, 0);
+</script>
+</html>
diff --git a/dom/html/crashtests/515829-1.html b/dom/html/crashtests/515829-1.html
new file mode 100644
index 0000000000..e2fc655c01
--- /dev/null
+++ b/dom/html/crashtests/515829-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body onload="document.getElementById('x').innerHTML = '<button></button>';">
+<form><div id="x"><button></button></div><button></button></form>
+</body>
+</html>
diff --git a/dom/html/crashtests/515829-2.html b/dom/html/crashtests/515829-2.html
new file mode 100644
index 0000000000..6de6d5986c
--- /dev/null
+++ b/dom/html/crashtests/515829-2.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body onload="document.getElementById('x').innerHTML = '<button></button>';">
+<form><div id="x"><button></button></div><button></button><input type="image"></form>
+</body>
+</html>
diff --git a/dom/html/crashtests/570566-1.html b/dom/html/crashtests/570566-1.html
new file mode 100644
index 0000000000..70ec003a68
--- /dev/null
+++ b/dom/html/crashtests/570566-1.html
@@ -0,0 +1,2 @@
+<body onload="document.getElementById('i').removeAttribute('type')"><input id=i type=image></body>
+
diff --git a/dom/html/crashtests/571428-1.html b/dom/html/crashtests/571428-1.html
new file mode 100644
index 0000000000..ae2b960cac
--- /dev/null
+++ b/dom/html/crashtests/571428-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+  var i = document.getElementById("i");
+  i.setAttribute("type", "button");
+  i.removeAttribute("type");
+}
+</script>
+</head>
+<body onload="boom();"><input id="i"></body>
+</html>
diff --git a/dom/html/crashtests/580507-1.xhtml b/dom/html/crashtests/580507-1.xhtml
new file mode 100644
index 0000000000..eff3fb255d
--- /dev/null
+++ b/dom/html/crashtests/580507-1.xhtml
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var input = document.getElementById("i");
+  input.setAttribute('type', "image");
+  input.removeAttribute('type');
+  input.placeholder = "Y";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><input id="i" /></body>
+</html>
diff --git a/dom/html/crashtests/590387.html b/dom/html/crashtests/590387.html
new file mode 100644
index 0000000000..50cd05ac9e
--- /dev/null
+++ b/dom/html/crashtests/590387.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+document.createElement("div").innerHTML = "<output form=x>";
+</script>
+</head>
+</html>
diff --git a/dom/html/crashtests/596785-1.html b/dom/html/crashtests/596785-1.html
new file mode 100644
index 0000000000..5d830628b0
--- /dev/null
+++ b/dom/html/crashtests/596785-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <body onload="document.getElementById('i').type = 'image';
+                document.documentElement.className = '';">
+    <form>
+      <input id='i' required>
+    </form>
+  </body>
+</html>
diff --git a/dom/html/crashtests/596785-2.html b/dom/html/crashtests/596785-2.html
new file mode 100644
index 0000000000..18cfe2788d
--- /dev/null
+++ b/dom/html/crashtests/596785-2.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <body onload="document.getElementById('i').type = 'text';
+                document.documentElement.className = '';">
+    <form>
+      <input id='i' type='image' required>
+    </form>
+  </body>
+</html>
diff --git a/dom/html/crashtests/602117.html b/dom/html/crashtests/602117.html
new file mode 100644
index 0000000000..0d1818b2a9
--- /dev/null
+++ b/dom/html/crashtests/602117.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+  <script>
+    var isindex = document.createElement("isindex");
+    isindex.setAttribute("form", "f");
+    isindex.form;
+  </script>
+</html>
diff --git a/dom/html/crashtests/604807.html b/dom/html/crashtests/604807.html
new file mode 100644
index 0000000000..bec4012e5c
--- /dev/null
+++ b/dom/html/crashtests/604807.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<script>
+try {
+  var selectElem = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
+  selectElem.QueryInterface(Ci.nsISelectElement);
+  selectElem.getOptionIndex(null, 0, true);
+} catch (e) {
+}
+</script>
diff --git a/dom/html/crashtests/605264.html b/dom/html/crashtests/605264.html
new file mode 100644
index 0000000000..782720a9d6
--- /dev/null
+++ b/dom/html/crashtests/605264.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var v = document.createElementNS("http://www.w3.org/1999/xhtml", "video");
+v.QueryInterface(Ci.nsIObserver);
+v.observe(null, null, null);
+
+</script>
diff --git a/dom/html/crashtests/606430-1.html b/dom/html/crashtests/606430-1.html
new file mode 100644
index 0000000000..c347e3c9f1
--- /dev/null
+++ b/dom/html/crashtests/606430-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var r = document.documentElement;
+  var i = document.getElementById("i");
+
+  document.removeChild(r);
+  document.appendChild(r);
+  w("dump('A\\n')");
+  document.removeChild(r);
+  w("dump('B\\n')");
+  document.appendChild(r);
+
+  function w(s)
+  {
+    var ns = document.createElement("script");
+    var nt = document.createTextNode(s);
+    ns.appendChild(nt);
+    i.appendChild(ns);
+  }
+}
+
+</script>
+</head>
+
+<body onload="boom();"><input id="i"></body>
+</html>
diff --git a/dom/html/crashtests/613027.html b/dom/html/crashtests/613027.html
new file mode 100644
index 0000000000..a866860f10
--- /dev/null
+++ b/dom/html/crashtests/613027.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var a = document.createElementNS("http://www.w3.org/1999/xhtml", "fieldset");
+  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");
+  var c = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+
+  a.appendChild(b);
+  a.appendChild(c);
+  a.removeChild(b);
+  c.expandoQ = a;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/614279.html b/dom/html/crashtests/614279.html
new file mode 100644
index 0000000000..ff1c505167
--- /dev/null
+++ b/dom/html/crashtests/614279.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var a = document.createElementNS("http://www.w3.org/1999/xhtml", "datalist");
+  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+
+  a.appendChild(b);
+  b.expando = a.options;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/614988-1.html b/dom/html/crashtests/614988-1.html
new file mode 100644
index 0000000000..931f83ac73
--- /dev/null
+++ b/dom/html/crashtests/614988-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head><script>window.addEventListener("load", function() { var t = document.getElementById("t"); t.appendChild(t.previousSibling); }, false);</script></head>
+<body><fieldset><legend></legend><textarea id="t"></textarea></fieldset></body>
+</html>
diff --git a/dom/html/crashtests/616401.html b/dom/html/crashtests/616401.html
new file mode 100644
index 0000000000..eb5a0bcf4c
--- /dev/null
+++ b/dom/html/crashtests/616401.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<script>
+var c = document.createElement("canvas");
+c.getContext("experimental-webgl", {
+  get a() { throw 7; },
+  get b() { throw 8; }
+});
+</script>
diff --git a/dom/html/crashtests/620078-1.html b/dom/html/crashtests/620078-1.html
new file mode 100644
index 0000000000..39462706c1
--- /dev/null
+++ b/dom/html/crashtests/620078-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var frame = document.getElementById("f");
+  var frameRoot = frame.contentDocument.documentElement;
+  document.body.removeChild(frame);
+  var i = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+  i.setAttribute("autofocus", "true"); 
+  frameRoot.appendChild(i);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body>
+</html>
diff --git a/dom/html/crashtests/620078-2.html b/dom/html/crashtests/620078-2.html
new file mode 100644
index 0000000000..1be23fa1f2
--- /dev/null
+++ b/dom/html/crashtests/620078-2.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+  <body onload='document.cloneNode(1)'>
+    <button autofocus></button>
+  </body>
+</html>
diff --git a/dom/html/crashtests/631421.html b/dom/html/crashtests/631421.html
new file mode 100644
index 0000000000..e4a7b9192b
--- /dev/null
+++ b/dom/html/crashtests/631421.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+"use strict";
+
+var f2;
+
+function newIframe()
+{
+  var f = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+  f.setAttributeNS(null, "src", "631421.png");
+  document.body.appendChild(f);
+  return f;
+}
+
+function b1()
+{
+  void newIframe();
+  f2 = newIframe();
+  setTimeout(b2, 0);
+}
+
+function b2()
+{
+  document.body.removeChild(f2);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="b1();"></body>
+</html>
diff --git a/dom/html/crashtests/631421.png b/dom/html/crashtests/631421.png
new file mode 100644
index 0000000000..ef350c4678
Binary files /dev/null and b/dom/html/crashtests/631421.png differ
diff --git a/dom/html/crashtests/673853.html b/dom/html/crashtests/673853.html
new file mode 100644
index 0000000000..1325fa9ed6
--- /dev/null
+++ b/dom/html/crashtests/673853.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var otherDoc = document.implementation.createDocument('', '', null);
+  var input = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "input");
+  var form = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "form");
+  input.setAttributeNS(null, "form", "x");
+  form.setAttributeNS(null, "id", "x");
+  input.appendChild(form);
+  otherDoc.appendChild(input);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/682058.xhtml b/dom/html/crashtests/682058.xhtml
new file mode 100644
index 0000000000..95e7da98fc
--- /dev/null
+++ b/dom/html/crashtests/682058.xhtml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <body onload="test()">
+    <script>
+      function test() {
+        document.body.innerHTML = "Foobar";
+      }
+      document.addEventListener("DOMNodeRemoved", function() {});
+    </script>
+  </body>
+</html>
diff --git a/dom/html/crashtests/682460.html b/dom/html/crashtests/682460.html
new file mode 100644
index 0000000000..91306be71d
--- /dev/null
+++ b/dom/html/crashtests/682460.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var f = function() {
+    document.documentElement.offsetHeight;
+  };
+  window.addEventListener("DOMSubtreeModified", f, true);
+
+  document.getElementsByTagName("table")[0].setAttribute("cellpadding", "2");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<table><tr><td></td></tr></table>
+</body>
+</html>
diff --git a/dom/html/crashtests/68912-1.html b/dom/html/crashtests/68912-1.html
new file mode 100644
index 0000000000..bdd2ab4614
--- /dev/null
+++ b/dom/html/crashtests/68912-1.html
@@ -0,0 +1,24 @@
+<html>
+<head>
+<title>Crash TR.cells = null</title>
+<script language="javascript">
+function crashme()
+{
+	var elm = document.createElement('tr');
+
+	elm.cells = null;
+}
+
+</script>
+</head>
+<body onload="crashme()">
+
+<p>
+This test case creates a TR element then tries to assign to the cells property
+</p>
+<p>
+Crash
+</p>
+
+</body>
+</html>
diff --git a/dom/html/crashtests/738744.xhtml b/dom/html/crashtests/738744.xhtml
new file mode 100644
index 0000000000..7f91d0149b
--- /dev/null
+++ b/dom/html/crashtests/738744.xhtml
@@ -0,0 +1,4 @@
+<input xmlns="http://www.w3.org/1999/xhtml" form="f">
+  <form id="f" />
+  <input form="f" />
+</input>
diff --git a/dom/html/crashtests/741218.json b/dom/html/crashtests/741218.json
new file mode 100644
index 0000000000..0967ef424b
--- /dev/null
+++ b/dom/html/crashtests/741218.json
@@ -0,0 +1 @@
+{}
diff --git a/dom/html/crashtests/741218.json^headers^ b/dom/html/crashtests/741218.json^headers^
new file mode 100644
index 0000000000..7b5e82d4b7
--- /dev/null
+++ b/dom/html/crashtests/741218.json^headers^
@@ -0,0 +1 @@
+Content-Type: application/json
diff --git a/dom/html/crashtests/741250.xhtml b/dom/html/crashtests/741250.xhtml
new file mode 100644
index 0000000000..e18a9409fe
--- /dev/null
+++ b/dom/html/crashtests/741250.xhtml
@@ -0,0 +1,9 @@
+<input form="f" id="x" xmlns="http://www.w3.org/1999/xhtml">
+<form id="f"></form>
+<script>
+window.addEventListener("load", function() {
+  var x = document.getElementById("x");
+  x.appendChild(x.cloneNode(true));
+}, false);
+</script>
+</input>
diff --git a/dom/html/crashtests/768344.html b/dom/html/crashtests/768344.html
new file mode 100644
index 0000000000..4830e6674d
--- /dev/null
+++ b/dom/html/crashtests/768344.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    function f() {
+        document.removeEventListener("DOMSubtreeModified", f, true);
+        document.documentElement.setAttributeNS(null, "contenteditable", "false");
+    }
+
+    document.addEventListener("DOMSubtreeModified", f, true);
+
+    document.documentElement.contentEditable = "true";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/html/crashtests/795221-1.html b/dom/html/crashtests/795221-1.html
new file mode 100644
index 0000000000..70e400bed9
--- /dev/null
+++ b/dom/html/crashtests/795221-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<style>
+  div { }
+</style>
+<script>
+  document.styleSheets[0].cssRules[0].style.foo = document;
+</script>
diff --git a/dom/html/crashtests/795221-2.html b/dom/html/crashtests/795221-2.html
new file mode 100644
index 0000000000..fc2aa7d506
--- /dev/null
+++ b/dom/html/crashtests/795221-2.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<style>
+  @media all {
+    div { }
+  }
+</style>
+<script>
+  document.styleSheets[0].cssRules[0].cssRules[0].style.foo = document;
+</script>
diff --git a/dom/html/crashtests/795221-3.html b/dom/html/crashtests/795221-3.html
new file mode 100644
index 0000000000..93348af0bd
--- /dev/null
+++ b/dom/html/crashtests/795221-3.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+<script>
+  // Create the stylesheet via script, so that the parser's preloading doesn't
+  // make the CSS loader hold on to the sheet we're _not_ trying to form a
+  // cycle through, thus accidentally avoiding the cycle
+  var link = document.createElement("link");
+  link.setAttribute("rel", "stylesheet");
+  link.setAttribute("href", "data:text/css,div { }");
+  link.onload = function () {
+    document.styleSheets[0].cssRules[0].style.foo = document;
+  }
+  document.body.appendChild(link);
+</script>
diff --git a/dom/html/crashtests/795221-4.html b/dom/html/crashtests/795221-4.html
new file mode 100644
index 0000000000..476dd34672
--- /dev/null
+++ b/dom/html/crashtests/795221-4.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<svg>
+  <style>
+    div { }
+  </style>
+</svg>
+<script>
+  document.styleSheets[0].cssRules[0].style.foo = document;
+</script>
diff --git a/dom/html/crashtests/795221-5.xml b/dom/html/crashtests/795221-5.xml
new file mode 100644
index 0000000000..286dcff0d4
--- /dev/null
+++ b/dom/html/crashtests/795221-5.xml
@@ -0,0 +1,6 @@
+<?xml-stylesheet href="data:text/css,div {}"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <script>
+    document.styleSheets[0].cssRules[0].style.foo = document;
+  </script>
+</html>
diff --git a/dom/html/crashtests/798802-1.html b/dom/html/crashtests/798802-1.html
new file mode 100644
index 0000000000..92ab50fd87
--- /dev/null
+++ b/dom/html/crashtests/798802-1.html
@@ -0,0 +1,18 @@
+<html>
+  <head>
+    <script>
+      onload = function() {
+        var canvas2d = document.createElement('canvas')
+        canvas2d.setAttribute('width', 0)
+        document.body.appendChild(canvas2d)
+        var ctx2d = canvas2d.getContext('2d')
+        ctx2d.fillStyle = 'black'
+        var gl = document.createElement('canvas').getContext('experimental-webgl')
+        gl.texImage2D(gl.TEXTURE_2D, 0, gl.RGBA, gl.RGBA, gl.UNSIGNED_BYTE, canvas2d)
+        ctx2d.fillRect(0, 0, 1, 1)
+      }
+    </script>
+  </head>
+  <body>
+  </body>
+</html>
diff --git a/dom/html/crashtests/811226.html b/dom/html/crashtests/811226.html
new file mode 100644
index 0000000000..990ef9af53
--- /dev/null
+++ b/dom/html/crashtests/811226.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('s').onerror;">
+<span id="s" onerror="0;"></span>
+</body>
+</html>
diff --git a/dom/html/crashtests/819745.html b/dom/html/crashtests/819745.html
new file mode 100644
index 0000000000..389e6b8c13
--- /dev/null
+++ b/dom/html/crashtests/819745.html
@@ -0,0 +1,5 @@
+<!doctype="html">
+<body>
+<script>
+  document.body.onerror = null;
+</script>
diff --git a/dom/html/crashtests/828180.html b/dom/html/crashtests/828180.html
new file mode 100644
index 0000000000..055c8a34ba
--- /dev/null
+++ b/dom/html/crashtests/828180.html
@@ -0,0 +1,5 @@
+<script>
+var table = document.createElement("table");
+table.tHead = null;
+table.tFoot = null;
+</script>
diff --git a/dom/html/crashtests/828472.html b/dom/html/crashtests/828472.html
new file mode 100644
index 0000000000..59ce4d280b
--- /dev/null
+++ b/dom/html/crashtests/828472.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<input type='date' value='2013-01-01'>
+</body>
+</html>
diff --git a/dom/html/crashtests/837033.html b/dom/html/crashtests/837033.html
new file mode 100644
index 0000000000..772d24014c
--- /dev/null
+++ b/dom/html/crashtests/837033.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.createElement('button').validity.x = null;"></body>
+</html>
diff --git a/dom/html/crashtests/838256-1.html b/dom/html/crashtests/838256-1.html
new file mode 100644
index 0000000000..e1cdc588e8
--- /dev/null
+++ b/dom/html/crashtests/838256-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<style>
+
+::-moz-range-track {
+  display: none ! important;
+}
+
+::-moz-range-thumb {
+  display: none ! important;
+}
+
+</style>
+</head>
+<body>
+<input type="range">
+</body>
+</html>
diff --git a/dom/html/crashtests/862084.html b/dom/html/crashtests/862084.html
new file mode 100644
index 0000000000..d6d04f74de
--- /dev/null
+++ b/dom/html/crashtests/862084.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<select></select>
+<script>
+var select = document.getElementsByTagName("select");
+select.item(0);
+select[0];
+select.namedItem("x")
+select["x"]
+</script>
diff --git a/dom/html/crashtests/865147.html b/dom/html/crashtests/865147.html
new file mode 100644
index 0000000000..841cf8b6d8
--- /dev/null
+++ b/dom/html/crashtests/865147.html
@@ -0,0 +1,7 @@
+<!doctype html>
+<select></select>
+<script>
+var select = document.getElementsByTagName("select")[0];
+var newOpt = document.createElement("option");
+select.add(newOpt, newOpt);
+</script>
diff --git a/dom/html/crashtests/877910.html b/dom/html/crashtests/877910.html
new file mode 100644
index 0000000000..d454c4478b
--- /dev/null
+++ b/dom/html/crashtests/877910.html
@@ -0,0 +1 @@
+<select><option id="foo"><script>document.querySelector("select").namedItem("foo")</script>
diff --git a/dom/html/crashtests/903106.html b/dom/html/crashtests/903106.html
new file mode 100644
index 0000000000..fceaf4761a
--- /dev/null
+++ b/dom/html/crashtests/903106.html
@@ -0,0 +1,3 @@
+<script>
+  document.createElement("tr").sectionRowIndex;
+</script>
diff --git a/dom/html/crashtests/916322-1.html b/dom/html/crashtests/916322-1.html
new file mode 100644
index 0000000000..56b43d6394
--- /dev/null
+++ b/dom/html/crashtests/916322-1.html
@@ -0,0 +1,10 @@
+<canvas height=16 id=gl>
+<script>
+// Without the fix, this would trigger an assertion in the debug build
+document.addEventListener("DOMContentLoaded", DifferentSizes);
+function DifferentSizes() {
+  gl.getContext("2d");
+  gl.removeAttribute('height');
+  gl.toBlob(function() { }, false)
+}
+</script>
diff --git a/dom/html/crashtests/916322-2.html b/dom/html/crashtests/916322-2.html
new file mode 100644
index 0000000000..c2e5c29205
--- /dev/null
+++ b/dom/html/crashtests/916322-2.html
@@ -0,0 +1,10 @@
+<canvas height=200 id=gl>
+<script>
+// Without the fix, this would trigger an assertion in the debug build
+document.addEventListener("DOMContentLoaded", DifferentSizes);
+function DifferentSizes() {
+  gl.getContext("2d");
+  gl.removeAttribute('height');
+  gl.toBlob(function() { }, false)
+}
+</script>
diff --git a/dom/html/crashtests/978644.xhtml b/dom/html/crashtests/978644.xhtml
new file mode 100644
index 0000000000..0fd9043a28
--- /dev/null
+++ b/dom/html/crashtests/978644.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<body onload="document.getElementById('b').appendChild(document.getElementById('v'));">
+
+<fieldset><fieldset id="b"></fieldset></fieldset>
+
+<div id="v"><fieldset><input required="" /><input required="" /></fieldset></div>
+
+</body>
+
+</html>
diff --git a/dom/html/crashtests/crashtests.list b/dom/html/crashtests/crashtests.list
new file mode 100644
index 0000000000..be51d248f0
--- /dev/null
+++ b/dom/html/crashtests/crashtests.list
@@ -0,0 +1,99 @@
+load 68912-1.html
+load 257818-1.html
+load 285166-1.html
+load 294235-1.html
+load 307616-1.html
+load 324918-1.xhtml
+load 338649-1.xhtml
+load 339501-1.xhtml
+load 339501-2.xhtml
+load 378993-1.xhtml
+load 382568-1.html
+load 383137.xhtml
+load 388183-1.html
+load 395340-1.html
+load 399694-1.html
+load 407053.html
+load 423371-1.html
+load 448564.html
+load 451123-1.html
+load 453406-1.html
+load 464197-1.html
+load 468562-1.html
+load 468562-2.html
+load 494225.html
+load 495543.svg
+load 495546-1.html
+load 504183-1.html
+load 515829-1.html
+load 515829-2.html
+load 570566-1.html
+load 571428-1.html
+load 580507-1.xhtml
+load 590387.html
+load 596785-1.html
+load 596785-2.html
+load 602117.html
+load 604807.html
+load 605264.html
+load 606430-1.html
+load 613027.html
+load 614279.html
+load 614988-1.html
+load 620078-1.html
+load 620078-2.html
+load 631421.html
+load 673853.html
+load 682058.xhtml
+load 682460.html
+load 738744.xhtml
+load 741218.json
+load 741250.xhtml
+load 768344.html
+load 795221-1.html
+load 795221-2.html
+load 795221-3.html
+load 795221-4.html
+load 795221-5.xml
+load 811226.html
+load 819745.html
+load 828180.html
+load 828472.html
+load 837033.html
+load 838256-1.html
+load 862084.html
+load 865147.html
+load 877910.html
+load 903106.html
+load 916322-1.html
+load 916322-2.html
+load 978644.xhtml
+load 1032654.html
+load 1141260.html
+load 1228876.html
+load 1230110.html
+load 1237633.html
+load 1281972-1.html
+load 1282894.html
+load 1290904.html
+load 1343886-1.html
+load 1343886-2.xml
+load 1343886-3.xml
+load 1350972.html
+load 1386905.html
+asserts(0-4) load 1401726.html
+load 1412173.html
+load 1440523.html
+load 1547057.html
+load 1550524.html
+load 1550881-1.html
+load 1550881-2.html
+skip-if(Android) pref(dom.disable_open_during_load,false) load 1667493.html
+load 1680418.html
+load 1704660.html
+load 1724816.html
+load 1785933.html
+skip-if(Android) load 1787671.html # printPreview doesn't work on android
+load 1789475.html
+load 1801380.html
+load 1840088.html
-- 
cgit v1.2.3