From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 02:47:55 +0200
Subject: Adding upstream version 124.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 layout/forms/crashtests/1102791.html       |  33 +++++++++
 layout/forms/crashtests/1140216.html       |  20 +++++
 layout/forms/crashtests/1182414.html       |  17 +++++
 layout/forms/crashtests/1212688.html       |  27 +++++++
 layout/forms/crashtests/1228670.xhtml      |   7 ++
 layout/forms/crashtests/1279354.html       |  21 ++++++
 layout/forms/crashtests/1388230-1.html     |   3 +
 layout/forms/crashtests/1388230-2.html     |   1 +
 layout/forms/crashtests/1405830.html       |  19 +++++
 layout/forms/crashtests/1418477.html       |   4 +
 layout/forms/crashtests/1432853.html       |   8 ++
 layout/forms/crashtests/1460787-1.html     |   7 ++
 layout/forms/crashtests/1464165-1.html     |  14 ++++
 layout/forms/crashtests/1471157.html       |  11 +++
 layout/forms/crashtests/1488219.html       |  26 +++++++
 layout/forms/crashtests/1600207.html       |   9 +++
 layout/forms/crashtests/1600367.html       |   8 ++
 layout/forms/crashtests/1617753.html       |  21 ++++++
 layout/forms/crashtests/166750-1.html      |  14 ++++
 layout/forms/crashtests/1679471.html       |   8 ++
 layout/forms/crashtests/1690166-1.html     |  19 +++++
 layout/forms/crashtests/1690166-2.html     |  19 +++++
 layout/forms/crashtests/1873802-1.html     | 114 +++++++++++++++++++++++++++++
 layout/forms/crashtests/200347-1.html      |   8 ++
 layout/forms/crashtests/203041-1.html      |  24 ++++++
 layout/forms/crashtests/213390-1.html      |  23 ++++++
 layout/forms/crashtests/258101-1.html      |  18 +++++
 layout/forms/crashtests/266225-1.html      |   7 ++
 layout/forms/crashtests/310426-1.xhtml     |   9 +++
 layout/forms/crashtests/310520-1.xhtml     |  19 +++++
 layout/forms/crashtests/315752-1.xhtml     |  21 ++++++
 layout/forms/crashtests/317502-1.xhtml     |  13 ++++
 layout/forms/crashtests/321894.html        |  17 +++++
 layout/forms/crashtests/343510-1.html      |   4 +
 layout/forms/crashtests/363696-1.xhtml     |  10 +++
 layout/forms/crashtests/363696-2.html      |   2 +
 layout/forms/crashtests/363696-3.html      |   5 ++
 layout/forms/crashtests/366205-1.html      |  11 +++
 layout/forms/crashtests/366537-1.xhtml     |  32 ++++++++
 layout/forms/crashtests/367587-1.html      |  37 ++++++++++
 layout/forms/crashtests/370703-1.html      |  30 ++++++++
 layout/forms/crashtests/370940-1.html      |  28 +++++++
 layout/forms/crashtests/370967.html        |  13 ++++
 layout/forms/crashtests/378369.html        |  19 +++++
 layout/forms/crashtests/380116-1.xhtml     |  11 +++
 layout/forms/crashtests/382610-1.html      |  11 +++
 layout/forms/crashtests/383887-1.html      |  20 +++++
 layout/forms/crashtests/386554-1.html      |  14 ++++
 layout/forms/crashtests/388374-1.xhtml     |  22 ++++++
 layout/forms/crashtests/388374-2.html      |  25 +++++++
 layout/forms/crashtests/393656-1.xhtml     |  13 ++++
 layout/forms/crashtests/393656-2.xhtml     |  22 ++++++
 layout/forms/crashtests/399262.html        |  50 +++++++++++++
 layout/forms/crashtests/402852-1.html      |   2 +
 layout/forms/crashtests/403148-1.html      |  22 ++++++
 layout/forms/crashtests/404118-1.html      |   5 ++
 layout/forms/crashtests/404123-1.html      |  12 +++
 layout/forms/crashtests/407066.html        |   1 +
 layout/forms/crashtests/451316.html        |   7 ++
 layout/forms/crashtests/455451-1.html      |  17 +++++
 layout/forms/crashtests/457537-1.html      |  17 +++++
 layout/forms/crashtests/457537-2.html      |  17 +++++
 layout/forms/crashtests/498698-1.html      |   6 ++
 layout/forms/crashtests/513113-1.html      |   6 ++
 layout/forms/crashtests/538062-1.xhtml     |  20 +++++
 layout/forms/crashtests/570624-1.html      |  15 ++++
 layout/forms/crashtests/578604-1.html      |  17 +++++
 layout/forms/crashtests/590302-1.xhtml     |   4 +
 layout/forms/crashtests/626014.xhtml       |  20 +++++
 layout/forms/crashtests/639733.xhtml       |  26 +++++++
 layout/forms/crashtests/669767.html        |  14 ++++
 layout/forms/crashtests/682684-binding.xml |   4 +
 layout/forms/crashtests/682684.xhtml       |   3 +
 layout/forms/crashtests/865602.html        |   9 +++
 layout/forms/crashtests/893331.html        |   9 +++
 layout/forms/crashtests/893332-1.html      |  10 +++
 layout/forms/crashtests/944198.html        |   9 +++
 layout/forms/crashtests/949891.xhtml       |   5 ++
 layout/forms/crashtests/959311.html        |  17 +++++
 layout/forms/crashtests/960277-2.html      |  14 ++++
 layout/forms/crashtests/997709-1.html      |   5 ++
 layout/forms/crashtests/crashtests.list    |  80 ++++++++++++++++++++
 82 files changed, 1361 insertions(+)
 create mode 100644 layout/forms/crashtests/1102791.html
 create mode 100644 layout/forms/crashtests/1140216.html
 create mode 100644 layout/forms/crashtests/1182414.html
 create mode 100644 layout/forms/crashtests/1212688.html
 create mode 100644 layout/forms/crashtests/1228670.xhtml
 create mode 100644 layout/forms/crashtests/1279354.html
 create mode 100644 layout/forms/crashtests/1388230-1.html
 create mode 100644 layout/forms/crashtests/1388230-2.html
 create mode 100644 layout/forms/crashtests/1405830.html
 create mode 100644 layout/forms/crashtests/1418477.html
 create mode 100644 layout/forms/crashtests/1432853.html
 create mode 100644 layout/forms/crashtests/1460787-1.html
 create mode 100644 layout/forms/crashtests/1464165-1.html
 create mode 100644 layout/forms/crashtests/1471157.html
 create mode 100644 layout/forms/crashtests/1488219.html
 create mode 100644 layout/forms/crashtests/1600207.html
 create mode 100644 layout/forms/crashtests/1600367.html
 create mode 100644 layout/forms/crashtests/1617753.html
 create mode 100644 layout/forms/crashtests/166750-1.html
 create mode 100644 layout/forms/crashtests/1679471.html
 create mode 100644 layout/forms/crashtests/1690166-1.html
 create mode 100644 layout/forms/crashtests/1690166-2.html
 create mode 100644 layout/forms/crashtests/1873802-1.html
 create mode 100644 layout/forms/crashtests/200347-1.html
 create mode 100644 layout/forms/crashtests/203041-1.html
 create mode 100644 layout/forms/crashtests/213390-1.html
 create mode 100644 layout/forms/crashtests/258101-1.html
 create mode 100644 layout/forms/crashtests/266225-1.html
 create mode 100644 layout/forms/crashtests/310426-1.xhtml
 create mode 100644 layout/forms/crashtests/310520-1.xhtml
 create mode 100644 layout/forms/crashtests/315752-1.xhtml
 create mode 100644 layout/forms/crashtests/317502-1.xhtml
 create mode 100644 layout/forms/crashtests/321894.html
 create mode 100644 layout/forms/crashtests/343510-1.html
 create mode 100644 layout/forms/crashtests/363696-1.xhtml
 create mode 100644 layout/forms/crashtests/363696-2.html
 create mode 100644 layout/forms/crashtests/363696-3.html
 create mode 100644 layout/forms/crashtests/366205-1.html
 create mode 100644 layout/forms/crashtests/366537-1.xhtml
 create mode 100644 layout/forms/crashtests/367587-1.html
 create mode 100644 layout/forms/crashtests/370703-1.html
 create mode 100644 layout/forms/crashtests/370940-1.html
 create mode 100644 layout/forms/crashtests/370967.html
 create mode 100644 layout/forms/crashtests/378369.html
 create mode 100644 layout/forms/crashtests/380116-1.xhtml
 create mode 100644 layout/forms/crashtests/382610-1.html
 create mode 100644 layout/forms/crashtests/383887-1.html
 create mode 100644 layout/forms/crashtests/386554-1.html
 create mode 100644 layout/forms/crashtests/388374-1.xhtml
 create mode 100644 layout/forms/crashtests/388374-2.html
 create mode 100644 layout/forms/crashtests/393656-1.xhtml
 create mode 100644 layout/forms/crashtests/393656-2.xhtml
 create mode 100644 layout/forms/crashtests/399262.html
 create mode 100644 layout/forms/crashtests/402852-1.html
 create mode 100644 layout/forms/crashtests/403148-1.html
 create mode 100644 layout/forms/crashtests/404118-1.html
 create mode 100644 layout/forms/crashtests/404123-1.html
 create mode 100644 layout/forms/crashtests/407066.html
 create mode 100644 layout/forms/crashtests/451316.html
 create mode 100644 layout/forms/crashtests/455451-1.html
 create mode 100644 layout/forms/crashtests/457537-1.html
 create mode 100644 layout/forms/crashtests/457537-2.html
 create mode 100644 layout/forms/crashtests/498698-1.html
 create mode 100644 layout/forms/crashtests/513113-1.html
 create mode 100644 layout/forms/crashtests/538062-1.xhtml
 create mode 100644 layout/forms/crashtests/570624-1.html
 create mode 100644 layout/forms/crashtests/578604-1.html
 create mode 100644 layout/forms/crashtests/590302-1.xhtml
 create mode 100644 layout/forms/crashtests/626014.xhtml
 create mode 100644 layout/forms/crashtests/639733.xhtml
 create mode 100644 layout/forms/crashtests/669767.html
 create mode 100644 layout/forms/crashtests/682684-binding.xml
 create mode 100644 layout/forms/crashtests/682684.xhtml
 create mode 100644 layout/forms/crashtests/865602.html
 create mode 100644 layout/forms/crashtests/893331.html
 create mode 100644 layout/forms/crashtests/893332-1.html
 create mode 100644 layout/forms/crashtests/944198.html
 create mode 100644 layout/forms/crashtests/949891.xhtml
 create mode 100644 layout/forms/crashtests/959311.html
 create mode 100644 layout/forms/crashtests/960277-2.html
 create mode 100644 layout/forms/crashtests/997709-1.html
 create mode 100644 layout/forms/crashtests/crashtests.list

(limited to 'layout/forms/crashtests')

diff --git a/layout/forms/crashtests/1102791.html b/layout/forms/crashtests/1102791.html
new file mode 100644
index 0000000000..0fd64d7553
--- /dev/null
+++ b/layout/forms/crashtests/1102791.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged"><head>
+    <meta charset="utf-8">
+    <title>Testcase for bug 1102791</title>
+    <style type="text/css">
+
+html,body {
+    color:black; background-color:white; font-size:16px; padding:0; margin:0;
+}
+
+button {
+  position: absolute;
+  -moz-appearance: none;
+  background: transparent;
+  padding: 0;
+  border-style:none;
+}
+button::before {
+  position: absolute;
+  content: "::before";
+  width: 10px;
+  height: 200em;
+  border: 1px solid black;
+}
+
+    </style>
+</head>
+<body>
+
+<button></button>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/1140216.html b/layout/forms/crashtests/1140216.html
new file mode 100644
index 0000000000..72612b8b3c
--- /dev/null
+++ b/layout/forms/crashtests/1140216.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+input { -moz-appearance: textfield; }
+
+</style>
+<script>
+
+function boom()
+{
+    window.getComputedStyle(x, "::-moz-number-spin-down").getPropertyValue("color");
+}
+
+</script>
+<body onload="boom();">
+<input type="number" id="x">
+</body>
+</html>
diff --git a/layout/forms/crashtests/1182414.html b/layout/forms/crashtests/1182414.html
new file mode 100644
index 0000000000..3aaa0bbfcc
--- /dev/null
+++ b/layout/forms/crashtests/1182414.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-paged">
+<head>
+<meta charset="UTF-8">
+<style type="text/css">
+#menu { position: fixed; left: 0px; top: 0px; }
+</style>
+</head>
+<body>
+	<svg id="canvas" width="2427" height="2295.5" version="1.1" xmlns="http://www.w3.org/2000/svg"></svg>
+
+<div id="menu">
+	<input id="chooseSize" type="range">
+</div>
+</body>
+</html>
+
diff --git a/layout/forms/crashtests/1212688.html b/layout/forms/crashtests/1212688.html
new file mode 100644
index 0000000000..68262d907f
--- /dev/null
+++ b/layout/forms/crashtests/1212688.html
@@ -0,0 +1,27 @@
+<style type="text/css">
+	optgroup {overflow-x: hidden;}
+</style>
+<select>
+  <optgroup label="optgroup">
+  <option>1</option>
+  <option>2</option>
+  <option>3</option>
+  <option>4</option>
+  <option>5</option>
+  <option>6</option>
+  <option>7</option>
+  <option>8</option>
+  <option>9</option>
+  <option>10</option>
+  <option>11</option>
+  <option>12</option>
+  <option>13</option>
+  <option>14</option>
+  <option>15</option>
+  <option>16</option>
+  <option>17</option>
+  <option>18</option>
+  <option>19</option>
+  <option>20</option>
+</optgroup>
+</select>
diff --git a/layout/forms/crashtests/1228670.xhtml b/layout/forms/crashtests/1228670.xhtml
new file mode 100644
index 0000000000..cc8d309c0e
--- /dev/null
+++ b/layout/forms/crashtests/1228670.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <body>
+        <select>
+            <optgroup style="display: list-item; list-style: inside;"></optgroup>
+        </select>
+    </body>
+</html>
diff --git a/layout/forms/crashtests/1279354.html b/layout/forms/crashtests/1279354.html
new file mode 100644
index 0000000000..5013392526
--- /dev/null
+++ b/layout/forms/crashtests/1279354.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html class="reftest-paged"><head>
+  <meta charset="utf-8">
+  <title>Testcase for bug 1279354</title>
+</head>
+<body>
+
+<div style="position:fixed"><progress></progress></div>
+1
+<br style="page-break-after: always">
+2
+<br style="page-break-after: always">
+3
+<br style="page-break-after: always">
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/1388230-1.html b/layout/forms/crashtests/1388230-1.html
new file mode 100644
index 0000000000..6662a6ef01
--- /dev/null
+++ b/layout/forms/crashtests/1388230-1.html
@@ -0,0 +1,3 @@
+<cite contenteditable='true'>
+  <input type='color'/>
+</cite>
diff --git a/layout/forms/crashtests/1388230-2.html b/layout/forms/crashtests/1388230-2.html
new file mode 100644
index 0000000000..630031d750
--- /dev/null
+++ b/layout/forms/crashtests/1388230-2.html
@@ -0,0 +1 @@
+<input contenteditable='true' type='color'>
diff --git a/layout/forms/crashtests/1405830.html b/layout/forms/crashtests/1405830.html
new file mode 100644
index 0000000000..c16eeca86a
--- /dev/null
+++ b/layout/forms/crashtests/1405830.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<style>
+#a { display: -webkit-box }
+* {	column-width: 0em }
+</style>
+<script>
+function go() {
+  document.body.appendChild(a);
+}
+</script>
+<body onload=go()>
+<select id="a" multiple=""></select>
+0
+Q
+-
+w
+g
+k
diff --git a/layout/forms/crashtests/1418477.html b/layout/forms/crashtests/1418477.html
new file mode 100644
index 0000000000..0be4732d58
--- /dev/null
+++ b/layout/forms/crashtests/1418477.html
@@ -0,0 +1,4 @@
+<head>
+<meta charset="UTF-8">
+<meta http-equiv='content-language' content='onnect-src http://Ÿ˜Ÿ™Ÿ˜­¿½¿½¿½¸�¹„»e/%2e%2f%2f%0B%1Bs%EF\u0073%09'>
+<input type='number' value='9'>
diff --git a/layout/forms/crashtests/1432853.html b/layout/forms/crashtests/1432853.html
new file mode 100644
index 0000000000..bc0735c47f
--- /dev/null
+++ b/layout/forms/crashtests/1432853.html
@@ -0,0 +1,8 @@
+<style>
+.c1 { height: 10ch; position: fixed }
+#a { column-width: 0em }
+.c2 { -webkit-transform-style: preserve-3d }
+</style>
+<details id="a" open="">
+<h4 class="c2">
+<select class="c1">
diff --git a/layout/forms/crashtests/1460787-1.html b/layout/forms/crashtests/1460787-1.html
new file mode 100644
index 0000000000..5b330555e2
--- /dev/null
+++ b/layout/forms/crashtests/1460787-1.html
@@ -0,0 +1,7 @@
+<script>
+document.addEventListener("DOMContentLoaded", function(){
+  document.getElementById('a').style.cssText="padding-inline-end:599352cm";
+});
+</script>
+<fieldset>
+<kbd id='a'>
diff --git a/layout/forms/crashtests/1464165-1.html b/layout/forms/crashtests/1464165-1.html
new file mode 100644
index 0000000000..2de4360f3c
--- /dev/null
+++ b/layout/forms/crashtests/1464165-1.html
@@ -0,0 +1,14 @@
+<html>
+  <head>
+    <script>
+      function start () {
+        try { o1 = document.createElementNS('http://www.w3.org/1999/xhtml', 'select') } catch(e) { }
+        try { o2 = document.createElementNS('http://www.w3.org/1999/xhtml', 'style') } catch(e) { }
+        try { document.documentElement.appendChild(o1) } catch(e) { }
+        try { document.documentElement.appendChild(o2) } catch(e) { }
+        try { o2.sheet.insertRule('* { border-left: green; -moz-padding-start: 5% !important; padding: 171798691; -moz-border-end: solid;', 0) } catch(e) { }
+      }
+      document.addEventListener('DOMContentLoaded', start)
+    </script>
+  </head>
+</html>
diff --git a/layout/forms/crashtests/1471157.html b/layout/forms/crashtests/1471157.html
new file mode 100644
index 0000000000..5cde3d0b84
--- /dev/null
+++ b/layout/forms/crashtests/1471157.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<input type="file">
+<script>
+  onload = function() {
+    var input = document.querySelector("input");
+    console.log(input.offsetWidth);  // Force layout flush and hence layout box
+                                     // creation.
+    input.dispatchEvent(new DragEvent("drop"));
+  }
+</script>
+
diff --git a/layout/forms/crashtests/1488219.html b/layout/forms/crashtests/1488219.html
new file mode 100644
index 0000000000..d10d3ef014
--- /dev/null
+++ b/layout/forms/crashtests/1488219.html
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<script>
+function doTest(){
+  document.getElementById('c').appendChild(document.getElementById('b').cloneNode(true));
+  window.frames[0].document.body.appendChild(document.getElementById('a'));
+  document.documentElement.removeAttribute('class');
+}
+document.addEventListener("MozReftestInvalidate", doTest);
+</script>
+
+<iframe hidden></iframe>
+<style>
+:last-of-type {
+  column-count:71;
+  float:left;
+}
+</style>
+<bdo id='a'>A</bdo>
+<address>
+<blockquote>
+</address>
+<footer id='b'>
+</footer>
+<input id='c' type='time'>
+</html>
diff --git a/layout/forms/crashtests/1600207.html b/layout/forms/crashtests/1600207.html
new file mode 100644
index 0000000000..a54a0d0c7d
--- /dev/null
+++ b/layout/forms/crashtests/1600207.html
@@ -0,0 +1,9 @@
+<style>
+:not(isindex) {
+  columns: 0px;
+  margin-top: 1%;
+}
+</style>
+<fieldset>
+<output>
+<br></br>
diff --git a/layout/forms/crashtests/1600367.html b/layout/forms/crashtests/1600367.html
new file mode 100644
index 0000000000..7a481f814e
--- /dev/null
+++ b/layout/forms/crashtests/1600367.html
@@ -0,0 +1,8 @@
+<style>
+FIELDSET {
+  border: 35482ex groove ! important;
+  all: unset;
+}
+</style>
+<i style="font-size-adjust: 113;" readonly>
+<fieldset>
diff --git a/layout/forms/crashtests/1617753.html b/layout/forms/crashtests/1617753.html
new file mode 100644
index 0000000000..213c483451
--- /dev/null
+++ b/layout/forms/crashtests/1617753.html
@@ -0,0 +1,21 @@
+<style>
+    LEGEND, FORM {
+        white-space: pre-wrap;
+    }
+
+    LEGEND {
+        max-height: 0em;
+    }
+
+    FORM {
+        column-width: 1px;
+    }
+
+    FIELDSET {
+        column-width: 1em;
+    }
+</style>
+<form id="htmlvar00005" class="class3">
+    <fieldset>
+        <legend>
+            <!-- COMMENT -->
diff --git a/layout/forms/crashtests/166750-1.html b/layout/forms/crashtests/166750-1.html
new file mode 100644
index 0000000000..d873be1b29
--- /dev/null
+++ b/layout/forms/crashtests/166750-1.html
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head><title>Killer</title></head>
+<body>
+	<form style="overflow: auto;">
+		<select style="position: fixed;">
+			<option>First</option>
+			<option>Second</option>
+			<option>Third</option>
+		</select>
+	</form>
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/1679471.html b/layout/forms/crashtests/1679471.html
new file mode 100644
index 0000000000..8d2bbc8eb0
--- /dev/null
+++ b/layout/forms/crashtests/1679471.html
@@ -0,0 +1,8 @@
+<style>
+* {
+  rotate: 0.8339rad;
+  inset: 84pt -15742cm 8% ! important;
+  position: fixed;
+}
+</style>
+<button>
diff --git a/layout/forms/crashtests/1690166-1.html b/layout/forms/crashtests/1690166-1.html
new file mode 100644
index 0000000000..85e9b56702
--- /dev/null
+++ b/layout/forms/crashtests/1690166-1.html
@@ -0,0 +1,19 @@
+<style>
+body {
+  columns: 0px;
+}
+* {
+  column-width: 95em;
+  break-before: page;
+}
+</style>
+<script>
+window.onload = () => {
+    document.vlinkColor = "x"
+}
+</script>
+<body>
+<canvas></canvas>
+<form style="-webkit-perspective: 16px">
+<fieldset style="position: fixed">
+<legend>x</legend>
diff --git a/layout/forms/crashtests/1690166-2.html b/layout/forms/crashtests/1690166-2.html
new file mode 100644
index 0000000000..c39d53873c
--- /dev/null
+++ b/layout/forms/crashtests/1690166-2.html
@@ -0,0 +1,19 @@
+<style>
+body {
+  columns: 0px;
+}
+* {
+  column-width: 95em;
+  break-before: page;
+}
+</style>
+<script>
+window.onload = () => {
+    document.vlinkColor = "x"
+}
+</script>
+<body>
+<canvas></canvas>
+<form style="-webkit-perspective: 16px">
+<fieldset style="float: left">
+<legend>x</legend>
diff --git a/layout/forms/crashtests/1873802-1.html b/layout/forms/crashtests/1873802-1.html
new file mode 100644
index 0000000000..f5cb28e1fa
--- /dev/null
+++ b/layout/forms/crashtests/1873802-1.html
@@ -0,0 +1,114 @@
+<html>
+<head>
+<script></script>
+<script>
+</script>
+<!-- foo -->
+<!-- foo -->
+<button>jLNJegDr5m(\r74f??</button>
+<details>
+<summary>
+<img></img>
+</summary>
+h45@|V+J)</details>
+<p>
+<title>N=y)sO6</title>
+</p>
+<iframe>B9xX</iframe>
+<style>
+</style>
+<h2>
+<form>
+<object>
+<param></param>
+<param></param>
+</object>
+</form>
+<q>
+<ol>
+<li></li>
+</ol>
+</q>
+</h2>
+<dir>#]76[#&lt;I%!&quot;Rrs.wL</dir>
+<table>
+<tbody>}}</tbody>
+<video>
+<track>rUe</track>
+</video>
+<caption>W9A1.&quot;\84gtu6%d</caption>
+<colgroup>k9</colgroup>
+<pre>6,$.MxUA&lt;F</pre>
+<b>
+<keygen>
+</b>
+</del>
+<select>
+<optgroup>
+<option>Cm]</option>
+<option>
+<basefont></basefont>
+<h3>
+<data>
+<canvas>
+<svg>
+<set />
+<path>
+<animateTransform />
+</path>
+<defs>
+<feFuncA />
+</defs>
+<metadata>
+<meshgradient>
+<feMergeNode>
+<feMergeNode>
+<feFlood />
+<altGlyphItem />
+<clipPath />
+<feDistantLight />
+<solidcolor />
+</feMergeNode>
+<font />
+<discard />
+</feMergeNode>
+<feDropShadow />
+</meshgradient>
+<feDiffuseLighting>
+<fePointLight />
+<fePointLight />
+<feSpotLight />
+</feDiffuseLighting>
+</metadata>
+<rect>
+<discard />
+<animateTransform />
+</rect>
+<text>
+<set />
+<tref>
+<unknown>
+<solidcolor>
+<unknown />
+<pattern>
+<animateColor />
+</pattern>
+</solidcolor>
+</unknown>
+<text />
+<meshrow />
+</tref>
+Text</text>
+<mask />
+<discard />
+<feDistantLight />
+<desc>0R</desc>
+</svg>
+<img></img>
+</canvas>
+</command>
+<pre>
+<video>
+<track>
+<input type="range">
+<!-- foo -->
diff --git a/layout/forms/crashtests/200347-1.html b/layout/forms/crashtests/200347-1.html
new file mode 100644
index 0000000000..b41ec8365a
--- /dev/null
+++ b/layout/forms/crashtests/200347-1.html
@@ -0,0 +1,8 @@
+<html>
+  <body>
+    <fieldset style="width: 300px; position: fixed">
+	<legend>Crash test</legend>
+  <div style="float: right; background-color: orange; border: 1px solid black">Hello, my name is Inigo Montoya.</div> hello world content  is the best content around, I love hello world content to death, especially when it wraps; that just gives me the chills.  Anything less than hello world content is uncivilized.
+  </fieldset>
+  </body>
+</html>
diff --git a/layout/forms/crashtests/203041-1.html b/layout/forms/crashtests/203041-1.html
new file mode 100644
index 0000000000..32d95b40e6
--- /dev/null
+++ b/layout/forms/crashtests/203041-1.html
@@ -0,0 +1,24 @@
+<html>
+
+<head></head>
+
+<body>
+<form method="post" action="#" enctype="multipart/form-data" name="content">
+
+	<div id="sshot" style="position:absolute; left:0; top:70; width:600;
+visibility:visible">
+	<input type="file" name="sshot-1"  size="20">
+	</div>
+
+	<div id="comment" style="position:absolute; left:0; top:70; width:600;
+visibility:hidden"></div>
+
+	<script language="JavaScript">
+	<!--
+    document.documentElement.offsetHeight;
+		document.getElementById('sshot').style.display = 'none';
+		document.getElementById('comment').style.display = 'none';
+	// -->
+	</script>
+</form>
+</body></html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/213390-1.html b/layout/forms/crashtests/213390-1.html
new file mode 100644
index 0000000000..0ff94ec542
--- /dev/null
+++ b/layout/forms/crashtests/213390-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd">
+
+<HTML>
+	<BODY>
+
+		<EMBED>
+
+		<TABLE>
+			<TR>
+			  <TD STYLE="FONT: 10px Arial;">
+				<A STYLE="FONT: 11px Arial;">1</A>
+			  </TD>
+			</TR>
+		</TABLE>
+
+		<DIV STYLE="POSITION: absolute;">
+			<FORM>
+				<SELECT STYLE="FONT: 11px Arial;">
+			</FORM>
+		</DIV>
+
+	</BODY>
+</HTML>
diff --git a/layout/forms/crashtests/258101-1.html b/layout/forms/crashtests/258101-1.html
new file mode 100644
index 0000000000..245917cbf7
--- /dev/null
+++ b/layout/forms/crashtests/258101-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+  <meta content="text/html; charset=ISO-8859-1"
+ http-equiv="content-type">
+  <title>Crash Testcase</title>
+  <script type="text/javascript">
+function crash()
+{
+  var inp = document.getElementById("theinp");
+  inp.type = "file";
+}
+  </script>
+</head>
+<body onload="crash();">
+<input id="theinp" type="text">
+</body>
+</html>
diff --git a/layout/forms/crashtests/266225-1.html b/layout/forms/crashtests/266225-1.html
new file mode 100644
index 0000000000..c714125dd5
--- /dev/null
+++ b/layout/forms/crashtests/266225-1.html
@@ -0,0 +1,7 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<FIELDSET STYLE="float:right; text-indent:999px;">Test</FIELDSET>
+</BODY>
+</HTML>
diff --git a/layout/forms/crashtests/310426-1.xhtml b/layout/forms/crashtests/310426-1.xhtml
new file mode 100644
index 0000000000..683dba679f
--- /dev/null
+++ b/layout/forms/crashtests/310426-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<body>
+
+<select><span style="position: absolute;" /></select>	
+
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/310520-1.xhtml b/layout/forms/crashtests/310520-1.xhtml
new file mode 100644
index 0000000000..6e111832a4
--- /dev/null
+++ b/layout/forms/crashtests/310520-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script><![CDATA[ 
+
+function init()
+{
+  var select = document.getElementsByTagName("select")[0];
+  select.remove();
+}
+
+window.addEventListener("load", init);
+
+]]></script>
+
+
+</head>
+<body><select><input/></select></body>
+</html>
diff --git a/layout/forms/crashtests/315752-1.xhtml b/layout/forms/crashtests/315752-1.xhtml
new file mode 100644
index 0000000000..66d3d793d7
--- /dev/null
+++ b/layout/forms/crashtests/315752-1.xhtml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html lang="en" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" xmlns:xml="http://www.w3.org/XML/1998/namespace">
+<head>
+<title>Settings - Unclassified NewsBoard</title>
+
+
+</head>
+<body>
+
+<select name="Language">
+	<option value="" style="clear: right;">
+				Automatic 	</option>
+	<option value="de" style="clear: right;">
+		<span alt="" style="float: right; margin-top: 1px;">		Deutsch</span> <small>(de)</small>	</option>
+	<option value="en" selected="selected" style="clear: right;">
+		<span alt="" style="float: right; margin-top: 1px;">		English</span> <small>(en)</small>	</option>
+</select>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/317502-1.xhtml b/layout/forms/crashtests/317502-1.xhtml
new file mode 100644
index 0000000000..7ef5f0b4c1
--- /dev/null
+++ b/layout/forms/crashtests/317502-1.xhtml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+	"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
+<head>
+	<title>Testcase, bug 317502</title>
+</head>
+<body onload="document.getElementsByTagName('input')[0].style.width='200px'">
+
+<input type="file" style="position: fixed" />
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/321894.html b/layout/forms/crashtests/321894.html
new file mode 100644
index 0000000000..0a82645ba4
--- /dev/null
+++ b/layout/forms/crashtests/321894.html
@@ -0,0 +1,17 @@
+<html><head>
+<title>
+Testcase bug 321894 - ASSERTION: RemovedAsPrimaryFrame called after PreDestroy: 'PR_FALSE'
+</title>
+</head>
+<body>
+This shouldn't assert in a debug build
+<span> 
+  <script>var x=document.body.offsetHeight;</script>
+  <div>
+    <span style="float:left;">
+      <input type="text">
+    </span>
+  </div>
+</span>
+</body>
+</html>
diff --git a/layout/forms/crashtests/343510-1.html b/layout/forms/crashtests/343510-1.html
new file mode 100644
index 0000000000..00cb94f211
--- /dev/null
+++ b/layout/forms/crashtests/343510-1.html
@@ -0,0 +1,4 @@
+<select style="position: absolute;">
+<meta>
+<option style="position: absolute;">
+<body style="display: block;">
diff --git a/layout/forms/crashtests/363696-1.xhtml b/layout/forms/crashtests/363696-1.xhtml
new file mode 100644
index 0000000000..19f938deba
--- /dev/null
+++ b/layout/forms/crashtests/363696-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body>
+
+<xul:hbox>
+  <input type="file" />
+</xul:hbox>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/363696-2.html b/layout/forms/crashtests/363696-2.html
new file mode 100644
index 0000000000..9d93edd185
--- /dev/null
+++ b/layout/forms/crashtests/363696-2.html
@@ -0,0 +1,2 @@
+<div style="display: -moz-box;">
+<input type="file">
diff --git a/layout/forms/crashtests/363696-3.html b/layout/forms/crashtests/363696-3.html
new file mode 100644
index 0000000000..e1d38076ed
--- /dev/null
+++ b/layout/forms/crashtests/363696-3.html
@@ -0,0 +1,5 @@
+<html><head></head><body>
+
+<span style="display: -moz-box;"><input type="file"><textarea></textarea></span>
+
+</body></html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/366205-1.html b/layout/forms/crashtests/366205-1.html
new file mode 100644
index 0000000000..2a3786afe0
--- /dev/null
+++ b/layout/forms/crashtests/366205-1.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+</head>
+<body onload='var yar=document.getElementById("yar"); yar.parentNode.removeChild(yar); document.getElementById("foo").removeAttribute("multiple");'>
+
+<div id="yar">Clicking the button below should not trigger an assertion</div>
+
+<select id="foo" multiple><option>A</option></select>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/366537-1.xhtml b/layout/forms/crashtests/366537-1.xhtml
new file mode 100644
index 0000000000..b799cd2ca2
--- /dev/null
+++ b/layout/forms/crashtests/366537-1.xhtml
@@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+
+function boom()
+{
+  var fieldset = document.getElementById("fieldset");
+  var h3 = document.getElementById("h3");
+  var legend = document.getElementById("legend");
+
+  fieldset.appendChild(legend);
+  fieldset.appendChild(h3);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+
+<body onload="setTimeout(boom, 30);">
+
+<legend id="legend">legend</legend>
+
+<h3 id="h3">H3</h3>
+
+<select><option>option<fieldset id="fieldset"></fieldset></option></select>
+
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/367587-1.html b/layout/forms/crashtests/367587-1.html
new file mode 100644
index 0000000000..9bffe569ed
--- /dev/null
+++ b/layout/forms/crashtests/367587-1.html
@@ -0,0 +1,37 @@
+<html class="reftest-wait">
+<head>
+
+<style>
+
+#opt1 { display: table-footer-group; }
+#opt1 { visibility: collapse; }
+#opt1 { overflow: hidden scroll; }
+
+#opt2 { display: table-cell; }
+#opt2 { clear: left; }
+
+select { width: 1px; }
+
+</style>
+
+<script>
+
+function boom()
+{
+  document.getElementById("opt2").style.clear = "none";
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<select multiple>
+<option id="opt1">A</option>
+<option id="opt2">B</option>
+</select>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/370703-1.html b/layout/forms/crashtests/370703-1.html
new file mode 100644
index 0000000000..b447b180b5
--- /dev/null
+++ b/layout/forms/crashtests/370703-1.html
@@ -0,0 +1,30 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("M").style.width = "6em";
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<body onload="setTimeout(boom, 30);">
+
+<div style="position:absolute; top: 50px; left: 50px; border: 2px solid orange;">
+
+  <select>
+    <option id="M">M</option>
+  </select>
+ 
+  <br>
+ 
+  <select style="width: 200%">
+    <option style="visibility: collapse; overflow: auto; display: table-footer-group;">X</option>
+  </select>
+ 
+</div>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/370940-1.html b/layout/forms/crashtests/370940-1.html
new file mode 100644
index 0000000000..ccaeb9643b
--- /dev/null
+++ b/layout/forms/crashtests/370940-1.html
@@ -0,0 +1,28 @@
+<html class="reftest-wait">
+<head>
+<script>
+  
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+
+function boom1()
+{
+  var newSpan = document.createElementNS(HTML_NS, "span");
+  document.body.appendChild(newSpan);
+  
+  setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+  var newDiv = document.createElementNS(HTML_NS, "div");
+  document.getElementById("s").appendChild(newDiv);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="setTimeout(boom1, 30);">
+ <p>العربي</p>
+ <span id="s"></span><input><select></select><isindex><span></span>
+</body>
+</html>
diff --git a/layout/forms/crashtests/370967.html b/layout/forms/crashtests/370967.html
new file mode 100644
index 0000000000..be7854b41c
--- /dev/null
+++ b/layout/forms/crashtests/370967.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+
+<html>
+<head>
+<title>Untitled</title>
+</head>
+<body>
+Focus the input of the isindex, then do a reload, Mozilla should not crash
+<isindex autofocus>
+</label>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/378369.html b/layout/forms/crashtests/378369.html
new file mode 100644
index 0000000000..90327735ef
--- /dev/null
+++ b/layout/forms/crashtests/378369.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<title>Testcase bug - Crash [@ nsEventListenerManager::FixContextMenuEvent] when firing contextmenu event in display: none iframe</title>
+</head>
+<body>
+This page should not crash Mozilla
+<iframe style="display: none;"></iframe>
+
+<script>
+function docontextmenu(i){
+var doc = window.frames[0].document;
+  var ev = doc.createEvent ('MouseEvents'); 
+  ev.initMouseEvent('contextmenu', true,true, window, 3,5, 5, 400, 400, 0, 0, 0,0,0,null);
+  doc.dispatchEvent(ev);
+}
+setTimeout(docontextmenu,0);
+</script>
+</body>
+</html>
diff --git a/layout/forms/crashtests/380116-1.xhtml b/layout/forms/crashtests/380116-1.xhtml
new file mode 100644
index 0000000000..cb37ff079a
--- /dev/null
+++ b/layout/forms/crashtests/380116-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.getElementById('t').style.display = 'block';">
+
+<table border="1" id="t">
+ <tr>
+  <td><select><option>foopy</option></select></td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/382610-1.html b/layout/forms/crashtests/382610-1.html
new file mode 100644
index 0000000000..9fe9c5b5c1
--- /dev/null
+++ b/layout/forms/crashtests/382610-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="position: absolute">
+  <input type="file" style="position: absolute; -moz-appearance: menulist;">
+</div>
+
+</body>
+</html>
+
diff --git a/layout/forms/crashtests/383887-1.html b/layout/forms/crashtests/383887-1.html
new file mode 100644
index 0000000000..65d4751f7d
--- /dev/null
+++ b/layout/forms/crashtests/383887-1.html
@@ -0,0 +1,20 @@
+<html>
+<body>
+
+<table>
+  <tr>
+    <td>
+      <select>
+        <option style="padding: 200%;">
+      </select>
+    </td>
+  </tr>
+  <tr>
+    <td>
+      <div style="padding: 200%"><span style="float: left; border: 1px solid red;"></span></div>
+    </td>
+  </tr>
+</table>
+ 
+</body>
+</html>
diff --git a/layout/forms/crashtests/386554-1.html b/layout/forms/crashtests/386554-1.html
new file mode 100644
index 0000000000..585f1e5b54
--- /dev/null
+++ b/layout/forms/crashtests/386554-1.html
@@ -0,0 +1,14 @@
+<html>
+<head></head>
+
+<body>
+
+<div style="position: absolute"><input id="input" type="file" style="top: 100%"></div>
+
+<script>
+document.body.offsetHeight;
+document.getElementById("input").style.position = "absolute";
+</script>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/388374-1.xhtml b/layout/forms/crashtests/388374-1.xhtml
new file mode 100644
index 0000000000..2a871f68b4
--- /dev/null
+++ b/layout/forms/crashtests/388374-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var newText = document.createTextNode('x');
+  document.getElementById("a").parentNode.appendChild(newText);
+}
+</script>
+</head>
+
+<body onload="boom()">
+
+<table border="1">
+ <tr>
+  <td>1</td>
+  <td id="a" style="padding-left: 10%"><select style="padding-left: 20%; bottom: 10%;"><option style="padding: 0 0 10% 20%;">pppp</option></select></td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/388374-2.html b/layout/forms/crashtests/388374-2.html
new file mode 100644
index 0000000000..81918c37cd
--- /dev/null
+++ b/layout/forms/crashtests/388374-2.html
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var newDiv = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  newDiv.style.width = "100px";
+  newDiv.style.height = "8px";
+  newDiv.style.background = "lightgreen";
+  document.getElementById("tr").appendChild(newDiv);
+}
+</script>
+</head>
+
+<body onload="boom()">
+
+<table border="1">
+ <tr id="tr">
+  <td></td>
+  <td style="padding-left: 10%"><select style="padding-left: 20%; bottom: 10%;"><option style="padding: 0 0 10% 20%; width: 25px;"></option></select></td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/393656-1.xhtml b/layout/forms/crashtests/393656-1.xhtml
new file mode 100644
index 0000000000..22a9326c5f
--- /dev/null
+++ b/layout/forms/crashtests/393656-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+ <select style="float: right; clear: right;">
+    <option><a style="float: right;"></a></option>
+    <option style="margin: 100%;"></option>
+    <option><div style="clear: both"></div></option>
+  </select>
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/393656-2.xhtml b/layout/forms/crashtests/393656-2.xhtml
new file mode 100644
index 0000000000..7d9adaf20d
--- /dev/null
+++ b/layout/forms/crashtests/393656-2.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+  <div style="overflow: hidden;">
+    <div style="float: right;"><span>XXX</span></div>
+    <select style="float: right; clear: right;">
+      <option><a style="float: right;"></a></option>
+      <option style="margin: 100%;"></option>
+      <option><div style="clear: both"></div></option>
+    </select>
+    <dl style="float: left;"></dl>
+    <div>
+      <div style="float: left;"></div>
+      <div style="display: block; clear: both"></div>
+      <dl style="float: left;"></dl>
+    </div>
+  </div>
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/399262.html b/layout/forms/crashtests/399262.html
new file mode 100644
index 0000000000..77bc0a16db
--- /dev/null
+++ b/layout/forms/crashtests/399262.html
@@ -0,0 +1,50 @@
+<style>
+select::first-letter, option::first-letter { color:green; }
+.block select, .block option{ display:block; }
+.scroll select, .scroll option{ display:block; overflow:hidden; }
+</style>
+
+<select></select>
+<select>F</select>
+<select>Ff</select>
+<select><option>F</select>
+<select><option>Ff</select>
+
+<div class="block">
+<select></select>
+<select>F</select>
+<select>Ff</select>
+<select><option>F</select>
+<select><option>Ff</select>
+</div>
+
+<div class="scroll">
+<select></select>
+<select>F</select>
+<select>Ff</select>
+<select><option>F</select>
+<select><option>Ff</select>
+</div>
+
+<select size=2></select>
+<select size=2>F</select>
+<select size=2>Ff</select>
+<select size=2><option>F</select>
+<select size=2><option>Ff</select>
+
+<div class="block">
+<select size=2></select>
+<select size=2>F</select>
+<select size=2>Ff</select>
+<select size=2><option>F</select>
+<select size=2><option>Ff</select>
+</div>
+
+<div class="scroll">
+<select size=2></select>
+<select size=2>F</select>
+<select size=2>Ff</select>
+<select size=2><option>F</select>
+<select size=2><option>Ff</select>
+</div>
+
diff --git a/layout/forms/crashtests/402852-1.html b/layout/forms/crashtests/402852-1.html
new file mode 100644
index 0000000000..e5ba9adb13
--- /dev/null
+++ b/layout/forms/crashtests/402852-1.html
@@ -0,0 +1,2 @@
+<body style="text-indent: 99999999999999999999px;">
+<fieldset>
diff --git a/layout/forms/crashtests/403148-1.html b/layout/forms/crashtests/403148-1.html
new file mode 100644
index 0000000000..cfb38fdb13
--- /dev/null
+++ b/layout/forms/crashtests/403148-1.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("ce").contentEditable = true;
+  document.documentElement.offsetHeight;
+  document.getElementById("finput").setAttribute("type", "");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<input id="finput" type="file" disabled>
+
+<span id="ce"></span>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/404118-1.html b/layout/forms/crashtests/404118-1.html
new file mode 100644
index 0000000000..40a2ac72b0
--- /dev/null
+++ b/layout/forms/crashtests/404118-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<input type="file" style="position: fixed; height: 0; width: 10px; white-space: normal;">
+</body>
+</html>
diff --git a/layout/forms/crashtests/404123-1.html b/layout/forms/crashtests/404123-1.html
new file mode 100644
index 0000000000..73fbaa363c
--- /dev/null
+++ b/layout/forms/crashtests/404123-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<fieldset>
+<legend style="padding: 0pt 100%;"></legend>
+</fieldset>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/407066.html b/layout/forms/crashtests/407066.html
new file mode 100644
index 0000000000..98c4d0f4ae
--- /dev/null
+++ b/layout/forms/crashtests/407066.html
@@ -0,0 +1 @@
+<div style="display: inline-block; column-count: 2;">text<input type="reset" style="float: right;">
diff --git a/layout/forms/crashtests/451316.html b/layout/forms/crashtests/451316.html
new file mode 100644
index 0000000000..51fda22bc0
--- /dev/null
+++ b/layout/forms/crashtests/451316.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="column-width: 1px;"><select style="height: 12em; display: block;"></select></div>
+<div style="column-width: 1px;"><select multiple style="height: 12em; display: block;"></select></div>
+</body>
+</html>
diff --git a/layout/forms/crashtests/455451-1.html b/layout/forms/crashtests/455451-1.html
new file mode 100644
index 0000000000..fd7d7b6b37
--- /dev/null
+++ b/layout/forms/crashtests/455451-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  window.addEventListener("DOMCharacterDataModified", function(){});
+  document.body.appendChild(document.createElement("isindex"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/forms/crashtests/457537-1.html b/layout/forms/crashtests/457537-1.html
new file mode 100644
index 0000000000..167d3b7076
--- /dev/null
+++ b/layout/forms/crashtests/457537-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html> 
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  window.addEventListener("DOMAttrModified", function(){});
+  document.body.appendChild(document.createElement("input"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/forms/crashtests/457537-2.html b/layout/forms/crashtests/457537-2.html
new file mode 100644
index 0000000000..626b035b48
--- /dev/null
+++ b/layout/forms/crashtests/457537-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html> 
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  window.addEventListener("DOMAttrModified", function(){});
+  document.body.appendChild(document.createElement("isindex"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/forms/crashtests/498698-1.html b/layout/forms/crashtests/498698-1.html
new file mode 100644
index 0000000000..fa8e2e17a8
--- /dev/null
+++ b/layout/forms/crashtests/498698-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<select style="height: 3401091640591pc"></select>
+</body>
+</html>
diff --git a/layout/forms/crashtests/513113-1.html b/layout/forms/crashtests/513113-1.html
new file mode 100644
index 0000000000..dc04ef6b6e
--- /dev/null
+++ b/layout/forms/crashtests/513113-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html><body onload="document.body.style.display = 'table';" style="column-count: 1; white-space: pre-line; -moz-appearance: resizer; height: 23698324514pc;">
+
+
+
+<input></body></html>
diff --git a/layout/forms/crashtests/538062-1.xhtml b/layout/forms/crashtests/538062-1.xhtml
new file mode 100644
index 0000000000..431f7ab847
--- /dev/null
+++ b/layout/forms/crashtests/538062-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  var option = document.getElementsByTagName("option")[0];
+  var b = option.firstChild;
+  option.appendChild(document.createTextNode("\u064A"));
+  document.documentElement.offsetHeight;
+  option.removeChild(b);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><select><option>B </option></select></body>
+</html>
diff --git a/layout/forms/crashtests/570624-1.html b/layout/forms/crashtests/570624-1.html
new file mode 100644
index 0000000000..47a2777282
--- /dev/null
+++ b/layout/forms/crashtests/570624-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var xt = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'textbox');
+  document.body.appendChild(xt);
+  xt.setAttribute('disabled', "true");
+  xt.setAttribute('value', "foo");
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/layout/forms/crashtests/578604-1.html b/layout/forms/crashtests/578604-1.html
new file mode 100644
index 0000000000..a7e3a870dd
--- /dev/null
+++ b/layout/forms/crashtests/578604-1.html
@@ -0,0 +1,17 @@
+<html class="reftest-paged">
+<head>
+<style>
+   h2 { page-break-before: always; }
+   #reviewer { position: fixed;}
+</style>
+</head>
+
+<body>
+
+<h2>Crash Test Case</h2>
+<div>
+<input id='reviewer'>
+</div>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/590302-1.xhtml b/layout/forms/crashtests/590302-1.xhtml
new file mode 100644
index 0000000000..85d49cb76c
--- /dev/null
+++ b/layout/forms/crashtests/590302-1.xhtml
@@ -0,0 +1,4 @@
+<html class="reftest-paged" xmlns="http://www.w3.org/1999/xhtml" style=" float: left; white-space: pre; ">
+<div style="page-break-before: always;"></div>
+<textarea style="position: fixed;"></textarea>
+</html>
diff --git a/layout/forms/crashtests/626014.xhtml b/layout/forms/crashtests/626014.xhtml
new file mode 100644
index 0000000000..05a2361d3d
--- /dev/null
+++ b/layout/forms/crashtests/626014.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+  document.getElementById("i").selectionEnd;
+  document.getElementById("a").appendChild(document.getElementById("b"));
+}
+
+]]>
+</script>
+</head>
+<body onload="boom();">
+
+<mrow xmlns="http://www.w3.org/1998/Math/MathML" id="a"><mrow id="b"/><input xmlns="http://www.w3.org/1999/xhtml" id="i" /></mrow>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/639733.xhtml b/layout/forms/crashtests/639733.xhtml
new file mode 100644
index 0000000000..a6d5b01a8d
--- /dev/null
+++ b/layout/forms/crashtests/639733.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function remove(n)
+{
+  n.remove();
+}
+
+function boom()
+{
+  
+  document.documentElement.offsetHeight;
+  remove(document.getElementById("s"));
+  remove(document.getElementById("e"));
+  document.documentElement.offsetHeight;
+}
+
+]]>
+</script>
+</head>
+<body onload="boom();">
+<embed id="e" src="data:text/html,A"></embed><span id="s"><div></div></span><isindex/>
+</body>
+</html>
diff --git a/layout/forms/crashtests/669767.html b/layout/forms/crashtests/669767.html
new file mode 100644
index 0000000000..f41a9125c2
--- /dev/null
+++ b/layout/forms/crashtests/669767.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<title>Untitled</title>
+
+
+</head>
+<body>
+<iframe src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%0A%3Ctextarea%3E%3C/textarea%3E%0A%0A%0A%3Cstyle%3E%0A@font-face%20%7B%0A%20%20%20%20%20%20font-family%3A%20%22cutabovetherest%22%3B%0A%20%20%20%20%20%20src%3A%20url%28%22http%3A//www.webpagepublicity.com/free-fonts/a/A%2520Cut%2520Above%2520The%2520Rest.ttf%22%29%3B%0A%7D%20%20%20%20%0A%0A%3C/style%3E%0A%0A%3Coptgroup%20contenteditable%3D%22true%22%20style%3D%22display%3A%20inline%3B%22%3E%3C/optgroup%3E%0A%0A%3C/body%3E%3C/html%3E"></iframe>
+<script>
+
+
+</script>
+</body>
+</html>
diff --git a/layout/forms/crashtests/682684-binding.xml b/layout/forms/crashtests/682684-binding.xml
new file mode 100644
index 0000000000..910eec33c8
--- /dev/null
+++ b/layout/forms/crashtests/682684-binding.xml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<style>html::before { content:"b"; }</style>
+<input contenteditable="true" spellcheck="true"/>
+</html>
\ No newline at end of file
diff --git a/layout/forms/crashtests/682684.xhtml b/layout/forms/crashtests/682684.xhtml
new file mode 100644
index 0000000000..2b7b2c83fa
--- /dev/null
+++ b/layout/forms/crashtests/682684.xhtml
@@ -0,0 +1,3 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<span style="mask: url(682684-binding.xml#a);"/>
+</html>
diff --git a/layout/forms/crashtests/865602.html b/layout/forms/crashtests/865602.html
new file mode 100644
index 0000000000..f560e7a385
--- /dev/null
+++ b/layout/forms/crashtests/865602.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html><body>
+
+<div style="column-count: 2;"><fieldset style="transform-style: preserve-3d;"><fieldset style="white-space: pre-line; position: fixed;"><div style="position: fixed;">
+
+
+</div></fieldset></fieldset></div>
+
+</body></html>
diff --git a/layout/forms/crashtests/893331.html b/layout/forms/crashtests/893331.html
new file mode 100644
index 0000000000..86a01f363e
--- /dev/null
+++ b/layout/forms/crashtests/893331.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<input type="range" min="10000.00000000003">
+</body>
+</html>
diff --git a/layout/forms/crashtests/893332-1.html b/layout/forms/crashtests/893332-1.html
new file mode 100644
index 0000000000..1cd17c0b1c
--- /dev/null
+++ b/layout/forms/crashtests/893332-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="UTF-8">
+  </head>
+  <body>
+    <input min="-10" max="10" step="0.1" type="range" value="-5"/>
+    <input max="50" min="10" step="2" type="range" value="7"/>
+  </body>
+</html>
diff --git a/layout/forms/crashtests/944198.html b/layout/forms/crashtests/944198.html
new file mode 100644
index 0000000000..0da7bc54dd
--- /dev/null
+++ b/layout/forms/crashtests/944198.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body onload="c.removeAttribute('type'); c.removeAttribute('value');">
+<input id="c" type="color">
+</body>
+</html>
diff --git a/layout/forms/crashtests/949891.xhtml b/layout/forms/crashtests/949891.xhtml
new file mode 100644
index 0000000000..8fbfe1e422
--- /dev/null
+++ b/layout/forms/crashtests/949891.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<input type="number"> </input>
+</body>
+</html>
diff --git a/layout/forms/crashtests/959311.html b/layout/forms/crashtests/959311.html
new file mode 100644
index 0000000000..1b4817221b
--- /dev/null
+++ b/layout/forms/crashtests/959311.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-paged">
+<head>
+<meta charset="utf-8">
+<style type="text/css">
+@page { size:5in 3in; margin:0in; }
+div { height: 2.5in; }
+select { height: 0.5in; display:block; padding:20px; page-break-inside:initial; }
+</style>
+</head>
+<body>
+    <div></div>
+    <select>
+      <option>Text</option>
+    </select>
+  </body>
+</html>
diff --git a/layout/forms/crashtests/960277-2.html b/layout/forms/crashtests/960277-2.html
new file mode 100644
index 0000000000..ea771ae798
--- /dev/null
+++ b/layout/forms/crashtests/960277-2.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML>
+<style>
+#d { overflow:scroll; width:200px; height:200px; background:yellow; }
+#d2 { right:0; width:100px; height:100px; background:purple; }
+</style>
+<fieldset id="d">
+  <div id="d2"></div>
+</fieldset>
+<script>
+d.getBoundingClientRect();
+d.style.transform = "translateX(100px)";
+d.getBoundingClientRect();
+d2.style.position = "absolute";
+</script>
diff --git a/layout/forms/crashtests/997709-1.html b/layout/forms/crashtests/997709-1.html
new file mode 100644
index 0000000000..baf5d0b14b
--- /dev/null
+++ b/layout/forms/crashtests/997709-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged"><body><div style="position: fixed;">
+<div style="page-break-after: always"></div>
+<select style="display:flex; position: fixed;"><option>A</select>
+</div></body></html>
diff --git a/layout/forms/crashtests/crashtests.list b/layout/forms/crashtests/crashtests.list
new file mode 100644
index 0000000000..da43270ba6
--- /dev/null
+++ b/layout/forms/crashtests/crashtests.list
@@ -0,0 +1,80 @@
+load 166750-1.html
+load 200347-1.html
+load 203041-1.html
+load 213390-1.html
+load 258101-1.html
+load 266225-1.html
+load 310426-1.xhtml
+load 310520-1.xhtml
+load 315752-1.xhtml
+load 317502-1.xhtml
+load 321894.html
+load 343510-1.html
+load chrome://reftest/content/crashtests/layout/forms/crashtests/363696-1.xhtml
+load 363696-2.html
+load 363696-3.html
+load 366205-1.html
+load 366537-1.xhtml
+load 367587-1.html
+load 370703-1.html
+load 370940-1.html
+load 370967.html
+load 378369.html
+load 380116-1.xhtml
+load 382610-1.html
+load 383887-1.html
+load 386554-1.html
+load 388374-1.xhtml
+load 388374-2.html
+load 393656-1.xhtml
+load 393656-2.xhtml
+load 399262.html
+load 402852-1.html
+load 403148-1.html
+load 404118-1.html
+load 404123-1.html
+load 407066.html
+load 451316.html
+load 455451-1.html
+load 457537-1.html
+load 457537-2.html
+load 498698-1.html
+load 513113-1.html
+load 538062-1.xhtml
+load 570624-1.html
+asserts(1) load 578604-1.html # bug 584564
+asserts(4-7) load 590302-1.xhtml # bug 584564
+load 626014.xhtml
+load 639733.xhtml
+load 669767.html
+load 682684.xhtml
+load 865602.html
+load 893331.html
+load 893332-1.html
+load 944198.html
+load 949891.xhtml
+load 959311.html
+load 960277-2.html
+load 997709-1.html
+load 1102791.html
+load 1140216.html
+load 1182414.html
+load 1212688.html
+load 1228670.xhtml
+load 1279354.html
+load 1388230-1.html
+load 1388230-2.html
+load 1405830.html
+load 1418477.html
+load 1432853.html
+asserts(1-4) load 1460787-1.html
+load 1464165-1.html
+load 1471157.html
+load 1488219.html
+load 1600207.html
+load 1600367.html
+load 1617753.html
+load 1679471.html
+load 1690166-1.html
+load 1690166-2.html
+load 1873802-1.html
-- 
cgit v1.2.3