From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 02:47:55 +0200
Subject: Adding upstream version 124.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 layout/painting/crashtests/1402183-1.html  | 20 ++++++++
 layout/painting/crashtests/1405881-1.html  | 24 ++++++++++
 layout/painting/crashtests/1407470-1.html  | 19 ++++++++
 layout/painting/crashtests/1413073-1.html  | 15 ++++++
 layout/painting/crashtests/1413073-2.html  | 18 ++++++++
 layout/painting/crashtests/1418177-1.html  | 34 ++++++++++++++
 layout/painting/crashtests/1418722-1.html  | 17 +++++++
 layout/painting/crashtests/1419917.html    | 15 ++++++
 layout/painting/crashtests/1425271-1.html  | 54 ++++++++++++++++++++++
 layout/painting/crashtests/1428906-1.html  | 16 +++++++
 layout/painting/crashtests/1430589-1.html  | 55 ++++++++++++++++++++++
 layout/painting/crashtests/1454105-1.html  | 22 +++++++++
 layout/painting/crashtests/1455944-1.html  | 14 ++++++
 layout/painting/crashtests/1458145.html    | 11 +++++
 layout/painting/crashtests/1465305-1.html  |  8 ++++
 layout/painting/crashtests/1468124-1.html  | 27 +++++++++++
 layout/painting/crashtests/1469472.html    |  7 +++
 layout/painting/crashtests/1477831-1.html  | 11 +++++
 layout/painting/crashtests/1504033.html    | 13 ++++++
 layout/painting/crashtests/1514544-1.html  | 15 ++++++
 layout/painting/crashtests/1547420-1.html  | 20 ++++++++
 layout/painting/crashtests/1549909.html    |  9 ++++
 layout/painting/crashtests/1551389-1.html  |  6 +++
 layout/painting/crashtests/1555819-1.html  | 12 +++++
 layout/painting/crashtests/1574392.html    |  1 +
 layout/painting/crashtests/1589800-1.html  | 47 +++++++++++++++++++
 layout/painting/crashtests/1667503-1.html  | 16 +++++++
 layout/painting/crashtests/1713880-1.html  | 10 ++++
 layout/painting/crashtests/1714584-1.html  |  5 ++
 layout/painting/crashtests/1717655-1.html  | 19 ++++++++
 layout/painting/crashtests/1763006-1.html  | 23 ++++++++++
 layout/painting/crashtests/1819957-1.html  | 14 ++++++
 layout/painting/crashtests/1851726-1.html  | 22 +++++++++
 layout/painting/crashtests/1862277-1.html  | 73 ++++++++++++++++++++++++++++++
 layout/painting/crashtests/crashtests.list | 34 ++++++++++++++
 35 files changed, 726 insertions(+)
 create mode 100644 layout/painting/crashtests/1402183-1.html
 create mode 100644 layout/painting/crashtests/1405881-1.html
 create mode 100644 layout/painting/crashtests/1407470-1.html
 create mode 100644 layout/painting/crashtests/1413073-1.html
 create mode 100644 layout/painting/crashtests/1413073-2.html
 create mode 100644 layout/painting/crashtests/1418177-1.html
 create mode 100644 layout/painting/crashtests/1418722-1.html
 create mode 100644 layout/painting/crashtests/1419917.html
 create mode 100644 layout/painting/crashtests/1425271-1.html
 create mode 100644 layout/painting/crashtests/1428906-1.html
 create mode 100644 layout/painting/crashtests/1430589-1.html
 create mode 100644 layout/painting/crashtests/1454105-1.html
 create mode 100644 layout/painting/crashtests/1455944-1.html
 create mode 100644 layout/painting/crashtests/1458145.html
 create mode 100644 layout/painting/crashtests/1465305-1.html
 create mode 100644 layout/painting/crashtests/1468124-1.html
 create mode 100644 layout/painting/crashtests/1469472.html
 create mode 100644 layout/painting/crashtests/1477831-1.html
 create mode 100644 layout/painting/crashtests/1504033.html
 create mode 100644 layout/painting/crashtests/1514544-1.html
 create mode 100644 layout/painting/crashtests/1547420-1.html
 create mode 100644 layout/painting/crashtests/1549909.html
 create mode 100644 layout/painting/crashtests/1551389-1.html
 create mode 100644 layout/painting/crashtests/1555819-1.html
 create mode 100644 layout/painting/crashtests/1574392.html
 create mode 100644 layout/painting/crashtests/1589800-1.html
 create mode 100644 layout/painting/crashtests/1667503-1.html
 create mode 100644 layout/painting/crashtests/1713880-1.html
 create mode 100644 layout/painting/crashtests/1714584-1.html
 create mode 100644 layout/painting/crashtests/1717655-1.html
 create mode 100644 layout/painting/crashtests/1763006-1.html
 create mode 100644 layout/painting/crashtests/1819957-1.html
 create mode 100644 layout/painting/crashtests/1851726-1.html
 create mode 100644 layout/painting/crashtests/1862277-1.html
 create mode 100644 layout/painting/crashtests/crashtests.list

(limited to 'layout/painting/crashtests')

diff --git a/layout/painting/crashtests/1402183-1.html b/layout/painting/crashtests/1402183-1.html
new file mode 100644
index 0000000000..ea54512894
--- /dev/null
+++ b/layout/painting/crashtests/1402183-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Bug 1402183</title>
+<style type="text/css">
+:not(article) {
+	-webkit-text-stroke-width: 1px;
+	box-decoration-break: clone;
+	clip-path: polygon(69px 1px, 49px 1px, 0px 0px);
+}
+</style>
+</head>
+<body>
+<ins>
+<p>
+r6O#i/q]
+</p>
+</ins>
+</body>
+</html>
diff --git a/layout/painting/crashtests/1405881-1.html b/layout/painting/crashtests/1405881-1.html
new file mode 100644
index 0000000000..01b2098ff5
--- /dev/null
+++ b/layout/painting/crashtests/1405881-1.html
@@ -0,0 +1,24 @@
+<style type="text/css">
+    #container {
+        height: 300px;
+        width: 300px;
+    }
+    #box {
+        height: 100px;
+        width: 100px;
+        background: red;
+        animation: 2s anim;
+    }
+    @keyframes anim {
+        from {
+            transform: matrix3d(1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 10%, 10%, 0, 1);
+        }
+        to {
+            transform: matrix3d(1, 0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 0, 40%, 40%, 0, 1);
+        }
+    }
+
+</style>
+<div id=container>
+    <div id=box></div>
+</div>
diff --git a/layout/painting/crashtests/1407470-1.html b/layout/painting/crashtests/1407470-1.html
new file mode 100644
index 0000000000..0ddf957182
--- /dev/null
+++ b/layout/painting/crashtests/1407470-1.html
@@ -0,0 +1,19 @@
+<body id='test_body'>
+<script>
+let o = [];
+o[0] = document.createElement("tt");
+test_body.appendChild(o[0]);
+o[1] = document.createElement("center");
+o[2] = document.createElement("footer");
+o[0].appendChild(o[2]);
+o[1].animate([{
+    "padding": "80.40vw 0.0vmax",
+    "transform": "matrix(6287.56,268.76,237.34,222.80,186.72,287.94) rotateX(2.046rad)"
+  }], { duration:3845.75 });
+o[2].appendChild(o[1]);
+test_body.animate([{
+    "transform": "scale3d(0.0,5961462.820,250.41)",
+    "outline": "auto thick",
+    "mask": "exclude no-clip url(data:image/gif;base64,R0lGODlhAQABAAD/ACH/C05FVFNDQVBFMi4wAwEAAAAsAAAAAAEAAQAAAgAsAAAAAAEAAQAAAgA7),exclude", 
+  }], 3617.63433129);
+</script>
\ No newline at end of file
diff --git a/layout/painting/crashtests/1413073-1.html b/layout/painting/crashtests/1413073-1.html
new file mode 100644
index 0000000000..ddecfb2424
--- /dev/null
+++ b/layout/painting/crashtests/1413073-1.html
@@ -0,0 +1,15 @@
+<html class="reftest-wait">
+<body>
+<div style="position:fixed; width:200px; height:200px; background-color:blue">
+    <div style="position:fixed; width:200px; height:200px; left:400px; background-color:red" id="inner"></div>
+</div>
+</body>
+<script>
+  function doTest() {
+    var d = document.getElementById("inner");
+    d.style.backgroundColor = "green";
+    document.documentElement.className = "";
+  }
+  window.addEventListener("MozReftestInvalidate", doTest);
+</script>
+</html>
diff --git a/layout/painting/crashtests/1413073-2.html b/layout/painting/crashtests/1413073-2.html
new file mode 100644
index 0000000000..01d1718745
--- /dev/null
+++ b/layout/painting/crashtests/1413073-2.html
@@ -0,0 +1,18 @@
+<html class="reftest-wait">
+<body>
+<div style="position:absolute; width:200px; height:200px; opacity:0.5">
+    <div style="opacity:0.9">
+      <div style="position:fixed; width:200px; height:200px; left:400px; background-color:blue" id="fixed"></div>
+    </div>
+    <div style="width:200px; height:200px; background-color:red" id="inner"></div>
+</div>
+</body>
+<script>
+  function doTest() {
+    var d = document.getElementById("inner");
+    d.style.backgroundColor = "green";
+    document.documentElement.className = "";
+  }
+  window.addEventListener("MozReftestInvalidate", doTest);
+</script>
+</html>
diff --git a/layout/painting/crashtests/1418177-1.html b/layout/painting/crashtests/1418177-1.html
new file mode 100644
index 0000000000..6420814bce
--- /dev/null
+++ b/layout/painting/crashtests/1418177-1.html
@@ -0,0 +1,34 @@
+<html>
+  <head>
+    <style>
+      * {
+        background: url(16.png), url(16.png) transparent;
+        -webkit-background-clip: text, text;
+        -moz-tab-size: calc(1 + 1) !important;
+        background-blend-mode: screen;
+        align-content: baseline;
+        background-color: green;
+      }
+    </style>
+    <script>
+      function fun_0() {
+        try { o3 = document.createElement('th') } catch (e) {};
+        try { o1.appendChild(o3) } catch (e) {}
+      }
+
+      try { o1 = document.createElement('tr') } catch (e) {}
+      try { o2 = document.createElement('ol') } catch (e) {}
+      try { xhr = new XMLHttpRequest({mozAnon: false }) } catch (e) {}
+      try { document.documentElement.appendChild(o1) } catch (e) {}
+      try { document.documentElement.appendChild(o2) } catch (e) {}
+      for (let i = 0; i < 100; i++) {
+        try { xhr.open('GET', 'data:text/html,1', false); } catch (e) {};
+        try { xhr.send(); } catch (e) {};
+        try { fuzzPriv.GC(); fuzzPriv.CC(); fuzzPriv.GC(); fuzzPriv.CC(); } catch (e) {};
+        try { xhr.addEventListener('readystatechange', fun_0, true) } catch (e) {};
+        try { o2.offsetLeft } catch (e) {};
+        try { document.styleSheets[0].cssRules[0].style['background-origin'] = 'border-box, border-box' } catch (e) {}
+      }
+    </script>
+  </head>
+</html>
diff --git a/layout/painting/crashtests/1418722-1.html b/layout/painting/crashtests/1418722-1.html
new file mode 100644
index 0000000000..93415d3012
--- /dev/null
+++ b/layout/painting/crashtests/1418722-1.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">
+<body>
+  <div style="width:200px; height:200px; perspective:1000px">
+    <div style="width:200px; height:200px; transform:translateZ(2px); background-color:green" id="transformed"></div>
+  </div>
+  <div style="width: 200px; height:200px; background-color:red" id="helper"></div>
+</body>
+<script>
+  function doTest() {
+    var element = document.getElementById("transformed");
+    element.parentNode.removeChild(element);
+    document.getElementById("helper").style.backgroundColor = "blue";
+    document.documentElement.className = "";
+  }
+  window.addEventListener("MozReftestInvalidate", doTest);
+</script>
+</html>
diff --git a/layout/painting/crashtests/1419917.html b/layout/painting/crashtests/1419917.html
new file mode 100644
index 0000000000..a60dd15403
--- /dev/null
+++ b/layout/painting/crashtests/1419917.html
@@ -0,0 +1,15 @@
+<html>
+  <head>
+    <style>
+      :nth-last-child(2) { -moz-appearance:listbox }
+    </style>
+    <script>
+    try { o1 = document.createElement('tr') } catch(e) { }
+    try { o2 = document.createElement('th') } catch(e) { }
+    try { o3 = document.createElement('canvas') } catch(e) { }
+    try { document.documentElement.appendChild(o1) } catch(e) { }
+    try { o1.appendChild(o2) } catch(e) { }
+    try { o1.appendChild(o3) } catch(e) { }
+    </script>
+  </head>
+</html>
diff --git a/layout/painting/crashtests/1425271-1.html b/layout/painting/crashtests/1425271-1.html
new file mode 100644
index 0000000000..164cb0f11f
--- /dev/null
+++ b/layout/painting/crashtests/1425271-1.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+
+<head>
+  <meta http-equiv="content-type" content="text/html; charset=UTF-8">
+  <meta charset="utf-8">
+</head>
+
+<body>
+<div id="container">
+  <div id="element">
+    <!--
+    The HTML code for this element has no other meaning than to create
+    display items that are merged together.
+    -->
+	<div style="column-count:2; column-count:2; width:300px; height:100px;">
+	  <div id="o" style="opacity:0.5; width:100px; height:200px; background:lime;">
+		<div id="d" style="height:50px; width:80px; background:red; padding:2px">Text</div>
+	  </div>
+	</div>
+  </div>
+</div>
+
+<script type="text/javascript">
+function redirect() {
+  document.documentElement.removeAttribute("class");
+
+  // Trigger root frame deletion.
+  window.location.replace("about:blank");
+}
+
+function removeElements(container) {
+  document.body.removeChild(container);
+
+  setTimeout(redirect, 0);
+}
+
+function createElements() {
+  var c = document.getElementById("container");
+  var e = document.getElementById("element");
+  for (var i = 0; i < 1000; ++i) {
+    // Populate the container with elements that cause display item merges.
+    c.appendChild(e.cloneNode(true));
+  }
+
+  setTimeout(() => removeElements(c), 0);
+}
+
+document.addEventListener("MozReftestInvalidate", createElements);
+// window.addEventListener("load", createElements);
+</script>
+
+</body>
+</html>
diff --git a/layout/painting/crashtests/1428906-1.html b/layout/painting/crashtests/1428906-1.html
new file mode 100644
index 0000000000..03e6d3aaf8
--- /dev/null
+++ b/layout/painting/crashtests/1428906-1.html
@@ -0,0 +1,16 @@
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8"><style>
+*,m{background:url()repeat center top fixed}
+#a{transform:scale(1)}
+</style>
+<script>
+function eh1(){
+  try{c=a.insertRow()}catch(e){}
+  try{c.appendChild(b)}catch(e){}
+}
+</script>
+</head><body><table id="a">
+<tbody><tr><d id="b">
+<video>
+<source onerror="eh1()">
+</video></d></tr></tbody></table></body></html>
diff --git a/layout/painting/crashtests/1430589-1.html b/layout/painting/crashtests/1430589-1.html
new file mode 100644
index 0000000000..88bb0494a7
--- /dev/null
+++ b/layout/painting/crashtests/1430589-1.html
@@ -0,0 +1,55 @@
+<html class="reftest-wait"><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+  <style>
+    :root {
+      flex-wrap: wrap-reverse;
+    }
+    menuitem {
+      -webkit-mask-image: url(data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7);
+    }
+
+    * {
+      margin-right: -1px;
+      display: -webkit-box;
+      overflow: scroll;
+    }
+
+
+    .css1 {
+      -webkit-border-bottom-left-radius: 10px;
+    }
+
+
+  </style>
+<script>
+function BOOM(){
+  setTimeout(() => {
+    var elem = document.getElementById("vuln");
+    elem.style.width = 600;
+    elem.style.height = 600;
+    window.requestAnimationFrame(() => {
+      window.requestAnimationFrame(() => {
+        document.documentElement.removeAttribute("class");
+      });
+    });
+  }, 0);
+}
+
+document.addEventListener("MozReftestInvalidate", BOOM);
+//window.addEventListener("load", BOOM);
+</script></head>
+
+<body>
+  <footer>
+      <textarea id="vuln" style="width: 500px; height: 500px;">Ashitaka</textarea>
+  </footer>
+  <menu>
+    <menuitem>
+      <iframe></iframe>
+  </menuitem></menu>
+  <menuitem>
+  <hr>
+  <dialog class="css1"></dialog>
+
+
+</menuitem></body></html>
diff --git a/layout/painting/crashtests/1454105-1.html b/layout/painting/crashtests/1454105-1.html
new file mode 100644
index 0000000000..946d45992b
--- /dev/null
+++ b/layout/painting/crashtests/1454105-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+#a {
+  filter: brightness(1);
+  border-style: solid;
+}
+#b {
+  opacity: 0.2;
+}
+</style>
+</head>
+<body>
+<span id="b">
+	<span id="a">
+		<div></div>
+	</span>
+</span>
+</body>
+</html>
diff --git a/layout/painting/crashtests/1455944-1.html b/layout/painting/crashtests/1455944-1.html
new file mode 100644
index 0000000000..c115f4dd8e
--- /dev/null
+++ b/layout/painting/crashtests/1455944-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<meta charset="utf-8">
+</head>
+
+<body>
+<div style="opacity: 0.9;">
+    <iframe style="border: none;" src=""></iframe>
+</div>
+
+</body>
+</html>
diff --git a/layout/painting/crashtests/1458145.html b/layout/painting/crashtests/1458145.html
new file mode 100644
index 0000000000..dc5f07c204
--- /dev/null
+++ b/layout/painting/crashtests/1458145.html
@@ -0,0 +1,11 @@
+<style>
+* { position: fixed; }
+#a {
+perspective: 0px;
+overflow: scroll;
+}
+.cl2 { -webkit-transform-style: preserve-3d; }
+.cl1 { border-bottom-right-radius: 0px 1px; }
+</style>
+<del id="a" class="cl1">
+<dl class="cl2">#_k</dl>
diff --git a/layout/painting/crashtests/1465305-1.html b/layout/painting/crashtests/1465305-1.html
new file mode 100644
index 0000000000..084f524fba
--- /dev/null
+++ b/layout/painting/crashtests/1465305-1.html
@@ -0,0 +1,8 @@
+<style>
+:not(cursor) {
+  -webkit-background-clip: text;
+  border-top-right-radius: 0vh;
+}
+</style>
+><input>
+<dialog open="">
diff --git a/layout/painting/crashtests/1468124-1.html b/layout/painting/crashtests/1468124-1.html
new file mode 100644
index 0000000000..9acf1427db
--- /dev/null
+++ b/layout/painting/crashtests/1468124-1.html
@@ -0,0 +1,27 @@
+<html class="reftest-wait">
+<style>
+:not(feFuncB) {
+  position: fixed;
+}
+a:last-child {
+  -webkit-transform-style: preserve-3d;
+}
+* {
+  -webkit-backface-visibility: hidden;
+</style>
+<script>
+window.requestIdleCallback(function() {
+  document.documentElement.getBoundingClientRect();
+});
+function go() {
+  var c = document.createElement("a")
+  c.text = "-";
+  try { c.replaceChild(b, c.childNodes[0]); } catch(e) { }
+  try { document.body.appendChild(c); } catch(e) { }
+  document.documentElement.className = "";
+}
+</script>
+<body onload=go()>
+<d id="b">|
+<audio controls="">
+</html>
diff --git a/layout/painting/crashtests/1469472.html b/layout/painting/crashtests/1469472.html
new file mode 100644
index 0000000000..f53d027704
--- /dev/null
+++ b/layout/painting/crashtests/1469472.html
@@ -0,0 +1,7 @@
+<style>
+:not(polygon) {
+background-image: url(#x);
+background-blend-mode: hue, normal;
+</style>
+<table>
+<th>
diff --git a/layout/painting/crashtests/1477831-1.html b/layout/painting/crashtests/1477831-1.html
new file mode 100644
index 0000000000..d6483bde02
--- /dev/null
+++ b/layout/painting/crashtests/1477831-1.html
@@ -0,0 +1,11 @@
+<style>
+* {
+  margin-left: 1vw;
+  columns: 2;
+  opacity: 0.2;
+  -webkit-transform: rotate(0deg);
+}
+#a { float: left; }
+</style>
+<content id="a">
+<dd>A</dd>
diff --git a/layout/painting/crashtests/1504033.html b/layout/painting/crashtests/1504033.html
new file mode 100644
index 0000000000..9aeb7973be
--- /dev/null
+++ b/layout/painting/crashtests/1504033.html
@@ -0,0 +1,13 @@
+<style>
+* { -webkit-transform-style: preserve-3d }
+</style>
+<script>
+function go() {
+  a.append("x");
+}
+</script>
+<body onload=go()>
+<svg overflow="auto">
+<use xlink:href="#b" style="-webkit-transform-style: flat"/>
+<use id="b" xlink:href="#a">
+<text id="a">
diff --git a/layout/painting/crashtests/1514544-1.html b/layout/painting/crashtests/1514544-1.html
new file mode 100644
index 0000000000..8e9efdc3c4
--- /dev/null
+++ b/layout/painting/crashtests/1514544-1.html
@@ -0,0 +1,15 @@
+<html class="reftest-wait">
+<script>
+setTimeout(function() {
+  a.appendChild(b);
+  document.documentElement.className = "";
+}, 100)
+</script>
+<style>
+:root { opacity: 0 }
+</style>
+A
+<textarea id="a" hidden=""></textarea>
+<object id="b" >
+A
+</html>
diff --git a/layout/painting/crashtests/1547420-1.html b/layout/painting/crashtests/1547420-1.html
new file mode 100644
index 0000000000..ce54d67d09
--- /dev/null
+++ b/layout/painting/crashtests/1547420-1.html
@@ -0,0 +1,20 @@
+<script></script>
+<style>
+* {
+  text-align-last: right;
+  min-height: max-content;
+  min-width: 1vmin;
+  writing-mode: vertical-rl;
+}
+</style>
+<q style="writing-mode: lr">
+<marquee></marquee>
+<style></style>
+</q>
+<dl style="-webkit-transform: skew(0deg); mso-ignore: colspan">
+<dd>
+<table>
+<dt style="margin-left: 67%; scale: 7 46 0.006057077979">
+</dt>
+<marquee bgcolor="-moz-mac-accentdarkestshadow">
+<button autofocus="autofocus">
diff --git a/layout/painting/crashtests/1549909.html b/layout/painting/crashtests/1549909.html
new file mode 100644
index 0000000000..0542ee91a8
--- /dev/null
+++ b/layout/painting/crashtests/1549909.html
@@ -0,0 +1,9 @@
+<style>
+* {
+  -webkit-column-break-after: always;
+  float: left;
+  column-width: 0px;
+}
+</style>
+}
+<video controls="controls">
diff --git a/layout/painting/crashtests/1551389-1.html b/layout/painting/crashtests/1551389-1.html
new file mode 100644
index 0000000000..4ee12c1ce9
--- /dev/null
+++ b/layout/painting/crashtests/1551389-1.html
@@ -0,0 +1,6 @@
+<style>
+dl::first-letter { float: right }
+* { -webkit-box-shadow: -moz-cellhighlighttext 0px 34px 1px }
+</style>
+<s dir="RTL">
+<dl style="break-inside: avoid">AA</iframe>
diff --git a/layout/painting/crashtests/1555819-1.html b/layout/painting/crashtests/1555819-1.html
new file mode 100644
index 0000000000..0327e3690f
--- /dev/null
+++ b/layout/painting/crashtests/1555819-1.html
@@ -0,0 +1,12 @@
+<style>
+body {
+  width: 1px;
+  height: 5vmax;
+  -webkit-filter: brightness(1);
+}
+* {
+  grid-template-areas: '';
+  columns: 1px;
+}
+</style>
+<keygen autofocus="">aaaa
diff --git a/layout/painting/crashtests/1574392.html b/layout/painting/crashtests/1574392.html
new file mode 100644
index 0000000000..2e8c4d15aa
--- /dev/null
+++ b/layout/painting/crashtests/1574392.html
@@ -0,0 +1 @@
+<u>🏴󠁵󠁳󠁣󠁡󠁿</u>
diff --git a/layout/painting/crashtests/1589800-1.html b/layout/painting/crashtests/1589800-1.html
new file mode 100644
index 0000000000..8af28028a0
--- /dev/null
+++ b/layout/painting/crashtests/1589800-1.html
@@ -0,0 +1,47 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+    <meta http-equiv="content-type" content="text/html; charset=utf-8">
+    <style>
+        #parent {
+        transform: rotateZ(1deg);
+        position: absolute;
+        opacity: 0.5;
+        overflow-x: hidden;
+    }
+
+    #child {
+        width: 10px;
+        height: 10px;
+    }
+
+    .blend {
+        mix-blend-mode: color-burn;
+    }
+    </style>
+</head>
+
+<body>
+    <div id="parent">
+        <div id="child">a</div>
+    </div>
+    <div>
+        <div id="blend">a</div>
+    </div>
+    <script type="text/javascript">
+    function modify() {
+        var e = document.getElementById("child");
+        e.style.backgroundColor = "red";
+        setTimeout(addBlend, 0);
+    }
+
+    function addBlend() {
+        var e = document.getElementById("blend");
+        e.classList.add("blend");
+    }
+
+    // setTimeout(modify, 3000);
+    window.addEventListener("MozAfterPaint", modify);
+    </script>
+</body>
+</html>
diff --git a/layout/painting/crashtests/1667503-1.html b/layout/painting/crashtests/1667503-1.html
new file mode 100644
index 0000000000..70f99b3f37
--- /dev/null
+++ b/layout/painting/crashtests/1667503-1.html
@@ -0,0 +1,16 @@
+<script>
+function go() {
+  b.src = "x:"
+  b.requestFullscreen()
+}
+function fuzz() {
+  a.close("")
+  b.src = "x"
+  a.showModal()
+  a.appendChild(document.createElement("b"))
+}
+</script>
+<body onload=go()>
+<dialog id="a">
+<nav>x</nav>
+<video id="b" onerror="fuzz()"></video>
diff --git a/layout/painting/crashtests/1713880-1.html b/layout/painting/crashtests/1713880-1.html
new file mode 100644
index 0000000000..1ccd59743a
--- /dev/null
+++ b/layout/painting/crashtests/1713880-1.html
@@ -0,0 +1,10 @@
+<script>
+window.onload = () => {
+  let a = document.createElement("dt")
+  c.appendChild(a)
+  let b = document.createElement("button")
+  a.appendChild(b)
+  b.animate([{"all": "revert"}], {delay: 9.04})
+}
+</script>
+<body id='c'></body>
diff --git a/layout/painting/crashtests/1714584-1.html b/layout/painting/crashtests/1714584-1.html
new file mode 100644
index 0000000000..1ef2812a2d
--- /dev/null
+++ b/layout/painting/crashtests/1714584-1.html
@@ -0,0 +1,5 @@
+<style>
+output:only-of-type { opacity: 0 }
+</style>
+<output>
+<iframe src="x">x</iframe>
diff --git a/layout/painting/crashtests/1717655-1.html b/layout/painting/crashtests/1717655-1.html
new file mode 100644
index 0000000000..940dac6dfb
--- /dev/null
+++ b/layout/painting/crashtests/1717655-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+      * {
+          transform: perspective(2337713741.755817Q) !important;
+          height: 2637992280%;
+      }
+
+      * {
+          border-width: medium;
+          display: table;
+      }
+  </style>
+</head>
+<table border="32767" rules="all">
+  <caption></caption>
+</table>
+</html>
diff --git a/layout/painting/crashtests/1763006-1.html b/layout/painting/crashtests/1763006-1.html
new file mode 100644
index 0000000000..080c88e7d8
--- /dev/null
+++ b/layout/painting/crashtests/1763006-1.html
@@ -0,0 +1,23 @@
+<style>
+#a {
+  -webkit-filter: invert(10%);
+  background: url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=) repeat-x center top fixed
+}
+</style>
+<script>
+function go() {
+  window.find("1")
+  requestIdleCallback(() => {
+    a.insertCell().appendChild(b)
+    var x = window.getSelection()
+    x.extend(b)
+    x.deleteFromDocument()
+  })
+}
+</script>
+<body onload=go()>
+<table>
+<colgroup>Z1xNfp~Zdx</colgroup>
+<tr id="a">
+<th></th>
+<li id="b">
diff --git a/layout/painting/crashtests/1819957-1.html b/layout/painting/crashtests/1819957-1.html
new file mode 100644
index 0000000000..647c9b7f12
--- /dev/null
+++ b/layout/painting/crashtests/1819957-1.html
@@ -0,0 +1,14 @@
+<style>
+::selection {
+  text-shadow: 0 1px 0px -moz-mac-menushadow;
+}
+</style>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  document.execCommand("selectAll", false)
+})
+</script>
+<dir>
+<menu id="foo"></menu>
+<menu>
+<link>a</link>
diff --git a/layout/painting/crashtests/1851726-1.html b/layout/painting/crashtests/1851726-1.html
new file mode 100644
index 0000000000..a57f66c64c
--- /dev/null
+++ b/layout/painting/crashtests/1851726-1.html
@@ -0,0 +1,22 @@
+<style>
+*:scope {
+  background-clip: text, border-box;
+}
+*:only-child {
+  background-image: repeating-radial-gradient(0.62em, blue 28% 0.38em);
+  writing-mode: vertical-lr;
+}
+*:root {
+  text-combine-upright: all;
+}
+</style>
+<script>
+function go() {
+  a.align = "right"
+}
+</script>
+<body onload="go()">
+<table>
+<footer dir="rtl">
+<tbody id="a">
+A
diff --git a/layout/painting/crashtests/1862277-1.html b/layout/painting/crashtests/1862277-1.html
new file mode 100644
index 0000000000..820bade2fd
--- /dev/null
+++ b/layout/painting/crashtests/1862277-1.html
@@ -0,0 +1,73 @@
+<html class="reftest-wait">
+<style>
+.hide {
+	display: none;
+}
+</style>
+
+<!--
+Need an svg element that references a clippath that is display none (so that we don't use the clip path).
+Then make the clippath no longer display none (and do it without touching the clippath itself, ie make an
+ancestor no longer display none).
+We should now draw the clip path, but the bug made us not invalidate.
+Then we can make things worse using retained display list partial updates by marking a frame modified
+that is affected by the clip path a couple times. The retained display list won't have the nsDisplayMask
+container, but the modified display list will have the nsDisplayMask, this will confuse merging when the
+same item appears inside two different containers.
+
+Note that we set widget.windows.window_occlusion_tracking.enabled=false for this test because
+crashtests leave windows open and occlud the crashtest window, which means the refresh driver doesn't
+run, which means the requestAnimationFrame don't run. Bug 1864255 tracks fixing this.
+
+Note that we image.decode-sync.enabled=false for this test because sync decoding triggers extra
+invalidation which "fixes" this bug before it gets a chance to appear. Bug 1866411 tracks this.
+-->
+
+<div style="width: 40px; height: 40px;">
+   <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="24" height="24" style="width: 100%; height: 100%;">
+      <defs id="thedefs" class="hide">
+         <clipPath id="aclip">
+            <rect width="10" height="10" x="0" y="0"></rect>
+         </clipPath>
+      </defs>
+      <g clip-path="url(#aclip)">
+      	<rect width="23" height="23" x="0" y="1" fill="rgb(0,255,0)"></rect>
+      	<rect id="therect" width="1" height="1" x="0" y="0" fill="rgb(255,0,0)"></rect>
+      </g>
+   </svg>
+</div>
+
+
+<script>
+
+function finish() {
+	document.documentElement.className = "";
+}
+
+function TweakSmall() {
+	let therect = document.getElementById("therect");
+	therect.setAttributeNS(null, "fill", "rgb(254,0,0)");
+	requestAnimationFrame(TweakSmall2);
+}
+
+function TweakSmall2() {
+	let therect = document.getElementById("therect");
+	therect.setAttributeNS(null, "fill", "rgb(253,0,0)");
+	requestAnimationFrame(finish);
+}
+
+function DisplaySomeClip() {
+	document.getElementById("thedefs").className.baseVal = "";
+	requestAnimationFrame(TweakSmall);
+}
+
+function start() {
+	requestAnimationFrame(DisplaySomeClip);
+
+}
+
+window.addEventListener("MozReftestInvalidate", start);
+//window.onload = start;
+</script>
+
+</html>
diff --git a/layout/painting/crashtests/crashtests.list b/layout/painting/crashtests/crashtests.list
new file mode 100644
index 0000000000..af2df7830c
--- /dev/null
+++ b/layout/painting/crashtests/crashtests.list
@@ -0,0 +1,34 @@
+load 1402183-1.html
+load 1407470-1.html
+load 1413073-1.html
+load 1413073-2.html
+load 1405881-1.html
+load 1418177-1.html
+load 1418722-1.html
+load 1419917.html
+load 1425271-1.html
+load 1428906-1.html
+pref(widget.windows.window_occlusion_tracking.enabled,false) load 1430589-1.html # Bug 1819154
+load 1454105-1.html
+load 1455944-1.html
+load 1458145.html
+load 1465305-1.html
+load 1468124-1.html
+load 1469472.html
+load 1477831-1.html
+load 1504033.html
+load 1514544-1.html
+asserts(0-1) asserts-if(Android,0-2) load 1547420-1.html
+load 1549909.html
+load 1551389-1.html
+asserts(0-2) load 1555819-1.html
+load 1574392.html
+load 1589800-1.html
+load 1667503-1.html
+load 1713880-1.html
+load 1717655-1.html
+load 1714584-1.html
+load 1763006-1.html
+load 1819957-1.html
+load 1851726-1.html
+pref(widget.windows.window_occlusion_tracking.enabled,false) pref(image.decode-sync.enabled,false) load 1862277-1.html
-- 
cgit v1.2.3