From 26a029d407be480d791972afb5975cf62c9360a6 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 02:47:55 +0200
Subject: Adding upstream version 124.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 .../children-with-negative-block-sizes.html        | 142 +++++++++++++++++++++
 .../children-with-negative-inline-sizes.html       | 142 +++++++++++++++++++++
 .../mathml/crashtests/chrome-bug-1287843.html      |  12 ++
 .../crashtests/display-and-column-properties.html  |  30 +++++
 .../dynamic-height-within-table-cell.html          |  33 +++++
 .../first-letter-contributed-to-ancestor.html      |  17 +++
 .../mathml/crashtests/fixed-pos-children.html      |  25 ++++
 .../mathml/crashtests/math-depth-overflow.html     |  10 ++
 .../tests/mathml/crashtests/mathml-in-svg-001.html |   3 +
 .../mmultiscripts-with-two-prescripts.html         |   8 ++
 .../mathml/crashtests/mozilla/1028521-1.xhtml      |   5 +
 .../tests/mathml/crashtests/mozilla/1061027.html   |  12 ++
 .../tests/mathml/crashtests/mozilla/1221888-1.html |  15 +++
 .../tests/mathml/crashtests/mozilla/1373767-1.html |  22 ++++
 .../tests/mathml/crashtests/mozilla/1376158.html   |   6 +
 .../tests/mathml/crashtests/mozilla/151054-1.xml   |  15 +++
 .../tests/mathml/crashtests/mozilla/1600635.html   |  16 +++
 .../tests/mathml/crashtests/mozilla/289180-1.xml   |  16 +++
 .../tests/mathml/crashtests/mozilla/307826-1.xhtml |  30 +++++
 .../tests/mathml/crashtests/mozilla/307839-1.xhtml |  15 +++
 .../tests/mathml/crashtests/mozilla/307839-2.xhtml |  24 ++++
 .../tests/mathml/crashtests/mozilla/323733-1.xml   |   7 +
 .../tests/mathml/crashtests/mozilla/323737-1.xml   |   9 ++
 .../tests/mathml/crashtests/mozilla/323738-1.xml   |  11 ++
 .../tests/mathml/crashtests/mozilla/323741-1.xml   |  13 ++
 .../tests/mathml/crashtests/mozilla/323742-1.xml   |  16 +++
 .../tests/mathml/crashtests/mozilla/336074-1.xhtml |  25 ++++
 .../mathml/crashtests/mozilla/347355-1-inner.xhtml |  28 ++++
 .../tests/mathml/crashtests/mozilla/347355-1.gif   | Bin 0 -> 980 bytes
 .../tests/mathml/crashtests/mozilla/347355-1.html  |   9 ++
 .../tests/mathml/crashtests/mozilla/347495-1.xhtml |  10 ++
 .../tests/mathml/crashtests/mozilla/347507-1.xhtml |  29 +++++
 .../tests/mathml/crashtests/mozilla/348492-1.xhtml |  31 +++++
 .../tests/mathml/crashtests/mozilla/348709-1.xhtml |  20 +++
 .../tests/mathml/crashtests/mozilla/348811-1.xhtml |  26 ++++
 .../tests/mathml/crashtests/mozilla/348811-2.xhtml |  31 +++++
 .../tests/mathml/crashtests/mozilla/353612-1.xhtml |  17 +++
 .../tests/mathml/crashtests/mozilla/355986-1.xhtml |  34 +++++
 .../tests/mathml/crashtests/mozilla/364685-1.xhtml |  19 +++
 .../tests/mathml/crashtests/mozilla/366012-1.xhtml |  23 ++++
 .../tests/mathml/crashtests/mozilla/366564-1.xhtml |  44 +++++++
 .../tests/mathml/crashtests/mozilla/367107-1.html  |  22 ++++
 .../tests/mathml/crashtests/mozilla/368430-1.xhtml |   5 +
 .../tests/mathml/crashtests/mozilla/370791-1.xhtml |  33 +++++
 .../tests/mathml/crashtests/mozilla/370862-1.xhtml |  27 ++++
 .../tests/mathml/crashtests/mozilla/372483-1.xhtml |   7 +
 .../tests/mathml/crashtests/mozilla/373472-1.xhtml |  20 +++
 .../tests/mathml/crashtests/mozilla/373472-2.xhtml |   9 ++
 .../tests/mathml/crashtests/mozilla/373533-1.xhtml |  32 +++++
 .../tests/mathml/crashtests/mozilla/373533-2.xhtml |  31 +++++
 .../tests/mathml/crashtests/mozilla/373533-3.xhtml |  31 +++++
 .../tests/mathml/crashtests/mozilla/375562-1.xhtml |  38 ++++++
 .../tests/mathml/crashtests/mozilla/377824-1.xhtml |   5 +
 .../tests/mathml/crashtests/mozilla/379418-1.xhtml |   7 +
 .../tests/mathml/crashtests/mozilla/385226-1.xhtml |  29 +++++
 .../tests/mathml/crashtests/mozilla/393760-1.xhtml |  16 +++
 .../tests/mathml/crashtests/mozilla/397518-1.xhtml |  15 +++
 .../tests/mathml/crashtests/mozilla/398038-1.html  |   8 ++
 .../tests/mathml/crashtests/mozilla/400475-1.xhtml |  16 +++
 .../tests/mathml/crashtests/mozilla/402400-1.xhtml |  41 ++++++
 .../tests/mathml/crashtests/mozilla/403156-1.xhtml |  12 ++
 .../tests/mathml/crashtests/mozilla/404485-1.xhtml |   9 ++
 .../tests/mathml/crashtests/mozilla/405187-1.xhtml |  10 ++
 .../tests/mathml/crashtests/mozilla/405271-1.xml   |  36 ++++++
 .../tests/mathml/crashtests/mozilla/412237-1.xml   |  11 ++
 .../tests/mathml/crashtests/mozilla/413063-1.xhtml |  21 +++
 .../tests/mathml/crashtests/mozilla/416907-1.xhtml |   5 +
 .../tests/mathml/crashtests/mozilla/420420-1.xhtml |   7 +
 .../tests/mathml/crashtests/mozilla/431072-1.xhtml |  25 ++++
 .../tests/mathml/crashtests/mozilla/443089-1.xhtml |   7 +
 .../tests/mathml/crashtests/mozilla/462929-1.html  |  12 ++
 .../tests/mathml/crashtests/mozilla/463763-1.xhtml |  10 ++
 .../tests/mathml/crashtests/mozilla/463763-2.xhtml |  12 ++
 .../tests/mathml/crashtests/mozilla/476547-1.xhtml |   5 +
 .../tests/mathml/crashtests/mozilla/541620-1.xhtml |   6 +
 .../tests/mathml/crashtests/mozilla/557474-1.html  |  11 ++
 .../tests/mathml/crashtests/mozilla/654928-1.html  |   3 +
 .../tests/mathml/crashtests/mozilla/655451-1.xhtml |  15 +++
 .../tests/mathml/crashtests/mozilla/713606-1.html  |  24 ++++
 .../tests/mathml/crashtests/mozilla/716349-1.html  |  13 ++
 .../tests/mathml/crashtests/mozilla/767251.xhtml   |   1 +
 .../tests/mathml/crashtests/mozilla/770710-1.html  |  25 ++++
 .../tests/mathml/crashtests/mozilla/848725-1.html  |  17 +++
 .../tests/mathml/crashtests/mozilla/848725-2.html  |  17 +++
 .../tests/mathml/crashtests/mozilla/947557-1.html  |  21 +++
 .../tests/mathml/crashtests/mozilla/973322-1.xhtml |   8 ++
 .../mspace-mpadded-negative-dimensions.html        |  13 ++
 .../tests/mathml/crashtests/mtd-as-multicol.html   |   9 ++
 .../mathml/crashtests/multicol-inside-ms.html      |   4 +
 .../crashtests/multicol-on-token-elements.html     |  11 ++
 .../crashtests/operator-and-first-letter.html      |   9 ++
 .../crashtests/scrollbar-caching-assert.html       |  17 +++
 92 files changed, 1798 insertions(+)
 create mode 100644 testing/web-platform/tests/mathml/crashtests/children-with-negative-block-sizes.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/children-with-negative-inline-sizes.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/chrome-bug-1287843.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/display-and-column-properties.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/dynamic-height-within-table-cell.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/first-letter-contributed-to-ancestor.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/fixed-pos-children.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mathml-in-svg-001.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mmultiscripts-with-two-prescripts.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1028521-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1061027.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1221888-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1373767-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1376158.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/151054-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1600635.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/289180-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/307826-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/307839-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/307839-2.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/323733-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/323737-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/323738-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/323741-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/323742-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/336074-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/347355-1-inner.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.gif
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/347495-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/347507-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/348492-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/348709-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/348811-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/348811-2.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/353612-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/355986-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/364685-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/366012-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/366564-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/367107-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/368430-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/370791-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/370862-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/372483-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/373472-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/373472-2.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/373533-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/373533-2.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/373533-3.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/375562-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/377824-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/379418-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/385226-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/393760-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/397518-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/398038-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/400475-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/402400-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/403156-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/404485-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/405187-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/405271-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/412237-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/413063-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/416907-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/420420-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/431072-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/443089-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/462929-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/463763-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/463763-2.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/476547-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/541620-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/557474-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/654928-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/655451-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/713606-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/716349-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/767251.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/770710-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/848725-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/848725-2.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/947557-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/973322-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mspace-mpadded-negative-dimensions.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mtd-as-multicol.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/multicol-inside-ms.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/multicol-on-token-elements.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/operator-and-first-letter.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/scrollbar-caching-assert.html

(limited to 'testing/web-platform/tests/mathml/crashtests')

diff --git a/testing/web-platform/tests/mathml/crashtests/children-with-negative-block-sizes.html b/testing/web-platform/tests/mathml/crashtests/children-with-negative-block-sizes.html
new file mode 100644
index 0000000000..c50f9be153
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/children-with-negative-block-sizes.html
@@ -0,0 +1,142 @@
+<!DOCTYPE html>
+<style>
+  /* These are children with negative block sizes. Absolute values are chosen
+     large enough compared to math layout constants. */
+  span { display: inline-block; }
+  mspace, span {
+    margin-block-start: -10em;
+    margin-block-end: -10em;
+  }
+  /* Override display: none; from UA style sheet for the following children. */
+  maction > :not(:first-child),
+  semantics > annotation,
+  semantics > annotation-xml {
+    display: math;
+  }
+</style>
+<math>
+  <mi><span></span></mi>
+  <mn><span></span></mn>
+  <mo><span></span></mo>
+  <ms><span></span></ms>
+  <mtext><span></span></mtext>
+</math>
+<math>
+  <semantics>
+    <mspace/>
+    <annotation><span></span></annotation>
+    <annotation-xml><span></span></annotation-xml>
+  </semantics>
+</math>
+<math>
+  <mtable>
+    <mtr>
+      <mtd><mspace/></mtd>
+      <mtd><mspace/></mtd>
+      <mtd><mspace/></mtd>
+    </mtr>
+    <mtr>
+      <mtd><mspace/></mtd>
+      <mtd><mspace/></mtd>
+      <mtd><mspace/></mtd>
+    </mtr>
+  </mtable>
+</math>
+<math>
+  <mspace/>
+  <mspace/>
+  <mspace/>
+  <mspace/>
+</math>
+<math>
+  <maction>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </maction>
+  <merror>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </merror>
+  <mpadded>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </mpadded>
+  <mphantom>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </mphantom>
+  <mstyle>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </mstyle>
+</math>
+<math>
+  <mfrac>
+    <mspace/>
+    <mspace/>
+  </mfrac>
+  <mfrac linethickness="0">
+    <mspace/>
+    <mspace/>
+  </mfrac>
+</math>
+<math>
+  <msqrt>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </msqrt>
+  <mroot>
+    <mspace/>
+    <mspace/>
+  </mroot>
+</math>
+<math>
+  <msup>
+    <mspace/>
+    <mspace/>
+  </msup>
+  <msub>
+    <mspace/>
+    <mspace/>
+  </msub>
+  <msubsup>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </msubsup>
+  <mmultiscripts>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mprescripts/>
+    <mspace/>
+    <mspace/>
+  </mmultiscripts>
+</math>
+<math>
+  <mover>
+    <mspace/>
+    <mspace/>
+  </mover>
+  <munder>
+    <mspace/>
+    <mspace/>
+  </munder>
+  <munderover>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </munderover>
+</math>
diff --git a/testing/web-platform/tests/mathml/crashtests/children-with-negative-inline-sizes.html b/testing/web-platform/tests/mathml/crashtests/children-with-negative-inline-sizes.html
new file mode 100644
index 0000000000..5c41fc8969
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/children-with-negative-inline-sizes.html
@@ -0,0 +1,142 @@
+<!DOCTYPE html>
+<style>
+  /* These are children with negative block sizes. Absolute values are chosen
+     large enough compared to math layout constants. */
+  span { display: inline-block; }
+  mspace, span {
+    margin-inline-start: -10em;
+    margin-inline-end: -10em;
+  }
+  /* Override display: none; from UA style sheet for the following children. */
+  maction > :not(:first-child),
+  semantics > annotation,
+  semantics > annotation-xml {
+    display: math;
+  }
+</style>
+<math>
+  <mi><span></span></mi>
+  <mn><span></span></mn>
+  <mo><span></span></mo>
+  <ms><span></span></ms>
+  <mtext><span></span></mtext>
+</math>
+<math>
+  <semantics>
+    <mspace/>
+    <annotation><span></span></annotation>
+    <annotation-xml><span></span></annotation-xml>
+  </semantics>
+</math>
+<math>
+  <mtable>
+    <mtr>
+      <mtd><mspace/></mtd>
+      <mtd><mspace/></mtd>
+      <mtd><mspace/></mtd>
+    </mtr>
+    <mtr>
+      <mtd><mspace/></mtd>
+      <mtd><mspace/></mtd>
+      <mtd><mspace/></mtd>
+    </mtr>
+  </mtable>
+</math>
+<math>
+  <mspace/>
+  <mspace/>
+  <mspace/>
+  <mspace/>
+</math>
+<math>
+  <maction>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </maction>
+  <merror>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </merror>
+  <mpadded>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </mpadded>
+  <mphantom>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </mphantom>
+  <mstyle>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </mstyle>
+</math>
+<math>
+  <mfrac>
+    <mspace/>
+    <mspace/>
+  </mfrac>
+  <mfrac linethickness="0">
+    <mspace/>
+    <mspace/>
+  </mfrac>
+</math>
+<math>
+  <msqrt>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </msqrt>
+  <mroot>
+    <mspace/>
+    <mspace/>
+  </mroot>
+</math>
+<math>
+  <msup>
+    <mspace/>
+    <mspace/>
+  </msup>
+  <msub>
+    <mspace/>
+    <mspace/>
+  </msub>
+  <msubsup>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </msubsup>
+  <mmultiscripts>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+    <mprescripts/>
+    <mspace/>
+    <mspace/>
+  </mmultiscripts>
+</math>
+<math>
+  <mover>
+    <mspace/>
+    <mspace/>
+  </mover>
+  <munder>
+    <mspace/>
+    <mspace/>
+  </munder>
+  <munderover>
+    <mspace/>
+    <mspace/>
+    <mspace/>
+  </munderover>
+</math>
diff --git a/testing/web-platform/tests/mathml/crashtests/chrome-bug-1287843.html b/testing/web-platform/tests/mathml/crashtests/chrome-bug-1287843.html
new file mode 100644
index 0000000000..6fc95fc12e
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/chrome-bug-1287843.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1287843">
+<div style="columns:2;">
+  <math>
+    <mtd>
+      <mtable>
+        <mtr></mtr>
+      </mtable>
+    </mtd>
+  </math>
+</div>
diff --git a/testing/web-platform/tests/mathml/crashtests/display-and-column-properties.html b/testing/web-platform/tests/mathml/crashtests/display-and-column-properties.html
new file mode 100644
index 0000000000..c40a2a0549
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/display-and-column-properties.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="test-wait">
+  <head>
+    <title>MathML elements with display and column properties</title>
+    <meta charset="utf-8"/>
+    <style>
+      math {
+          column-width: 100px;
+      }
+    </style>
+  </head>
+  <body>
+    <math></math>
+    <math style="display: list-item"></math>
+    <script>
+      window.addEventListener("load", function() {
+          // Force initial layout.
+          document.documentElement.getBoundingClientRect();
+
+          // Change display and reforce layout.
+          let maths = document.getElementsByTagName("math");
+          maths[0].setAttribute("style", "display: list-item");
+          maths[1].removeAttribute("style");
+          document.documentElement.getBoundingClientRect();
+
+          document.documentElement.classList.remove("test-wait");
+      });
+    </script>
+  </body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/dynamic-height-within-table-cell.html b/testing/web-platform/tests/mathml/crashtests/dynamic-height-within-table-cell.html
new file mode 100644
index 0000000000..cf42101bc8
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/dynamic-height-within-table-cell.html
@@ -0,0 +1,33 @@
+<!DOCTYPE>
+<html class="test-wait">
+  <head>
+    <title>Dynamic height within table cell</title>
+    <meta charset="utf-8"/>
+    <link rel="author" title="Frédéric Wang" href="mailto:fwang@igalia.com">
+    <link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1254572">
+    <style>
+      #cell {
+          position: relative;
+      }
+      #elementToResize {
+          position: absolute;
+          height: 50px;
+      }
+    </style>
+  </head>
+  <body>
+    <math>
+      <mtd id="cell">
+        <mrow id="elementToResize"></mrow>
+      </mtd>
+    </math>
+    <script>
+      window.addEventListener("load", () => {
+          window.requestAnimationFrame(() => {
+              elementToResize.style.height = "0px";
+              document.documentElement.classList.remove('test-wait');
+          });
+      });
+    </script>
+  </body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/first-letter-contributed-to-ancestor.html b/testing/web-platform/tests/mathml/crashtests/first-letter-contributed-to-ancestor.html
new file mode 100644
index 0000000000..f50841d94a
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/first-letter-contributed-to-ancestor.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1495811">
+<style>
+  math {
+    display: inline-block;
+  }
+  math::first-letter {
+    background-color: blue;
+  }
+</style>
+<math>
+  <mo id="mo">%</mo>
+</math>
+<script>
+  mo.appendChild(document.createTextNode("A"));
+  document.body.innerText += "";
+</script>
diff --git a/testing/web-platform/tests/mathml/crashtests/fixed-pos-children.html b/testing/web-platform/tests/mathml/crashtests/fixed-pos-children.html
new file mode 100644
index 0000000000..773439d6f3
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/fixed-pos-children.html
@@ -0,0 +1,25 @@
+<style>
+    * {
+        border-bottom: hsla(115.49088416259553deg 12% 15% / 18%) groove thin;
+        -webkit-text-stroke: InactiveCaptionText thin;
+        scale: -121
+    }
+
+    * * {
+        padding-inline: 69%;
+    }
+</style>
+<script>
+  document.addEventListener('DOMContentLoaded', () => {
+    const style = document.createElement('style')
+    document.head.appendChild(style)
+    style.sheet.insertRule('* {-webkit-mask-image:url(', 0)
+  })
+</script>
+<math>
+    <mmultiscripts>
+        <mglyph>
+            <maligngroup style='position:fixed'></maligngroup>
+        </mglyph>
+    </mmultiscripts>
+</math>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html b/testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html
new file mode 100644
index 0000000000..e096dbb558
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/math-depth-overflow.html
@@ -0,0 +1,10 @@
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  let a = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'math')
+  a.setAttribute('scriptlevel', '127')
+  let b = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'mstyle')
+  b.setAttribute('scriptlevel', '+2147483645')
+  a.appendChild(b)
+  document.documentElement.appendChild(a)
+})
+</script>
diff --git a/testing/web-platform/tests/mathml/crashtests/mathml-in-svg-001.html b/testing/web-platform/tests/mathml/crashtests/mathml-in-svg-001.html
new file mode 100644
index 0000000000..94a905f3b0
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mathml-in-svg-001.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1262555">
+<svg><foreignObject><math><mn>42</mn></math></foreignObject></svg>
diff --git a/testing/web-platform/tests/mathml/crashtests/mmultiscripts-with-two-prescripts.html b/testing/web-platform/tests/mathml/crashtests/mmultiscripts-with-two-prescripts.html
new file mode 100644
index 0000000000..54f9384606
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mmultiscripts-with-two-prescripts.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<math>
+  <mmultiscripts>
+    <mrow></mrow>
+    <mprescripts></mprescripts>
+    <mprescripts></mprescripts>
+  </mmultiscripts>
+</math>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1028521-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/1028521-1.xhtml
new file mode 100644
index 0000000000..b8d0947741
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1028521-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<mstyle xmlns="http://www.w3.org/1998/Math/MathML"><li xmlns="http://www.w3.org/1999/xhtml" dir="rtl"></li></mstyle>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1061027.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1061027.html
new file mode 100644
index 0000000000..3187f500a3
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1061027.html
@@ -0,0 +1,12 @@
+<style>
+.c1 { transform-style: preserve-3d; display: table-row-group;</style><script>
+var docElement = document.documentElement;
+function init() {
+test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "defs");
+test1.setAttribute("class", "c1");
+docElement.appendChild(test1);
+test2 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "msub");
+test1.appendChild(test2);
+}
+document.addEventListener("DOMContentLoaded", init);
+</script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1221888-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1221888-1.html
new file mode 100644
index 0000000000..741daa7503
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1221888-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE htm>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+
+    <div>
+        <math>
+            <mspace height="50px" width="100px" style="outline-style: dotted;"></mspace>
+        </math>
+    </div>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1373767-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1373767-1.html
new file mode 100644
index 0000000000..a159cec7be
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1373767-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+math {
+  position: fixed;
+}
+div {
+  transform: translateZ(0px);
+}
+body {
+  display: -moz-box;
+}
+</style>
+</head>
+<body>
+<div>
+<math></math>
+</div>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1376158.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1376158.html
new file mode 100644
index 0000000000..42b6dd73c8
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1376158.html
@@ -0,0 +1,6 @@
+<math>
+<munderover>
+></ms>
+<munder accentunder="true">
+<mo>)</mo>
+<mscarry>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/151054-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/151054-1.xml
new file mode 100644
index 0000000000..f634d089f3
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/151054-1.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+  <meta http-equiv="Content-Type" content="text/html" />
+  <title>Math with position: absolute</title>
+  <style>
+   math { position: absolute; }
+  </style>
+</head>
+<body>
+ <math xmlns="http://www.w3.org/1998/Math/MathML">
+  <infinity/>
+ </math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1600635.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1600635.html
new file mode 100644
index 0000000000..d6ad315885
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1600635.html
@@ -0,0 +1,16 @@
+<style>
+  * {
+    overflow-inline: scroll;
+  }
+</style>
+<script>
+  window.addEventListener('load', () => {
+    const mbsubsup = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'msubsup')
+    const m = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'm')
+    const ms = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'ms')
+    mbsubsup.appendChild(m)
+    ms.innerHTML = '<figure>'
+    mbsubsup.appendChild(ms)
+    document.documentElement.appendChild(mbsubsup)
+  })
+</script>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/289180-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/289180-1.xml
new file mode 100644
index 0000000000..8d1f2e843c
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/289180-1.xml
@@ -0,0 +1,16 @@
+
+
+    <math xmlns="http://www.w3.org/1998/Math/MathML" mode="inline">
+      <mfrac>
+        <mi>x</mi>
+        <mi>y</mi>
+      </mfrac>
+    </math>
+    <math xmlns="http://www.w3.org/1998/Math/MathML" mode="display">
+      <mfrac>
+
+        <mi>x</mi>
+        <mi>y</mi>
+      </mfrac>
+    </math>
+
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/307826-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/307826-1.xhtml
new file mode 100644
index 0000000000..02d436e825
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/307826-1.xhtml
@@ -0,0 +1,30 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait">
+
+<head>
+
+<title>Testcase for MathML crash</title>
+
+<script><![CDATA[
+
+function boom() {
+  var div = document.getElementById("div");
+  var mi = document.getElementById("mi");
+  mi.appendChild(div);
+  mi.removeChild(div);
+
+  document.documentElement.removeAttribute("class");
+}
+
+]]></script>
+
+</head>
+
+
+<body onload="setTimeout(boom, 30);">
+
+<div style="float: right;" id="div">Floated div</div>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML" display="block"><mi id="mi">mi</mi></math>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/307839-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/307839-1.xhtml
new file mode 100644
index 0000000000..a26e58ac07
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/307839-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+        <head>
+                <title>Testcase</title>
+        </head>
+        <body onload="document.getElementById('B').appendChild(document.getElementById('A'));">
+                <div style="position: relative;">
+                        <math xmlns="http://www.w3.org/1998/Math/MathML">
+                                <mover>
+                                        <mrow id="A"/>
+                                        <mn id="B"/>
+                                </mover>
+                        </math>
+                </div>
+        </body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/307839-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/307839-2.xhtml
new file mode 100644
index 0000000000..05dc08a78f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/307839-2.xhtml
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN" "http://www.w3.org/TR/MathML2/dtd/xhtml-math11-f.dtd" [
+  <!ENTITY mathml "http://www.w3.org/1998/Math/MathML">
+]>
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<title>Testcase bug - Evil mrow:hover testcase crashes Mozilla</title>
+<style type="text/css">
+#h:hover{display:block;}
+</style>
+</head>
+<body onload="document.getElementById('mrow').setAttribute('id', 'h');">
+<math mode="display" xmlns="http://www.w3.org/1998/Math/MathML">
+<mover>
+  <mrow id="mrow">hovering over this should not crash Mozilla</mrow>
+  <mover>
+    <mo>10</mo>
+    <mrow>times</mrow>
+  </mover>
+</mover>
+</math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/323733-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/323733-1.xml
new file mode 100644
index 0000000000..5551d8588c
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/323733-1.xml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <div>
+    <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline">
+      <ms />
+    </math>
+  </div>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/323737-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/323737-1.xml
new file mode 100644
index 0000000000..ad673f9460
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/323737-1.xml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <div>
+    <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline">
+      <mtable>
+        <mroot />
+      </mtable>
+    </math>
+  </div>
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/323738-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/323738-1.xml
new file mode 100644
index 0000000000..318aa93b4e
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/323738-1.xml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <div>
+    <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline">
+          <msub>
+            <mo>
+              <factorial />
+            </mo>
+          </msub>
+    </math>
+  </div>
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/323741-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/323741-1.xml
new file mode 100644
index 0000000000..8527c1a783
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/323741-1.xml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <div>
+    <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline">
+      <notin>
+        <mspace>
+          <mfenced />
+        </mspace>
+
+        f
+      </notin>
+    </math>
+  </div>
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/323742-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/323742-1.xml
new file mode 100644
index 0000000000..2cd225990d
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/323742-1.xml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <div>
+    <math xmlns="http://www.w3.org/1998/Math/MathML" display="inline">
+
+      <eulergamma>
+        <arcsech>
+          <mrow>
+            <mtable>
+              <maction/>
+            </mtable>
+          </mrow>
+        </arcsech>
+      </eulergamma>
+    </math>
+  </div>
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/336074-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/336074-1.xhtml
new file mode 100644
index 0000000000..3d1f5b4223
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/336074-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait">
+
+<head>
+
+<script>
+<![CDATA[
+
+function init()
+{
+  var k = document.getElementById("k");
+  k.remove();
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+</head>
+
+<body onload="setTimeout(init, 30);">
+
+<mo xmlns='http://www.w3.org/1998/Math/MathML'><mi id="k">z</mi></mo>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1-inner.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1-inner.xhtml
new file mode 100644
index 0000000000..22689c3c12
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1-inner.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function foo()
+{
+  var mrow = document.getElementById("mrow")
+
+  mrow.parentNode.removeChild(mrow);
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(foo, 100)">
+
+<div>
+<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+  <mrow id="mrow">
+    <mtd><img xmlns="http://www.w3.org/1999/xhtml" src="347355-1.gif" /></mtd>
+    <mtable>
      <mtr>
         <mtd><mi>t</mi></mtd>
      </mtr>
    </mtable>
+  </mrow>
+</math>
+</div>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.gif b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.gif
new file mode 100644
index 0000000000..475ea8c164
Binary files /dev/null and b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.gif differ
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.html
new file mode 100644
index 0000000000..0d61fb9d4a
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347355-1.html
@@ -0,0 +1,9 @@
+<html class="test-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="347355-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347495-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/347495-1.xhtml
new file mode 100644
index 0000000000..4a65b8f34d
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347495-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+  <munderover>
    <mo>&#x0220F;</mo>
    <mn>1</mn>
  </munderover>
+</math></div>
+
+</body>
+
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347507-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/347507-1.xhtml
new file mode 100644
index 0000000000..274ae48ff2
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347507-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function foo()
+{
+  var div = document.getElementById("div");
+  div.appendChild(div.firstChild);
+
+  var td = document.getElementById("td");
+  td.setAttribute('rowspan', -2);
+}
+
+</script>
+
+</head>
+
+<body onload="foo()">
+
+
+<div id="div"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+
+    <mtable>
      <mtr>
         <mtd id="td"><mi>y</mi></mtd>
      </mtr>
    </mtable>
+
+</math></div>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/348492-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/348492-1.xhtml
new file mode 100644
index 0000000000..f59c9353a4
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/348492-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait">
+<head>
+
+<script>
+var MATHML_NS = "http://www.w3.org/1998/Math/MathML";
+
+function foo()
+{
+  var mmultiscripts = document.createElementNS(MATHML_NS, 'mmultiscripts');
+  var mtd = document.createElementNS(MATHML_NS, 'mtd');
+
+
+  document.body.appendChild(mmultiscripts);
+  aC(mmultiscripts, mtd);
+  aC(mmultiscripts, document.createTextNode('foo'));
+
+  document.documentElement.removeAttribute("class");
+}
+
+function aC(q1, q2) { q1.appendChild(q2); }
+
+</script>
+</head>
+
+<body onload="setTimeout(foo, 30)">
+
+
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/348709-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/348709-1.xhtml
new file mode 100644
index 0000000000..907ede6abb
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/348709-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+function foo()
+{
+  document.getElementById("mtr").appendChild(document.createTextNode("a"));
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+<mrow>
  <mfenced open="[" close="]">
    <mtable>
      <mtr id="mtr">
         <mtd><mi>x</mi></mtd>
         <mtd><mi>y</mi></mtd>
      </mtr>
    </mtable>
  </mfenced>
</mrow>
+</math></div>
+
+</body>
+
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/348811-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/348811-1.xhtml
new file mode 100644
index 0000000000..f6557e5a67
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/348811-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+  var newTable = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mtable")
+
+  document.getElementById("mtr").appendChild(newTable);
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+
+<div>
+  <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+    <mtable>
      <mtr id="mtr">
         <mtd>
+           <mi>x</mi>
+         </mtd>
      </mtr>
    </mtable>
  </math>
+</div>
+
+
+</body>
+
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/348811-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/348811-2.xhtml
new file mode 100644
index 0000000000..d6a741765a
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/348811-2.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+  var m = "http://www.w3.org/1998/Math/MathML";
+  var newTable = document.createElementNS(m, "mtable")
+  document.getElementById("mtable").appendChild(newTable);
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+
+<div>
+  <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+    <mtable id="mtable">
+      <mtr id="mtr">
+         <mtd>
+           <mi>x</mi>
+         </mtd>
+      </mtr>
+    </mtable>
+  </math>
+</div>
+
+
+</body>
+
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/353612-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/353612-1.xhtml
new file mode 100644
index 0000000000..386e66f933
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/353612-1.xhtml
@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+  document.getElementById("ms").setAttribute("lquote", "'");
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+<mtr xmlns="http://www.w3.org/1998/Math/MathML" />
+<mstyle xmlns="http://www.w3.org/1998/Math/MathML" id="ms" />
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/355986-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/355986-1.xhtml
new file mode 100644
index 0000000000..787e1f6772
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/355986-1.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+
+<head>
+<style>
+
+body * {
+  display: table-footer-group;
+  overflow: hidden scroll;
+}
+
+</style>
+</head>
+
+
+
+<body onload="document.getElementById('eee').style.display = 'inline';">
+
+
+
+
+<div id="eee">
+  <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+    <mtable>
+      <mtr>
+         <mtd><mi>x</mi></mtd>
+      </mtr>
+    </mtable>
+  </math>
+</div>
+
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/364685-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/364685-1.xhtml
new file mode 100644
index 0000000000..ab2b56a2f8
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/364685-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<body onload="boom();">
+
+<script>
+function boom()
+{
+  document.getElementById("merror").appendChild(document.getElementById("s"));
+}
+</script>
+
+<math:merror id="merror"></math:merror>
+
+<span id="s" />
+
+</body>
+</html>
+
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/366012-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/366012-1.xhtml
new file mode 100644
index 0000000000..55f29f3ac3
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/366012-1.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait">
+
+<head>
+<script>
+
+function boom()
+{
+  var doom = document.getElementById("doom");
+  doom.parentNode.removeChild(doom);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+  <div>
+    <p id="doom">This paragraph disappears.</p>
+    <math xmlns='http://www.w3.org/1998/Math/MathML' display='block'><msub><mi>y</mi><mn>0</mn><frameset xmlns="http://www.w3.org/1999/xhtml" /></msub></math>
+  </div>
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/366564-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/366564-1.xhtml
new file mode 100644
index 0000000000..8bb112a30d
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/366564-1.xhtml
@@ -0,0 +1,44 @@
+<?xml version='1.0' encoding='utf-8'?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN" "http://www.w3.org/Math/DTD/mathml2/xhtml-math11-f.dtd" >
+<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait">
+<head>
+<script>
+function boom1()
+{
+  document.getElementById("mfenced3").appendChild(document.getElementById("div4"));
+  setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+  document.getElementById("sup1").appendChild(document.getElementById("mo2"));
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom1, 30);">
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+  <msup id="sup1">
+    <mi>b</mi>
+    <mn>2</mn>
+  </msup>
+</math></div>
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+  <mi>j</mi>
+  <mo id="mo2">=</mo>
+  <mfenced id="mfenced3" open="[" close="]">
+    <mn>55</mn>
+  </mfenced>
+</math></div>
+
+<div id="div4"><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+  <mo> &int; </mo>
+</math></div>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/367107-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/367107-1.html
new file mode 100644
index 0000000000..775ace87e0
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/367107-1.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var MATHML_NS = "http://www.w3.org/1998/Math/MathML";
+
+  var mtr = document.createElementNS(MATHML_NS, 'mtr');
+  var mtable = document.createElementNS(MATHML_NS, 'mtable');
+
+  document.body.appendChild(mtr);
+  mtr.appendChild(mtable);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/368430-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/368430-1.xhtml
new file mode 100644
index 0000000000..79e10c46ac
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/368430-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<maction xmlns="http://www.w3.org/1998/Math/MathML">Foo Bar</maction>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/370791-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/370791-1.xhtml
new file mode 100644
index 0000000000..d72eb5f709
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/370791-1.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML" class="test-wait">
+<head>
+<script>
+
+function boom()
+{
+  var mi = document.getElementById("mi");
+  var textA = mi.firstChild;
+  var textB = document.createTextNode("b");
+  var textSpace = document.createTextNode(" ");
+
+  var floater = document.getElementById("floater");
+
+  mi.appendChild(textB);
+  mi.appendChild(textSpace);
+  mi.removeChild(textA);
+  mi.removeChild(textSpace);
+
+  floater.parentNode.removeChild(floater);
+
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<math:mi id="mi">a<p><span style="float: right;" id="floater" /></p></math:mi>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/370862-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/370862-1.xhtml
new file mode 100644
index 0000000000..fa2f1a4d67
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/370862-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait">
+
+<head>
+<script>
+function boom()
+{
+  var math = document.getElementById("math");
+  var div = document.getElementById("div")
+
+  math.setAttribute("color", "g");
+  document.body.appendChild(div);
+
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<div id="div">
+
+<mo xmlns='http://www.w3.org/1998/Math/MathML'>+<math id="math"><mn>1</mn></math></mo>
+
+</div>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/372483-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/372483-1.xhtml
new file mode 100644
index 0000000000..41edd7d9b7
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/372483-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<div><munder xmlns="http://www.w3.org/1998/Math/MathML"/></div>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/373472-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/373472-1.xhtml
new file mode 100644
index 0000000000..6c6a304a73
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/373472-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  document.getElementById("mo").appendChild(document.getElementById("mo2"));
+  document.body.offsetWidth;
+  document.getElementById("span").appendChild(document.createTextNode("baz"));
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<p>Foo <math xmlns="http://www.w3.org/1998/Math/MathML"><mo id="mo2">-</mo></math></p>
+
+<p><math xmlns="http://www.w3.org/1998/Math/MathML"><msub id="msub"><mo id="mo">+</mo></msub></math> <span id="span">bar</span></p>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/373472-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/373472-2.xhtml
new file mode 100644
index 0000000000..1c7e1c7ade
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/373472-2.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<p><math xmlns="http://www.w3.org/1998/Math/MathML"><mroot><mo>k</mo></mroot></math></p>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/373533-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-1.xhtml
new file mode 100644
index 0000000000..247a5cb39a
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-1.xhtml
@@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head></head>
+<body>
+
+<xul:box collapsed="true"><math:mrow><div id="div">
+<p id="para">Foo bar</p>
+</div></math:mrow></xul:box>
+
+<script type="application/javascript">
+document.body.offsetWidth;
+
+try
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+  var para = document.getElementById("para");
+  var div = document.getElementById("div");
+  var hbox = document.createElementNS(XUL_NS, 'hbox');
+
+  div.appendChild(hbox);
+  div.removeChild(para);
+}
+catch (e)
+{
+  document.body.appendChild(document.createTextNode(e));
+}
+</script>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/373533-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-2.xhtml
new file mode 100644
index 0000000000..16929262a2
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-2.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      xmlns:math="http://www.w3.org/1998/Math/MathML"><head>
+</head>
+<body><xul:box collapsed="true"><math:mrow><div id="div">
+<p id="para">Foo bar</p>
+
+</div></math:mrow></xul:box>
+
+<script type="application/javascript">
+try
+{
+  document.body.offsetWidth;
+
+  var para = document.getElementById("para");
+  var div = document.getElementById("div");
+  var hbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul",
+                                      'hbox');
+
+  div.appendChild(hbox);
+
+  document.body.offsetWidth;
+
+  div.appendChild(para);
+}
+catch (e)
+{
+  document.body.appendChild(document.createTextNode(e));
+}
+</script>
+</body></html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/373533-3.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-3.xhtml
new file mode 100644
index 0000000000..18c104096a
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/373533-3.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head><body><xul:box collapsed="true"><math:mrow><div id="div">
+<p id="para">Foo bar</p>
+
+</div></math:mrow></xul:box>
+
+<script type="application/javascript">
+try
+{
+  document.body.offsetWidth;
+
+  var para = document.getElementById("para");
+  var div = document.getElementById("div");
+  var hbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul",
+                                      'hbox');
+
+  div.appendChild(hbox);
+
+  document.body.offsetWidth;
+
+  div.removeChild(para);
+}
+catch (e)
+{
+  document.body.appendChild(document.createTextNode(e));
+}
+</script>
+</body></html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/375562-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/375562-1.xhtml
new file mode 100644
index 0000000000..7b00d1f91a
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/375562-1.xhtml
@@ -0,0 +1,38 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="test-wait">
+<head>
+<script>
+
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+
+function boom()
+{
+  var a = document.getElementById("a");
+  var plus = document.getElementById("plus");
+  var frameset = document.createElementNS(HTML_NS, "frameset");
+
+  document.body.style.width = "300px";
+
+  a.parentNode.removeChild(a);
+
+  plus.appendChild(frameset);
+
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+  <msup>
+    <mi id="a">a</mi>
+    <mo id="plus">+</mo>
+    <mi>b</mi>
+    <mi>c</mi>
+  </msup>
+</math></div>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/377824-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/377824-1.xhtml
new file mode 100644
index 0000000000..ddbe7da664
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/377824-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<body>
+<math:mtable />
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/379418-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/379418-1.xhtml
new file mode 100644
index 0000000000..dc6e9e5711
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/379418-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ע</math>
+</body>
+</html>
+
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/385226-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/385226-1.xhtml
new file mode 100644
index 0000000000..b1d261eb38
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/385226-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<head>
+<style>
+[class="capleft"] { caption-side: left; }
+[class="collapse"] { visibility: collapse; }
+</style>
+</head>
+
+<body>
+
+<div>
+  <math xmlns="http://www.w3.org/1998/Math/MathML" display="block" class="collapse">
+    <mtable>
+      <mtr>
+        <mtd><mi>x</mi></mtd>
+        <mtd><mi>y</mi></mtd>
+      </mtr>
+      <html:caption class="capleft">
+        <mtd><mi>z</mi></mtd>
+        <mtd><mi>w</mi></mtd>
+      </html:caption>
+    </mtable>
+  </math>
+</div>
+
+</body>
+
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/393760-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/393760-1.xhtml
new file mode 100644
index 0000000000..cb5c2d7a12
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/393760-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+<script>
+function boom()
+{
+  document.getElementById("mfenced").setAttribute("mathbackground", "yellow");
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<math:mfenced id="mfenced" />
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/397518-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/397518-1.xhtml
new file mode 100644
index 0000000000..bc460ead11
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/397518-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+<script>
+function boom()
+{
+  var span = document.getElementById("s");
+  var newSpan = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+  span.appendChild(newSpan);
+}
+</script>
+</head>
+<body onload="boom();">
+<math:math><span id="s"><div/></span></math:math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/398038-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/398038-1.html
new file mode 100644
index 0000000000..b383141c45
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/398038-1.html
@@ -0,0 +1,8 @@
+<html>
+<head><title>Crashtest for bug 398038</title></head>
+<body>
+  <math><mpadded height="20 10"/></math>
+  <math><mpadded height="10 0000000000em"/></math>
+  <math><mpadded height="10 1.2em"/></math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/400475-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/400475-1.xhtml
new file mode 100644
index 0000000000..13ff2fcb63
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/400475-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function foo()
+{
+  document.getElementById("ms").setAttribute("foo", "x");
+}
+</script>
+</head>
+
+<body onload="foo()">
+
+<mstyle xmlns="http://www.w3.org/1998/Math/MathML" id="ms" />
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/402400-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/402400-1.xhtml
new file mode 100644
index 0000000000..5212d67f16
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/402400-1.xhtml
@@ -0,0 +1,41 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var textB = document.createTextNode("b");
+  var textC = document.createTextNode("c");
+  var textN = document.createTextNode("n");
+  var textP = document.createTextNode("p");
+
+  var blv = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  var odj = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  var tr = document.createElementNS("http://www.w3.org/1999/xhtml", "tr");
+  var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+  var mathMO = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
+
+  td.appendChild(textB);
+  document.body.appendChild(blv);
+  blv.appendChild(tr);
+  blv.appendChild(mathMO);
+  mathMO.appendChild(textP);
+  odj.appendChild(td);
+  odj.appendChild(textN);
+
+  blv.removeChild(tr);
+  mathMO.appendChild(odj);
+  td.removeChild(textB);
+  blv.appendChild(textC);
+  document.body.appendChild(odj);
+  odj.insertBefore(mathMO, textN);
+  document.body.appendChild(mathMO);
+  mathMO.appendChild(odj);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/403156-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/403156-1.xhtml
new file mode 100644
index 0000000000..b49bff7d04
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/403156-1.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+
+<head>
+<style>
+maction { height: 12em; }
+</style>
+</head>
+
+<body>
+<m:maction>&#x499a;<span>c<div>t&#x499a;</div></span>&#x499a;x&#x499a;&#x499a;2</m:maction>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/404485-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/404485-1.xhtml
new file mode 100644
index 0000000000..fea18cbd59
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/404485-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<body onload="document.getElementById('s').firstChild.splitText(1);">
+
+<math:msqrt><span xmlns="http://www.w3.org/1999/xhtml" id="s">x <math:mo/></span></math:msqrt>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/405187-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/405187-1.xhtml
new file mode 100644
index 0000000000..537512e629
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/405187-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<style id="s">
+[class="fx"] { position: fixed; }
+</style>
+</head>
+<body onload="document.getElementById('s').textContent = '* { color: magenta; }'">
+<m:mrow><m:mrow class="fx" /><span class="fx" /></m:mrow>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/405271-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/405271-1.xml
new file mode 100644
index 0000000000..c94525c638
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/405271-1.xml
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+
+<style type="text/css">
+#q { width: 16px; height: 16px; }
+#a, #b { counter-increment: chicken; }
+</style>
+
+<style id="s" type="text/css">
+#a { content: 'x'; }
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  remove(document.getElementById("s"));
+  remove(document.getElementById("b"));
+}
+
+function remove(n)
+{
+  n.parentNode.removeChild(n);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<m:mrow id="a"/><m:mo id="q"><m:malignmark><m:msubsup/><m:munderover/><m:munder id="b"/></m:malignmark></m:mo>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/412237-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/412237-1.xml
new file mode 100644
index 0000000000..2e8f13b73e
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/412237-1.xml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+  <ms fontsize="-2%"><mfrac><mi>x</mi><mi>y</mi></mfrac></ms>
+</math>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/413063-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/413063-1.xhtml
new file mode 100644
index 0000000000..b595acd1ce
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/413063-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var mtd = document.getElementById("mtd");
+  var ns = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+  var nt = document.createTextNode("foo");
+  ns.appendChild(nt);
+  mtd.appendChild(ns);
+  mtd.setAttribute("rowspan", "0");
+}
+
+
+</script>
+</head>
+
+<body onload="boom();"><m:mtd id="mtd" style="display: table-footer-group"><m:mi /></m:mtd></body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/416907-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/416907-1.xhtml
new file mode 100644
index 0000000000..94a9abde21
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/416907-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<mathml:mroot>
+<frameset/>
+</mathml:mroot>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/420420-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/420420-1.xhtml
new file mode 100644
index 0000000000..db17b277a7
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/420420-1.xhtml
@@ -0,0 +1,7 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN" "http://www.w3.org/Math/DTD/mathml2/xhtml-math11-f.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<body>
+<m:math><span><m:mfenced><m:mo>&ApplyFunction;</m:mo></m:mfenced></span></m:math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/431072-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/431072-1.xhtml
new file mode 100644
index 0000000000..f25ce28f14
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/431072-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("math").setAttribute("class", "li");
+  document.documentElement.offsetHeight;
+  document.documentElement.appendChild(document.createTextNode("\n"));
+}
+
+</script>
+
+<style type="text/css">
+
+[class="li"] { display: list-item; }
+
+</style>
+
+</head>
+
+<body onload="boom();"><math xmlns="http://www.w3.org/1998/Math/MathML" id="math"/></body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/443089-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/443089-1.xhtml
new file mode 100644
index 0000000000..2630cea131
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/443089-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+<mtd xmlns="http://www.w3.org/1998/Math/MathML" id="mtd" rowspan="1073741825"/>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/462929-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/462929-1.html
new file mode 100644
index 0000000000..386d8e138f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/462929-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+var a = document.createElementNS("http://www.w3.org/2000/svg", "foo");
+var b = document.createElementNS("http://www.w3.org/1998/Math/MathML", "math");
+
+</script>
+</head>
+<body></body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/463763-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/463763-1.xhtml
new file mode 100644
index 0000000000..61df8ff0c3
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/463763-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<math xmlns="http://www.w3.org/1998/Math/MathML"
+      xmlns:h="http://www.w3.org/1999/xhtml">
+<msup style="display:block"><mo><h:frameset/></mo></msup>
+<msub style="display:block"><mo><h:frameset/></mo></msub>
+<msubsup style="display:block"><mo><h:frameset/></mo></msubsup>
+</math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/463763-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/463763-2.xhtml
new file mode 100644
index 0000000000..8d41abade0
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/463763-2.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<math xmlns="http://www.w3.org/1998/Math/MathML"
+      xmlns:h="http://www.w3.org/1999/xhtml">
+<mstyle displaystyle="false">
+<munder style="display:block"><mo movablelimits="true"><h:frameset/></mo></munder>
+<mover style="display:block"><mo movablelimits="true"><h:frameset/></mo></mover>
+<munderover style="display:block"><mo movablelimits="true"><h:frameset/></mo></munderover>
+</mstyle>
+</math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/476547-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/476547-1.xhtml
new file mode 100644
index 0000000000..0cece35eaa
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/476547-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="quotes: '&lt;1&gt;' '';">
+<body onload="document.getElementById('ms').setAttribute('lquote', '');" style="direction: rtl;">
+<span><ms id="ms" xmlns="http://www.w3.org/1998/Math/MathML"><mstyle/></ms></span>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/541620-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/541620-1.xhtml
new file mode 100644
index 0000000000..ccef762e48
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/541620-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<body>
+<m:ms><m:mfenced/></m:ms>
+</body>
+</html>
+
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/557474-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/557474-1.html
new file mode 100644
index 0000000000..1bf8d534ca
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/557474-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Test mpadded</title>
+  </head>
+  <body>
+    <math>
+      <mpadded width="-100px" height="-100px" depth="-100px"></mpadded>
+    </math>
+  </body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/654928-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/654928-1.html
new file mode 100644
index 0000000000..da52f34b45
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/654928-1.html
@@ -0,0 +1,3 @@
+<html>
+  <math><maction selection="2">A<mo>B</mo></maction></math>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/655451-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/655451-1.xhtml
new file mode 100644
index 0000000000..0d5fb687b7
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/655451-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.style.fontStyle = "oblique";
+  var c = document.getElementById("c");
+  c.parentNode.removeChild(c);
+}
+
+</script>
+</head>
+<body onload="boom();"><math xmlns="http://www.w3.org/1998/Math/MathML"><frameset xmlns="http://www.w3.org/1999/xhtml"></frameset><msubsup id="c"/><mo><frameset xmlns="http://www.w3.org/1999/xhtml"></frameset></mo></math>x</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/713606-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/713606-1.html
new file mode 100644
index 0000000000..a0d4939a83
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/713606-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Crashtest bug 713606</title>
+  </head>
+  <body onload="document.querySelector('mstyle').setAttribute('scriptminsize', '0%');">
+    <math>
+      <msubsup>
+        <mtext>X</mtext>
+        <mtable displaystyle="true"></mstyle>
+        </mtext>Y</mtext>
+      </msubsup>
+    </math>
+    <math>
+      <msubsup>
+        <mtext>X</mtext>
+        <mstyle displaystyle="true"></mstyle>
+        </mtext>Y</mtext>
+      </msubsup>
+    </math>
+    <math><mfrac><mstyle displaystyle="true"></mstyle></mfrac></math>
+  </body>
+</html>
+
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/716349-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/716349-1.html
new file mode 100644
index 0000000000..9b5895ad64
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/716349-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Crashtest bug 716349</title>
+  </head>
+  <body>
+    <math>
+      <mspace width="-10px"/>
+      <mspace height="-10px"/>
+    </math>
+  </body>
+</html>
+
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/767251.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/767251.xhtml
new file mode 100644
index 0000000000..aa3632a6ba
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/767251.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" dir="rtl"><tr><span><math xmlns="http://www.w3.org/1998/Math/MathML"/><tr>n</tr></span></tr></html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/770710-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/770710-1.html
new file mode 100644
index 0000000000..2171966769
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/770710-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
+  var text = document.createTextNode(" ");
+  mo.appendChild(text);
+  document.body.appendChild(mo);
+
+  window.getSelection().removeAllRanges();
+  var r = document.createRange();
+  r.setStart(mo.firstChild, 0);
+  r.setEnd(mo.firstChild, 1);
+  window.getSelection().addRange(r);
+
+  window.getSelection().toString();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/848725-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/848725-1.html
new file mode 100644
index 0000000000..7ce9c434cc
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/848725-1.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html>
+  <head>
+    <title>Bug 848725</title>
+    <meta charset="utf-8"/>
+  </head>
+  <body>
+    <div>
+      <math>
+        <mover>
+          <mo>&#x21A0;</mo>
+          <mspace width="500px"></mspace>
+        </mover>
+      </math>
+    </div>
+  </body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/848725-2.html b/testing/web-platform/tests/mathml/crashtests/mozilla/848725-2.html
new file mode 100644
index 0000000000..b6362f9bf2
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/848725-2.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html>
+  <head>
+    <title>Bug 848725</title>
+    <meta charset="utf-8"/>
+  </head>
+  <body>
+    <div>
+      <math>
+        <mover>
+          <mo>&#x21A1;</mo>
+          <mspace height="500px"></mspace>
+        </mover>
+      </math>
+    </div>
+  </body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/947557-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/947557-1.html
new file mode 100644
index 0000000000..3ddfb7b984
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/947557-1.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<body>
+  <math>
+    <mmultiscripts>
+      <mo>A</mo>
+      <mprescripts/>
+      <mmultiscripts>
+        <mo>A</mo>
+        <mprescripts/>
+        <mo>A</mo>
+        <mo>A</mo>
+      </mmultiscripts>
+      <mmultiscripts>
+        <mo>A</mo>
+        <mprescripts/>
+        <mo>A</mo>
+        <mo>A</mo>
+      </mmultiscripts>
+    </mmultiscripts>
+  </math>
+</body>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/973322-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/973322-1.xhtml
new file mode 100644
index 0000000000..dfac127fb4
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/973322-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <body onload="document.getElementById('f').setAttribute('class', 'e');">
+        <math xmlns="http://www.w3.org/1998/Math/MathML">
+            <mfenced id="f"/>
+        </math>
+        <p style="overflow: scroll; position: sticky;"></p>
+    </body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mspace-mpadded-negative-dimensions.html b/testing/web-platform/tests/mathml/crashtests/mspace-mpadded-negative-dimensions.html
new file mode 100644
index 0000000000..97ae5b89b8
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mspace-mpadded-negative-dimensions.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1421195">
+<math><mspace width="-1px"/></math>
+<math><mspace height="-1px"/></math>
+<math><mspace depth="-1px"/></math>
+<math><mspace height="-2px" depth="1px"/></math>
+<math><mspace height="1px" depth="-2px"/></math>
+<math><mpadded width="-1px"/></math>
+<math><mpadded height="-1px"/></math>
+<math><mpadded depth="-1px"/></math>
+<math><mpadded height="-2px" depth="1px"></mpadded></math>
+<math><mpadded height="1px" depth="-2px"></mpadded></math>
+<math><mpadded lspace="-1px"/></math>
diff --git a/testing/web-platform/tests/mathml/crashtests/mtd-as-multicol.html b/testing/web-platform/tests/mathml/crashtests/mtd-as-multicol.html
new file mode 100644
index 0000000000..f00fa48815
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mtd-as-multicol.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1354561">
+<div id="container"></div>
+<script>
+  mtd = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mtd");
+  mtd.style.columns = "2";
+  container.appendChild(mtd);
+</script>
diff --git a/testing/web-platform/tests/mathml/crashtests/multicol-inside-ms.html b/testing/web-platform/tests/mathml/crashtests/multicol-inside-ms.html
new file mode 100644
index 0000000000..b7d481e1fb
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/multicol-inside-ms.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<link rel="author" title="Morten Stenshorne" href="mailto:mstensho@chromium.org">
+<link rel="help" href="https://bugs.chromium.org/p/chromium/issues/detail?id=1178979">
+<math><ms><span><span style="columns:3;">
diff --git a/testing/web-platform/tests/mathml/crashtests/multicol-on-token-elements.html b/testing/web-platform/tests/mathml/crashtests/multicol-on-token-elements.html
new file mode 100644
index 0000000000..9fc00eb691
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/multicol-on-token-elements.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<math><mi style="column-count: 10">mi</mi></math>
+<math><mi style="column-width: 10px">mi</mi></math>
+<math><mn style="column-count: 10">mn</mn></math>
+<math><mn style="column-width: 10px">mn</mn></math>
+<math><mo style="column-count: 10">mo</mo></math>
+<math><mo style="column-width: 10px">mo</mo></math>
+<math><ms style="column-count: 10">ms</ms></math>
+<math><ms style="column-width: 10px">ms</ms></math>
+<math><mtext style="column-count: 10">mtext</mtext></math>
+<math><mtext style="column-width: 10px">mtext</mtext></math>
diff --git a/testing/web-platform/tests/mathml/crashtests/operator-and-first-letter.html b/testing/web-platform/tests/mathml/crashtests/operator-and-first-letter.html
new file mode 100644
index 0000000000..a4d56de72f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/operator-and-first-letter.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<style>
+  p::first-letter { --panel-arrowcontent-color:-moz-FieldText; }
+</style>
+<p>
+  <math display="block">
+    <mo>&#x222B;</mo>
+  </math>
+</p>
diff --git a/testing/web-platform/tests/mathml/crashtests/scrollbar-caching-assert.html b/testing/web-platform/tests/mathml/crashtests/scrollbar-caching-assert.html
new file mode 100644
index 0000000000..3f972ef70d
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/scrollbar-caching-assert.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1663740">
+<style>
+@namespace url(http://www.w3.org/1998/Math/MathML);
+* {
+  all: inherit;
+  overflow-inline: hidden;
+}
+</style>
+<script>
+window.addEventListener('load', () => {
+  var x = document.getElementById('a')
+  x.setAttribute('mathvariant', 'double-struck')
+  x.innerHTML = '<select></select>'
+})
+</script>
+<math id='a'>
-- 
cgit v1.2.3