From fbaf0bb26397aa498eb9156f06d5a6fe34dd7dd8 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 03:14:29 +0200
Subject: Merging upstream version 125.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 .../tests/mathml/crashtests/mozilla/1092053.html   | 20 ++++++++++++++
 .../tests/mathml/crashtests/mozilla/1140268-1.html | 18 +++++++++++++
 .../tests/mathml/crashtests/mozilla/1397439-1.html |  6 +++++
 .../tests/mathml/crashtests/mozilla/1403465.html   | 24 +++++++++++++++++
 .../tests/mathml/crashtests/mozilla/1435015.html   |  9 +++++++
 .../tests/mathml/crashtests/mozilla/1555757-1.html | 16 +++++++++++
 .../tests/mathml/crashtests/mozilla/1555757-2.html | 27 +++++++++++++++++++
 .../tests/mathml/crashtests/mozilla/1701975-1.html | 20 ++++++++++++++
 .../tests/mathml/crashtests/mozilla/243159-2.xhtml | 25 +++++++++++++++++
 .../tests/mathml/crashtests/mozilla/306902-1.xml   | 14 ++++++++++
 .../tests/mathml/crashtests/mozilla/347506-1.xhtml | 23 ++++++++++++++++
 .../tests/mathml/crashtests/mozilla/355993-1.xhtml | 26 ++++++++++++++++++
 .../tests/mathml/crashtests/mozilla/364686-1.xhtml | 11 ++++++++
 .../tests/mathml/crashtests/mozilla/368461-1.xhtml | 11 ++++++++
 .../tests/mathml/crashtests/mozilla/370884-1.xhtml | 14 ++++++++++
 .../tests/mathml/crashtests/mozilla/382208-1.xhtml |  7 +++++
 .../tests/mathml/crashtests/mozilla/382396-1.xhtml |  7 +++++
 .../tests/mathml/crashtests/mozilla/384649-1.xhtml | 31 ++++++++++++++++++++++
 .../tests/mathml/crashtests/mozilla/385265-1.xhtml | 13 +++++++++
 .../tests/mathml/crashtests/mozilla/385289-1.xhtml | 30 +++++++++++++++++++++
 .../tests/mathml/crashtests/mozilla/394150-1.xhtml | 27 +++++++++++++++++++
 .../tests/mathml/crashtests/mozilla/395450-1.xhtml | 28 +++++++++++++++++++
 .../tests/mathml/crashtests/mozilla/399676-1.xhtml |  7 +++++
 .../tests/mathml/crashtests/mozilla/400445-1.xhtml | 22 +++++++++++++++
 .../tests/mathml/crashtests/mozilla/400904-1.xhtml | 20 ++++++++++++++
 .../tests/mathml/crashtests/mozilla/410728-1.xml   | 14 ++++++++++
 .../tests/mathml/crashtests/mozilla/411603-1.html  |  7 +++++
 .../tests/mathml/crashtests/mozilla/413274-1.xhtml | 18 +++++++++++++
 .../tests/mathml/crashtests/mozilla/418007-1.xhtml | 24 +++++++++++++++++
 .../tests/mathml/crashtests/mozilla/467914-1.html  |  3 +++
 .../tests/mathml/crashtests/mozilla/547843-1.xhtml |  1 +
 .../tests/mathml/crashtests/mozilla/700031.xhtml   |  9 +++++++
 32 files changed, 532 insertions(+)
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1092053.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1140268-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1397439-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1403465.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1435015.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1555757-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1555757-2.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/1701975-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/306902-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/347506-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/355993-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/364686-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/368461-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/370884-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/382208-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/382396-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/384649-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/385265-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/385289-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/394150-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/395450-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/399676-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/400445-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/400904-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/410728-1.xml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/411603-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/413274-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/418007-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/467914-1.html
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/547843-1.xhtml
 create mode 100644 testing/web-platform/tests/mathml/crashtests/mozilla/700031.xhtml

(limited to 'testing/web-platform/tests/mathml/crashtests')

diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1092053.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1092053.html
new file mode 100644
index 0000000000..51b5858b6f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1092053.html
@@ -0,0 +1,20 @@
+﻿<!DOCTYPE html>
+<html>
+  <head>
+    <title>Largeop stretching</title>
+    <meta charset="utf-8"/>
+  </head>
+  <body>
+    <p>
+      <!-- &bigotimes; allows to check for an assertion involving
+           the direction of the largeop pre-stretch -->
+      <math displaystyle="true">
+        <mrow>
+          <mo id="mo4">(</mo>
+          <mo>&bigotimes;</mo>
+          <mo id="mo5">)</mo>
+        </mrow>
+      </math>
+    </p>
+  </body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1140268-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1140268-1.html
new file mode 100644
index 0000000000..5e5510ba7f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1140268-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset=utf-8>
+<script>
+function boom()
+{
+    var e = document.getElementsByTagName("mo")[0];
+    e.setAttribute("style", "position: absolute; top: 0px;");
+    document.documentElement.offsetHeight;
+    e.setAttribute("style", "position: absolute; top: 100px;");
+}
+</script>
+</head>
+<body onload="boom();">
+<math><mo>boom!</mo></math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1397439-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1397439-1.html
new file mode 100644
index 0000000000..b617f8e0ed
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1397439-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<math>
+<mstyle scriptlevel=101>
+<mstyle scriptlevel=-204>
+</math>
+
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1403465.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1403465.html
new file mode 100644
index 0000000000..924392757b
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1403465.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <math class="hidden">
+    <mi>x</mi>
+    <mo>=</mo>
+  </math>
+<script>
+window.onload = function() {
+  let s = document.createElement("style");
+  s.textContent = `
+    body {
+      line-height: 1.42857143;
+    }
+
+    .hidden {
+      display: none;
+    }
+  `;
+  document.body.appendChild(s);
+};
+</script>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1435015.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1435015.html
new file mode 100644
index 0000000000..329aaca22f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1435015.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<style>
+  div { display: contents; }
+</style>
+<math></math>
+<script>
+  let div = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'div');
+  document.querySelector('math').appendChild(div);
+</script>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-1.html
new file mode 100644
index 0000000000..04f2b27a60
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-1.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+    <style>
+        .class_1 {
+            transition-delay: 2129ms;
+            contain: strict;
+        }
+    </style>
+</head>
+<math>
+    <mover>
+        <ms></ms>
+        <mtable class="class_1"></mtable>
+    </mover>
+</math>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-2.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-2.html
new file mode 100644
index 0000000000..eff048784a
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1555757-2.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    #testElem {
+        border: 1px solid black;
+        background: yellow;
+        contain: layout size;
+        width: 300px;
+    }
+  </style>
+  <script>
+    function go() {
+        /* trigger an incremental reflow.
+         * Note: elem.style is undefined for MathML elements, so we have
+         * to use setAttribute().
+         */
+        testElem.setAttribute("style", "width:150px");
+    }
+  </script>
+</head>
+<body onload="go()">
+  <math>
+    <mtable id="testElem">Change my size</mtable>
+  </math>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/1701975-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/1701975-1.html
new file mode 100644
index 0000000000..c7d54ca996
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/1701975-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <style>
+        #id_0 {
+            font-size: 10000% ! important
+        }
+
+        * {
+            border-top-style: groove;
+        }
+    </style>
+
+</head>
+<math>
+    <semantics style='border-inline: 1000000em outset !important'>
+        <mmultiscripts id='id_0'></mmultiscripts>
+    </semantics>
+</math>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml
new file mode 100644
index 0000000000..ff0326816d
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/243159-2.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+      <body onload="run()">
+      <mathml:math id="test" style="display: block">
+      </mathml:math>
+<script>
+  function run() {
+    var t1 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+                                      "mtable");
+    var t2 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+                                      "mtable");
+    var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+                                      "mtr");
+    var r2 = document.createElementNS("http://www.w3.org/1998/Math/MathML",
+                                      "mtr");
+    var test =
+      document.getElementsByTagNameNS("http://www.w3.org/1998/Math/MathML", "math")[0];
+    t1.appendChild(r1);
+    test.appendChild(t1);
+    test.appendChild(t2);
+    t2.appendChild(r2);
+  }
+</script>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/306902-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/306902-1.xml
new file mode 100644
index 0000000000..24e8c068a0
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/306902-1.xml
@@ -0,0 +1,14 @@
+<?xml version='1.0'?>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<body>
+
+<math xmlns='http://www.w3.org/1998/Math/MathML' display='block'><msup>
+
+XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+</msup></math>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/347506-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/347506-1.xhtml
new file mode 100644
index 0000000000..4119389a56
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/347506-1.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<body>
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+
+  <mtable>
+    <mtr>
+       <mtd><mi>x</mi></mtd>
+       <mtd rowspan="4" columnspan="4"><mi>y</mi></mtd>
+    </mtr>
+    <mtr>
+       <mtd rowspan="0" columnspan="0"><mi>z</mi></mtd>
+       <mtd><mi>w</mi></mtd>
+    </mtr>
+  </mtable>
+
+
+</math></div>
+
+</body>
+
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/355993-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/355993-1.xhtml
new file mode 100644
index 0000000000..cbbddf013a
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/355993-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<style>
+body, body * { position: fixed;  }
+</style>
+</head>
+
+<body>
+
+
+<div>
+  <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+
+    <mtable>
+      <mtr>
+        <mtd>
+          <mn>1</mn>
+        </mtd>
+      </mtr>
+    </mtable>
+  </math>
+</div>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/364686-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/364686-1.xhtml
new file mode 100644
index 0000000000..add9238d8f
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/364686-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<body>
+
+<math:merror>
+  <img/>
+</math:merror>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/368461-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/368461-1.xhtml
new file mode 100644
index 0000000000..d5baccf523
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/368461-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<head>
+</head>
+
+<body>
+
+<math:msubsup><span>Foo bar baz<td></td></span></math:msubsup>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/370884-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/370884-1.xhtml
new file mode 100644
index 0000000000..3959d4b178
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/370884-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+
+<body>
+
+<math:mroot>
+  <div>
+    <div style="position: fixed;">Y</div>
+  </div>
+</math:mroot>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/382208-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/382208-1.xhtml
new file mode 100644
index 0000000000..88d2728bfe
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/382208-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<body>
+
+<div><math:mfrac><math:mmultiscripts/><math:mi/></math:mfrac></div>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/382396-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/382396-1.xhtml
new file mode 100644
index 0000000000..89af7ea18d
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/382396-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<body>
+
+a<math:ms/>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/384649-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/384649-1.xhtml
new file mode 100644
index 0000000000..e2ba50cdee
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/384649-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+
+/* use attribute selector instead of the .class shorthand to work around bug 379178 */
+
+*[class="fixed"] { position: fixed; }
+
+math, mtable, mtr { position: inherit; }
+
+</style>
+</head>
+
+<body>
+
+<div class="fixed">
+  <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+    <mtable>
+      <mtr class="fixed">
+        <mtd><mi>x</mi></mtd>
+      </mtr>
+      <mtr>
+        <mtd><mi>y</mi></mtd>
+      </mtr>
+    </mtable>
+  </math>
+</div>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/385265-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/385265-1.xhtml
new file mode 100644
index 0000000000..7994653ffa
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/385265-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+  <mtable>
+    <mtr>
+      <mtd><mi>x</mi></mtd>
+    </mtr>
+  </mtable>
+</math>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/385289-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/385289-1.xhtml
new file mode 100644
index 0000000000..8f0e871aaf
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/385289-1.xhtml
@@ -0,0 +1,30 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var mss = document.getElementById("mss");
+
+  var j = document.createTextNode("j");
+  var comb = document.createTextNode("\u0302");
+
+  mss.appendChild(j);
+  mss.appendChild(comb);
+}
+</script>
+</head>
+
+<body onload="boom()">
+
+<div>
+  <math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+    <msub id="mss">
+      <mi>v</mi>
+      <mn>1</mn>
+    </msub>
+  </math>
+</div>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/394150-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/394150-1.xhtml
new file mode 100644
index 0000000000..ee54a8dd3b
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/394150-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+<script>
+
+function boom()
+{
+  var ms = document.createElementNS("http://www.w3.org/1998/Math/MathML", "ms");
+  var textNode = document.getElementById("emptyset").firstChild;
+  var mrow = document.getElementById("mrow");
+
+  ms.appendChild(textNode); // *move* the text node from one place to another!
+  mrow.appendChild(ms);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+<merror><emptyset id="emptyset">
+  <mrow id="mrow"></mrow></emptyset></merror>
+</math>
+
+</body>
+
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/395450-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/395450-1.xhtml
new file mode 100644
index 0000000000..79510267ba
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/395450-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<head>
+<style>
+
+/*
+  This testcase uses [class~="foo"] instead of .foo to work around bug 276267
+  (see bug 379178 comment 78)
+*/
+
+[class~="abs"] { position: absolute; }
+[class~="marg"] { margin: 1em; }
+[class="noheight"] {  height: 0; }
+
+</style>
+</head>
+
+<body>
+
+<math:mrow class="noheight">
+  <span class="abs">
+    <math:mroot class="abs marg" />
+    <span class="abs" />
+  </span>
+</math:mrow>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/399676-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/399676-1.xhtml
new file mode 100644
index 0000000000..82b547e5ea
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/399676-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+<body>
+<math:mtd><span style="float: right;" /></math:mtd>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/400445-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/400445-1.xhtml
new file mode 100644
index 0000000000..9cb71dbbd6
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/400445-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+<script>
+
+function boom()
+{
+  var mtd1 = document.getElementById("mtd1");
+  var mtd2 = document.getElementById("mtd2");
+  var newSpan = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+
+  mtd1.appendChild(newSpan);
+  mtd1.removeAttribute("columnspan");
+  mtd2.setAttribute("columnspan", 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<math:mtd id="mtd1" columnspan="5" /><math:mtd id="mtd2" />
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/400904-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/400904-1.xhtml
new file mode 100644
index 0000000000..a00f42fd02
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/400904-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var MATHML_NS = "http://www.w3.org/1998/Math/MathML";
+  var mtd = document.getElementById("mtd");
+  var n = document.createElementNS(MATHML_NS, 'mrow');
+  mtd.appendChild(n);
+  mtd.setAttribute('rowspan', 7);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<math:mtd id="mtd"></math:mtd><math:mtr><math:mrow></math:mrow></math:mtr>
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/410728-1.xml b/testing/web-platform/tests/mathml/crashtests/mozilla/410728-1.xml
new file mode 100644
index 0000000000..deaeb8fc55
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/410728-1.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC
+  "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN"
+  "http://www.w3.org/TR/MathML2/dtd/xhtml-math11-f.dtd"
+[
+  <!ENTITY mathml "http://www.w3.org/1998/Math/MathML">
+]>
+<math display="block" xmlns="&mathml;">
+  <mi>f &#x0332;</mi>
+  <mi>-</mi>
+  <mo>+</mo>
+  <mo> -</mo>
+  <mo>&#x0332;</mo>
+</math>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/411603-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/411603-1.html
new file mode 100644
index 0000000000..596565fbc3
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/411603-1.html
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+<body onload="document.getElementById('ms').setAttribute('scriptminsize', '9em');">
+<math:mstyle id="ms" /><span />
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/413274-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/413274-1.xhtml
new file mode 100644
index 0000000000..19d8fab0fd
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/413274-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+  <mstyle scriptsizemultiplier="8205" scriptlevel="15">
+    <mroot>
+      <mrow/>
+      <mrow>
+        <span xmlns="http://www.w3.org/1999/xhtml"/>
+      </mrow>
+    </mroot>
+  </mstyle>
+</math>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/418007-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/418007-1.xhtml
new file mode 100644
index 0000000000..f07a693444
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/418007-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+  <ms fontsize="8179em">
+    <span xmlns="http://www.w3.org/1999/xhtml">
+      <span>
+        <td>
+          <mfrac xmlns="http://www.w3.org/1998/Math/MathML">
+            <mfrac>
+              <mrow/>
+              <mrow/>
+            </mfrac>
+            <mrow/>
+          </mfrac>
+        </td>
+      </span>
+    </span>
+  </ms>
+</math>
+
+</body>
+</html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/467914-1.html b/testing/web-platform/tests/mathml/crashtests/mozilla/467914-1.html
new file mode 100644
index 0000000000..4f518f09df
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/467914-1.html
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<mathml:munder style="transform: translate(50px);clip-path: url(#h);"/>
+</window>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/547843-1.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/547843-1.xhtml
new file mode 100644
index 0000000000..0ad086d90c
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/547843-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body><math xmlns="http://www.w3.org/1998/Math/MathML" style="display: table;"/><div style="position: fixed;"></div></body></html>
diff --git a/testing/web-platform/tests/mathml/crashtests/mozilla/700031.xhtml b/testing/web-platform/tests/mathml/crashtests/mozilla/700031.xhtml
new file mode 100644
index 0000000000..70f924279e
--- /dev/null
+++ b/testing/web-platform/tests/mathml/crashtests/mozilla/700031.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body>
+
+<div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML"><mover>abcdef</mover></math>
+
+</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
+
+</body></html>
-- 
cgit v1.2.3