Adding upstream version 1:115.7.0.upstream/1%115.7.0upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

58 files changed, 1007 insertions, 0 deletions

diff --git a/layout/xul/crashtests/131008-1.xhtml b/layout/xul/crashtests/131008-1.xhtml
new file mode 100644
index 0000000000..fe15a46aa6
--- /dev/null
+++ b/layout/xul/crashtests/131008-1.xhtml
@@ -0,0 +1,11 @@
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns:html="http://www.w3.org/1999/xhtml"
+	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+	xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+	id="MainWindow"
+	title="IWindow Test">
+<div style="display: block; position:absolute">abc</div>
+
+
+</window>
diff --git a/layout/xul/crashtests/137216-1.xhtml b/layout/xul/crashtests/137216-1.xhtml
new file mode 100644
index 0000000000..e01541c622
--- /dev/null
+++ b/layout/xul/crashtests/137216-1.xhtml
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>

+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

+	<iframe style="position:absolute; display: block;"/>

+</window>

diff --git a/layout/xul/crashtests/1379332-2.xhtml b/layout/xul/crashtests/1379332-2.xhtml
new file mode 100644
index 0000000000..cab6145c44
--- /dev/null
+++ b/layout/xul/crashtests/1379332-2.xhtml
@@ -0,0 +1,9 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <hbox style="position: relative;visibility: collapse;">
+    <hbox style="padding:5px; border: 5px solid black">
+      <hbox style="position: absolute; display: block; width: 10px; height: 10px">
+      </hbox>
+    </hbox>
+  </hbox>
+</window>
diff --git a/layout/xul/crashtests/140218-1.xml b/layout/xul/crashtests/140218-1.xml
new file mode 100644
index 0000000000..311afc2188
--- /dev/null
+++ b/layout/xul/crashtests/140218-1.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>

+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

+      <treechildren style = " display: block; " />

+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/151826-1.xhtml b/layout/xul/crashtests/151826-1.xhtml
new file mode 100644
index 0000000000..bb8ee2e200
--- /dev/null
+++ b/layout/xul/crashtests/151826-1.xhtml
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>

+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>

+

+<window

+   title      = "Arrowscrollbox->Splitter Crash Testcase"

+   xmlns      = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"

+   xmlns:html="http://www.w3.org/1999/xhtml"

+   width      = "300"

+   height     = "200"

+   orient     = "vertical"

+>

+<vbox flex="1">

+

+<scrollbox flex="1">

+<vbox flex="1">

+<vbox id="box_1">

+<hbox><label value="Test"/></hbox>

+</vbox>

+<splitter collapse="none"/>

+<vbox id="box_2">

+<hbox><label value="Test"/></hbox>

+</vbox>

+</vbox>

+</scrollbox>

+

+</vbox>

+</window>
diff --git a/layout/xul/crashtests/168724-1.xhtml b/layout/xul/crashtests/168724-1.xhtml
new file mode 100644
index 0000000000..61d4f48327
--- /dev/null
+++ b/layout/xul/crashtests/168724-1.xhtml
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>

+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css" ?>

+

+<window

+  id="nodeCreator" title="Node Creator"

+  xmlns:html="http://www.w3.org/1999/xhtml"

+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"

+  >

+<description context="context">Right-click here, and expect a crash.</description>

+

+<popupset id="context-set">

+<popup id="context">

+<deck selectedItem="0">

+<menuitem label="You should never see this" />

+</deck>

+</popup>

+</popupset>

+</window>
diff --git a/layout/xul/crashtests/289410-1.xhtml b/layout/xul/crashtests/289410-1.xhtml
new file mode 100644
index 0000000000..fa235b607e
--- /dev/null
+++ b/layout/xul/crashtests/289410-1.xhtml
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window id="crash-window"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <scrollbox>
+    <tree id="crash-tree">
+      <treecols/>
+      <treechildren/>
+    </tree>
+  </scrollbox>
+
+</window>
diff --git a/layout/xul/crashtests/291702-1.xhtml b/layout/xul/crashtests/291702-1.xhtml
new file mode 100644
index 0000000000..6b36046d16
--- /dev/null
+++ b/layout/xul/crashtests/291702-1.xhtml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window title="Negative flex bug #2"
+		orient="horizontal"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <button label="Button" style="-moz-box-flex: 2"/>
+  <label value="This is a label" style="-moz-box-flex: 1"/>
+  <label value="This is the second label" style="-moz-box-flex: -2"/>
+  <label value="This is another label" style="-moz-box-flex: -1"/>
+</window>
diff --git a/layout/xul/crashtests/291702-2.xhtml b/layout/xul/crashtests/291702-2.xhtml
new file mode 100644
index 0000000000..a47dbbdd41
--- /dev/null
+++ b/layout/xul/crashtests/291702-2.xhtml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window title="Negative flex bug #2"
+		orient="horizontal"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <button label="Button" style="-moz-box-flex: 1073741824"/>
+  <label value="This is a label" style="-moz-box-flex: 1073741824"/>
+  <label value="This is the second label" style="-moz-box-flex: 1073741824"/>
+  <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+</window>
diff --git a/layout/xul/crashtests/291702-3.xhtml b/layout/xul/crashtests/291702-3.xhtml
new file mode 100644
index 0000000000..6f947f4887
--- /dev/null
+++ b/layout/xul/crashtests/291702-3.xhtml
@@ -0,0 +1,137 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window title="Negative flex bug #2"
+		orient="vertical"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+  </hbox>
+
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+  </hbox>
+
+
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" style="-moz-box-flex: 1"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" style="-moz-box-flex: 1"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" style="-moz-box-flex: 1"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" style="-moz-box-flex: 2"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" style="-moz-box-flex: 2"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" style="-moz-box-flex: 1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" style="-moz-box-flex: 2"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+</window>
diff --git a/layout/xul/crashtests/294371-1.xhtml b/layout/xul/crashtests/294371-1.xhtml
new file mode 100644
index 0000000000..ca5b54914a
--- /dev/null
+++ b/layout/xul/crashtests/294371-1.xhtml
@@ -0,0 +1,53 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window
+  id    = "overflow crash"
+  title = "scrollbox crasher"
+  xmlns = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+	persist="sizemode width height screenX screenY"
+	width="320"
+	height="240">
+
+	<scrollbox flex="1">
+			<grid style="overflow: auto">
+				<columns>
+					<column flex="0"/>
+				</columns>
+				<rows>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+				</rows>
+			</grid>
+		</scrollbox>
+
+</window>
diff --git a/layout/xul/crashtests/322786-1.xhtml b/layout/xul/crashtests/322786-1.xhtml
new file mode 100644
index 0000000000..79bb092c4b
--- /dev/null
+++ b/layout/xul/crashtests/322786-1.xhtml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <foo style="display: inline;">
+    <scrollbox/>
+  </foo>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/325377.xhtml b/layout/xul/crashtests/325377.xhtml
new file mode 100644
index 0000000000..8ea30473d8
--- /dev/null
+++ b/layout/xul/crashtests/325377.xhtml
@@ -0,0 +1,16 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml"
+ title="Testcase bug 325377 - Crash on reload with evil xul textcase, using menulist and nested tooltips">
+<menulist style="display: table-cell;">
+<tooltip style="display: none;">
+    <tooltip/>
+</tooltip>
+</menulist>
+
+<html:script>
+function removestyles(){
+document.getElementsByTagName('tooltip')[0].removeAttribute('style');
+}
+try { document.getElementsByTagName('tooltip')[0].offsetHeight; } catch(e) {}
+setTimeout(removestyles,0);
+</html:script>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/326879-1.xhtml b/layout/xul/crashtests/326879-1.xhtml
new file mode 100644
index 0000000000..26965ae65e
--- /dev/null
+++ b/layout/xul/crashtests/326879-1.xhtml
@@ -0,0 +1,31 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+
+
+<script>
+
+
+function init() { 
+
+  var menupopup = document.getElementsByTagName("menupopup")[0];
+  menupopup.style.MozBoxOrdinalGroup = null;
+};
+
+
+window.addEventListener("load", init, false);
+
+</script>
+
+
+<menulist>
+  <menupopup>
+    <menuitem label="Foo"/>
+  </menupopup>
+</menulist>
+
+        
+
+</window>
diff --git a/layout/xul/crashtests/329327-1.xhtml b/layout/xul/crashtests/329327-1.xhtml
new file mode 100644
index 0000000000..fcfed07c4c
--- /dev/null
+++ b/layout/xul/crashtests/329327-1.xhtml
@@ -0,0 +1,2 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><menulist equalsize="always"><y/> <z width="-444981589286"/> </menulist></window>
diff --git a/layout/xul/crashtests/329407-1.xml b/layout/xul/crashtests/329407-1.xml
new file mode 100644
index 0000000000..0d41c0185f
--- /dev/null
+++ b/layout/xul/crashtests/329407-1.xml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      >
+
+<body>
+
+  <xul:hbox>
+    <select/>
+    <select/>
+  </xul:hbox>
+
+</body>
+
+</html>
diff --git a/layout/xul/crashtests/336962-1.xhtml b/layout/xul/crashtests/336962-1.xhtml
new file mode 100644
index 0000000000..bd2129a853
--- /dev/null
+++ b/layout/xul/crashtests/336962-1.xhtml
@@ -0,0 +1,18 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<script>

+
+function init() {
+  document.getElementById("foopy").style.display = "block";
+  document.getElementById("foopy").style.position = "absolute";
+}

+
+window.addEventListener("load", init, 0);

+
+</script>
+
+
+<box id="foopy" />
+
+
+</window>
diff --git a/layout/xul/crashtests/344228-1.xhtml b/layout/xul/crashtests/344228-1.xhtml
new file mode 100644
index 0000000000..d6015707bd
--- /dev/null
+++ b/layout/xul/crashtests/344228-1.xhtml
@@ -0,0 +1,27 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(boom, 30);" class="reftest-wait">
+
+<script>
+
+function remove(q1) { q1.parentNode.removeChild(q1); } 
+
+function boom()
+{
+  var x = document.getElementById("x");
+  var y = document.getElementById("y");
+  remove(x);
+  remove(y);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<tree>
+  <treechildren id="y"/>
+  <richlistbox>
+    <hbox id="x"/>
+    <menulist/>
+  </richlistbox>
+</tree>
+
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/365151.xhtml b/layout/xul/crashtests/365151.xhtml
new file mode 100644
index 0000000000..001707f4eb
--- /dev/null
+++ b/layout/xul/crashtests/365151.xhtml
@@ -0,0 +1,39 @@
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="boom()" class="reftest-wait">
+
+
+<script>
+function boom()
+{
+ try {
+  var tree = document.getElementById("tree");
+  var col = tree.columns.getFirstColumn();
+  var treecols = document.getElementById("treecols");
+  treecols.parentNode.removeChild(treecols);
+  var x = col.x;
+ } finally {
+  document.documentElement.removeAttribute("class");
+ }
+}
+</script>
+
+
+<tree rows="6" id="tree">
+
+  <treecols id="treecols">
+      <treecol id="firstname" label="First Name"/>
+  </treecols>
+
+  <treechildren id="treechildren">
+    <treeitem>
+      <treerow>
+        <treecell label="Bob"/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+
+</tree>
+
+</window>
diff --git a/layout/xul/crashtests/366112-1.xhtml b/layout/xul/crashtests/366112-1.xhtml
new file mode 100644
index 0000000000..ff95a722f3
--- /dev/null
+++ b/layout/xul/crashtests/366112-1.xhtml
@@ -0,0 +1,9 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <nativescrollbar />
+
+</window>
diff --git a/layout/xul/crashtests/366203-1.xhtml b/layout/xul/crashtests/366203-1.xhtml
new file mode 100644
index 0000000000..5d97782ea3
--- /dev/null
+++ b/layout/xul/crashtests/366203-1.xhtml
@@ -0,0 +1,40 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(boom, 500);">
+
+<script>
+function boom()
+{
+  tc1 = document.getElementById("tc1");
+  tc1.parentNode.removeChild(tc1);
+}
+</script>
+
+<tree rows="6">
+  <treecols>
+      <treecol id="firstname" label="First Name" primary="true" style="-moz-box-flex: 3"/>
+      <treecol id="lastname" label="Last Name" style="-moz-box-flex: 7"/>
+  </treecols>
+
+  <treechildren id="tc1">
+    <treeitem container="true" open="true">
+      <treerow>
+        <treecell label="Foo"/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+
+  <treechildren>
+    <treeitem container="true" open="true">
+      <treerow>
+        <treecell label="Bar"/>
+      </treerow>
+    </treeitem>
+  </treechildren>
+</tree>
+
+
+</window>
+
diff --git a/layout/xul/crashtests/367185-1.xhtml b/layout/xul/crashtests/367185-1.xhtml
new file mode 100644
index 0000000000..08fd39fa11
--- /dev/null
+++ b/layout/xul/crashtests/367185-1.xhtml
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>

+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"

+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

+<head>

+<title>Testcase bug - ASSERTION: shouldn't use unconstrained widths anymore with nested marquees</title>

+</head>

+<body>

+<xul:hbox style="margin: 0 100%;"><span><xul:hbox style="margin: 0 100%;"></xul:hbox></span></xul:hbox>

+</body>

+</html>

diff --git a/layout/xul/crashtests/369942-1.xhtml b/layout/xul/crashtests/369942-1.xhtml
new file mode 100644
index 0000000000..a05705843d
--- /dev/null
+++ b/layout/xul/crashtests/369942-1.xhtml
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml"

+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"

+      class="reftest-wait">

+<head>

+

+<script>

+function boom()

+{

+  var span = document.getElementById("span");

+  var radio = document.getElementById("radio");

+  

+  radio.appendChild(span);

+  

+  document.documentElement.removeAttribute("class");

+}

+</script>

+

+

+<style>

+body {

+	text-align: center;

+	font-size: 9px;

+}

+</style>

+

+</head>

+

+

+<body onload="setTimeout(boom, 30);">

+

+<span id="span"><xul:wizard/><div>Industries</div></span>

+

+<xul:radio id="radio"/>

+

+</body>

+</html>

diff --git a/layout/xul/crashtests/376137-1.html b/layout/xul/crashtests/376137-1.html
new file mode 100644
index 0000000000..33d706f9c1
--- /dev/null
+++ b/layout/xul/crashtests/376137-1.html
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+span { display:block; outline: 10px solid yellow; }
+</style>
+</head>
+
+<body>
+
+<div>
+  <div style="display: -moz-inline-box">
+    <span>M</span>
+    <span>N</span>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/376137-2.html b/layout/xul/crashtests/376137-2.html
new file mode 100644
index 0000000000..d3abb2d838
--- /dev/null
+++ b/layout/xul/crashtests/376137-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>

+<title>Bug 376137</title>

+<style>

+p { width: 100%; border: solid 1px;}

+</style>

+

+<div style="display: -moz-inline-box">

+  <div><p>M</p></div>

+  <div><p>N</p></div>

+</div>

+

diff --git a/layout/xul/crashtests/378961.html b/layout/xul/crashtests/378961.html
new file mode 100644
index 0000000000..42e9a64bd8
--- /dev/null
+++ b/layout/xul/crashtests/378961.html
@@ -0,0 +1,9 @@
+<html>

+<head>

+<title>Testcase bug 378961 - Crash [@ nsSplitterFrameInner::RemoveListener] when dragging splitter and DOMAttrModified event removing window</title>

+</head>

+<body>

+<iframe src="data:application/xhtml+xml;charset=utf-8,%3C%3Fxml%20version%3D%221.0%22%3F%3E%0A%3C%3Fxml-stylesheet%20href%3D%22chrome%3A//global/skin%22%20type%3D%22text/css%22%3F%3E%0A%3Cwindow%20xmlns%3D%22http%3A//www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%22%20orient%3D%22horizontal%22%3E%0A%3Ctextbox/%3E%3Csplitter/%3E%3Cbox/%3E%0A%0A%3Cscript%20xmlns%3D%22http%3A//www.w3.org/1999/xhtml%22%3E%0Afunction%20doe%28%29%20%7B%0Awindow.frameElement.parentNode.removeChild%28window.frameElement%29%3B%0A%7D%0Adocument.addEventListener%28%27DOMAttrModified%27%2C%20doe%2C%20true%29%3B%0A%3C/script%3E%0A%3C/window%3E" style="width: 500px;height:200px;"></iframe>

+

+</body>

+</html>

diff --git a/layout/xul/crashtests/381862.html b/layout/xul/crashtests/381862.html
new file mode 100644
index 0000000000..65721d1a3f
--- /dev/null
+++ b/layout/xul/crashtests/381862.html
@@ -0,0 +1,23 @@
+<html><head>

+<title>Testcase bug - Crash [@ nsBoxFrame::BuildDisplayListForChildren] with tree stuff in iframe toggling display</title>

+</head>

+<body>

+<iframe src="data:application/xhtml+xml;charset=utf-8,%3Cwindow%20xmlns%3D%22http%3A//www.mozilla.org/keymaster/gatekeeper/there.is.only.xul%22%3E%0A%20%20%3Ctree%20style%3D%22display%3A%20block%3B%20position%3A%20absolute%3B%22%3E%0A%20%20%20%20%3Ctree%20style%3D%22display%3A%20table%3B%22%3E%0A%20%20%20%20%20%20%3Ctreeseparator%20style%3D%22display%3A%20block%3B%20position%3A%20absolute%3B%22%3E%0A%20%20%20%20%20%20%20%20%3Ctreechildren%20style%3D%22display%3A%20block%3B%22/%3E%0A%20%20%20%20%20%20%3C/treeseparator%3E%0A%20%20%20%20%20%20%3Ctreechildren%20style%3D%22display%3A%20none%3B%22/%3E%0A%20%20%20%20%3C/tree%3E%0A%20%20%3C/tree%3E%0A%3C/window%3E" id="content"></iframe>

+

+<script>

+function toggleIframe(){

+var x=document.getElementById('content');

+x.style.display = x.style.display == 'none' ? x.style.display = 'block' : x.style.display = 'none';

+setTimeout(toggleIframe,200);

+}

+setTimeout(toggleIframe,500);

+

+function removestyles(i){

+window.frames[0].document.getElementsByTagName('*')[1].removeAttribute('style');

+}

+

+setTimeout(removestyles,500,1);

+/*template*/

+</script>

+</body>

+</html>

diff --git a/layout/xul/crashtests/382746-1.xhtml b/layout/xul/crashtests/382746-1.xhtml
new file mode 100644
index 0000000000..c76a1531cd
--- /dev/null
+++ b/layout/xul/crashtests/382746-1.xhtml
@@ -0,0 +1,15 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<grid>
+  <rows>
+    <column>
+      <hbox/>
+      <hbox/>
+    </column>
+    <hbox/>
+  </rows>
+</grid>
+
+</window>
diff --git a/layout/xul/crashtests/382899-1.xhtml b/layout/xul/crashtests/382899-1.xhtml
new file mode 100644
index 0000000000..4b48eac240
--- /dev/null
+++ b/layout/xul/crashtests/382899-1.xhtml
@@ -0,0 +1,9 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<hbox equalsize="always"><grid/>x</hbox>
+
+</window>
diff --git a/layout/xul/crashtests/384037-1.xhtml b/layout/xul/crashtests/384037-1.xhtml
new file mode 100644
index 0000000000..04bac671cc
--- /dev/null
+++ b/layout/xul/crashtests/384037-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" 

+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">

+<body>

+

+<xul:splitter id="s" collapse="both" state="collapsed" />

+

+</body>

+</html>

+

diff --git a/layout/xul/crashtests/384105-1-inner.xhtml b/layout/xul/crashtests/384105-1-inner.xhtml
new file mode 100644
index 0000000000..ea9c0be8ad
--- /dev/null
+++ b/layout/xul/crashtests/384105-1-inner.xhtml
@@ -0,0 +1,21 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">
+function doe(){
+document.getElementById('a').removeAttribute('style');
+}
+setTimeout(doe,100);
+</script>
+<box id="a" style="position: absolute; display: block;">
+  <menuitem sizetopopup="always">
+    <menupopup style="position: absolute; display: block;"/>
+  </menuitem>
+
+  <box style="position: fixed; display: block;">
+    <tree>
+      <treecol>
+        <treecol/>
+      </treecol>
+    </tree>
+  </box>
+</box>
+</window>
diff --git a/layout/xul/crashtests/384105-1.html b/layout/xul/crashtests/384105-1.html
new file mode 100644
index 0000000000..8161342ec8
--- /dev/null
+++ b/layout/xul/crashtests/384105-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="384105-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/layout/xul/crashtests/384373-1.xhtml b/layout/xul/crashtests/384373-1.xhtml
new file mode 100644
index 0000000000..603b53cdea
--- /dev/null
+++ b/layout/xul/crashtests/384373-1.xhtml
@@ -0,0 +1,10 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" 

+onerror="var x=document.getElementsByTagName('*');x[Math.floor(Math.random()*x.length)].focus()"

+onblur="event.originalTarget.parentNode.parentNode.removeChild(event.originalTarget.parentNode)">

+<script xmlns="http://www.w3.org/1999/xhtml">setTimeout(function() {window.location.reload()}, 200);</script>

+

+<broadcasterset style="display: block;">

+  <broadcaster style="display: block;"></broadcaster>

+</broadcasterset>

+<preferences></preferences>

+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/384373-2.xhtml b/layout/xul/crashtests/384373-2.xhtml
new file mode 100644
index 0000000000..1d56394e31
--- /dev/null
+++ b/layout/xul/crashtests/384373-2.xhtml
@@ -0,0 +1,4 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onerror="document.getElementsByTagName('*')[1].focus()" onfocus="event.target.parentNode.removeChild(event.target)">

+<broadcaster style="display: block;"/>

+<preferences/>

+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/384373.html b/layout/xul/crashtests/384373.html
new file mode 100644
index 0000000000..a3658b86f8
--- /dev/null
+++ b/layout/xul/crashtests/384373.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+    <meta charset="utf-8">
+    <title>Testcase for bug 384373</title>
+<script>
+function reload() {
+  this.location.reload();
+}
+// Run the test for 1 second
+setTimeout(function() {
+    document.body.getBoundingClientRect();
+    document.documentElement.removeChild(document.body);
+    document.documentElement.className = "";
+  }, 2000);
+</script>
+</head>
+<body onload="document.body.getBoundingClientRect()">
+
+<iframe src="384373-1.xhtml"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,500)" src="384373-2.xhtml"></iframe>
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/384871-1-inner.xhtml b/layout/xul/crashtests/384871-1-inner.xhtml
new file mode 100644
index 0000000000..62efdb2608
--- /dev/null
+++ b/layout/xul/crashtests/384871-1-inner.xhtml
@@ -0,0 +1,9 @@
+<popup xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<script xmlns="http://www.w3.org/1999/xhtml">
+function doe(){
+document.documentElement.autoPosition = 'on';
+window.location.reload();
+}
+setTimeout(doe, 300);
+</script>
+</popup>
\ No newline at end of file
diff --git a/layout/xul/crashtests/384871-1.html b/layout/xul/crashtests/384871-1.html
new file mode 100644
index 0000000000..bcd9f98bc8
--- /dev/null
+++ b/layout/xul/crashtests/384871-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+<body>
+<iframe src="384871-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/layout/xul/crashtests/386642.xhtml b/layout/xul/crashtests/386642.xhtml
new file mode 100644
index 0000000000..50db21a095
--- /dev/null
+++ b/layout/xul/crashtests/386642.xhtml
@@ -0,0 +1,31 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        title="Bug 386642 Crash [@ IsCanvasFrame] while opening context menu or changing styles">
+<toolbarbutton type="menu" id="a">
+<menupopup id="b"/>
+</toolbarbutton>
+
+<style xmlns="http://www.w3.org/1999/xhtml">
+.one image {
+display: -moz-box;
+}
+image{
+display: none;
+}
+
+</style>
+<script><![CDATA[
+var gg=0;
+function doe() {
+  var a = document.getElementById('a');
+  if (!a.hasAttribute('class')) {
+    a.setAttribute('class', 'one');
+  } else {
+    a.removeAttribute('class');
+  }
+document.getElementById('b').hidePopup();
+}
+
+doe();
+setInterval(doe, 200);
+]]></script>
+</window>
diff --git a/layout/xul/crashtests/387080-1.xhtml b/layout/xul/crashtests/387080-1.xhtml
new file mode 100644
index 0000000000..4eb9bd784b
--- /dev/null
+++ b/layout/xul/crashtests/387080-1.xhtml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <description>
+    <foo height="1793689537164611773" width="20000238421986669650" />
+  </description>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/391974-1-inner.xhtml b/layout/xul/crashtests/391974-1-inner.xhtml
new file mode 100644
index 0000000000..f13aa2110f
--- /dev/null
+++ b/layout/xul/crashtests/391974-1-inner.xhtml
@@ -0,0 +1,19 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<menuitem>
+<tooltip/>
+<box/>
+</menuitem>
+
+<script xmlns="http://www.w3.org/1999/xhtml">
+function doe2() {
+document.getElementsByTagName('menuitem')[0].setAttribute('description', 'tetx');
+}
+
+function doe3() {
+document.getElementsByTagName('menuitem')[0].removeAttribute('description');
+document.getElementsByTagName('tooltip')[0].setAttribute('ordinal', '0');
+}
+setTimeout(doe2,150);
+setTimeout(doe3,200);
+</script>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/391974-1.html b/layout/xul/crashtests/391974-1.html
new file mode 100644
index 0000000000..6946d66182
--- /dev/null
+++ b/layout/xul/crashtests/391974-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="391974-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/layout/xul/crashtests/402912-1.xhtml b/layout/xul/crashtests/402912-1.xhtml
new file mode 100644
index 0000000000..b2cb98dc5a
--- /dev/null
+++ b/layout/xul/crashtests/402912-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body>
+<xul:vbox equalsize="always"><xul:hbox flex="1"><span><xul:hbox width="10" height="10"/></span><xul:button /></xul:hbox><xul:hbox maxheight="0"/></xul:vbox>
+</body>
+</html>
diff --git a/layout/xul/crashtests/404192.xhtml b/layout/xul/crashtests/404192.xhtml
new file mode 100644
index 0000000000..4ad5af348b
--- /dev/null
+++ b/layout/xul/crashtests/404192.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait">

+<xul:titlebar id="a" style="overflow: auto;"/>

+

+<script>

+function doe() {

+document.getElementsByTagName('*')[1].focus();

+document.getElementsByTagName('*')[0].focus();

+document.documentElement.removeAttribute("class");

+}

+setTimeout(doe, 200);

+</script>

+</html>

diff --git a/layout/xul/crashtests/408904-1.xhtml b/layout/xul/crashtests/408904-1.xhtml
new file mode 100644
index 0000000000..59f215c73b
--- /dev/null
+++ b/layout/xul/crashtests/408904-1.xhtml
@@ -0,0 +1 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><grid><rows><label/></rows><columns><column><label/></column></columns></grid></window>
diff --git a/layout/xul/crashtests/412479-1.xhtml b/layout/xul/crashtests/412479-1.xhtml
new file mode 100644
index 0000000000..b1086a816e
--- /dev/null
+++ b/layout/xul/crashtests/412479-1.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head></head>
+<body><xul:menubar style="display: table-column; padding: 10px 3000px;"/></body>
+</html>
diff --git a/layout/xul/crashtests/417509.xhtml b/layout/xul/crashtests/417509.xhtml
new file mode 100644
index 0000000000..81703ada37
--- /dev/null
+++ b/layout/xul/crashtests/417509.xhtml
@@ -0,0 +1,7 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<span id="a" datasources="" xmlns="http://www.w3.org/1999/xhtml"/>
+<script xmlns="http://www.w3.org/1999/xhtml">
+document.documentElement.appendChild(document.getElementById('a'));
+
+</script>
+</window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/430356-1.xhtml b/layout/xul/crashtests/430356-1.xhtml
new file mode 100644
index 0000000000..8e7858904f
--- /dev/null
+++ b/layout/xul/crashtests/430356-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="visibility: collapse;">
+<tabpanels xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" style="width: max-content;"></tabpanels>
+</body>
+</html>
diff --git a/layout/xul/crashtests/464407-1.xhtml b/layout/xul/crashtests/464407-1.xhtml
new file mode 100644
index 0000000000..83666a6a46
--- /dev/null
+++ b/layout/xul/crashtests/464407-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+</head>
+<body>
+
+<xul:radio style="overflow: auto; height: 72057594037927940pt; display: table-cell;"/>
+
+</body>
+</html>
diff --git a/layout/xul/crashtests/470063-1.html b/layout/xul/crashtests/470063-1.html
new file mode 100644
index 0000000000..11c01b30e4
--- /dev/null
+++ b/layout/xul/crashtests/470063-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.removeChild(document.documentElement)
+  document.appendChild(document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "hbox"));
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/xul/crashtests/470272.html b/layout/xul/crashtests/470272.html
new file mode 100644
index 0000000000..5caf12d636
--- /dev/null
+++ b/layout/xul/crashtests/470272.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+function doe2(i) {
+document.documentElement.offsetHeight;
+document.getElementById('a').setAttribute('style', 'display: -moz-inline-box;');
+document.documentElement.offsetHeight;
+}
+</script>
+</head>
+<body style="float: right; column-count: 2; height: 20%;" onload="setTimeout(doe2,0);">
+  <div style="display: none;"></div>
+  <ul style="display: -moz-inline-box;"></ul>
+  <span id="a">
+    <ul style="display: -moz-box; overflow: scroll;"></ul>
+      <span style="display: -moz-inline-box; height: 10px;">
+        <span style="position: absolute;"></span>
+      </span>
+  </span>
+</body>
+</html>
diff --git a/layout/xul/crashtests/538308-1.xhtml b/layout/xul/crashtests/538308-1.xhtml
new file mode 100644
index 0000000000..477c725ed1
--- /dev/null
+++ b/layout/xul/crashtests/538308-1.xhtml
@@ -0,0 +1,32 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+        onload="run()">
+
+    <tree id="tr" flex="1">
+        <treecols>
+            <treecol/>
+        </treecols>
+        <treechildren>
+            <html:optgroup id="group">
+                <html:option id="victim" label="never see this"/>
+            </html:optgroup>
+        </treechildren>
+    </tree>
+
+    <script type="text/javascript"><![CDATA[
+    function run() {
+        group = document.getElementById("group");
+        tc = document.createXULElement("treechildren");
+        group.appendChild(tc);
+
+        v = document.getElementById("victim");
+        v.remove();
+        v = null;
+
+        tree = document.getElementById("tr");
+        col = tree.columns[0];
+        alert(tree.view.getItemAtIndex(1, col)); 
+    }
+    ]]></script>
+</window>
diff --git a/layout/xul/crashtests/557174-1.xml b/layout/xul/crashtests/557174-1.xml
new file mode 100644
index 0000000000..02850a2db9
--- /dev/null
+++ b/layout/xul/crashtests/557174-1.xml
@@ -0,0 +1 @@
+<ther:window xmlns:ther="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" a="" e=""><HTML><ther:statusbar l="" c=""><ther:menulist d=""><ther:menu t="" i="" l=""><mat:h xmlns:mat="http://www.w3.org/1998/Math/MathML" w=""/></ther:menu><ther:menupopup p=""/><ther:menu a="" t="" l=""><ther:menuseparator u="" x=""><xht:html xmlns:xht="http://www.w3.org/1999/xhtml" x=""><xht:body d=""><xht:abbr d=""><xht:abbr p=""><xht:small s=""><xht:a s=""><xht:var e=""><xht:samp e=""><xht:code p=""><xht:b e=""><xht:b d=""><xht:del t=""><xht:h4 r=""><xht:var l=""><xht:i r=""><xht:em r=""><xht:em n=""><xht:map g=""><xht:isindex d=""/></xht:map></xht:em></xht:em></xht:i></xht:var></xht:h4></xht:del></xht:b></xht:b></xht:code></xht:samp></xht:var></xht:a></xht:small></xht:abbr></xht:abbr></xht:body></xht:html></ther:menuseparator></ther:menu></ther:menulist></ther:statusbar></HTML></ther:window>
\ No newline at end of file
diff --git a/layout/xul/crashtests/564705-1.xhtml b/layout/xul/crashtests/564705-1.xhtml
new file mode 100644
index 0000000000..b0f29bef7a
--- /dev/null
+++ b/layout/xul/crashtests/564705-1.xhtml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><label value="&#x2026;" accesskey="b"></label></window>
+
diff --git a/layout/xul/crashtests/583957-1.html b/layout/xul/crashtests/583957-1.html
new file mode 100644
index 0000000000..48d29fc1c6
--- /dev/null
+++ b/layout/xul/crashtests/583957-1.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  window.addEventListener("DOMSubtreeModified", function(){});
+
+  var m = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "menuitem");
+  document.body.appendChild(m);
+  m.setAttribute("type", "checkbox");
+  m.setAttribute("checked", "true");
+  m.removeAttribute("type");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/xul/crashtests/617089.html b/layout/xul/crashtests/617089.html
new file mode 100644
index 0000000000..22e5f6d535
--- /dev/null
+++ b/layout/xul/crashtests/617089.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <div style="display: -moz-inline-box;">
+      <table style="height: 101%;"><tbody><tr><td><div></div></td></tr></tbody></table>
+      <table style="height: 101%;"><tbody><tr><td><div></div></td></tr></tbody></table>
+    </div>
+  </body>
+</html>
diff --git a/layout/xul/crashtests/716503.html b/layout/xul/crashtests/716503.html
new file mode 100644
index 0000000000..250ad2ba40
--- /dev/null
+++ b/layout/xul/crashtests/716503.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+div::before {
+  content: "j";
+  display:-moz-inline-box;
+}
+</style>
+<body><div></div></body>
+</html>
diff --git a/layout/xul/crashtests/crashtests.list b/layout/xul/crashtests/crashtests.list
new file mode 100644
index 0000000000..3154435451
--- /dev/null
+++ b/layout/xul/crashtests/crashtests.list
@@ -0,0 +1,52 @@
+load chrome://reftest/content/crashtests/layout/xul/crashtests/131008-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/137216-1.xhtml
+load 140218-1.xml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/151826-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/168724-1.xhtml
+skip-if(Android) load chrome://reftest/content/crashtests/layout/xul/crashtests/289410-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/291702-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/291702-2.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/291702-3.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/294371-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/322786-1.xhtml
+skip-if(Android) load chrome://reftest/content/crashtests/layout/xul/crashtests/325377.xhtml
+skip-if(Android) load chrome://reftest/content/crashtests/layout/xul/crashtests/326879-1.xhtml
+skip-if(Android) load chrome://reftest/content/crashtests/layout/xul/crashtests/329327-1.xhtml
+load 329407-1.xml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/336962-1.xhtml
+skip-if(Android) load chrome://reftest/content/crashtests/layout/xul/crashtests/344228-1.xhtml
+skip-if(Android) load chrome://reftest/content/crashtests/layout/xul/crashtests/365151.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/366112-1.xhtml
+skip-if(Android) load chrome://reftest/content/crashtests/layout/xul/crashtests/366203-1.xhtml
+load 367185-1.xhtml
+load 369942-1.xhtml
+load 376137-1.html
+load 376137-2.html
+load 378961.html
+load 381862.html
+load chrome://reftest/content/crashtests/layout/xul/crashtests/382746-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/382899-1.xhtml
+load 384037-1.xhtml
+load 384105-1.html
+load 384373.html
+load 384871-1.html
+load chrome://reftest/content/crashtests/layout/xul/crashtests/386642.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/387080-1.xhtml
+load 391974-1.html
+load 402912-1.xhtml
+load 404192.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/408904-1.xhtml
+load 412479-1.xhtml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/417509.xhtml
+load 430356-1.xhtml
+asserts(0-1) load 464407-1.xhtml # Bugs 450974, 1267054, 718883
+load 470063-1.html
+load 470272.html
+skip-if(Android) load chrome://reftest/content/crashtests/layout/xul/crashtests/538308-1.xhtml
+load 557174-1.xml
+load chrome://reftest/content/crashtests/layout/xul/crashtests/564705-1.xhtml
+load 583957-1.html
+load 617089.html
+load menulist-focused.xhtml
+load 716503.html
+load chrome://reftest/content/crashtests/layout/xul/crashtests/1379332-2.xhtml
diff --git a/layout/xul/crashtests/menulist-focused.xhtml b/layout/xul/crashtests/menulist-focused.xhtml
new file mode 100644
index 0000000000..7a09a838d7
--- /dev/null
+++ b/layout/xul/crashtests/menulist-focused.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body>
+<xul:menulist focused="true"/>
+</body>
+</html>