Adding upstream version 115.7.0esr.upstream/115.7.0esr

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
author: Daniel Baumann <daniel.baumann@progress-linux.org> 2024-04-07 19:33:14 +0000
committer: Daniel Baumann <daniel.baumann@progress-linux.org> 2024-04-07 19:33:14 +0000
commit: 36d22d82aa202bb199967e9512281e9a53db42c9 (patch)
tree: 105e8c98ddea1c1e4784a60a5a6410fa416be2de /layout/style/crashtests
parent: Initial commit. (diff)
download: firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz
firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip
329 files changed, 5494 insertions, 0 deletions
diff --git a/layout/style/crashtests/1017798-1.css b/layout/style/crashtests/1017798-1.css
new file mode 100644
index 0000000000..feb77d9dcf
--- /dev/null
+++ b/layout/style/crashtests/1017798-1.css
@@ -0,0 +1,84 @@
+/* ----------------------------------
+ * SWITCHES
+ * ---------------------------------- */
+
+label.pack-switch {
+  display: inline-block;
+  vertical-align: middle;
+  width: 100%;
+  height: 5rem;
+  position: relative;
+  background: none;
+}
+
+label.pack-switch span {
+  float: left;
+  font-size: 1.8rem;
+  color: #333;
+  padding: 1rem 0 0;
+  height: 6rem;
+  line-height: 3rem;
+  box-sizing: border-box;
+  display: block;
+}
+
+label.pack-switch input {
+  margin: 0;
+  opacity: 0;
+  position: absolute;
+  top: 0;
+  left: 0;
+}
+
+label.pack-switch input:checked ~ span:after {
+  background-position: center bottom;
+}
+
+/* ----------------------------------
+ * ON/OFF SWITCHES
+ * ---------------------------------- */
+
+label.pack-switch input ~ span:after {
+  content: '';
+  position: absolute;
+  right: 0;
+  top: 50%;
+  width: 6rem;
+  margin: -1.4rem 0 0;
+  height: 2.7rem;
+  border-radius: 1.35rem;
+  overflow: hidden;
+  background: #e6e6e6 url(images/background_off.png) no-repeat -3.2rem 0 / 9.2rem 2.7rem;
+  transition: background 0.2s ease;
+}
+
+/* switch: 'ON' state */
+label.pack-switch input:checked ~ span:after {
+  background: #e6e6e6 url(images/background.png) no-repeat 0 0 / 9.2rem 2.7rem;
+}
+
+/* switch: disabled state */
+label.pack-switch input:disabled ~ span:after {
+  opacity: 0.4;
+}
+
+label.pack-switch input.uninit ~ span:after {
+  transition: none;
+}
+
+/******************************************************************************
+ * Right-To-Left tweaks
+ */
+html[dir="rtl"] label.pack-switch input {
+  left: auto;
+  right: 0;
+}
+
+html[dir="rtl"] label.pack-switch input ~ span:after {
+  left: 0;
+  right: auto;
+}
+
+html[dir="rtl"] label.pack-switch input ~ span:after {
+  background-position: 0;
+}
diff --git a/layout/style/crashtests/1017798-1.html b/layout/style/crashtests/1017798-1.html
new file mode 100644
index 0000000000..9ca89fdf98
--- /dev/null
+++ b/layout/style/crashtests/1017798-1.html
@@ -0,0 +1,126 @@
+
+<!DOCTYPE html>
+<!--
+This is a slightly minimised, modified and self-contained version of
+gaia_switch/examples/index.html from the Gaia repository.
+-->
+<script>
+'use strict';
+
+(function(exports) {
+
+  /**
+   * ComponentUtils is a utility which allows us to use web components earlier
+   * than we should be able to by polyfilling and fixing platform deficiencies.
+   */
+  var ComponentUtils = {
+
+    /**
+     * Injects a style.css into both the shadow root and outside the shadow
+     * root so we can style projected content. Bug 992249.
+     */
+    style: function(baseUrl) {
+      var style = document.createElement('style');
+      style.setAttribute('scoped', '');
+      var url = baseUrl + '1017798-1.css';
+      style.innerHTML = '@import url(' + url + ');';
+
+      this.appendChild(style);
+
+      if (!this.shadowRoot) {
+        return;
+      }
+
+      // The setTimeout is necessary to avoid missing @import styles
+      // when appending two stylesheets. Bug 1003294.
+      setTimeout(() => {
+        this.shadowRoot.appendChild(style.cloneNode(true));
+      });
+    }
+
+  };
+
+  exports.ComponentUtils = ComponentUtils;
+
+}(window));
+</script>
+<script>
+'use strict';
+/* global ComponentUtils */
+
+window.GaiaSwitch = (function(win) {
+  // Extend from the HTMLElement prototype
+  class GaiaSwitch extends HTMLElement {
+    connectedCallback() {
+      var shadow = this.attachShadow({ mode: "open" });
+      this._template = template.content.cloneNode(true);
+      this._input = this._template.querySelector('input[type="checkbox"]');
+
+      var checked = this.getAttribute('checked');
+      if (checked !== null) {
+        this._input.checked = true;
+      }
+
+      shadow.appendChild(this._template);
+
+      ComponentUtils.style.call(this, '');
+    }
+  };
+
+
+  /**
+   * Proxy the checked property to the input element.
+   */
+  Object.defineProperty( GaiaSwitch.prototype, 'checked', {
+    get: function() {
+      return this._input.checked;
+    },
+    set: function(value) {
+      this._input.checked = value;
+    }
+  });
+
+  /**
+   * Proxy the name property to the input element.
+   */
+  Object.defineProperty( GaiaSwitch.prototype, 'name', {
+    get: function() {
+      return this.getAttribute('name');
+    },
+    set: function(value) {
+      this.setAttribute('name', value);
+    }
+  });
+
+  // HACK: Create a <template> in memory at runtime.
+  // When the custom-element is created we clone
+  // this template and inject into the shadow-root.
+  // Prior to this we would have had to copy/paste
+  // the template into the <head> of every app that
+  // wanted to use <gaia-switch>, this would make
+  // markup changes complicated, and could lead to
+  // things getting out of sync. This is a short-term
+  // hack until we can import entire custom-elements
+  // using HTML Imports (bug 877072).
+  var template = document.createElement('template');
+  template.innerHTML = '<label id="switch-label" class="pack-switch">' +
+      '<input type="checkbox">' +
+      '<span><slot></slot></span>' +
+    '</label>';
+
+  // Register and return the constructor
+  win.customElements.define('gaia-switch', GaiaSwitch);
+  return GaiaSwitch;
+})(window);
+</script>
+<body>
+<section>
+  <gaia-switch>
+    <label>With a label</label>
+  </gaia-switch>
+</section>
+<script>
+window.onload = function() {
+  document.querySelector('gaia-switch').checked = true;
+};
+</script>
diff --git a/layout/style/crashtests/1028514-1.html b/layout/style/crashtests/1028514-1.html
new file mode 100644
index 0000000000..bbe7f3ba50
--- /dev/null
+++ b/layout/style/crashtests/1028514-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    document.documentElement.style.animation = "137438953471s bounce";
+    document.documentElement.offsetHeight;
+    document.documentElement.style.animationIterationCount = "infinite";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/105619-1.html b/layout/style/crashtests/105619-1.html
new file mode 100644
index 0000000000..27746f29ad
--- /dev/null
+++ b/layout/style/crashtests/105619-1.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<html>
+<head>
+	<title>International Herald Tribune</title>
+	
+	<script type="text/javascript">
+
+	function displayFix() {
+		document.getElementById("bodyNode").style.display = "block";
+	}
+
+	</script>
+	<style type="text/css">
+
+	#clippingsContainer {overflow:auto;}
+	#menuSearch {position:absolute;}
+
+	</style>
+	
+</head>
+
+<body id="bodyNode" onload="displayFix()">
+	<div>
+		<div id="menuSearch"><input type="text"></div>
+		<div id="clippingsContainer"></div>
+	</div>
+
+	<table>
+		<tr><td></td><td></td><td></td></tr>
+		<tr><td></td><td></td><td></td></tr>
+	</table>
+
+</body></html>
diff --git a/layout/style/crashtests/1066089-1.html b/layout/style/crashtests/1066089-1.html
new file mode 100644
index 0000000000..019a20a7f8
--- /dev/null
+++ b/layout/style/crashtests/1066089-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf8">
+<style>
+  @counter-style triangle { symbols: a; }
+  @counter-style disc     { system: extends triangle; }
+</style>
+<script>
+  function crash() {
+    var styleNode = document.createElement("style");
+    styleNode.textContent =
+      "@counter-style triangle { symbols: b; } " +
+      "@counter-style disc     { system: extends triangle; } " +
+      "ul {}";
+    document.getElementsByTagName("head")[0].appendChild(styleNode);
+  }
+</script>
+</head>
+<body onload="crash()">
+  <ul><li>Don't technically need any text here, but here's some anyway.
diff --git a/layout/style/crashtests/1074651-1.html b/layout/style/crashtests/1074651-1.html
new file mode 100644
index 0000000000..b76855cc1d
--- /dev/null
+++ b/layout/style/crashtests/1074651-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html style="transition-duration: 500000000000000000ms">
+<body onload="document.documentElement.style.strokeWidth = '17px';"></body>
+</html>
diff --git a/layout/style/crashtests/1089463-1.html b/layout/style/crashtests/1089463-1.html
new file mode 100644
index 0000000000..8efb3f6674
--- /dev/null
+++ b/layout/style/crashtests/1089463-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<div></div>
+<script>
+window.onload = function() {
+  var div = document.querySelector("div");
+  var shadow = div.attachShadow({ mode: "open" });
+  shadow.innerHTML = "<p style='display: none'><span><i>x</i></span></p>";
+  var p = shadow.lastChild;
+  var span = p.firstChild;
+  var i = span.firstChild;
+
+  span.style.color = 'blue';
+  p.remove();
+
+  document.body.offsetTop;
+
+  shadow.appendChild(p);
+  i.style.color = 'red';
+};
+</script>
diff --git a/layout/style/crashtests/1135534.html b/layout/style/crashtests/1135534.html
new file mode 100644
index 0000000000..920ec9c7bf
--- /dev/null
+++ b/layout/style/crashtests/1135534.html
@@ -0,0 +1 @@
+<ruby><rtc style="border-image: url(whatever); border-style: solid;"></ruby>
diff --git a/layout/style/crashtests/1136010-1.html b/layout/style/crashtests/1136010-1.html
new file mode 100644
index 0000000000..bdf63f9c08
--- /dev/null
+++ b/layout/style/crashtests/1136010-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<style>
+body { text-transform: uppercase; width: 200px; height: 200px; background-color: white; }
+#a, #b { font-size: 24px; }
+</style>
+<div id=a><div id=b><span>x</span><span>y</span></div></div>
+<script>
+document.body.offsetTop;
+var a = document.getElementById("a");
+var b = document.getElementById("b");
+a.style.fontSize = "24px";
+b.style.fontSize = "24px";
+document.body.offsetTop;
+b.style.fontSize = "36px";
+document.body.offsetTop;
+</script>
diff --git a/layout/style/crashtests/1146101-1.html b/layout/style/crashtests/1146101-1.html
new file mode 100644
index 0000000000..e3f8f2aa3f
--- /dev/null
+++ b/layout/style/crashtests/1146101-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<script>
+function boom()
+{
+    document.getElementsByTagName("tbody")[0].style.position = "absolute";
+    document.getElementsByTagName("table")[0].style.color = "green";
+}
+</script>
+<body onload="boom();">
+<table><tbody></tbody></table>
diff --git a/layout/style/crashtests/1153693-1.html b/layout/style/crashtests/1153693-1.html
new file mode 100644
index 0000000000..8035f1b218
--- /dev/null
+++ b/layout/style/crashtests/1153693-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+
+.a { clip-path: url(z); }
+#x { clip-path: inherit; }
+
+</style>
+</head>
+
+<body>
+    <div class="a">
+        <div class="a" id="x"></div>
+    </div>
+    <script>
+        getComputedStyle(document.getElementById("x"), "").clipPath;
+    </script>
+</body>
+
+</html>
diff --git a/layout/style/crashtests/1156969.svg b/layout/style/crashtests/1156969.svg
new file mode 100644
index 0000000000..478df7d6ac
--- /dev/null
+++ b/layout/style/crashtests/1156969.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+    <circle id="x" r="10" style="transition-duration: 1ms;" />
+    <script>
+        window.addEventListener("load", function() {
+            document.getElementById("x").style.MozTransform = "matrix(1, 2, 3, 4, 5, 6%)";
+        }, false)
+    </script>
+</svg>
diff --git a/layout/style/crashtests/1161320-1.html b/layout/style/crashtests/1161320-1.html
new file mode 100644
index 0000000000..3cb3a7b45e
--- /dev/null
+++ b/layout/style/crashtests/1161320-1.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+<meta charset=utf-8>
+<style>
+@keyframes a { }
+body {
+  animation-name: a;
+}
+</style>
+
+<script>
+function boom()
+{
+  var body = document.body;
+  body.style.animationPlayState = 'paused';
+  window.getComputedStyle(body).animationPlayState;
+  body.style.animationPlayState = 'running';
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="setTimeout(boom, 100);"></body>
+</html>
diff --git a/layout/style/crashtests/1161320-2.html b/layout/style/crashtests/1161320-2.html
new file mode 100644
index 0000000000..71db694d01
--- /dev/null
+++ b/layout/style/crashtests/1161320-2.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+<meta charset=utf-8>
+<style>
+@keyframes a { }
+body {
+  animation: a 100s;
+}
+</style>
+
+<script>
+function boom()
+{
+  var anim = document.body.getAnimations()[0];
+  anim.finish();
+  anim.pause();
+  anim.play();
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="setTimeout(boom, 100);"></body>
+</html>
diff --git a/layout/style/crashtests/1161366-1.html b/layout/style/crashtests/1161366-1.html
new file mode 100644
index 0000000000..d4eacccdc9
--- /dev/null
+++ b/layout/style/crashtests/1161366-1.html
@@ -0,0 +1,7 @@
+<script>
+var f = new FontFace("x", "url(x.ttf)", { unicodeRange: "U+0041" });
+f.load();
+document.fonts.add(f);
+f = new FontFace("x", "url(x.ttf)", { unicodeRange: "U+0042" });
+f.load();
+</script>
diff --git a/layout/style/crashtests/1163446-1.html b/layout/style/crashtests/1163446-1.html
new file mode 100644
index 0000000000..a3ca0c44d5
--- /dev/null
+++ b/layout/style/crashtests/1163446-1.html
@@ -0,0 +1,4 @@
+<script>
+// Will leak with bug 1161413 patches and without bug 1163446 fix.
+new FontFace("x", new ArrayBuffer(0));
+</script>
diff --git a/layout/style/crashtests/1164813-1.html b/layout/style/crashtests/1164813-1.html
new file mode 100644
index 0000000000..ee5a60ffd6
--- /dev/null
+++ b/layout/style/crashtests/1164813-1.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html class="reftest-wait">
+<style>
+#parent.hidden {
+  display: none;
+}
+.icon {
+  opacity: 0;
+  transition: opacity 0.5s;
+}
+.icon.shrink {
+  animation: shrink 1s;
+}
+@keyframes shrink {
+  to { transform: scale(0); }
+}
+</style>
+<div id="parent">
+  <div class="icon">Searching</div>
+</div>
+<script>
+var icon = document.querySelector('.icon');
+getComputedStyle(icon).opacity;
+icon.style.opacity = 1;
+icon.classList.add('shrink');
+setTimeout(function() {
+  document.getElementById('parent').classList.add('hidden');
+  setTimeout(function() {
+    document.documentElement.removeAttribute('class');
+  }, 500);
+}, 500);
+</script>
+</html>
diff --git a/layout/style/crashtests/1167782-1.html b/layout/style/crashtests/1167782-1.html
new file mode 100644
index 0000000000..4b41ea3983
--- /dev/null
+++ b/layout/style/crashtests/1167782-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+<html>
+<body>
+<script>
+  var d = window.getComputedStyle(document.body, "::-moz-color-swatch").display;
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1186768-1.xhtml b/layout/style/crashtests/1186768-1.xhtml
new file mode 100644
index 0000000000..22608557df
--- /dev/null
+++ b/layout/style/crashtests/1186768-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <body>
+        <mfrac xmlns="http://www.w3.org/1998/Math/MathML">
+            <mi>
+                <div xmlns="http://www.w3.org/1999/xhtml" style="font-family: monospace; font-size: 1.17em;"></div>
+            </mi>
+            <mi/>
+        </mfrac>
+    </body>
+</html>
diff --git a/layout/style/crashtests/1200568-1.html b/layout/style/crashtests/1200568-1.html
new file mode 100644
index 0000000000..e2dc9c09df
--- /dev/null
+++ b/layout/style/crashtests/1200568-1.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html>
+<head>
+<style>
+.anim { animation: anim 2s infinite linear }
+@keyframes anim { }
+</style>
+</head>
+<body>
+<script>
+var i = document.createElement('i');
+i.setAttribute('class', 'anim');
+getComputedStyle(i).display;
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1206105-1.html b/layout/style/crashtests/1206105-1.html
new file mode 100644
index 0000000000..88af39e532
--- /dev/null
+++ b/layout/style/crashtests/1206105-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<title>crashtest, bug 1206105</title>
+<style>
+*:nth-child(-n-2147483647) {}
+</style>
+<body>
diff --git a/layout/style/crashtests/1223688-1.html b/layout/style/crashtests/1223688-1.html
new file mode 100644
index 0000000000..70f9d85795
--- /dev/null
+++ b/layout/style/crashtests/1223688-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom() {
+    CSS.supports('');
+
+    var style = document.createElement("style");
+    var tn = document.createTextNode("* { border: var(--b); }");
+    style.appendChild(tn);
+    document.body.appendChild(style);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/1223694-1.html b/layout/style/crashtests/1223694-1.html
new file mode 100644
index 0000000000..c4589884f7
--- /dev/null
+++ b/layout/style/crashtests/1223694-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    var sheet = document.createElement("style");
+    sheet.scoped = true;
+    document.documentElement.appendChild(sheet);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/1226400-1.html b/layout/style/crashtests/1226400-1.html
new file mode 100644
index 0000000000..dea15642c7
--- /dev/null
+++ b/layout/style/crashtests/1226400-1.html
@@ -0,0 +1,55 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>FontFaceSet::Load crasher</title>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+
+<style type="text/css">
+
+body {
+  margin: 50px;
+}
+
+p {
+  margin: 0;
+  font-size: 300%;
+}
+
+</style>
+
+</head>
+<body>
+
+<p>This may crash on load...</p>
+
+<script>
+var scriptText = `
+  var fontFaceSet = document.fonts;
+  var link = document.createElement("link");
+  link.onerror = link.onload = function() {
+    fontFaceSet.load("12px foo");
+  }
+  link.rel = "stylesheet";
+  link.href = "data:text/css,";
+  document.body.appendChild(link);
+`;
+
+var styleText = `
+  @font-face {
+    font-family: foo;
+    src: url("data:text/ttf,");
+  }
+`;
+
+var ifr = document.createElement("iframe");
+document.body.appendChild(ifr);
+var style = ifr.contentDocument.createElement("style");
+style.textContent = styleText;
+ifr.contentDocument.body.appendChild(style);
+var script = ifr.contentDocument.createElement("script");
+script.textContent = scriptText;
+ifr.contentDocument.body.appendChild(script);
+ifr.remove();
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1227498.html b/layout/style/crashtests/1227498.html
new file mode 100644
index 0000000000..3ccc263fd5
--- /dev/null
+++ b/layout/style/crashtests/1227498.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    addScopedSheet("#x { }");
+}
+
+function addScopedSheet(text)
+{
+    var sheet = document.createElementNS("http://www.w3.org/1999/xhtml", "style");
+    sheet.appendChild(document.createTextNode(text));
+    sheet.scoped = true;
+    document.documentElement.appendChild(sheet);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+  <embed type="application/x-missing-plugin"></embed>
+</body>
+</html>
diff --git a/layout/style/crashtests/1227501-1.html b/layout/style/crashtests/1227501-1.html
new file mode 100644
index 0000000000..03383813d0
--- /dev/null
+++ b/layout/style/crashtests/1227501-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+* { will-change: --t; }
+</style>
+</head>
+</html>
diff --git a/layout/style/crashtests/1228789-1.html b/layout/style/crashtests/1228789-1.html
new file mode 100644
index 0000000000..b8e7ffda61
--- /dev/null
+++ b/layout/style/crashtests/1228789-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="border-image-source: -webkit-gradient();"></body>
+</html>
diff --git a/layout/style/crashtests/1230408-1.html b/layout/style/crashtests/1230408-1.html
new file mode 100644
index 0000000000..0a2588c8ae
--- /dev/null
+++ b/layout/style/crashtests/1230408-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<style>
+body { width: 1px; }
+body:first-letter { }
+</style>
+<body>
+<rb>C</rb>
+</body>
diff --git a/layout/style/crashtests/1233135-1.html b/layout/style/crashtests/1233135-1.html
new file mode 100644
index 0000000000..58a82f3049
--- /dev/null
+++ b/layout/style/crashtests/1233135-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<style>
+  fieldset, input, select {
+    display: ruby;
+  }
+</style>
+<fieldset></fieldset>
+<input type="color">
+<input type="file">
+<input type="number">
+<input type="range">
+<select></select>
+<select size="2"></select>
diff --git a/layout/style/crashtests/1233135-2.html b/layout/style/crashtests/1233135-2.html
new file mode 100644
index 0000000000..03e356ae1f
--- /dev/null
+++ b/layout/style/crashtests/1233135-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<ruby>
+  <fieldset></fieldset>
+  <input type="color">
+  <input type="file">
+  <input type="number">
+  <input type="range">
+  <select></select>
+  <select size="2"></select>
+  <span style="display: block; overflow: scroll"></span>
+</ruby>
diff --git a/layout/style/crashtests/1236398.xhtml b/layout/style/crashtests/1236398.xhtml
new file mode 100644
index 0000000000..c1739fac72
--- /dev/null
+++ b/layout/style/crashtests/1236398.xhtml
@@ -0,0 +1,71 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/Math/DTD/mathml2/xhtml-math11-f.dtd" [ <!ENTITY mathml "http://www.w3.org/1998/Math/MathML"> ]>
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+  <meta http-equiv="Content-type" content="text/xml; charset=utf-8" />
+  <meta http-equiv="expires" content="0" />
+  <title>Crashing Firefox 3.0.2</title>
+ </head>
+ <body>
+  <table class="site" cellpadding="0" cellspacing="2">
+   <tr>
+    <td class="title" colspan="2">
+     <div class="title"></div>
+    </td>
+   </tr>
+ 
+   <tr>
+    <td class="content" width="100%" height="100%">
+    
+
+
+<div class="headline">Text</div>
+
+
+
+<div class="navigation">
+ <a href="/forum/">Text</a>
+ 
+   
+     / <a href="#">Link</a>
+   
+ 
+ 
+   / <a href="#">Link</a>
+ 
+</div>
+
+
+<table class="foren" cellspacing="0" cellpadding="0" width="100%" >
+ <col width="200" class="author" />
+ <tfoot><tr><td colspan="2"></td></tr></tfoot>
+ <tbody>
+
+<tr class="message">
+ <td class="text">
+  <div class="body">[x<i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i><i>?</i>]</div>
+ </td>
+</tr>
+
+
+
+<tr class="message">
+ <td class="text">
+  <div class="body"><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b>.</b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></div>
+ </td>
+</tr>
+
+<tr class="message">
+ <td class="author">  
+ </td>
+
+ <td class="text">
+<div class="body"><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><i><b><b><i><b><i><b><i><b><i><b></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></i></b></b></i></b></i></b></i></b></i></div>
+ </td>
+</tr>
+</tbody>
+</table>
+</td>
+</tr>
+</table>
+</body>
+</html>
diff --git a/layout/style/crashtests/1238660-1.html b/layout/style/crashtests/1238660-1.html
new file mode 100644
index 0000000000..2323d2cfa5
--- /dev/null
+++ b/layout/style/crashtests/1238660-1.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<html>
+  <head>
+    <title>Bug 1238660</title>
+  </head>
+  <body>
+    <span>
+      <div>
+        <span></span>
+      </div>
+    </span>
+    <style>
+    span {
+      animation: anim 0.1s 0.1s;
+    }
+    @keyframes anim { to { opacity:1 } }
+    </style>
+  </body>
+</html>
diff --git a/layout/style/crashtests/1245260-1.html b/layout/style/crashtests/1245260-1.html
new file mode 100644
index 0000000000..6f2dda9955
--- /dev/null
+++ b/layout/style/crashtests/1245260-1.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<html>
+<head lang="en">
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<title>Bug 1245260</title>
+</head>
+<body>
+<style>
+body {
+  color: blue;
+}
+
+div {
+  transition: text-emphasis-color 0.1s;
+}
+
+.hide {
+  display: none;
+}
+
+a {
+  color: red;
+  transition: text-emphasis-color 0.1s;
+}
+
+span {
+  transition: text-emphasis-color 0.1s;
+}
+
+@font-face {
+  font-family: "icon-fonts";
+  src: url(x);
+}
+</style>
+
+<div>
+<span><a>Shows</a></span>
+<span><a>Video</a></span>
+<span><a>Schedule</a></span>
+<span><a>Topics</a></span>
+<span><a>Games</a></span>
+<span><a>Shop</a></span>
+<span><a>This Day In History</a></span>
+<span><a>Ask History</a></span>
+<span><a>History Lists</a></span>
+<span><a>Hungry History</a></span>
+<span><a>Speeches &amp; Audio</a></span>
+<span class="hide"><a>Sign In</a></span>
+<span><a class="hide">Sign Out</a></span>
+</div>
+<script/>
+</body>
+</html>
diff --git a/layout/style/crashtests/1247865-1.html b/layout/style/crashtests/1247865-1.html
new file mode 100644
index 0000000000..b7ec8ba60a
--- /dev/null
+++ b/layout/style/crashtests/1247865-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <style>
+    .nav { display: table }
+    .nav:after { content: " " }
+  </style>
+</head>
+<body>
+  <div style="font-size: 1rem"></div>
+  <div class="nav">
+  </div>
+  <script>
+    document.documentElement.style.fontSize = "10px";
+    document.documentElement.offsetHeight;
+    document.documentElement.style.fontSize = "15px";
+  </script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1250791.html b/layout/style/crashtests/1250791.html
new file mode 100644
index 0000000000..8fb0a16431
--- /dev/null
+++ b/layout/style/crashtests/1250791.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+    <body>
+        <div style="font-size: calc(-1e9%);">
+            <div style="font-size: 1e900%;"></div>
+        </div>
+    </body>
+</html>
diff --git a/layout/style/crashtests/1264396-1.html b/layout/style/crashtests/1264396-1.html
new file mode 100644
index 0000000000..abba4de3b5
--- /dev/null
+++ b/layout/style/crashtests/1264396-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<meta charset="utf-8" />
+<style>
+@keyframes bug {
+  from {display:none}
+  to {display:inline-block}
+}
+body {
+  animation-name: bug;
+  animation-duration: 1s;
+}
+</style>
+</html>
diff --git a/layout/style/crashtests/1264949.html b/layout/style/crashtests/1264949.html
new file mode 100644
index 0000000000..780bff97a3
--- /dev/null
+++ b/layout/style/crashtests/1264949.html
@@ -0,0 +1,23 @@
+<!doctype HTML>
+<html>
+  <head>
+    <style>
+      div {
+        background-image: linear-gradient(green, red);
+        background-clip: text;
+        width: 150px;
+        color:transparent;
+        overflow: hidden;
+        opacity:0.5;
+        text-overflow: ellipsis;
+      }
+    </style>
+  </head>
+  <body>
+    <div>
+      <span stype="font-size: 30px;">
+        ALongLongLongLongLongLongLongLongLongLongLongLongString
+      </span>
+    </div>
+  </body>
+</html>
diff --git a/layout/style/crashtests/1265611-1.html b/layout/style/crashtests/1265611-1.html
new file mode 100644
index 0000000000..df5467ffa3
--- /dev/null
+++ b/layout/style/crashtests/1265611-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<!--
+  NOTE: The comment below is no longer quite true - in particular, we've
+  removed the 'layout.css.prefixes.webkit' pref entirely, so this test doesn't
+  exercise the same codepath that it did when the below comment was written. We
+  might as well keep this crashtest, though, even if it traverses a different
+  codepath now.
+-->
+<!--
+  This test relies on triggering a transition on the 'color' property which,
+  at least when this test was written, would trigger a transition on the
+  -webkit-text-fill-color property since its default value is 'currentcolor'.
+
+  However, in crashtests.list we turn off layout.css.prefixes.webkit so
+  we should not trigger a transition on -webkit-text-fill-color.
+  [Alert: This is no longer accurate, per NOTE above.]
+
+  This test exercises some code that, prior to this bug, would fail because we
+  would initially create the transition on -webkit-text-fill-color (because we
+  forgot to check if it was enabled or not) and then we would call other
+  methods that *do* check for the enabled-ness of the property leaving us
+  in an unexpected state.
+-->
+<body style="transition: all 4s" onload="document.body.style.color = 'green';"></body>
diff --git a/layout/style/crashtests/1270795.html b/layout/style/crashtests/1270795.html
new file mode 100644
index 0000000000..c4262078ed
--- /dev/null
+++ b/layout/style/crashtests/1270795.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <table style="background-image: linear-gradient(black, white); background-clip: text;">
+      <tr>
+        <td>Table 1</td>
+      </tr>
+    </table>
+    <table style="background-color: red; background-clip: text;">
+      <tr>
+        <td>Table 2</td>
+      </tr>
+    </table>
+  </body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1275026.html b/layout/style/crashtests/1275026.html
new file mode 100644
index 0000000000..7960d2889a
--- /dev/null
+++ b/layout/style/crashtests/1275026.html
@@ -0,0 +1,4 @@
+<!doctype HTML>
+<html style="background: linear-gradient(to right, red, blue); background-clip: text;">
+<body></body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1277908-1.html b/layout/style/crashtests/1277908-1.html
new file mode 100644
index 0000000000..e02f45c4c8
--- /dev/null
+++ b/layout/style/crashtests/1277908-1.html
@@ -0,0 +1,26 @@
+<script>
+window.onload = function () {
+  var root = document.documentElement; while(root.firstChild) { root.firstChild.remove(); }
+  var a = document.createElementNS("http://www.w3.org/1999/xhtml", "link");
+  a.setAttributeNS(null, "href", "mailto:");
+  root.appendChild(a);
+  var b = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+  var c = document.createElementNS("http://www.w3.org/1999/xhtml", "p");
+  root.appendChild(b);
+  root.animate([{"opacity":1},
+                {"opacity":-64},
+                {"opacity":1024},
+                {"opacity":32},
+                {"opacity":3},
+                {"opacity":1024},
+                {"opacity":0.19310025712314532},
+                {"opacity":512}],
+                {"duration":1,"fill":"backwards"});
+  a.style.maskType = "alpha, luminance";
+  c.animate({}, 1);
+  root.style.position = "fixed";
+  b.getAnimations();
+  a.style.MozPerspectiveOrigin = "1rem bottom";
+  root.style.position = "static";
+};
+</script>
diff --git a/layout/style/crashtests/1277908-2.html b/layout/style/crashtests/1277908-2.html
new file mode 100644
index 0000000000..4c5266826a
--- /dev/null
+++ b/layout/style/crashtests/1277908-2.html
@@ -0,0 +1,19 @@
+<script>
+function start() {
+  o28=document.createElement('a');
+  o28.href='javascript:x()';
+  o115=document.createElement('tr');
+  o116=document.createElement('th');
+  o116.innerHTML="<style>{}\n*{ display: table;> </style><style>@keyframes key8 { from{ left; background-position-x: 128vw}to{}label}\n*{ animation-name: key8; animation-duration: 0.001s";
+  document.documentElement.appendChild(o28);
+  document.documentElement.appendChild(o115);
+  document.documentElement.appendChild(o116);
+  o213=document.createElement('input');
+  o115.appendChild(o213);
+  o216=document.createElement('style');
+  o217=document.createTextNode("*{ text-shadow: 196608rem -3px");
+  o216.appendChild(o217);
+  o213.appendChild(o216);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1278463-1.html b/layout/style/crashtests/1278463-1.html
new file mode 100644
index 0000000000..da3b976d88
--- /dev/null
+++ b/layout/style/crashtests/1278463-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+ @keyframes c {
+     50% {
+         stroke-dasharray: context-value;
+     }
+ }
+
+ div {
+     animation-name: c;
+ }
+
+</style>
+</head>
+<body>
+<div></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/1279819-1.html b/layout/style/crashtests/1279819-1.html
new file mode 100644
index 0000000000..1794551739
--- /dev/null
+++ b/layout/style/crashtests/1279819-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+function start() {
+  o0=window.document;
+  o1=window.document.documentElement;
+  o1.hidden^=true;
+  document.replaceChild(o0.documentElement,document.documentElement);
+  o132=o0.createElement('form');
+  o0.documentElement.appendChild(o132);
+  o132.innerHTML=
+"<svg id><style id>@font-face{ font-family: font7; src: url('eot');}{}\n"+
+"*{ font-size: 85rem!important; all: initial;<style>@keyframes{{}}*{ animation-name: key12; animation-duration: 0.001s}{}\n"+
+"@keyframes key12{ from{ font: larger Helvetica";
+  document.documentElement.classList.remove("reftest-wait");
+}
+window.setTimeout("start()",4);
+</script>
diff --git a/layout/style/crashtests/1282076-1.html b/layout/style/crashtests/1282076-1.html
new file mode 100644
index 0000000000..d5d1f0c74b
--- /dev/null
+++ b/layout/style/crashtests/1282076-1.html
@@ -0,0 +1,51 @@
+<script>
+function start() {
+  o0=document;
+  o24=document.createElement('table');
+  o35=window;
+  o60=document.createElement('input');
+  o24.appendChild(o60);
+  o62=document.body;
+  o66=document.createElement('input');
+  o62.appendChild(o66);
+  o60.innerHTML="<svg><color-profile><script><rect><animateColor><style><style>*{ all: unset<script><style>div<style>";
+  o93=o60.querySelectorAll('*')[5];
+  o97=o60.querySelectorAll('*')[9];
+  document.body.appendChild(o24);
+  o305=document.createTextNode("{}:first-line{");
+  o93.appendChild(o305);
+  o318=(new DOMParser()).parseFromString('','text/html');
+  o320=o318.all[1];
+  o355=document.createElement('style');
+  o356=document.createTextNode("@keyframes key2{ from{ opacity: 0}}#id2{ animation-name: key2; animation-duration: 0.01s");
+  o355.appendChild(o356);
+  o97.appendChild(o355);
+  o66.style.display='list-item';
+  o473=document.createElement('script');
+  o24.appendChild(o473);
+  o577=document.createElement('style');
+  o320.appendChild(o577);
+  o577.style.position='fixed';
+  document.replaceChild(o318.documentElement,document.documentElement);
+  o908=(new DOMParser()).parseFromString('','text/html');
+  o911=o908.all[2];
+  o911.style.display='inline';
+  o577.id='id2';
+  o1202=document.createElement('table');
+  document.body=o911;
+  document.body.appendChild(o1202);
+  document.replaceChild(o0.documentElement,document.documentElement);
+  o1232=o473.parentNode;
+  o1233=o1232.parentNode;
+  document.body=o1233;
+  o35.scrollByLines(1);
+  o577.style.position='absolute';
+  setTimeout(f2, 4);
+}
+
+function f2() {
+  o0.designMode='on';
+  o0.execCommand('insertparagraph',false,null);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1282076-2.html b/layout/style/crashtests/1282076-2.html
new file mode 100644
index 0000000000..1c6f986396
--- /dev/null
+++ b/layout/style/crashtests/1282076-2.html
@@ -0,0 +1,46 @@
+<script>
+function start() {
+  o0=document;
+  o24=document.createElement('table');
+  o35=window;
+  o60=document.createElement('input');
+  o24.appendChild(o60);
+  o62=document.body;
+  o66=document.createElement('input');
+  o62.appendChild(o66);
+  o60.innerHTML="<svg><color-profile><script><rect><animateColor><style><style>*{ all: unset<script>";
+  o93=o60.querySelectorAll('*')[5];
+  document.body.appendChild(o24);
+  o305=document.createTextNode("{}:first-line{");
+  o93.appendChild(o305);
+  o318=(new DOMParser()).parseFromString('','text/html');
+  o320=o318.all[1];
+  o66.style.display='list-item';
+  o473=document.createElement('script');
+  o24.appendChild(o473);
+  o577=document.createElement('style');
+  o320.appendChild(o577);
+  o577.style.position='fixed';
+  document.replaceChild(o318.documentElement,document.documentElement);
+  o908=(new DOMParser()).parseFromString('','text/html');
+  o911=o908.all[2];
+  o911.style.display='inline';
+  o577.animate({ opacity: [0, 1] }, 100);
+  o1202=document.createElement('table');
+  document.body=o911;
+  document.body.appendChild(o1202);
+  document.replaceChild(o0.documentElement,document.documentElement);
+  o1232=o473.parentNode;
+  o1233=o1232.parentNode;
+  document.body=o1233;
+  o35.scrollByLines(1);
+  o577.style.position='absolute';
+  setTimeout(f2, 4);
+}
+
+function f2() {
+  o0.designMode='on';
+  o0.execCommand('insertparagraph',false,null);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1290994-1.html b/layout/style/crashtests/1290994-1.html
new file mode 100644
index 0000000000..d9d99a5b06
--- /dev/null
+++ b/layout/style/crashtests/1290994-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+  var a = document.createElement("div");
+  document.documentElement.appendChild(a);
+  a.animate([{borderLeftColor:"black"},
+             {borderLeftColor:"hsl(0,0e309%,0%)"}]);
+};
+</script>
+</html>
diff --git a/layout/style/crashtests/1290994-2.html b/layout/style/crashtests/1290994-2.html
new file mode 100644
index 0000000000..e592b84eee
--- /dev/null
+++ b/layout/style/crashtests/1290994-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+  var a = document.createElement("div");
+  document.documentElement.appendChild(a);
+  a.animate([{color:"rgb(0,0,0)"},
+             {color:"rgb(0e309%,0%,0%)"}]);
+};
+</script>
+</html>
diff --git a/layout/style/crashtests/1290994-3.html b/layout/style/crashtests/1290994-3.html
new file mode 100644
index 0000000000..76589f5a69
--- /dev/null
+++ b/layout/style/crashtests/1290994-3.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+  var a = document.createElement("div");
+  document.documentElement.appendChild(a);
+  a.animate([{background: "-webkit-gradient(radial, 1 2, 8, 3 4, 9, from(lime))"},
+             {background: "-webkit-gradient(radial, 0e309 2, 8, 3 4, 9, from(lime))"}]);
+};
+</script>
+</html>
diff --git a/layout/style/crashtests/1290994-4.html b/layout/style/crashtests/1290994-4.html
new file mode 100644
index 0000000000..4278856d0c
--- /dev/null
+++ b/layout/style/crashtests/1290994-4.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<style>
+@keyframes anim {
+  0e309% {}
+}
+</style>
+</html>
diff --git a/layout/style/crashtests/1314531.html b/layout/style/crashtests/1314531.html
new file mode 100644
index 0000000000..8e804643fd
--- /dev/null
+++ b/layout/style/crashtests/1314531.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<style>::-moz-tree-row:hover {}</style>
diff --git a/layout/style/crashtests/1315889-1.html b/layout/style/crashtests/1315889-1.html
new file mode 100644
index 0000000000..29186fac1c
--- /dev/null
+++ b/layout/style/crashtests/1315889-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<style>
+.x { color: blue; }
+</style>
+<div class=x>hello</div>
+<script>
+document.body.offsetWidth;
+var x = document.querySelector(".x");
+x.className = "";
+x.remove();
+document.body.offsetWidth;
+</script>
diff --git a/layout/style/crashtests/1315894-1.html b/layout/style/crashtests/1315894-1.html
new file mode 100644
index 0000000000..e0192460ff
--- /dev/null
+++ b/layout/style/crashtests/1315894-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<div style="display: none"><span>x</span></div>
+<script>
+document.body.offsetWidth;
+document.querySelector("div").style.display = "inline";
+document.body.offsetWidth;
+document.querySelector("span").style.color = "blue";
+document.body.offsetWidth;
+</script>
diff --git a/layout/style/crashtests/1319072-1.html b/layout/style/crashtests/1319072-1.html
new file mode 100644
index 0000000000..f6c1330559
--- /dev/null
+++ b/layout/style/crashtests/1319072-1.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html class="reftest-wait">
+<title>Interpolation of decomposed matrices</title>
+<style>
+#target {
+  width: 100px; height: 100px;
+  background: blue;
+  animation: anim 0.1s cubic-bezier(0,1.5,1,1.5);
+}
+@keyframes anim {
+  from { transform: matrix(1, 0, 0, 1, 100, 200); }
+  to { transform: matrix(1, 0, 0, 1, 200, 100); }
+}
+</style>
+<div id="target"></div>
+<script>
+document.getElementById("target").addEventListener("animationend", () => {
+  document.documentElement.classList.remove("reftest-wait");
+});
+</script>
diff --git a/layout/style/crashtests/1320423-1.html b/layout/style/crashtests/1320423-1.html
new file mode 100644
index 0000000000..9769455e75
--- /dev/null
+++ b/layout/style/crashtests/1320423-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<style>
+#target {
+  cursor: url(file:///somewhere/cursor.png), pointer;
+  position: absolute;
+  top: 0;
+  left: 0;
+  width: 100%;
+  height: 100%;
+  background: yellow;
+}
+#target:hover {
+  background: green;
+}
+</style>
+<div id=target></div>
+<script>
+var target = document.getElementById("target");
+var x = window.outerWidth / 2, y = window.outerHeight / 2;
+SpecialPowers.DOMWindowUtils.sendMouseEvent("mouseover", x, y, 0, 0, 0);
+</script>
diff --git a/layout/style/crashtests/1321357-1.html b/layout/style/crashtests/1321357-1.html
new file mode 100644
index 0000000000..7b3a3c39c0
--- /dev/null
+++ b/layout/style/crashtests/1321357-1.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<html>
+<body onload="document.getElementById('containerA').pauseAnimations()">
+  <svg id="containerA">
+    <animate id="ia" end="50s"></animate>
+    <animate begin="60s" end="ic.end"></animate>
+  </svg>
+  <svg>
+    <animate id="ic" end="ia.end"></animate>
+  </svg>
+</body>
+</html>
diff --git a/layout/style/crashtests/1328535-1.html b/layout/style/crashtests/1328535-1.html
new file mode 100644
index 0000000000..3738380978
--- /dev/null
+++ b/layout/style/crashtests/1328535-1.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<html>
+<style>
+@keyframes anim {
+  from { box-shadow: none; }
+  to { box-shadow: rgba(120, 120, 120, 0.5) 10px 10px 10px 0px; }
+}
+#target {
+  width: 100px; height: 100px;
+  /*
+   * Use negative delay to shift to the point that the cubic-bezier function
+   * produces a value out of range of [0, 1].
+   */
+  animation: anim 1s -0.02s cubic-bezier(0, -0.5, 0, 0) paused;
+}
+</style>
+<div id="target"></div>
diff --git a/layout/style/crashtests/1331272.html b/layout/style/crashtests/1331272.html
new file mode 100644
index 0000000000..6ee9f022f7
--- /dev/null
+++ b/layout/style/crashtests/1331272.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<style>
+  div::before {
+    content: "PASS";
+    display: none;
+  }
+  .foo::before {
+    display: none;
+  }
+</style>
+<div></div>
+<script>
+window.onload = function() {
+  document.querySelector('div').className = "foo";
+}
+</script>
diff --git a/layout/style/crashtests/1332550.html b/layout/style/crashtests/1332550.html
new file mode 100644
index 0000000000..4299450a58
--- /dev/null
+++ b/layout/style/crashtests/1332550.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<style>
+  @keyframes test {
+    0% {
+    }
+  }
+</style>
+<script>
+  var sheet = document.styleSheets[0];
+  var rule = sheet.cssRules[0];
+  var keyframe = rule.cssRules[0];
+  rule.deleteRule("0%");
+  sheet.deleteRule(0);
+  rule = null;
+  SpecialPowers.forceGC();
+  SpecialPowers.forceCC();
+  keyframe.parentRule;
+</script>
diff --git a/layout/style/crashtests/1333001-1.css b/layout/style/crashtests/1333001-1.css
new file mode 100644
index 0000000000..ee2d477b79
--- /dev/null
+++ b/layout/style/crashtests/1333001-1.css
@@ -0,0 +1 @@
+@import url(chrome://foo);
diff --git a/layout/style/crashtests/1333001-1.html b/layout/style/crashtests/1333001-1.html
new file mode 100644
index 0000000000..2fb577b7bd
--- /dev/null
+++ b/layout/style/crashtests/1333001-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<link rel=stylesheet href=1333001-1.css type=text/css>
+<link rel=stylesheet href=1333001-1.css type=text/css>
+<body onload="f()">
+<script>
+function f() {
+  document.styleSheets[1].cssRules[0].media;
+}
+</script>
diff --git a/layout/style/crashtests/1340248.html b/layout/style/crashtests/1340248.html
new file mode 100644
index 0000000000..04e7ebaada
--- /dev/null
+++ b/layout/style/crashtests/1340248.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <script>
+            o1 = document.createElement('style');
+            o1.textContent = "* { position: absolute; }";
+            o1.className = 'c2';
+            document.head.appendChild(o1);
+            document.styleSheets[0].insertRule("*::first-line { border-inline-end-style: solid; }", 0);
+            document.styleSheets[0].insertRule("* { display: table-row ; }", 0);
+            document.styleSheets[0].insertRule(".c2::first-line { border-style: none ; }", 0);
+        </script>
+    </head>
+</html>
diff --git a/layout/style/crashtests/1340344.html b/layout/style/crashtests/1340344.html
new file mode 100644
index 0000000000..5d0a3c85fd
--- /dev/null
+++ b/layout/style/crashtests/1340344.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = function(){
+  var anim =
+    document.documentElement.animate([{ "color": "hsla(6e147grad,16%,183.379675555%,0.0210463770007)" }]);
+  anim.ready.then(() => {
+    document.documentElement.classList.remove("reftest-wait");
+  });
+};
+</script>
+</head>
+</html>
diff --git a/layout/style/crashtests/1342316-1.html b/layout/style/crashtests/1342316-1.html
new file mode 100644
index 0000000000..091c6e8261
--- /dev/null
+++ b/layout/style/crashtests/1342316-1.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html class="reftest-wait">
+<title>calc() in translate3d as base style of transform animation</title>
+<style>
+#target {
+  width: 100px; height: 100px;
+  background: blue;
+  animation: anim 1s;
+  transform: translate3d(100px, calc(10px + 30%), 10px);
+}
+@keyframes anim {
+  to { transform: translate3d(0px, 0px, 0px); }
+}
+</style>
+<div id="target"></div>
+<script>
+document.getElementById("target").addEventListener("animationstart", () => {
+  document.documentElement.classList.remove("reftest-wait");
+});
+</script>
diff --git a/layout/style/crashtests/1344210.html b/layout/style/crashtests/1344210.html
new file mode 100644
index 0000000000..f6b39eb082
--- /dev/null
+++ b/layout/style/crashtests/1344210.html
@@ -0,0 +1,22 @@
+<html>
+    <head>
+        <script>
+            o1 = document.createElement('style');
+            o2 = document.createElement('style');
+            o3 = document.createElement('style');
+            o4 = document.implementation.createHTMLDocument().documentElement;
+            document.replaceChild(o4, document.documentElement);
+            document.head.appendChild(o1);
+            document.head.appendChild(o2);
+            document.head.appendChild(o3);
+            o1.scrollLeft = 2;
+            document.styleSheets[0].insertRule("*:first-line { border-inline-start-color: green; }", 0);
+            document.styleSheets[0].insertRule("* {float: left ; }", 0);
+            window.find('foobar', true, false, true, true, true, false);
+            document.styleSheets[2].insertRule("*:first-line { border: 10px solid;", 0);
+            window.find('foobar', true, true, true, false, false, false);
+            o3.parentNode.removeChild(o3);
+        </script>
+    </head>
+    <body></body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1353312.html b/layout/style/crashtests/1353312.html
new file mode 100644
index 0000000000..56adf9ed6d
--- /dev/null
+++ b/layout/style/crashtests/1353312.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML>
+<style>
+  body { float: left }
+  div::first-line {
+    border-inline-start: 0;
+  }
+  div.boom::first-line {
+    border: 0;
+  }
+</style>
+
+<div>x</div>
+<div class="boom">x</div>
+<div>x</div>
diff --git a/layout/style/crashtests/1356601-1.html b/layout/style/crashtests/1356601-1.html
new file mode 100644
index 0000000000..4fc28bd58f
--- /dev/null
+++ b/layout/style/crashtests/1356601-1.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<html>
+<style>
+div::first-line {
+  --bar: left;
+}
+span {
+  animation: var(--bar) 5s infinite alternate;
+}
+@keyframes left {
+  from {left: 0;}
+  to {left: 30px;}
+}
+</style>
+<div>
+  <span>Crash</span>
+</div>
+</html>
diff --git a/layout/style/crashtests/1364139-1.html b/layout/style/crashtests/1364139-1.html
new file mode 100644
index 0000000000..d33093d018
--- /dev/null
+++ b/layout/style/crashtests/1364139-1.html
@@ -0,0 +1,20 @@
+<html>
+  <head>
+    <script>
+      try { o1 = document.createElement('area');  } catch(e) { };
+      try { o2 = document.createElement('article');  } catch(e) { };
+      try { o3 = document.createElement('iframe');  } catch(e) { };
+      try { o4 = document.createElement('style');  } catch(e) { };
+      try { o1.className = 'c3';  } catch(e) { };
+      try { o2.className = 'c3';  } catch(e) { };
+      try { o2.innerText = "\uE4C9"; } catch(e) { };
+      try { document.documentElement.appendChild(o1); } catch(e) { };
+      try { document.documentElement.appendChild(o2); } catch(e) { };
+      try { document.documentElement.appendChild(o3);  } catch(e) { };
+      try { document.documentElement.appendChild(o4); } catch(e) { };
+      try { document.styleSheets[0].insertRule("*::first-letter, .c3 ~ .c3::first-line { float: right; font-variant-alternates: annotation(\\62 lah); }", 0); } catch(e) { };
+      try { o3.src = "data:text/html,"; } catch(e) { };
+      try { document.styleSheets[0].insertRule(".c3:last-child:nth-of-type(+3n) { }", 0); } catch(e) { };
+    </script>
+  </head>
+</html>
diff --git a/layout/style/crashtests/1371450-1.html b/layout/style/crashtests/1371450-1.html
new file mode 100644
index 0000000000..199f326bb5
--- /dev/null
+++ b/layout/style/crashtests/1371450-1.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<title></title>
+<style>
+@keyframes anim {
+  to { transform: rotate(360deg); }
+}
+#animation {
+  animation: anim 3s infinite;
+}
+.red {
+  color: red;
+}
+</style>
+<div><span id="target">text</span></div>
+<div id="animation">animation</div>
+<script>
+window.addEventListener('load', () => {
+  var target = document.getElementById('target');
+  target.classList.add('red');
+  setTimeout(() => {
+    target.classList.remove('red');
+    SpecialPowers.getDOMWindowUtils(window)
+                 .sendMouseEvent("mousemove", 100, 100, 1,
+                                 0, 1, 0);
+    setTimeout(() => {
+      document.documentElement.classList.remove("reftest-wait");
+    }, 0);
+  }, 0);
+  SpecialPowers.getDOMWindowUtils(window)
+               .sendMouseEvent("mousemove", 100, 100, 1,
+                               0, 1, 0);
+});
+</script>
diff --git a/layout/style/crashtests/1374175-1.html b/layout/style/crashtests/1374175-1.html
new file mode 100644
index 0000000000..e534f77719
--- /dev/null
+++ b/layout/style/crashtests/1374175-1.html
@@ -0,0 +1,12 @@
+<style>
+@keyframes anim {
+  from { color: red }
+}
+input {
+  animation: anim 1s;
+}
+</style>
+<script>
+  input=document.createElement('input');
+  document.documentElement.appendChild(input);
+</script>
diff --git a/layout/style/crashtests/1375812-1.html b/layout/style/crashtests/1375812-1.html
new file mode 100644
index 0000000000..e51fc60faf
--- /dev/null
+++ b/layout/style/crashtests/1375812-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Bug 1375812 - Interpolation between interpolatematrix and none tranform
+</title>
+<meta charset="UTF-8">
+<style>
+  #target {
+    transition: all 10s linear;
+    transform: translateX(100px);
+  }
+</style>
+<script>
+  function go() {
+    var div = document.getElementById('target');
+    div.style.setProperty("transform", "rotate(60deg)", "");
+    window.getComputedStyle(div).transform;
+    div.style.setProperty("transform", "none", "");
+  }
+</script>
+</head>
+<body onload="go()">
+<div id="target"></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/1377053-1.html b/layout/style/crashtests/1377053-1.html
new file mode 100644
index 0000000000..829a36128d
--- /dev/null
+++ b/layout/style/crashtests/1377053-1.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<style>
+div {
+  animation: t 1s;
+}
+@keyframes t {
+  to { stroke-dasharray: none; }
+}
+</style>
+<div></div>
diff --git a/layout/style/crashtests/1377256-1-helper.html b/layout/style/crashtests/1377256-1-helper.html
new file mode 100644
index 0000000000..67c7dd05b4
--- /dev/null
+++ b/layout/style/crashtests/1377256-1-helper.html
@@ -0,0 +1,13 @@
+<script>
+document.addEventListener("DOMContentLoaded", function(){
+  window.getSelection().modify('extend','backward','character');
+  let n=document.getElementById('a');
+  n.parentNode.removeChild(n);
+  setTimeout(function(){window.parent.finish(); }, 0);
+});
+</script>
+<body id='a'>
+<table contenteditable='true'>
+>
+<th
+</html>
diff --git a/layout/style/crashtests/1377256-1.html b/layout/style/crashtests/1377256-1.html
new file mode 100644
index 0000000000..187803f6f2
--- /dev/null
+++ b/layout/style/crashtests/1377256-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<iframe src="1377256-1-helper.html"></iframe>
+<script>
+function finish() {
+  document.querySelector("iframe").remove();
+  document.documentElement.className = "";
+}
+</script>
diff --git a/layout/style/crashtests/1378064-1.html b/layout/style/crashtests/1378064-1.html
new file mode 100644
index 0000000000..aaf9bb3b7d
--- /dev/null
+++ b/layout/style/crashtests/1378064-1.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<title></title>
+<style>
+@keyframes anim {
+  to { transform: rotate(360deg); }
+}
+span {
+  color: black;
+  animation: anim 3s infinite;
+}
+span.red {
+  color: red;
+}
+</style>
+<div>
+<span id="target">text</span>
+<span>text</span>
+</div>
+<script>
+window.addEventListener('load', () => {
+  var target = document.getElementById('target');
+  target.classList.add('red');
+  requestAnimationFrame(() => {
+    target.classList.remove('red');
+    SpecialPowers.getDOMWindowUtils(window)
+                 .sendMouseEvent("mousemove", 100, 100, 1,
+                                 0, 1, 0);
+    requestAnimationFrame(() => {
+      document.documentElement.classList.remove("reftest-wait");
+    });
+  });
+
+  SpecialPowers.getDOMWindowUtils(window)
+               .sendMouseEvent("mousemove", 100, 100, 1,
+                               0, 1, 0);
+});
+</script>
diff --git a/layout/style/crashtests/1378814.html b/layout/style/crashtests/1378814.html
new file mode 100644
index 0000000000..4177063408
--- /dev/null
+++ b/layout/style/crashtests/1378814.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+getComputedStyle(document.documentElement, '::first-letter').display;
+</script>
diff --git a/layout/style/crashtests/1380800.html b/layout/style/crashtests/1380800.html
new file mode 100644
index 0000000000..a01740cd83
--- /dev/null
+++ b/layout/style/crashtests/1380800.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<style></style>
+<script>
+document.styleSheets[0].deleteRule(0);
+</script>
diff --git a/layout/style/crashtests/1381420-1.html b/layout/style/crashtests/1381420-1.html
new file mode 100644
index 0000000000..e4d3df8d48
--- /dev/null
+++ b/layout/style/crashtests/1381420-1.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<title></title>
+<style>
+@keyframes anim {
+  from { transform: scale(1); }
+  to { transform: rotate(0deg); }
+}
+#target {
+  animation: anim 3s infinite;
+  background-color: blue;
+  width: 100px;
+  height: 100px;
+}
+</style>
+<div>
+<div id="target"></div>
+<details id="details" open>
+  <summary>Summary</summary>
+  <p>detail description</p>
+</details>
+</div>
+<script>
+window.addEventListener('load', () => {
+  requestAnimationFrame(() => {
+    details.open = false;
+    SpecialPowers.getDOMWindowUtils(window)
+                 .sendMouseEvent("mousemove", 100, 100, 1,
+                                 0, 1, 0);
+    requestAnimationFrame(() => {
+      document.documentElement.classList.remove("reftest-wait");
+    });
+  });
+});
+</script>
diff --git a/layout/style/crashtests/1381682.html b/layout/style/crashtests/1381682.html
new file mode 100644
index 0000000000..3db2e8a4d9
--- /dev/null
+++ b/layout/style/crashtests/1381682.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<style>
+.foo :not(.bar) + baz {
+  color: red;
+}
+
+.descendant::before {
+  content: "";
+}
+</style>
+<div class="foo">
+  <div class="descendant">
+  </div>
+</div>
+<script>
+  document.body.offsetTop;
+  document.querySelector('.foo').classList.remove('foo');
+</script>
diff --git a/layout/style/crashtests/1382672.html b/layout/style/crashtests/1382672.html
new file mode 100644
index 0000000000..86526e840e
--- /dev/null
+++ b/layout/style/crashtests/1382672.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = () => {
+  document.documentElement.animate([ { "font": "menu" }, { "font": "message-box" } ])
+}
+</script>
+</head>
+</html>
diff --git a/layout/style/crashtests/1382710.html b/layout/style/crashtests/1382710.html
new file mode 100644
index 0000000000..46c7720d79
--- /dev/null
+++ b/layout/style/crashtests/1382710.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<script>
+document.documentElement.appendChild(document.createElement("table"))
+</script>
+</head>
+<body></body>
+</html>
diff --git a/layout/style/crashtests/1383001-2.html b/layout/style/crashtests/1383001-2.html
new file mode 100644
index 0000000000..5fba0184b4
--- /dev/null
+++ b/layout/style/crashtests/1383001-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = () => {
+  a = document.createElement("p")
+  document.documentElement.appendChild(a)
+  a.animate([])
+  document.designMode = 'on'
+  document.documentElement.appendChild(document.createElement("div"))
+}
+</script>
+</head>
+</html>
diff --git a/layout/style/crashtests/1383001.html b/layout/style/crashtests/1383001.html
new file mode 100644
index 0000000000..e963c847f6
--- /dev/null
+++ b/layout/style/crashtests/1383001.html
@@ -0,0 +1,23 @@
+<!doctype html>
+<html class="reftest-wait">
+<div id="test" contenteditable>
+  <div id="first"></div>
+</div>
+<script>
+document.body.offsetTop;
+let anim = document.createElement('div');
+anim.animate({ color: ['red', 'green' ] }, 1000);
+first.appendChild(anim);
+
+let child = document.createElement('span');
+child.innerText = 'text';
+
+requestAnimationFrame(() => {
+  requestAnimationFrame(() => {
+    anim.appendChild(child);
+    test.appendChild(anim);
+    document.documentElement.className = "";
+  });
+});
+</script>
+</html>
diff --git a/layout/style/crashtests/1383319.html b/layout/style/crashtests/1383319.html
new file mode 100644
index 0000000000..960b539383
--- /dev/null
+++ b/layout/style/crashtests/1383319.html
@@ -0,0 +1,18 @@
+<!doctype html>
+<style>
+  @keyframes anim {
+    to { background-color: green; }
+  }
+  .foo {
+    width: 100px;
+    height: 100px;
+    background: red;
+    animation: anim 10s ease;
+  }
+</style>
+<div id="test" contenteditable>
+</div>
+<script>
+document.documentElement.offsetTop;
+test.innerHTML = '<div class="foo">Some random element</div>';
+</script>
diff --git a/layout/style/crashtests/1383493-1.html b/layout/style/crashtests/1383493-1.html
new file mode 100644
index 0000000000..12a04818ad
--- /dev/null
+++ b/layout/style/crashtests/1383493-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+document.documentElement.animate([{ "transform": "matrix3d(195.311324955,58.3749549585,-94.0753846053,1.0,33.6874926451,148.902450737,122.351964713,-50.0063005423,1.0,6238.29,-236.4116913,-63.5213475335,106.192024542,57.7281969546,268.082053869,39.5424976348)" }],
+    { duration: 3000, iterationComposite: "accumulate", iterationStart: 70.6806439384 })
+</script>
+</head>
+</html>
diff --git a/layout/style/crashtests/1383589-1.html b/layout/style/crashtests/1383589-1.html
new file mode 100644
index 0000000000..16c4f456ad
--- /dev/null
+++ b/layout/style/crashtests/1383589-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+window.addEventListener('load', () => {
+  document.documentElement.animate([{ transform: 'none' }], 10000);
+  requestAnimationFrame(() => {
+    SpecialPowers.getDOMWindowUtils(window)
+                 .sendMouseEvent("mousemove", 100, 100, 1, 0, 1, 0);
+    requestAnimationFrame(() => {
+      document.documentElement.classList.remove('reftest-wait');
+    });
+  });
+});
+</script>
diff --git a/layout/style/crashtests/1383975.html b/layout/style/crashtests/1383975.html
new file mode 100644
index 0000000000..5cf5ee7574
--- /dev/null
+++ b/layout/style/crashtests/1383975.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+color: url(9
+۰
+</style>
+</head>
+</html>
diff --git a/layout/style/crashtests/1383981-2.html b/layout/style/crashtests/1383981-2.html
new file mode 100644
index 0000000000..410e5ecff4
--- /dev/null
+++ b/layout/style/crashtests/1383981-2.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<style>
+div { padding: 1px; }
+.test div { padding: 2px; }
+.test div ~ div { padding: 3px; }
+.test div ~ div ~ div { background: orange; }
+.test div ~ div ~ div ~ div { background: white; }
+.test div ~ div ~ div ~ div ~ div { background: red; }
+</style>
+<body>
+<script>
+let root = document.createElement('div');
+for (let i = 0; i < 1000; ++i) {
+  let div = root.appendChild(document.createElement('div'));
+  div.appendChild(document.createTextNode(i));
+}
+document.body.appendChild(root);
+document.body.offsetTop;
+root.className = 'test';
+</script>
+</body>
diff --git a/layout/style/crashtests/1383981-3.html b/layout/style/crashtests/1383981-3.html
new file mode 100644
index 0000000000..91891d3d3d
--- /dev/null
+++ b/layout/style/crashtests/1383981-3.html
@@ -0,0 +1,36 @@
+<!doctype html>
+<style>
+div { padding: 1px; }
+.test div { padding: 2px; }
+.test div div { padding: 3px; }
+.test div div div { background: orange; }
+.test div div div div { background: white; }
+.test div div div div div { background: red; }
+</style>
+<body>
+<script>
+let root = document.createElement('div');
+let p = root;
+for (let i = 0; i < 1000; ++i) {
+  p = p.appendChild(document.createElement('div'));
+  p.appendChild(document.createTextNode(i));
+}
+document.body.appendChild(root);
+
+// Flush styles.
+document.body.offsetTop;
+
+// Add 20 more top-level siblings to ensure that the style traversal goes
+// parallel before the deep tree is processed.
+//
+// Note that we need to make these children of the <html> element, not the
+// <body> element, because invalidations get processed by the parent when
+// enqueuing children, so the _parent_ needs to be at a level in the DOM
+// with enough dirty siblings to trigger a switch to parallel mode.
+for (let i = 0; i < 20; ++i) {
+  document.documentElement.appendChild(document.createElement('div'));
+}
+
+root.className = 'test';
+</script>
+</body>
diff --git a/layout/style/crashtests/1383981.html b/layout/style/crashtests/1383981.html
new file mode 100644
index 0000000000..94bb9700a8
--- /dev/null
+++ b/layout/style/crashtests/1383981.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<style>
+div { padding: 1px; }
+.test div { padding: 2px; }
+.test div div { padding: 3px; }
+.test div div div { background: orange; }
+.test div div div div { background: white; }
+.test div div div div div { background: red; }
+</style>
+<body>
+<script>
+let root = document.createElement('div');
+let p = root;
+for (let i = 0; i < 1000; ++i) {
+  p = p.appendChild(document.createElement('div'));
+  p.appendChild(document.createTextNode(i));
+}
+document.body.appendChild(root);
+document.body.offsetTop;
+root.className = 'test';
+</script>
+</body>
diff --git a/layout/style/crashtests/1384232.html b/layout/style/crashtests/1384232.html
new file mode 100644
index 0000000000..df9df64e81
--- /dev/null
+++ b/layout/style/crashtests/1384232.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<script>
+root = document.createElement("div")
+document.documentElement.appendChild(root)
+document.documentElement.appendChild(document.createElement("thead"))
+document.documentElement.getBoundingClientRect()
+root.appendChild(document.createElement("textarea"))
+</script>
diff --git a/layout/style/crashtests/1384824-1.html b/layout/style/crashtests/1384824-1.html
new file mode 100644
index 0000000000..6dcf485f0e
--- /dev/null
+++ b/layout/style/crashtests/1384824-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+  textarea {
+    min-height: 100px;
+  }
+</style>
+<div>
+  <iframe src="about:blank"></iframe>
+</div>
+<script>
+  let div = document.querySelector('div');
+  let iframe = document.querySelector('iframe');
+  iframe.onload = function() {
+    let doc = iframe.contentDocument;
+    let e = doc.createElement('textarea');
+    doc.body.appendChild(e);
+    setTimeout(function() {
+      getComputedStyle(e).minHeight;
+      div.style.display = 'none';
+      setTimeout(function() {
+        getComputedStyle(e).minHeight;
+        document.documentElement.className = "";
+      }, 0);
+    }, 0);
+  };
+</script>
diff --git a/layout/style/crashtests/1384824-2.html b/layout/style/crashtests/1384824-2.html
new file mode 100644
index 0000000000..65e6f29fd1
--- /dev/null
+++ b/layout/style/crashtests/1384824-2.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+  textarea {
+    min-height: 100px;
+  }
+</style>
+<div>
+  <iframe src="about:blank"></iframe>
+</div>
+<script>
+  let div = document.querySelector('div');
+  let iframe = document.querySelector('iframe');
+  iframe.onload = function() {
+    let doc = iframe.contentDocument;
+    let e = doc.createElement('textarea');
+    doc.body.appendChild(e);
+    setTimeout(function() {
+      var cs = getComputedStyle(e);
+      cs.minHeight;
+      div.style.display = 'none';
+      setTimeout(function() {
+        div.style.display = 'block';
+        setTimeout(function() {
+          cs.minHeight;
+          document.documentElement.className = "";
+        }, 0);
+      }, 0);
+    }, 0);
+  };
+</script>
diff --git a/layout/style/crashtests/1386773.html b/layout/style/crashtests/1386773.html
new file mode 100644
index 0000000000..b6267ca344
--- /dev/null
+++ b/layout/style/crashtests/1386773.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset=UTF-8>
+<style>
+::-moz-selection{}
+</style>
+<script>
+window.onload = () => {
+  r = document.createRange()
+  document.getSelection().addRange(r)
+  r.setEndAfter(document.body)
+}
+</script>
+</head>
+<body>A</body>
+</html>
diff --git a/layout/style/crashtests/1387481-1-iframe.html b/layout/style/crashtests/1387481-1-iframe.html
new file mode 100644
index 0000000000..87fde769c5
--- /dev/null
+++ b/layout/style/crashtests/1387481-1-iframe.html
@@ -0,0 +1,26 @@
+<html>
+  <head>
+    <script id='x'>
+      try { o1 = document.getElementById('x') } catch(e) { }
+      try { o2 = document.createElement('table') } catch(e) { }
+      try { o3 = document.createElement('td') } catch(e) { }
+      try { o5 = document.createElement('input') } catch(e) { }
+      try { o6 = document.createTextNode('{\r\u2044/=+=\u06F0\u2029\u06F9a  \uDC1D0\n-\v')  } catch(e) { }
+      try { o7 = new Image(0.167398293512524, 0.2503646329685738) } catch(e) { }
+      try { o1.appendChild(o2) } catch(e) { }
+      try { o2.appendChild(o3) } catch(e) { }
+      try { o3.appendChild(o6) } catch(e) { }
+      try { o8 = document.createRange() } catch(e) { }
+      try { document.documentElement.appendChild(o7) } catch(e) { }
+      try { o7.outerHTML = '<select contenteditable="true"></select>' } catch(e) { }
+      try { document.documentElement.appendChild(o5) } catch(e) { }
+      try { o9 = window.getSelection() } catch(e) { }
+      try { o5.select() } catch(e) { }
+      try { document.replaceChild(document.documentElement, document.documentElement) } catch(e) { }
+      try { document.designMode = 'on' } catch(e) { }
+      try { o8.selectNode(o6) } catch(e) { }
+      try { o9.addRange(o8) } catch(e) { }
+      try { document.execCommand('unlink', false, null) } catch(e) { }
+    </script>
+  </head>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1387481-1.html b/layout/style/crashtests/1387481-1.html
new file mode 100644
index 0000000000..98783d1666
--- /dev/null
+++ b/layout/style/crashtests/1387481-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<iframe id="f" src="1387481-1-iframe.html" onload="step()"></iframe>
+<script>
+var reloads = 3;
+function step() {
+  if (--reloads) {
+    f.contentWindow.location.reload();
+  } else {
+    document.documentElement.className = "";
+  }
+}
+</script>
diff --git a/layout/style/crashtests/1387499.html b/layout/style/crashtests/1387499.html
new file mode 100644
index 0000000000..86afa3e84f
--- /dev/null
+++ b/layout/style/crashtests/1387499.html
@@ -0,0 +1,15 @@
+<html>
+  <head>
+    <script>
+      try { o1 = document.createElement('code') } catch(e) { }
+      try { o2 = document.createElement('iframe') } catch(e) { }
+      try { document.documentElement.appendChild(o2) } catch(e) { }
+      try { o3 = o2.getSVGDocument() } catch(e) { }
+      try { o4 = document.caretPositionFromPoint(1, 1) } catch(e) { }
+      try { o3.head.appendChild(o1); } catch(e) { }
+      try { document.replaceChild(document.documentElement, document.documentElement); } catch(e) { }
+      try { document.replaceChild(o3.firstElementChild, document.documentElement); } catch(e) { }
+      window.close()
+    </script>
+  </head>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1388234.html b/layout/style/crashtests/1388234.html
new file mode 100644
index 0000000000..db4d52a5ef
--- /dev/null
+++ b/layout/style/crashtests/1388234.html
@@ -0,0 +1,9 @@
+<style></style>
+<script>
+  try { o1 = document.createElement('th') } catch(e) { }
+  try { document.documentElement.appendChild(o1) } catch(e) { }
+  try { document.styleSheets[0].insertRule("* { }", 0); } catch(e) { }
+  try { document.documentElement.getBoundingClientRect() } catch(e) { }
+  try { document.styleSheets[0].insertRule("* { unicode-bidi: bidi-override}", 0); } catch(e) { }
+  try { o1.rowSpan = 32 } catch(e) { }
+</script>
diff --git a/layout/style/crashtests/1389645.html b/layout/style/crashtests/1389645.html
new file mode 100644
index 0000000000..85d3314478
--- /dev/null
+++ b/layout/style/crashtests/1389645.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<script>
+window.onload = () => {
+  a = document.createElement("x")
+  document.documentElement.appendChild(a)
+  b = document.createElement("span")
+  document.documentElement.appendChild(b)
+  document.documentElement.getBoundingClientRect()
+  a.appendChild(document.createElement('div'))
+  b.innerText = "\uFDDE\r\u0301\n"
+}
+</script>
diff --git a/layout/style/crashtests/1390726.html b/layout/style/crashtests/1390726.html
new file mode 100644
index 0000000000..308c56627b
--- /dev/null
+++ b/layout/style/crashtests/1390726.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+window.onload = () => {
+  a = document.createElement("frameset")
+  document.documentElement.appendChild(a)
+  b = document.createElement("f")
+  b.setAttribute("class", "x")
+  a.appendChild(b)
+  c = document.createElement("t")
+  document.documentElement.appendChild(c)
+  d = document.createElement('m')
+  d.setAttribute("class", "x")
+  c.appendChild(d)
+  f = document.createElement('d')
+  d.appendChild(f)
+  g = document.createElement('n')
+  f.appendChild(g)
+  setTimeout(() => {
+    g.setAttribute("class", "")
+    sheet = document.createElement("style")
+    sheet.appendChild(document.createTextNode(".x:-moz-broken{"))
+    document.head.appendChild(sheet)
+    document.documentElement.className = "";
+  }, 500)
+}
+</script>
diff --git a/layout/style/crashtests/1391577.html b/layout/style/crashtests/1391577.html
new file mode 100644
index 0000000000..b0e3211c65
--- /dev/null
+++ b/layout/style/crashtests/1391577.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<style>
+.foo input[type="range"]::-moz-range-thumb:hover {
+  color: red;
+}
+</style>
+<div>
+  <input type="range"></input>
+</div>
+<script>
+onload = function() {
+  document.querySelector('div').classList.add('foo');
+}
+</script>
diff --git a/layout/style/crashtests/1393189.html b/layout/style/crashtests/1393189.html
new file mode 100644
index 0000000000..5a0bfc7244
--- /dev/null
+++ b/layout/style/crashtests/1393189.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<style>
+@keyframes x {
+  0% {
+     list-style-type: c;
+  }
+}
+div {
+  animation-name: x;
+  list-style-type: t;
+}
+</style>
+<div></div>
diff --git a/layout/style/crashtests/1393580.html b/layout/style/crashtests/1393580.html
new file mode 100644
index 0000000000..4a59016308
--- /dev/null
+++ b/layout/style/crashtests/1393580.html
@@ -0,0 +1,10 @@
+<style>
+* {
+  scroll-snap-points-x: repeat(calc(1px));
+}
+</style>
+<script>
+window.onload = () => {
+  document.documentElement.animate([{"scrollSnapPointsX": "repeat(1px)"}])
+}
+</script>
diff --git a/layout/style/crashtests/1393791.html b/layout/style/crashtests/1393791.html
new file mode 100644
index 0000000000..ad045f9a7c
--- /dev/null
+++ b/layout/style/crashtests/1393791.html
@@ -0,0 +1,12 @@
+<script>
+window.onload = () => {
+  a = document.createElement("p")
+  document.documentElement.appendChild(a)
+  b = document.createElement("caption")
+  document.documentElement.appendChild(b)
+  a.insertAdjacentHTML("afterEnd", "<audio controls></audio><iframe>");
+  document.documentElement.getBoundingClientRect()
+  document.documentElement.appendChild(document.createElement("tr"))
+  b.style.borderCollapse = "collapse"
+}
+</script>
diff --git a/layout/style/crashtests/1395719.html b/layout/style/crashtests/1395719.html
new file mode 100644
index 0000000000..5cb4aa0c7a
--- /dev/null
+++ b/layout/style/crashtests/1395719.html
@@ -0,0 +1,19 @@
+<script>
+o = []
+window.onload = () => {
+  a = document.createElement("body");
+  b = document.createElementNS("http://www.w3.org/1998/Math/MathML", "math");
+  b.setAttributeNS(null, "display", "block");
+  c = document.createElementNS("http://www.w3.org/1998/Math/MathML", "munderover");
+  d = document.createTextNode("\n          ");
+  c.appendChild(d);
+  c.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo"));
+  b.appendChild(c);
+  a.appendChild(b);
+  document.documentElement.appendChild(a);
+  a.style.display = "inline";
+  setTimeout(() => {
+    d.data = "\u934F" + d.data;
+  }, 100)
+}
+</script>
diff --git a/layout/style/crashtests/1395725.html b/layout/style/crashtests/1395725.html
new file mode 100644
index 0000000000..0ff8b4d10c
--- /dev/null
+++ b/layout/style/crashtests/1395725.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAGQAAABQCAYAAADvCdDvAAAAZElEQVR4nO3RQQ0AIBDAMPybBgu8YJe0DpatxbX9wO/GUQyJMSTGkBhDYgyJMSTGkBhDYgyJMSTGkBhDYgyJMSTGkBhDYgyJMSTGEAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAGQ4uFciajNXnVwAAAABJRU5ErkJggg==" usemap="#map">
+<map name="map"><area></map>
+<script>
+window.onload = () => {
+  let d = document.querySelector('area');
+  setTimeout(() => {
+    d.appendChild(document.createElement('div'));
+    document.body.offsetHeight;
+    document.documentElement.className = '';
+  }, 100);
+}
+</script>
+</html>
diff --git a/layout/style/crashtests/1396041.html b/layout/style/crashtests/1396041.html
new file mode 100644
index 0000000000..4bca993486
--- /dev/null
+++ b/layout/style/crashtests/1396041.html
@@ -0,0 +1,9 @@
+<script>
+document.documentElement.appendChild(document.createElement("meter"))
+a = document.createElement("textarea")
+document.documentElement.appendChild(a)
+b = document.createElement("style")
+b.appendChild(document.createTextNode("*::-moz-meter-bar { text-indent: calc(50%); scroll-behavior: smooth; transition-duration: 250ms; }"))
+a.select()
+document.head.appendChild(b)
+</script>
diff --git a/layout/style/crashtests/1397091.html b/layout/style/crashtests/1397091.html
new file mode 100644
index 0000000000..54dfb4fd51
--- /dev/null
+++ b/layout/style/crashtests/1397091.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<div id="wrapper" style="display: flex">
+  Some anon flex item.
+  <div id="item">
+    Foo bar.
+    <span> Baz</span>
+  </div>
+</div>
+<script>
+  document.body.offsetTop;
+  item.style.color = "red";
+  wrapper.firstChild.textContent = "";
+</script>
diff --git a/layout/style/crashtests/1397363-1.html b/layout/style/crashtests/1397363-1.html
new file mode 100644
index 0000000000..5ccbfa3176
--- /dev/null
+++ b/layout/style/crashtests/1397363-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+a = document.documentElement.animate([{ "clip": "rect(632vw,0,103.9vmax,5ex)" }],
+                                     { duration:96.2272536276,
+                                       iterations:Number.POSITIVE_INFINITY,
+                                       iterationComposite:"accumulate" });
+a.playbackRate = 3000;
+</script>
+</head>
+</html>
diff --git a/layout/style/crashtests/1397439-1.html b/layout/style/crashtests/1397439-1.html
new file mode 100644
index 0000000000..b617f8e0ed
--- /dev/null
+++ b/layout/style/crashtests/1397439-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<math>
+<mstyle scriptlevel=101>
+<mstyle scriptlevel=-204>
+</math>
+
diff --git a/layout/style/crashtests/1398479.html b/layout/style/crashtests/1398479.html
new file mode 100644
index 0000000000..85d49274a2
--- /dev/null
+++ b/layout/style/crashtests/1398479.html
@@ -0,0 +1 @@
+<table align="center" hspace="1">
diff --git a/layout/style/crashtests/1398581.html b/layout/style/crashtests/1398581.html
new file mode 100644
index 0000000000..e056ab44d5
--- /dev/null
+++ b/layout/style/crashtests/1398581.html
@@ -0,0 +1,17 @@
+<script>
+function start() {
+	o3=document.createElement('div');
+	document.body.appendChild(o3);
+	o14=document.createElement('style');
+	document.documentElement.appendChild(o14);
+	o18=document.createElement('style');
+	o14.appendChild(o18);
+	s4=unescape('%u06A10');
+	o3.appendChild(document.createTextNode(s4));
+	o59=document.createTextNode("{}:first-letter{ all: inherit;'x'}\n*{ float: left}:first-line{");
+	o18['before'](o18,-1,o59);
+	document.documentElement.offsetHeight;
+	o3.appendChild(document.createTextNode("x"));
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1399006.html b/layout/style/crashtests/1399006.html
new file mode 100644
index 0000000000..20e9e79869
--- /dev/null
+++ b/layout/style/crashtests/1399006.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+  let n=document.getElementById('a');
+  n.parentNode.removeChild(n);
+  document.designMode='on';
+}
+</script>
+<wbr/>
+<script></script>
+<img space='-155.002502498'/>
+<blockquote style="display:ruby-text-container">
+<mark id='a'></mark>
+</blockquote>
+<video></video>
+<area/>
+<section></section>
+<img/>
+<noscript></noscript>
+<bdo></bdo>
+<select></select>
+<select></select>
+<option></option>
+<figure style="border-image:stretch url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=) 27% fill / / 297.456633622ex"></figure>
+<wbr/>
+<pre></pre>
+<table>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1399546.html b/layout/style/crashtests/1399546.html
new file mode 100644
index 0000000000..883ee9fd65
--- /dev/null
+++ b/layout/style/crashtests/1399546.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<script>
+var d = document
+var de = d.documentElement
+de.appendChild(d.createElement("x"))
+de.appendChild(d.createElement("x"))
+de.appendChild(d.createElement("x"))
+de.appendChild(d.createElement("body"))
+
+// Should be enough of them in order for styling to be paralelizable.
+for (var i = 0; i < 100; ++i)
+  de.appendChild(d.createElement("x"))
+
+var t = d.createElement("x")
+de.appendChild(t)
+t.appendChild(d.createElement("table"))
+</script>
diff --git a/layout/style/crashtests/1400035.html b/layout/style/crashtests/1400035.html
new file mode 100644
index 0000000000..fb7a56ffbb
--- /dev/null
+++ b/layout/style/crashtests/1400035.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html id="landing-page-home">
+<style>
+@keyframes opacity {
+  from { opacity: 0; }
+  to { opacity: 1; }
+}
+#circle {
+  animation: opacity 1s infinite;
+}
+</style>
+<svg width="100" height="100">
+  <mask id="mask">
+    <circle id="circle" cx="50" cy="50" r="50" fill="red"/>
+  </mask>
+  <rect class="rect" x="0" y="0" width="100" height="100" fill="blue" mask="url(#mask)"/>
+</svg>
+</html>
diff --git a/layout/style/crashtests/1400325.html b/layout/style/crashtests/1400325.html
new file mode 100644
index 0000000000..39e33a53eb
--- /dev/null
+++ b/layout/style/crashtests/1400325.html
@@ -0,0 +1,6 @@
+<style>
+* {
+  padding-right: 2em;
+  font-size: calc(1pt + 5% + 0% + 4em);
+}
+</style>
diff --git a/layout/style/crashtests/1400926.html b/layout/style/crashtests/1400926.html
new file mode 100644
index 0000000000..f49030759e
--- /dev/null
+++ b/layout/style/crashtests/1400926.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<style>
+@keyframes anim {
+  0% { background-color: black; }
+  100% { background-color: yellow; }
+}
+</style>
+<script>
+document.styleSheets[0].cssRules[0].cssRules[0].style.setProperty('background-color', 'red', 'important');
+</script>
diff --git a/layout/style/crashtests/1400936-1.html b/layout/style/crashtests/1400936-1.html
new file mode 100644
index 0000000000..3af80a73d3
--- /dev/null
+++ b/layout/style/crashtests/1400936-1.html
@@ -0,0 +1,26 @@
+<!doctype html>
+<style>
+fieldset:invalid {
+  border: 10px solid red;
+}
+fieldset:valid {
+  border: 10px solid green;
+}
+input.foo {
+  color: green;
+}
+</style>
+<div>
+  <fieldset id="fieldset">
+    <div id="ancestor">
+      <input type="text" id="requiredInput" required>
+      <input type="text" id="other">
+    </div>
+  </fieldset>
+</div>
+<script>
+window.onload = function() {
+  other.classList.add('foo');
+  ancestor.remove();
+};
+</script>
diff --git a/layout/style/crashtests/1400936-2.html b/layout/style/crashtests/1400936-2.html
new file mode 100644
index 0000000000..b8cdc873da
--- /dev/null
+++ b/layout/style/crashtests/1400936-2.html
@@ -0,0 +1,12 @@
+<script>
+document.addEventListener("DOMContentLoaded", function(){
+  document.getElementById('a').appendChild(document.createElement('rtc'));
+  let e = document.getElementById('b');
+  document.getElementById('c').appendChild(e.parentNode.removeChild(e));
+});
+</script>
+<body dir='auto'>
+<abbr id='b'>
+&#x79C;
+<meter id='c'>
+<keygen id='a'>
diff --git a/layout/style/crashtests/1401256.html b/layout/style/crashtests/1401256.html
new file mode 100644
index 0000000000..da0a579504
--- /dev/null
+++ b/layout/style/crashtests/1401256.html
@@ -0,0 +1,5 @@
+<script>
+  let o1 = document.createElement('p');
+  document.documentElement.appendChild(o1);
+  o1.animate({'minWidth':['max-content']});
+</script>
diff --git a/layout/style/crashtests/1401706.html b/layout/style/crashtests/1401706.html
new file mode 100644
index 0000000000..7443acd8c9
--- /dev/null
+++ b/layout/style/crashtests/1401706.html
@@ -0,0 +1,10 @@
+<style></style>
+<script>
+  try { o1 = document.createElement('r') } catch(e) { }
+  try { o2 = document.createElement('input') } catch(e) { }
+  try { document.documentElement.appendChild(o1) } catch(e) { }
+  try { document.documentElement.appendChild(o2) } catch(e) { }
+  try { document.styleSheets[0].insertRule('*, :first-line { float:left }', 0); } catch(e) { }
+  try { o1.getClientRects() } catch(e) { }
+  try { o2.type = 'url' } catch(e) { }
+</script>
diff --git a/layout/style/crashtests/1401801.html b/layout/style/crashtests/1401801.html
new file mode 100644
index 0000000000..1dedd1fff1
--- /dev/null
+++ b/layout/style/crashtests/1401801.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+#test {
+  display: none;
+  width: 100px;
+  height: 100px;
+}
+</style>
+<div id="test"></div>
+<script>
+  test.animate({ backgroundColor: [ 'red', 'blue' ] },
+               { duration: 1000,
+                 iterations: Infinity });
+
+  requestAnimationFrame(() => {
+    requestAnimationFrame(() => {
+      document.styleSheets[0].cssRules[0].style.setProperty('display', 'block');
+      test.getBoundingClientRect();
+      document.documentElement.classList.remove('reftest-wait');
+    });
+  });
+</script>
+</html>
diff --git a/layout/style/crashtests/1401825.html b/layout/style/crashtests/1401825.html
new file mode 100644
index 0000000000..d42aaeefa3
--- /dev/null
+++ b/layout/style/crashtests/1401825.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<style>
+::marker {
+  -moz-appearance: button;
+}
+</style>
+<li></li>
diff --git a/layout/style/crashtests/1402218-1.html b/layout/style/crashtests/1402218-1.html
new file mode 100644
index 0000000000..597c1c4d5e
--- /dev/null
+++ b/layout/style/crashtests/1402218-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<style>
+#wrapper::first-line {}
+</style>
+<body>
+<div id="wrapper">
+  <div id="test"></div>
+</div>
+<script>
+  document.querySelector('#test').style.position = 'absolute';
+  document.body.offsetHeight;
+  document.querySelector('#wrapper').style.color = 'green';
+  document.querySelector('#test').style.position = '';
+</script>
+</body>
diff --git a/layout/style/crashtests/1402366.html b/layout/style/crashtests/1402366.html
new file mode 100644
index 0000000000..9cffd08f04
--- /dev/null
+++ b/layout/style/crashtests/1402366.html
@@ -0,0 +1,10 @@
+<script>
+document.documentElement.appendChild(document.createElement('x'))
+a = document.createElement('x')
+document.documentElement.appendChild(a)
+new Range().getClientRects()
+document.documentElement.appendChild(document.createElement('tr'))
+b = document.createElement('input')
+b.type = 'date'
+document.documentElement.insertBefore(b, a)
+</script>
diff --git a/layout/style/crashtests/1402419.html b/layout/style/crashtests/1402419.html
new file mode 100644
index 0000000000..052de43834
--- /dev/null
+++ b/layout/style/crashtests/1402419.html
@@ -0,0 +1,3 @@
+<style>
+html { color: -8192e17%; }
+</style>
diff --git a/layout/style/crashtests/1402472.html b/layout/style/crashtests/1402472.html
new file mode 100644
index 0000000000..e2842a928b
--- /dev/null
+++ b/layout/style/crashtests/1402472.html
@@ -0,0 +1,13 @@
+<style>
+* { display: contents; }
+</style>
+<script>
+a = document.createElement('map')
+document.documentElement.appendChild(a)
+a.appendChild(document.head)
+document.documentElement.getBoundingClientRect()
+document.designMode = "on"
+document.designMode = "off"
+a.appendChild(document.createElement('frame'))
+document.designMode = "on"
+</script>
diff --git a/layout/style/crashtests/1403028.html b/layout/style/crashtests/1403028.html
new file mode 100644
index 0000000000..485a08efde
--- /dev/null
+++ b/layout/style/crashtests/1403028.html
@@ -0,0 +1,9 @@
+<style>:invalid { color: red; }</style>
+<form id="theForm"></form>
+<button id="button" form="theForm">
+<script>
+window.onload = function() {
+  button.setCustomValidity("foo");
+  document.body.remove();
+}
+</script>
diff --git a/layout/style/crashtests/1403433.html b/layout/style/crashtests/1403433.html
new file mode 100644
index 0000000000..58ef5d8099
--- /dev/null
+++ b/layout/style/crashtests/1403433.html
@@ -0,0 +1,6 @@
+<style>
+#b { -webkit-filter: url(#a); }
+</style>
+<iframe id="a" height="0" src="data:v;base64,AAAAIGZ0eXBpc29tAAACAGlzb21pc28yYXZjMW1wNDEAAAAIZnJlZQAAA5NtZGF0AAACrgYF//+q3EXpvebZSLeWLNgg2SPu73gyNjQgLSBjb3JlIDE0OCByMjY0MyA1YzY1NzA0IC0gSC4yNjQvTVBFRy00IEFWQyBjb2RlYyAtIENvcHlsZWZ0IDIwMDMtMjAxNSAtIGh0dHA6Ly93d3cudmlkZW9sYW4ub3JnL3gyNjQuaHRtbCAtIG9wdGlvbnM6IGNhYmFjPTEgcmVmPTMgZGVibG9jaz0xOjA6MCBhbmFseXNlPTB4MzoweDExMyBtZT1oZXggc3VibWU9NyBwc3k9MSBwc3lfcmQ9MS4wMDowLjAwIG1peGVkX3JlZj0xIG1lX3JhbmdlPTE2IGNocm9tYV9tZT0xIHRyZWxsaXM9MSA4eDhkY3Q9MSBjcW09MCBkZWFkem9uZT0yMSwxMSBmYXN0X3Bza2lwPTEgY2hyb21hX3FwX29mZnNldD0tMiB0aHJlYWRzPTEgbG9va2FoZWFkX3RocmVhZHM9MSBzbGljZWRfdGhyZWFkcz0wIG5yPTAgZGVjaW1hdGU9MSBpbnRlcmxhY2VkPTAgYmx1cmF5X2NvbXBhdD0wIGNvbnN0cmFpbmVkX2ludHJhPTAgYmZyYW1lcz0zIGJfcHlyYW1pZD0yIGJfYWRhcHQ9MSBiX2JpYXM9MCBkaXJlY3Q9MSB3ZWlnaHRiPTEgb3Blbl9nb3A9MCB3ZWlnaHRwPTIga2V5aW50PTI1MCBrZXlpbnRfbWluPTI1IHNjZW5lY3V0PTQwIGludHJhX3JlZnJlc2g9MCByY19sb29rYWhlYWQ9NDAgcmM9Y3JmIG1idHJlZT0xIGNyZj0yMy4wIHFjb21wPTAuNjAgcXBtaW49MCBxcG1heD02OSBxcHN0ZXA9NCBpcF9yYXRpbz0xLjQwIGFxPTE6MS4wMACAAAAAvWWIhAAh/9PWYQ7q+jvvWOfBgvpv0eIYkqWiQW6SsLQx8ByoouBLEC9HBQTAXOJh/wFnteOP+NH5Er2DeHrP4kxvjj4nXKG9Zm/FycSAdlzoMDOFc4CmXmCL51Dj+zekurxKazOLwXVd7f/rOQpa9+iPXYTZsRw+WFFNokI8saLT7Mt03UvGxwdAYkwe7UmwPZacue5goP6rQhBgGMjgK21nSHZWUcz5Y6Ec/wdCPp0Sxx/h6UsSneF9hINuvwAAAAhBmiJsQx92QAAAAAgBnkF5DH/EgQAAAzRtb292AAAAbG12aGQAAAAAAAAAAAAAAAAAAAPoAAAAZAABAAABAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACXnRyYWsAAABcdGtoZAAAAAMAAAAAAAAAAAAAAAEAAAAAAAAAZAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAEAAAAAAIAAAACAAAAAAACRlZHRzAAAAHGVsc3QAAAAAAAAAAQAAAGQAAAQAAAEAAAAAAdZtZGlhAAAAIG1kaGQAAAAAAAAAAAAAAAAAADwAAAAGAFXEAAAAAAAtaGRscgAAAAAAAAAAdmlkZQAAAAAAAAAAAAAAAFZpZGVvSGFuZGxlcgAAAAGBbWluZgAAABR2bWhkAAAAAQAAAAAAAAAAAAAAJGRpbmYAAAAcZHJlZgAAAAAAAAABAAAADHVybCAAAAABAAABQXN0YmwAAACVc3RzZAAAAAAAAAABAAAAhWF2YzEAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAIAAgAEgAAABIAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAY//8AAAAvYXZjQwFkAAr/4QAWZ2QACqzZSWhAAAADAEAAAA8DxIllgAEABmjr48siwAAAABhzdHRzAAAAAAAAAAEAAAADAAACAAAAABRzdHNzAAAAAAAAAAEAAAABAAAAKGN0dHMAAAAAAAAAAwAAAAEAAAQAAAAAAQAABgAAAAABAAACAAAAABxzdHNjAAAAAAAAAAEAAAABAAAAAwAAAAEAAAAgc3RzegAAAAAAAAAAAAAAAwAAA3MAAAAMAAAADAAAABRzdGNvAAAAAAAAAAEAAAAwAAAAYnVkdGEAAABabWV0YQAAAAAAAAAhaGRscgAAAAAAAAAAbWRpcmFwcGwAAAAAAAAAAAAAAAAtaWxzdAAAACWpdG9vAAAAHWRhdGEAAAABAAAAAExhdmY1Ni40MC4xMDEnow">
+</iframe>
+<table id="b">
diff --git a/layout/style/crashtests/1403465.html b/layout/style/crashtests/1403465.html
new file mode 100644
index 0000000000..924392757b
--- /dev/null
+++ b/layout/style/crashtests/1403465.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <math class="hidden">
+    <mi>x</mi>
+    <mo>=</mo>
+  </math>
+<script>
+window.onload = function() {
+  let s = document.createElement("style");
+  s.textContent = `
+    body {
+      line-height: 1.42857143;
+    }
+
+    .hidden {
+      display: none;
+    }
+  `;
+  document.body.appendChild(s);
+};
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/1403592.html b/layout/style/crashtests/1403592.html
new file mode 100644
index 0000000000..184096c11c
--- /dev/null
+++ b/layout/style/crashtests/1403592.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<style></style>
+<script>
+function boom() {
+  a = document.createElement("x")
+  a.style.overflow = "o"
+  document.styleSheets[0].insertRule("i {}", 0)
+  setTimeout(function() {
+    document.documentElement.className = "";
+  }, 0);
+}
+setTimeout(boom, 0)
+</script>
+</head>
+<i id=id0 style="margin: 15ch">
+<svg><animate xlink:href=#id0 attributeName=width to></svg>
+</html>
diff --git a/layout/style/crashtests/1403615.html b/layout/style/crashtests/1403615.html
new file mode 100644
index 0000000000..ab2c27f7b8
--- /dev/null
+++ b/layout/style/crashtests/1403615.html
@@ -0,0 +1,24 @@
+<html class="reftest-wait">
+<script>
+window.onload = () => {
+  a = document.createElement("body")
+  b = document.createElement("span")
+  a.appendChild(b)
+  c = document.createElement("div")
+  d = document.createElement("div")
+  c.appendChild(d)
+  a.appendChild(c)
+  document.documentElement.appendChild(a)
+  setTimeout(() => {
+    a.style.display = "table-column-group"
+    d.appendChild(document.createTextNode("\u05D2"))
+    setTimeout(() => {
+      d.appendChild(document.createElement("span"))
+      b.style.zIndex = "1073741824"
+      document.documentElement.offsetTop;
+      document.documentElement.className = "";
+    }, 0)
+  }, 0)
+}
+</script>
+</html>
diff --git a/layout/style/crashtests/1403712.html b/layout/style/crashtests/1403712.html
new file mode 100644
index 0000000000..1166a11964
--- /dev/null
+++ b/layout/style/crashtests/1403712.html
@@ -0,0 +1,26 @@
+<!doctype html>
+<style>
+  :indeterminate { color: red; }
+</style>
+<div id="container">
+  <fieldset>
+    <label>
+      <input name="layout" type="radio">Foo
+    </label>
+    <label>
+      <input name="layout" type="radio">Bar
+    </label>
+    <label>
+      <input name="layout" type="radio">Baz
+    </label>
+    <label>
+      <input name="layout" type="radio">Buz
+    </label>
+  </fieldset>
+</div>
+<script>
+container.querySelector('input').checked = true;
+document.body.offsetTop;
+container.remove();
+document.body.offsetTop;
+</script>
diff --git a/layout/style/crashtests/1404057.html b/layout/style/crashtests/1404057.html
new file mode 100644
index 0000000000..4c4a33ce49
--- /dev/null
+++ b/layout/style/crashtests/1404057.html
@@ -0,0 +1,6 @@
+<html>
+  <title>Testcase, bug 143862</title>
+  <head>
+<svg><text><t style='all:initial'>aaa</t></text></svg>
+  </head>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1404180-1.html b/layout/style/crashtests/1404180-1.html
new file mode 100644
index 0000000000..079d6800f5
--- /dev/null
+++ b/layout/style/crashtests/1404180-1.html
@@ -0,0 +1,22 @@
+<script>
+function jsfuzzer() {
+  try { htmlvar00016.appendChild(htmlvar00017); } catch(e) { }
+  try { htmlvar00016.form.setAttribute("novalidate", "novalidate"); } catch(e) { }
+  try { htmlvar00017.appendChild(htmlvar00036); } catch(e) { }
+  try { svgvar00007.appendChild(htmlvar00008); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<form id="htmlvar00007">
+<legend id="htmlvar00008">
+<output id="htmlvar00016"></output>
+</legend>
+<link id="htmlvar00017"></link>
+<svg>
+<path id="svgvar00006">
+<animateTransform id="svgvar00007"/>
+</path>
+<use xlink:href="#svgvar00006">
+<table id="htmlvar00036">
+<th>
+<output form="htmlvar00007">
diff --git a/layout/style/crashtests/1404316.html b/layout/style/crashtests/1404316.html
new file mode 100644
index 0000000000..4ac2f16701
--- /dev/null
+++ b/layout/style/crashtests/1404316.html
@@ -0,0 +1,20 @@
+<html contenteditable="">
+  <style></style>
+  <script>
+  try { o1 = document.getSelection() } catch(e) { }
+  try { o2 = document.createElement('table') } catch(e) { }
+  try { o3 = document.createElement('r') } catch(e) { }
+  try { o4 = document.createElement('l') } catch(e) { }
+  try { o5 = document.createElement('k') } catch(e) { }
+  try { o6 = document.createElement('u') } catch(e) { }
+  try { document.documentElement.appendChild(o2) } catch(e) { }
+  try { document.documentElement.appendChild(o3) } catch(e) { }
+  try { document.documentElement.appendChild(o4) } catch(e) { }
+  try { document.documentElement.appendChild(o5) } catch(e) { }
+  try { document.designMode = "on"; } catch(e) { }
+  try { document.designMode = "off"; } catch(e) { }
+  try { o1.selectAllChildren(o2) } catch(e) { }
+  try { document.styleSheets[0].insertRule("e{", 0); } catch(e) { }
+  try { document.documentElement.appendChild(o6) } catch(e) { }
+  </script>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1404324-1.html b/layout/style/crashtests/1404324-1.html
new file mode 100644
index 0000000000..574a5437cb
--- /dev/null
+++ b/layout/style/crashtests/1404324-1.html
@@ -0,0 +1,12 @@
+<style></style>
+<script>
+document.documentElement.className = 'c1'
+o1 = document.createElement('form')
+o2 = document.createElement('e')
+o1.className = 'c2'
+document.documentElement.appendChild(o1)
+document.documentElement.appendChild(o2)
+document.styleSheets[0].insertRule('.c1:first-line, .c2 { position:fixed', 0);
+document.documentElement.getBoundingClientRect()
+document.styleSheets[0].cssRules[0].style.position = 'relative'
+</script>
diff --git a/layout/style/crashtests/1404324-2.html b/layout/style/crashtests/1404324-2.html
new file mode 100644
index 0000000000..797347d5c0
--- /dev/null
+++ b/layout/style/crashtests/1404324-2.html
@@ -0,0 +1,10 @@
+<style>
+  del, *::first-line {
+    position: absolute;
+  }
+</style>
+<del></del>
+<script>
+  document.documentElement.offsetTop;
+  document.styleSheets[0].cssRules[0].style.position = 'sticky'
+</script>
diff --git a/layout/style/crashtests/1404324-3.html b/layout/style/crashtests/1404324-3.html
new file mode 100644
index 0000000000..3b06f12a2b
--- /dev/null
+++ b/layout/style/crashtests/1404324-3.html
@@ -0,0 +1,14 @@
+<style>
+del {
+  position: absolute;
+}
+
+body::first-line {
+  color: red;
+}
+</style>
+<del></del>
+<script>
+  document.documentElement.offsetTop;
+  document.styleSheets[0].cssRules[0].style.position = 'sticky'
+</script>
diff --git a/layout/style/crashtests/1405880.html b/layout/style/crashtests/1405880.html
new file mode 100644
index 0000000000..aad53507a7
--- /dev/null
+++ b/layout/style/crashtests/1405880.html
@@ -0,0 +1,21 @@
+<style>
+input:invalid {}
+</style>
+<script>
+function eventhandler1() {
+try { htmlvar00005.select(); } catch(e) { }
+try { htmlvar00009.appendChild(htmlvar00004); } catch(e) { }
+try { htmlvar00013.innerText = ""; } catch(e) { }
+}
+function eventhandler2() {
+try { htmlvar00011.addEventListener("DOMSubtreeModified", eventhandler1); } catch(e) { }
+try { htmlvar00011.style.setProperty("text-transform", "full-width"); } catch(e) { }
+}
+</script>
+<marquee id="htmlvar00004">
+<input id="htmlvar00005" required="">
+</marquee>
+<form id="htmlvar00009">
+<legend id="htmlvar00011">
+<q id="htmlvar00013">
+<image onload="eventhandler2()" src="data:;base64,R0lGODlhIAAAAAAAACH5BAAAAAAALAAAAAgACAAAAO">
diff --git a/layout/style/crashtests/1406222-1.html b/layout/style/crashtests/1406222-1.html
new file mode 100644
index 0000000000..218a3da095
--- /dev/null
+++ b/layout/style/crashtests/1406222-1.html
@@ -0,0 +1,25 @@
+<script>
+window.addEventListener("load", function(event) {
+  setTimeout(window.close, 1000);
+});
+</script>
+<!-- a -->
+<style id="s1">
+:not(video) { position: fixed; }
+a::first-line {}
+*, .class3 { columns: 0px; }
+</style>
+<script>
+function jsfuzzer() {
+try { s1.appendChild(htmlvar00009); } catch(e) { }
+try { htmlvar00001.scrollIntoView(true); } catch(e) { }
+try { htmlvar00003.href = undefined; } catch(e) { }
+try { document.createEvent("1"); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<shadow id="htmlvar00001">
+<a id="htmlvar00003">
+</a>
+<a id="htmlvar00009">
+<!-- a -->
diff --git a/layout/style/crashtests/1406222-2.html b/layout/style/crashtests/1406222-2.html
new file mode 100644
index 0000000000..3ae655d972
--- /dev/null
+++ b/layout/style/crashtests/1406222-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<style>
+a { display: block; }
+a { columns: 0px; }
+a::first-line {}
+</style>
+<script>
+onload = function() {
+  document.body.offsetWidth;
+  document.body.style.color = "green";
+  document.body.offsetWidth;
+  document.querySelector("a").href = "Something";
+}
+</script>
+<a>Some text</a>
diff --git a/layout/style/crashtests/1409183.html b/layout/style/crashtests/1409183.html
new file mode 100644
index 0000000000..7fe21032cd
--- /dev/null
+++ b/layout/style/crashtests/1409183.html
@@ -0,0 +1,15 @@
+<script>
+function jsfuzzer() {
+try { htmlvar00043.defaultChecked = true; } catch(e) { }
+try { svgvar00002.appendChild(htmlvar00040); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<table>
+<svg id="svgvar00001">
+<title id="svgvar00002">Title</title>
+</table>
+<svg>
+<use xlink:href="#svgvar00001"><body xmlns="">
+<label id="htmlvar00040">
+<input id="htmlvar00043" name="x" type="radio">
diff --git a/layout/style/crashtests/1409502.html b/layout/style/crashtests/1409502.html
new file mode 100644
index 0000000000..33c5d38728
--- /dev/null
+++ b/layout/style/crashtests/1409502.html
@@ -0,0 +1,13 @@
+<html>
+  <head>
+    <style>
+      HTML:first-line, DIV { position:fixed }
+    </style>
+    <script>
+      try { o1 = document.createElement('DIV') } catch(e) { }
+      try { document.documentElement.appendChild(o1) } catch(e) { }
+      try { document.documentElement.getBoundingClientRect() } catch(e) { }
+      try { document.styleSheets[0].cssRules[0].style['position'] = 'relative' } catch(e) { }
+    </script>
+  </head>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1409931.html b/layout/style/crashtests/1409931.html
new file mode 100644
index 0000000000..00a8272f94
--- /dev/null
+++ b/layout/style/crashtests/1409931.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<map id="htmlvar00005">
+<area></area>
+<input
+     id="htmlvar00019"
+     type="image"
+     usemap="#htmlvar00005"
+     src="data:image/gif;base64,R0lGODlhIAAgAPIBAGbMzP///wAAADOZZpn/zAAAAAAAAAAAACH5BAAAAAAALAAAAAAgACAAAAOLGLrc/k7ISau9S5DNu/8fICgaYJ5oqqbDGJRrLAMtScw468J5Xr+3nm8XFM5+PGMMWYwxcMyZ40iULQaDhSzqDGBNisGyuhUDrmNb72pWcaXhtpsM/27pVi8UX96rcQpDf3V+QD12d4NKK2+Lc4qOKI2RJ5OUNHyXSDRYnZ6foKAuLxelphMQqaoPCQA7">
+<script>
+onload = () => {
+  document.body.offsetTop;
+  document.querySelector('area').style.color = "red";
+}
+</script>
diff --git a/layout/style/crashtests/1410226-1.html b/layout/style/crashtests/1410226-1.html
new file mode 100644
index 0000000000..0ced6eefed
--- /dev/null
+++ b/layout/style/crashtests/1410226-1.html
@@ -0,0 +1,8 @@
+<style>
+ * { display: contents; }
+</style>
+<details>
+</details>
+<marquee>
+<ul>
+<canvas>
diff --git a/layout/style/crashtests/1410226-2.html b/layout/style/crashtests/1410226-2.html
new file mode 100644
index 0000000000..c02e585512
--- /dev/null
+++ b/layout/style/crashtests/1410226-2.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<style>
+ * { display: contents; }
+</style>
+<marquee>
+<div id="target">
+</div>
+</marquee>
+<script>
+document.body.offsetTop;
+let div = document.createElement('div');
+div.style.display = "block";
+div.appendChild(document.createTextNode('where am I'));
+target.appendChild(div);
+document.body.style.color = "red";
+</script>
diff --git a/layout/style/crashtests/1411008.html b/layout/style/crashtests/1411008.html
new file mode 100644
index 0000000000..9621a559ee
--- /dev/null
+++ b/layout/style/crashtests/1411008.html
@@ -0,0 +1,22 @@
+<!doctype html>
+<script>
+  try { o1 = document.createElement('c') } catch(e) { }
+  try { o2 = document.createElement('p') } catch(e) { }
+  try { o3 = document.createElement('progress') } catch(e) { }
+  try { o4 = document.createElement('legend') } catch(e) { }
+  try { o5 = document.createElement('m') } catch(e) { }
+  try { o6 = new Range() } catch(e) { }
+  try { o7 = window.getSelection() } catch(e) { }
+  try { document.documentElement.appendChild(o1) } catch(e) { }
+  try { document.documentElement.appendChild(o2) } catch(e) { }
+  try { document.documentElement.appendChild(o3) } catch(e) { }
+  try { o1.scrollTopMax } catch(e) { }
+  try { o2.outerHTML = '<b contenteditable="">' } catch(e) { }
+  try { o7.modify('move', 'right', 'line') } catch(e) { }
+  try { o1.prepend(o4) } catch(e) { }
+  try { document.documentElement.appendChild(o5) } catch(e) { }
+  try { o5.scrollLeft = 8 } catch(e) { }
+  try { document.designMode = 'on'; } catch(e) { }
+  try { o7.addRange(o6); } catch(e) { }
+  try { document.execCommand('inserttext') } catch(e) { }
+</script>
diff --git a/layout/style/crashtests/1411143.html b/layout/style/crashtests/1411143.html
new file mode 100644
index 0000000000..adf3f2c042
--- /dev/null
+++ b/layout/style/crashtests/1411143.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<link rel="stylesheet" href="data:image/png,">
+<script>
+window.onload = function() {
+  document.styleSheets[0].insertRule("* { marker: url(#a); }", 0);
+};
+</script>
diff --git a/layout/style/crashtests/1411478.html b/layout/style/crashtests/1411478.html
new file mode 100644
index 0000000000..fcbf640186
--- /dev/null
+++ b/layout/style/crashtests/1411478.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<script>
+  document.write('<frameset><frame hidden>');
+  document.documentElement.offsetHeight;
+  document.querySelector('frame').appendChild(document.createElement('div'));
+</script>
diff --git a/layout/style/crashtests/1413288.html b/layout/style/crashtests/1413288.html
new file mode 100644
index 0000000000..cab30aee5b
--- /dev/null
+++ b/layout/style/crashtests/1413288.html
@@ -0,0 +1,17 @@
+<style>
+:root { column-width: 0px; }
+:not(article) {	padding: 2 0px; }
+</style>
+<script>
+function jsfuzzer() {
+try { htmlvar00007.setAttribute("align", "LEFT"); } catch(e) { }
+try { svgvar00016.getStartPositionOfChar(0); } catch(e) { }
+try { htmlvar00016.style.setProperty("column-gap", "0"); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<iframe id="htmlvar00007"></iframe>
+<details>
+<summary id="htmlvar00016">)
+<svg>
+<tspan id="svgvar00016" />
diff --git a/layout/style/crashtests/1413361.html b/layout/style/crashtests/1413361.html
new file mode 100644
index 0000000000..c7bd075f23
--- /dev/null
+++ b/layout/style/crashtests/1413361.html
@@ -0,0 +1,8 @@
+<script>
+function go() {
+  window.getSelection().selectAllChildren(document.body.firstChild);
+  document.createElement("body").aLink = "-moz-mac-menuselect";
+  window.getSelection().getRangeAt(0).getClientRects();
+}
+</script>
+<body onload=go()>
diff --git a/layout/style/crashtests/1413670.html b/layout/style/crashtests/1413670.html
new file mode 100644
index 0000000000..958485c0ef
--- /dev/null
+++ b/layout/style/crashtests/1413670.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">
+<script>
+setTimeout(function(){
+  document.designMode='on';
+  window.frames[0].document.body.appendChild(document.getElementById('a'));
+  document.documentElement.className = "";
+}, 0);
+</script>
+<iframe></iframe>
+<base href=''/>
+<body id='a'>
+<kbd contenteditable='true'>
+<li contenteditable='false'>
+</li>
+<label>
+<a href=''>
+</html>
diff --git a/layout/style/crashtests/1415353.html b/layout/style/crashtests/1415353.html
new file mode 100644
index 0000000000..e44f72cde6
--- /dev/null
+++ b/layout/style/crashtests/1415353.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<textarea id="htmlvar00003" maxlength="0">
+  <!-- Text nodes around me are important -->
+</textarea>
+<script>
+document.body.offsetTop;
+document.querySelector('textarea').attachShadow({ mode: "open" });
+</script>
diff --git a/layout/style/crashtests/1418059.html b/layout/style/crashtests/1418059.html
new file mode 100644
index 0000000000..a799e162a9
--- /dev/null
+++ b/layout/style/crashtests/1418059.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+@keyframes anim {
+  to { transform: rotate(360deg); }
+}
+.document-ready .animation::after {
+  display: none;
+}
+.animation::after {
+  content: "";
+  animation: anim 1s infinite;
+}
+</style>
+<div class="animation"></div>
+<script>
+window.addEventListener('load', () => {
+  document.documentElement.classList.add('document-ready');
+  requestAnimationFrame(() => {
+    document.documentElement.classList.remove('reftest-wait');
+  });
+});
+</script>
+</html>
diff --git a/layout/style/crashtests/1418867.html b/layout/style/crashtests/1418867.html
new file mode 100644
index 0000000000..4317f812c2
--- /dev/null
+++ b/layout/style/crashtests/1418867.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+@keyframes anim {
+  to { transform: rotate(360deg); }
+}
+.document-ready div::after {
+  display: none;
+}
+div::after {
+  content: "";
+}
+.animation::after {
+  animation: anim 1s infinite;
+}
+</style>
+<div id="target"></div>
+<script>
+window.addEventListener('load', () => {
+  target.classList.add('animation');
+  const psuedo = document.getAnimations()[0].effect.target;
+  target.classList.remove('animation');
+
+  psuedo.animate([ { transform: 'rotate(360deg)' } ], 1000);
+  requestAnimationFrame(() => {
+    document.documentElement.classList.add('document-ready');
+    requestAnimationFrame(() => {
+      document.documentElement.classList.remove('reftest-wait');
+    });
+  });
+});
+</script>
+</html>
diff --git a/layout/style/crashtests/1419554.html b/layout/style/crashtests/1419554.html
new file mode 100644
index 0000000000..3a9b917c19
--- /dev/null
+++ b/layout/style/crashtests/1419554.html
@@ -0,0 +1,9 @@
+<script>
+function go() {
+  a.attachShadow({ mode: "open" });
+  a.appendChild(b);
+}
+</script>
+<body onload=go()>
+<div id="b"></div>
+<div id="a"></div>
diff --git a/layout/style/crashtests/1426312.html b/layout/style/crashtests/1426312.html
new file mode 100644
index 0000000000..4a99d1eec0
--- /dev/null
+++ b/layout/style/crashtests/1426312.html
@@ -0,0 +1,4 @@
+<style>
+  @keyframes a { }
+  * { animation: a -7s }
+</style>
diff --git a/layout/style/crashtests/1439793.html b/layout/style/crashtests/1439793.html
new file mode 100644
index 0000000000..1667978a63
--- /dev/null
+++ b/layout/style/crashtests/1439793.html
@@ -0,0 +1,10 @@
+<script>
+  o1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mfenced")
+  document.documentElement.appendChild(o1);
+  o3 = document.createElementNS("http://www.w3.org/1999/xhtml", "style");
+  o3.appendChild(document.createTextNode("[s=\"\"]{"));
+  (document.head || document.children[0]).appendChild(o3);
+  o4 = o3.sheet;
+  window.scrollBy(0.41979783887602806, 16);
+  o4.insertRule("::-moz-math-anonymous,g{scroll-behavior:smooth", 1);
+</script>
diff --git a/layout/style/crashtests/1445682.html b/layout/style/crashtests/1445682.html
new file mode 100644
index 0000000000..b79fd1d89b
--- /dev/null
+++ b/layout/style/crashtests/1445682.html
@@ -0,0 +1,16 @@
+<script>
+  function go() {
+    let host = document.createElement('div');
+    let style_1 = document.createElement('style');
+    let style_2 = document.createElement('style');
+    let otherElement = document.createElement('div');
+    let shadowRoot = host.attachShadow({mode: "open"});
+    style_1.title = 'x';
+    style_2.title = 'y';
+    document.head.appendChild(style_1);
+    shadowRoot.appendChild(style_2);
+    document.documentElement.appendChild(otherElement);
+    otherElement.before('', host, '');
+  }
+  window.addEventListener('load', go)
+</script>
diff --git a/layout/style/crashtests/1449243.html b/layout/style/crashtests/1449243.html
new file mode 100644
index 0000000000..ad07f572a8
--- /dev/null
+++ b/layout/style/crashtests/1449243.html
@@ -0,0 +1,13 @@
+<!doctype html>
+<div id="host"></div>
+<script>
+  host.attachShadow({ mode: 'open' }).innerHTML = `
+    <style>
+      div { color: green }
+    </style>
+    <div></div>
+  `;
+  document.body.offsetTop;
+  host.shadowRoot.styleSheets[0].insertRule("[foo] { color: green }", 0);
+  host.shadowRoot.querySelector("div").setAttribute("foo", "bar");
+</script>
diff --git a/layout/style/crashtests/1450691.html b/layout/style/crashtests/1450691.html
new file mode 100644
index 0000000000..2c83abbdbb
--- /dev/null
+++ b/layout/style/crashtests/1450691.html
@@ -0,0 +1,12 @@
+<script>
+  o0 = document.createElement('iframe');
+  o1 = document.createElement('iframe');
+  document.documentElement.appendChild(o0);
+  o2 = o0.getSVGDocument();
+  o3 = o2.childNodes[0];
+  o3.appendChild(o1);
+  o3.scrollHeight;
+  o3.hidden = true;
+  o4 = window.getComputedStyle(o1.contentDocument.childNodes[0].childNodes[1], ":z");
+  o4.length;
+</script>
diff --git a/layout/style/crashtests/1453206.html b/layout/style/crashtests/1453206.html
new file mode 100644
index 0000000000..da63711bde
--- /dev/null
+++ b/layout/style/crashtests/1453206.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<div id="host"></div>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  let shadow = host.attachShadow({ mode: 'open' });
+  shadow.appendChild(document.createElement('marquee'));
+});
+</script>
diff --git a/layout/style/crashtests/1454140.html b/layout/style/crashtests/1454140.html
new file mode 100644
index 0000000000..8e388d43f9
--- /dev/null
+++ b/layout/style/crashtests/1454140.html
@@ -0,0 +1,4 @@
+<!-- A -->
+<table background="
+#"><base href=Y:
+<!-- A -->
diff --git a/layout/style/crashtests/1455108.html b/layout/style/crashtests/1455108.html
new file mode 100644
index 0000000000..29b1467797
--- /dev/null
+++ b/layout/style/crashtests/1455108.html
@@ -0,0 +1,17 @@
+<!doctype html>
+<style>
+  div::first-line {
+    color: yellow:
+  }
+  .foo span {
+    display: none;
+  }
+  .foo::first-line {
+    color: red;
+  }
+</style>
+<div><span>Yo, I'm a first-line<span> really</span></span>
+<script>
+  document.body.offsetTop;
+  document.querySelector('div').classList.add('foo');
+</script>
diff --git a/layout/style/crashtests/1457288.html b/layout/style/crashtests/1457288.html
new file mode 100644
index 0000000000..43ca9c365e
--- /dev/null
+++ b/layout/style/crashtests/1457288.html
@@ -0,0 +1,9 @@
+<script>
+function start() {
+	o234=document.createElement('style');
+	o235=document.createTextNode("*{ shape-outside: ellipse(1% 10%); shape-margin: 1048576rem; float: right}");
+	o234.appendChild(o235);
+	document.documentElement.appendChild(o234);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/style/crashtests/1457985.html b/layout/style/crashtests/1457985.html
new file mode 100644
index 0000000000..9772908c50
--- /dev/null
+++ b/layout/style/crashtests/1457985.html
@@ -0,0 +1,2 @@
+<body style="content:attr(a) open-quote">
+<header style="all:inherit">
diff --git a/layout/style/crashtests/1468640.html b/layout/style/crashtests/1468640.html
new file mode 100644
index 0000000000..4e9f3bad1e
--- /dev/null
+++ b/layout/style/crashtests/1468640.html
@@ -0,0 +1,10 @@
+<script>
+function go() {
+  a.attachShadow({mode: "closed"}).innerHTML = b.outerHTML;
+  a.setAttribute("o", "");
+}
+</script>
+<body onload=go()>
+<meter id="b">
+<style></style>
+<div id="a">
diff --git a/layout/style/crashtests/1469076.html b/layout/style/crashtests/1469076.html
new file mode 100644
index 0000000000..0270316382
--- /dev/null
+++ b/layout/style/crashtests/1469076.html
@@ -0,0 +1,12 @@
+<style>
+* { display: contents }
+</style>
+<script>
+function go() {
+  a.parentElement.animate({"ping": [0, 1]}, 0.281207776578);
+}
+</script>
+<body onload=go()>
+></br>
+<shadow>
+<details id="a">
diff --git a/layout/style/crashtests/1475003.html b/layout/style/crashtests/1475003.html
new file mode 100644
index 0000000000..6cdfefbe62
--- /dev/null
+++ b/layout/style/crashtests/1475003.html
@@ -0,0 +1,21 @@
+<html class="reftest-wait">
+<head>
+<script>
+function go() {
+  window.requestAnimationFrame(eh);
+}
+function eh() {
+  a.appendChild(b);
+  d.innerHTML = c.outerHTML;
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload=go()>
+<audio id="a" onerror="eh()" src="x"></audio>
+<data id="b">
+<li id="c">
+<svg>
+<set attributeName="overflow" to="hidden"/>
+<li id="d">
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1479681.html b/layout/style/crashtests/1479681.html
new file mode 100644
index 0000000000..1d4c6c612d
--- /dev/null
+++ b/layout/style/crashtests/1479681.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<style>
+  div {
+    color: red;
+    transition: margin 1s ease, all 2s;
+  }
+</style>
+<div>Should turn Green</div>
+<script>
+onload = function() {
+  document.querySelector('div').style.color = "green";
+  document.body.offsetTop;
+}
+</script>
diff --git a/layout/style/crashtests/1488817.html b/layout/style/crashtests/1488817.html
new file mode 100644
index 0000000000..7613927185
--- /dev/null
+++ b/layout/style/crashtests/1488817.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+<style id='style'></style>
+<script>
+function start() {
+  o1 = document.createElement('figcaption')
+  o1.innerText = 'ᾂ﷞󠈂7阘𝅨ᷱ𝉗٩m󠙅,︥𖕬שּׁ︦　n-፝󠿸𫮨𯚪҅҈h"٪۰󠗽錐󠇪҈שּׁ𛜑𝔡L‭\r\n埤സ&\n<<=󠺁킻&︠‬e󠔥\b\r>𯉸󠕯'
+  document.documentElement.appendChild(o1)
+  document.getElementById('style').textContent = `
+  FIGCAPTION::before, FIGCAPTION {
+    content: counters(\\46, \'.\')
+  }
+  HTML {
+    -webkit-transition-delay: 1s, 250ms
+  }
+  FIGCAPTION::first-letter, * {
+    fill: currentColor
+  }
+  FIGCAPTION::first-line {}`
+  document.body.offsetTop;
+  document.replaceChild(document.documentElement, document.documentElement)
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+<body></body>
+</html>
diff --git a/layout/style/crashtests/1490012.html b/layout/style/crashtests/1490012.html
new file mode 100644
index 0000000000..fcd951ccc4
--- /dev/null
+++ b/layout/style/crashtests/1490012.html
@@ -0,0 +1,11 @@
+<script>
+function go() {
+  b.appendChild(document.createElement("iframe"));
+  a.scroll({left: -1, top: 1});
+  window[0].matchMedia("").addListener(function(){});
+  b.open = false;
+}
+</script>
+<body onload=go()>
+<image id="a"></image>
+<details id="b" open="true">
diff --git a/layout/style/crashtests/1502893.html b/layout/style/crashtests/1502893.html
new file mode 100644
index 0000000000..eed2d75f5e
--- /dev/null
+++ b/layout/style/crashtests/1502893.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<style>
+  #animate_0[onrepeat=''] {}
+</style>
+<animate id="animate_0" />
+<animate id="animate_1" />
+<script>
+  window.CustomElement0 = class extends HTMLElement {
+    constructor() {
+      super();
+      this.attachShadow({
+        mode: 'open'
+      })
+    }
+    connectedCallback() {
+      this.shadowRoot.prepend(o2)
+      this.setAttribute('contenteditable', 'true')
+    }
+  }
+
+  customElements.define('custom-element-0', CustomElement0)
+  o1 = document.createElement('custom-element-0')
+  o2 = document.getElementById('animate_0')
+  o3 = document.getElementById('animate_1')
+  document.documentElement.appendChild(o1)
+  document.replaceChild(document.documentElement, document.documentElement)
+  o1.shadowRoot.prepend(o3)
+  o3.offsetTop;
+</script>
diff --git a/layout/style/crashtests/1507674.html b/layout/style/crashtests/1507674.html
new file mode 100644
index 0000000000..be247b781c
--- /dev/null
+++ b/layout/style/crashtests/1507674.html
@@ -0,0 +1,16 @@
+<style>
+menuitem { -webkit-filter: url(#a) }
+</style>
+<menuitem>A
+</menu>
+<svg id="b" style="-webkit-text-stroke-width: 1px;">
+<text id="a">
+<menu style="background-image: url();">
+<menuitem id="c">
+<script>
+c.offsetTop;
+a.setAttribute("exponent", "1");
+c.offsetTop;
+b.setAttribute("text-decoration", "line-through");
+c.offsetTop;
+</script>
diff --git a/layout/style/crashtests/1509989.html b/layout/style/crashtests/1509989.html
new file mode 100644
index 0000000000..1eacaddd96
--- /dev/null
+++ b/layout/style/crashtests/1509989.html
@@ -0,0 +1,11 @@
+<script>
+function go() {
+  window.getSelection().getRangeAt(0).insertNode(a);
+}
+</script>
+<body onload=go()>
+<dl>
+<dd id="a">
+<video>
+</dd>
+<input type="number" autofocus="">
diff --git a/layout/style/crashtests/1514086.html b/layout/style/crashtests/1514086.html
new file mode 100644
index 0000000000..dc3f81e2ac
--- /dev/null
+++ b/layout/style/crashtests/1514086.html
@@ -0,0 +1,13 @@
+<script>
+let o = [];
+window.onload = function(){
+  o[0] = document.createElement("font");
+  document.body.appendChild(o[0]);
+  o[1] = document.createElement("embed");
+  o[0].appendChild(o[1]);
+  o[2] = document.createElement("dialog");
+  o[1].appendChild(o[2]);
+  o[2].appendChild(document.createElement("s"));
+  o[2].animate([{"all": "unset"}, {}], 3);
+}
+</script>
diff --git a/layout/style/crashtests/1533783.html b/layout/style/crashtests/1533783.html
new file mode 100644
index 0000000000..1b793c6f4e
--- /dev/null
+++ b/layout/style/crashtests/1533783.html
@@ -0,0 +1,10 @@
+<script>
+  function start() {
+    const style = document.createElement('style')
+    document.head.appendChild(style)
+    const sheet_1 = style.sheet
+    document.head.appendChild(style)
+    sheet_1.insertRule('@import url()', 0)
+  }
+  document.addEventListener('DOMContentLoaded', start)
+</script>
diff --git a/layout/style/crashtests/1533891.html b/layout/style/crashtests/1533891.html
new file mode 100644
index 0000000000..da135c66eb
--- /dev/null
+++ b/layout/style/crashtests/1533891.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+    <style>
+        * {
+            border-image-source: url(data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7);
+        }
+        pre::first-line { }
+    </style>
+    <head>
+<body>
+<pre><data>]j% BAVxE</command>
+</body>
+</html>
diff --git a/layout/style/crashtests/1533968.html b/layout/style/crashtests/1533968.html
new file mode 100644
index 0000000000..1297e3b485
--- /dev/null
+++ b/layout/style/crashtests/1533968.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+  <style>
+    #th {
+      width: 100px;
+      height: 100px;
+      transition-duration: 1s;
+    }
+  </style>
+  <script>
+    function start () {
+      var div = document.getElementById('th');
+      div.style.backgroundColor = 'green';
+    }
+  </script>
+</head>
+<body onload="start()">
+<table>
+  <tr style="background-color: blue;"><th id="th"></th></tr>
+</table>
+</body>
+</html>
diff --git a/layout/style/crashtests/1545177.html b/layout/style/crashtests/1545177.html
new file mode 100644
index 0000000000..476bb4c77e
--- /dev/null
+++ b/layout/style/crashtests/1545177.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+    <script>
+      function start () {
+        const font_1 = new FontFace('m', 'url()', {})
+        const font_2 = new FontFace('', '')
+        document.fonts.add(font_1)
+        font_1.family = 'f'
+        document.fonts.add(font_2)
+      }
+
+      window.addEventListener('load', start)
+    </script>
+</head>
+</html>
diff --git a/layout/style/crashtests/1546255.html b/layout/style/crashtests/1546255.html
new file mode 100644
index 0000000000..ca5c1933c6
--- /dev/null
+++ b/layout/style/crashtests/1546255.html
@@ -0,0 +1,29 @@
+<style id="id_0">
+    @import url('data:;base64,QGN7IGJ9CkRBTVAsIEhUTUwgey');
+</style>
+<script>
+  function start () {
+    style = document.createElement('style')
+    document.head.appendChild(style)
+
+    const o0 = document.getElementById('id_0')
+    const o1 = document.getElementById('id_1')
+
+    const range = new Range()
+    range.selectNode(o1)
+
+    style.sheet.insertRule('@namespace\'', 0)
+    for (let i = 0; i < 7; i++) {
+      range.insertNode(o0)
+    }
+
+    const xhr = new XMLHttpRequest()
+    xhr.open('G', '', false)
+    xhr.send()
+
+    SpecialPowers.InspectorUtils.getCSSStyleRules(document.documentElement)
+  }
+
+  window.addEventListener('load', start)
+</script>
+<li id="id_1">
diff --git a/layout/style/crashtests/1552911.html b/layout/style/crashtests/1552911.html
new file mode 100644
index 0000000000..0e8fcb8db7
--- /dev/null
+++ b/layout/style/crashtests/1552911.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+  <script>
+    function start() {
+      const o1 =
+        document.createElementNS('http://www.w3.org/1999/xhtml', 'slot');
+      const observer = new ResizeObserverEntry(o1);
+      typeof observer.borderBoxSize;
+      typeof observer.contentBoxSize;
+    }
+
+    window.addEventListener('load', start);
+  </script>
+</head>
+</html>
diff --git a/layout/style/crashtests/1562361.html b/layout/style/crashtests/1562361.html
new file mode 100644
index 0000000000..6f79560341
--- /dev/null
+++ b/layout/style/crashtests/1562361.html
@@ -0,0 +1,15 @@
+<script>
+window.onload = function() {
+  a.setAttribute("width", "0")
+  b.select()
+  document.documentElement.style.display="none"
+  document.documentElement.getBoundingClientRect()
+  document.documentElement.style.display=""
+
+  SpecialPowers.forceGC();
+  SpecialPowers.forceCC();
+  document.body.offsetTop;
+}
+</script>
+<input id="b" type="number">
+<iframe id="a" height="0">
diff --git a/layout/style/crashtests/1566684.html b/layout/style/crashtests/1566684.html
new file mode 100644
index 0000000000..328ec46a6b
--- /dev/null
+++ b/layout/style/crashtests/1566684.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<style>
+  x { }
+</style>
+<script>
+  var sheet = document.styleSheets[0];
+  var rule = sheet.cssRules[0];
+  var decl = rule.style;
+  rule.expando = 5;
+  decl.expando = 6;
+  sheet.deleteRule(0);
+  rule = decl = null;
+  SpecialPowers.forceGC();
+  SpecialPowers.forceCC();
+  SpecialPowers.forceGC();
+</script>
diff --git a/layout/style/crashtests/1579788.html b/layout/style/crashtests/1579788.html
new file mode 100644
index 0000000000..1379062d06
--- /dev/null
+++ b/layout/style/crashtests/1579788.html
@@ -0,0 +1,15 @@
+<script>
+function start() {
+  document.addEventListener('DOMAttrModified', function() {
+    b.scroll()
+    b.setAttribute('dir', 'ltr')
+    b.dir = ''
+  })
+  a.setAttribute('d', '')
+}
+document.addEventListener('DOMContentLoaded', start)
+</script>
+<form dir="rtl">
+<object id="a">
+<input value="X" multiple pattern="[]">
+<p id="b">
diff --git a/layout/style/crashtests/1580307.html b/layout/style/crashtests/1580307.html
new file mode 100644
index 0000000000..0d2c56d0ff
--- /dev/null
+++ b/layout/style/crashtests/1580307.html
@@ -0,0 +1 @@
+<legend style="justify-items: left legacy; overflow-y: hidden">
diff --git a/layout/style/crashtests/1581579.html b/layout/style/crashtests/1581579.html
new file mode 100644
index 0000000000..96e94a0771
--- /dev/null
+++ b/layout/style/crashtests/1581579.html
@@ -0,0 +1,3 @@
+<div dir="RTL">
+<textarea style="resize: vertical" dir="auto"></textarea>
+<textarea></textarea>
diff --git a/layout/style/crashtests/1586444.html b/layout/style/crashtests/1586444.html
new file mode 100644
index 0000000000..9ae041c7a1
--- /dev/null
+++ b/layout/style/crashtests/1586444.html
@@ -0,0 +1,15 @@
+<style>
+#a {
+  overflow: auto auto;
+  display: -webkit-box;
+}
+</style>
+<script>
+window.onload = () => {
+  a.align = "ABSMIDDLE"
+  document.documentElement.style.display="none"
+  document.documentElement.getBoundingClientRect()
+  document.documentElement.style.display=""
+}
+</script>
+<object id="a">
diff --git a/layout/style/crashtests/1593766.html b/layout/style/crashtests/1593766.html
new file mode 100644
index 0000000000..5fe3dd0be2
--- /dev/null
+++ b/layout/style/crashtests/1593766.html
@@ -0,0 +1,3 @@
+<script>
+  typeof (window.paintWorklet || CSS.paintWorklet);
+</script>
diff --git a/layout/style/crashtests/1594949.html b/layout/style/crashtests/1594949.html
new file mode 100644
index 0000000000..df332a05f0
--- /dev/null
+++ b/layout/style/crashtests/1594949.html
@@ -0,0 +1,13 @@
+<script>
+window.onload = () => {
+  a.style.setProperty("scale", "3")
+  a.clientTop
+  a.style.setProperty("offset", "path('M1 6')0deg")
+
+  b.style.setProperty("offset", "path('M100 6')0deg")
+}
+</script>
+<svg>
+  <text id="a"></text>
+  <foreignObject id="b"></foreignObject>
+</svg>
diff --git a/layout/style/crashtests/1594960.html b/layout/style/crashtests/1594960.html
new file mode 100644
index 0000000000..48cf0e4e41
--- /dev/null
+++ b/layout/style/crashtests/1594960.html
@@ -0,0 +1,15 @@
+<style>
+.x {
+  transform: scale(1, 1) rotate(50deg);
+  opacity: 0.2;
+  transition: transform 0.96s, opacity 1s;
+  border: solid medium;
+  offset-path: path('M0 1 1 0');
+}
+</style>
+<script>
+window.onload = () => {
+  a.setAttribute("class", "x")
+}
+</script>
+<ol id="a">
diff --git a/layout/style/crashtests/1599286.html b/layout/style/crashtests/1599286.html
new file mode 100644
index 0000000000..9e08d6f204
--- /dev/null
+++ b/layout/style/crashtests/1599286.html
@@ -0,0 +1,2 @@
+<rt>
+<ul id="a" style="overflow: auto" noresize>
diff --git a/layout/style/crashtests/1609786.html b/layout/style/crashtests/1609786.html
new file mode 100644
index 0000000000..1545085b76
--- /dev/null
+++ b/layout/style/crashtests/1609786.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+    <style>
+        * {
+            offset-path: path(' ') ! important;
+        }
+    </style>
+</head>
+</html>
diff --git a/layout/style/crashtests/1616407.html b/layout/style/crashtests/1616407.html
new file mode 100644
index 0000000000..a4fc4fa033
--- /dev/null
+++ b/layout/style/crashtests/1616407.html
@@ -0,0 +1,7 @@
+<script>
+    async function start() {
+      var a = new CSSStyleSheet({ })
+      document.adoptedStyleSheets = [new CSSStyleSheet({ }), a, a]
+    }
+    document.addEventListener('DOMContentLoaded', start)
+  </script>
diff --git a/layout/style/crashtests/1616433.html b/layout/style/crashtests/1616433.html
new file mode 100644
index 0000000000..7d7049bec0
--- /dev/null
+++ b/layout/style/crashtests/1616433.html
@@ -0,0 +1,9 @@
+<script>
+    window.addEventListener('load', () => {
+      var a = document.createElementNS('http://www.w3.org/1999/xhtml', 'div')
+      var b = new CSSStyleSheet({'disabled': true})
+      var c = a.attachShadow({'mode': 'closed'})
+      c.adoptedStyleSheets = [new CSSStyleSheet(), b, b]
+      b.disabled = false
+    })
+</script>
+\ No newline at end of file
diff --git a/layout/style/crashtests/1639533.html b/layout/style/crashtests/1639533.html
new file mode 100644
index 0000000000..5bf2118ffe
--- /dev/null
+++ b/layout/style/crashtests/1639533.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<style>
+.tweak ::-moz-range-thumb:is(:hover) {
+  background: red;
+}
+</style>
+<div>
+  <input type=range>
+</div>
+<script>
+  onload = function() {
+    document.querySelector("div").getBoundingClientRect();
+    document.querySelector("div").classList.add("tweak");
+  }
+</script>
diff --git a/layout/style/crashtests/1640040.html b/layout/style/crashtests/1640040.html
new file mode 100644
index 0000000000..a1bbb4e2af
--- /dev/null
+++ b/layout/style/crashtests/1640040.html
@@ -0,0 +1,11 @@
+<script>
+window.onload = () => {
+  b.type = ""
+  document.getSelection().selectAllChildren(a)
+  b.placeholder = ""
+  b.setRangeText(String.fromCodePoint(814688))
+}
+</script>
+<menu spellcheck="true">
+<input id="b" autofocus="" type="button">
+<menu id="a">
diff --git a/layout/style/crashtests/1806189-1.html b/layout/style/crashtests/1806189-1.html
new file mode 100644
index 0000000000..9a2d5f718a
--- /dev/null
+++ b/layout/style/crashtests/1806189-1.html
@@ -0,0 +1,15 @@
+<ins id="a">
+<li contenteditable="true">
+<shadow id="b">
+<script>
+window.onload = function() {
+  var c = window.getSelection();
+  a.addEventListener("DOMNodeRemoved", function() {
+    document.execCommand("insertHorizontalRule", false);
+    document.execCommand("justifyCenter", false);
+  });
+  c.setPosition(b);
+  document.execCommand("insertText", false, "1");
+}
+</script>
+<option>
diff --git a/layout/style/crashtests/1821416.html b/layout/style/crashtests/1821416.html
new file mode 100644
index 0000000000..127a97a65e
--- /dev/null
+++ b/layout/style/crashtests/1821416.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<style>
+*, *::after {
+  scroll-timeline: tl;
+}
+</style>
+<script>
+window.addEventListener("load", () => {
+  let a = document.createElement("ul")
+  let b = document.createElement("li")
+  let c = document.createElement("div")
+  let d = document.createElement("del")
+  d.appendChild(document.createElement("q"))
+  c.appendChild(d)
+  b.appendChild(c)
+  a.appendChild(b)
+  document.documentElement.appendChild(a);
+  a.scrollBy(32767, 256);
+  a.type = "square";
+})
+</script>
diff --git a/layout/style/crashtests/187671-1.html b/layout/style/crashtests/187671-1.html
new file mode 100644
index 0000000000..7395c23b42
--- /dev/null
+++ b/layout/style/crashtests/187671-1.html
@@ -0,0 +1,12 @@
+<a href="http://mozillazine.org/">Link text</a>
+
+<SPAN><p>Paragraph text</p></span>
+
+
+
+<!-- The styles have to be after the content.  (In the original, the styles were loaded using javascript, with the style sheet loaded depending on the browser.) -->
+
+<style>
+a    {font-size: 13px }
+span {position: relative;}
+</style>
diff --git a/layout/style/crashtests/192408-1.html b/layout/style/crashtests/192408-1.html
new file mode 100644
index 0000000000..bb75e44012
--- /dev/null
+++ b/layout/style/crashtests/192408-1.html
@@ -0,0 +1,15 @@
+<html>
+   <head>
+      <title>bug 192408</title>
+   </head>
+   <body>
+      <span>
+         <embed src="foo.mid"></embed>
+         <script>
+            document;
+         </script>
+         <center></center>
+         <script src="bar.js"></script> 
+      </span>
+   </body>
+</html>
diff --git a/layout/style/crashtests/285727-1.html b/layout/style/crashtests/285727-1.html
new file mode 100644
index 0000000000..db1d28d8d4
--- /dev/null
+++ b/layout/style/crashtests/285727-1.html
@@ -0,0 +1,13 @@
+<BODY STYLE="display:table-row;">
+<SPAN>
+1
+</SPAN>
+<FORM>
+<DIV STYLE="float:left;">
+1
+<FONT>
+1
+</FONT>
+</DIV>
+</FORM>
+</BODY>
diff --git a/layout/style/crashtests/286707-1.html b/layout/style/crashtests/286707-1.html
new file mode 100644
index 0000000000..7485a9644f
--- /dev/null
+++ b/layout/style/crashtests/286707-1.html
@@ -0,0 +1,2 @@
+<html><body><p style="font-size:1px">hi<sup>1
+
diff --git a/layout/style/crashtests/317561-1.html b/layout/style/crashtests/317561-1.html
new file mode 100644
index 0000000000..01335a17ca
--- /dev/null
+++ b/layout/style/crashtests/317561-1.html
@@ -0,0 +1,104 @@
+<!doctype html>
+<html>
+<head>
+<style type="text/css">
+div:not([id^='img']) {
+ height: 20px; width: 20px; border: 1px solid #000;
+}
+#img1 {position:absolute; left:180px; top:17px;}
+#img2 {position:absolute; left:-72px; top:58px;}
+#img3 {position:absolute; left:2px; top:0px;}
+#img4 {position:absolute; left:25px; top:-3px;}
+#img5 {position:absolute; left:1px; top:-3px;}
+#img6 {position:absolute; left:27px; top:-1px;}
+#img7 {position:absolute; left:41px; top:14px;}
+#img8 {position:absolute; left:17px; top:3px;}
+#img9 {position:absolute; left:50px; top:42px;}
+#img11 {position:absolute; left:-265px; top:113px;}
+#img12 {position:absolute; left:25px; top:-57px;}
+#img13 {position:absolute; left:17px; top:-4px;}
+#img14 {position:absolute; left:8px; top:-13px;}
+#img15 {position:absolute; left:38px; top:0px;}
+#img16 {position:absolute; left:37px; top:8px;}
+#img17 {position:absolute; left:11px; top:12px;}
+#img18 {position:absolute; left:4px; top:12px;}
+#img19 {position:absolute; left:-7px; top:13px;}
+#img20 {position:absolute; left:17px; top:13px;}
+#img21 {position:absolute; left:7px; top:12px;}
+#img22 {position:absolute; left:32px; top:6px;}
+#img23 {position:absolute; left:20px; top:10px;}
+#img24 {position:absolute; left:22px; top:10px;}
+#img25 {position:absolute; left:81px; top:-27px;}
+#img26 {position:absolute; left:9px; top:-19px;}
+#img27 {position:absolute; left:0px; top:-15px;}
+#img28 {position:absolute; left:19px; top:63px;}
+#img29 {position:absolute; left:-68px; top:0px;}
+#img32 {position:absolute; left:42px; top:121px;}
+#img33 {position:absolute; left:21px; top:1px;}
+#img34 {position:absolute; left:29px; top:2px;}
+#img35 {position:absolute; left:25px; top:1px;}
+#img36 {position:absolute; left:-115px; top:16px;}
+#img37 {position:absolute; left:11px; top:-8px;}
+#img38 {position:absolute; left:-16px; top:-15px;}
+#img39 {position:absolute; left:-18px; top:-1px;}
+#img40 {position:absolute; left:-28px; top:-8px;}
+#img41 {position:absolute; left:-6px; top:-6px;}
+#img42 {position:absolute; left:-19px; top:-12px;}
+#img43 {position:absolute; left:-26px; top:-9px;}
+#img44 {position:absolute; left:1px; top:-23px;}
+#img45 {position:absolute; left:-10px; top:-22px;}
+#img46 {position:absolute; left:-59px; top:-39px;}
+#img47 {position:absolute; left:-28px; top:0px;}
+#img48 {position:absolute; left:-13px; top:4px;}
+#img49 {position:absolute; left:-21px; top:4px;}
+</style>
+</head>
+<body>
+<div id="img1"><div></div>
+<div id="img2"><div></div>
+<div id="img3"><div></div>
+<div id="img4"><div></div>
+<div id="img5"><div></div>
+<div id="img6"><div></div>
+<div id="img7"><div></div>
+<div id="img8"><div></div>
+<div id="img9"><div></div>
+<div id="img11"><div></div>
+<div id="img12"><div></div>
+<div id="img13"><div></div>
+<div id="img14"><div></div>
+<div id="img15"><div></div>
+<div id="img16"><div></div>
+<div id="img17"><div></div>
+<div id="img18"><div></div>
+<div id="img19"><div></div>
+<div id="img20"><div></div>
+<div id="img21"><div></div>
+<div id="img22"><div></div>
+<div id="img23"><div></div>
+<div id="img24"><div></div>
+<div id="img25"><div></div>
+<div id="img26"><div></div>
+<div id="img27"><div></div>
+<div id="img28"><div></div>
+<div id="img29"><div></div>
+<div id="img32"><div></div>
+<div id="img33"><div></div>
+<div id="img34"><div></div>
+<div id="img35"><div></div>
+<div id="img36"><div></div>
+<div id="img37"><div></div>
+<div id="img38"><div></div>
+<div id="img39"><div></div>
+<div id="img40"><div></div>
+<div id="img41"><div></div>
+<div id="img42"><div></div>
+<div id="img43"><div></div>
+<div id="img44"><div></div>
+<div id="img45"><div></div>
+<div id="img46"><div></div>
+<div id="img47"><div></div>
+<div id="img48"><div></div>
+<div id="img49"><div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/330998-1.html b/layout/style/crashtests/330998-1.html
new file mode 100644
index 0000000000..9696bc4202
--- /dev/null
+++ b/layout/style/crashtests/330998-1.html
@@ -0,0 +1,30 @@
+<html>
+
+<head>
+
+<script>
+
+function init()
+{
+  var form1 = document.getElementById("form1");
+  var tr1 = document.getElementById("tr1");
+
+  tr1.appendChild(form1);
+  tr1.removeChild(form1);
+}
+
+window.addEventListener("load", init);
+
+</script>
+
+</head>
+
+<body>
+
+<table><tr id="tr1"><td></td></tr></table>
+
+<form id="form1"><span style="float:left"></span></form>
+
+</body>
+
+</html>
diff --git a/layout/style/crashtests/363950.html b/layout/style/crashtests/363950.html
new file mode 100644
index 0000000000..a0d04810c6
--- /dev/null
+++ b/layout/style/crashtests/363950.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<title>Testcase bug 363950 - crash [@ nsComputedDOMStyle::GetMarginWidthCoordFor]</title>
+</head>
+<body>
+This page should not crash Mozilla
+<script>
+var properties = ['margin-left','margin-right','margin-top','padding-bottom','padding-left','padding-right','padding-top'];
+
+function removestyles(i, j){
+if (j>=properties.length)
+   j = 0;
+document.defaultView.getComputedStyle(document.getElementsByTagName('head')[0]).getPropertyValue(properties[j]);
+j++;
+setTimeout(removestyles,50,j);
+}
+setTimeout(removestyles,500,0,0);
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/368175-1.html b/layout/style/crashtests/368175-1.html
new file mode 100644
index 0000000000..5352ae4d46
--- /dev/null
+++ b/layout/style/crashtests/368175-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf-8">
+</head>
+<body>
+<div style="width: 300px; height: 200px; overflow: auto">
+ <div style='direction: rtl; column-width:1em; column-gap:1em; width: 500px;'>
+  <p>滾滾長江東逝水,浪花淘盡英雄。是非成敗轉頭空：青山依舊在,幾度夕陽紅。</p>
+  <p style='direction: rtl; column-width:1em; column-gap:1em;'>
+  滾滾長江東逝水,浪花淘盡英雄。是非成敗轉頭空：青山依舊在,幾度夕陽紅。</p>
+ </div>
+</div>
+</body>
+</html>
diff --git a/layout/style/crashtests/368740.html b/layout/style/crashtests/368740.html
new file mode 100644
index 0000000000..b7a0d7735d
--- /dev/null
+++ b/layout/style/crashtests/368740.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<title>Testcase bug - Crash [@ nsIFrame::IsThemed] when trying to get the computed style of a button in iframe</title>
+
+<style>
+iframe {
+width: 800px;
+height: 400px;
+}
+</style>
+</head>
+<body>
+This page should not crash Mozilla<br>
+<iframe id="content" src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%0A%3Cbutton%3E%3C/button%3E%0A%3C/body%3E%3C/html%3E"></iframe>
+
+<script>
+function getComputedStyles(){
+var x=document.getElementById('content').contentDocument.getElementsByTagName('button')[0];
+var style = document.defaultView.getComputedStyle(x).getPropertyValue('border-left-width');
+}
+setTimeout(getComputedStyles,300);
+</script>
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/379788-1.html b/layout/style/crashtests/379788-1.html
new file mode 100644
index 0000000000..40e38a7ccd
--- /dev/null
+++ b/layout/style/crashtests/379788-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('p2').style.position = 'fixed';">
+
+<p style="right: 1em; bottom: 1em; position: fixed;">Foo</p>
+<p id="p2">Bar</p>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/383979-1.xhtml b/layout/style/crashtests/383979-1.xhtml
new file mode 100644
index 0000000000..9a3f8e6735
--- /dev/null
+++ b/layout/style/crashtests/383979-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("div1").appendChild(document.getElementById("div2"));
+}
+
+</script>
+
+<style type="text/css">
+
+#s1, #s2 { 
+  font: 8pt arial;
+}
+
+#div1 #s1, #div1 #s2 {
+  font-size: 20pt;
+}
+
+</style>
+</head>
+
+<body onload="boom();">
+
+<div id="div1"></div>
+<div id="div2"><span id="s1"><span id="s2">foo</span></span></div>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/383979-2.html b/layout/style/crashtests/383979-2.html
new file mode 100644
index 0000000000..a2cc055a6d
--- /dev/null
+++ b/layout/style/crashtests/383979-2.html
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function run()
+{
+  var a = getComputedStyle(document.getElementById("s1"), "").listStyleType;
+  var b = getComputedStyle(document.getElementById("s3"), "").listStyleType;
+}
+
+</script>
+
+<style type="text/css">
+
+body { display: none } /* so we control the order of the ComputeListData calls */
+
+#s1, #s2, #s3 { 
+  list-style-image: none;
+  list-style-position: outside;
+  list-style-type: disc;
+}
+
+#s2, #s3 {
+  list-style-type: disc;
+}
+
+</style>
+</head>
+
+<body onload="run();">
+
+<div id="s1"><div id="s2"><div id="s3"></div></div></div>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/386939-1.html b/layout/style/crashtests/386939-1.html
new file mode 100644
index 0000000000..345581d100
--- /dev/null
+++ b/layout/style/crashtests/386939-1.html
@@ -0,0 +1,24 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function rM(n)
+{
+  n.remove();
+}
+
+function boom()
+{
+  rM(document.getElementById("f1"));
+  rM(document.getElementById("f2"));
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<frameset rows="170,*" onload="setTimeout(boom, 30);">
+<frame src="data:text/html,frame1" id="f1">
+<frame src="data:text/html,frame2" id="f2">
+</frameset>
+
+</html>
diff --git a/layout/style/crashtests/391034-1.xhtml b/layout/style/crashtests/391034-1.xhtml
new file mode 100644
index 0000000000..315796d285
--- /dev/null
+++ b/layout/style/crashtests/391034-1.xhtml
@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  var p = document.getElementById("p");
+  window.getComputedStyle(p, null).getPropertyValue("right");
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<p id="p" style="position: relative; left: 3ch;">foo</p>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/397022-1.html b/layout/style/crashtests/397022-1.html
new file mode 100644
index 0000000000..ececc3fa5f
--- /dev/null
+++ b/layout/style/crashtests/397022-1.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<style>
+
+div:before { content: counter(c); }
+
+.b:before { content: "x"; }
+
+</style>
+</head>
+
+<body onload="document.getElementById('v').setAttribute('class', 'b');">
+
+<div id="v"></div>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/399289-1.svg b/layout/style/crashtests/399289-1.svg
new file mode 100644
index 0000000000..583de2c241
--- /dev/null
+++ b/layout/style/crashtests/399289-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="url(#x)">
+  <rect fill="url(#y)" />
+</svg>
diff --git a/layout/style/crashtests/404470-1.html b/layout/style/crashtests/404470-1.html
new file mode 100644
index 0000000000..03cac228f4
--- /dev/null
+++ b/layout/style/crashtests/404470-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var iframe = document.createElement("iframe");
+  document.body.appendChild(iframe);
+  iframe.setAttribute("src", 'data:application/xhtml+xml,<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><script>window.parent.document.body.style.display="inline"; window.parent.document.body.offsetWidth;</' + 'script></window>');
+}
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/411603-1.html b/layout/style/crashtests/411603-1.html
new file mode 100644
index 0000000000..596565fbc3
--- /dev/null
+++ b/layout/style/crashtests/411603-1.html
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+<body onload="document.getElementById('ms').setAttribute('scriptminsize', '9em');">
+<math:mstyle id="ms" /><span />
+</body>
+</html>
diff --git a/layout/style/crashtests/412588-1.html b/layout/style/crashtests/412588-1.html
new file mode 100644
index 0000000000..561aed564d
--- /dev/null
+++ b/layout/style/crashtests/412588-1.html
@@ -0,0 +1,5 @@
+<html><head>
+<link rel="stylesheet" href="data:text/css;charset=utf-8,@media%20print%20%7B%7B%7D%0Aa%20%7B%20%7D%0Aa%7Bfont-size%3A%20200%25%3B%7D" type="text/css">
+<style>
+</style>
+</head><body></body></html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/413274-1.xhtml b/layout/style/crashtests/413274-1.xhtml
new file mode 100644
index 0000000000..19d8fab0fd
--- /dev/null
+++ b/layout/style/crashtests/413274-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+  <mstyle scriptsizemultiplier="8205" scriptlevel="15">
+    <mroot>
+      <mrow/>
+      <mrow>
+        <span xmlns="http://www.w3.org/1999/xhtml"/>
+      </mrow>
+    </mroot>
+  </mstyle>
+</math>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/416461-1.xhtml b/layout/style/crashtests/416461-1.xhtml
new file mode 100644
index 0000000000..1624dbc29c
--- /dev/null
+++ b/layout/style/crashtests/416461-1.xhtml
@@ -0,0 +1,6 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <wizard>
+    <msqrt xmlns="http://www.w3.org/1998/Math/MathML"/>
+  </wizard>
+  <menupopup style="display: inline; order: 2147483646;"/>
+</window>
diff --git a/layout/style/crashtests/418007-1.xhtml b/layout/style/crashtests/418007-1.xhtml
new file mode 100644
index 0000000000..f07a693444
--- /dev/null
+++ b/layout/style/crashtests/418007-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+  <ms fontsize="8179em">
+    <span xmlns="http://www.w3.org/1999/xhtml">
+      <span>
+        <td>
+          <mfrac xmlns="http://www.w3.org/1998/Math/MathML">
+            <mfrac>
+              <mrow/>
+              <mrow/>
+            </mfrac>
+            <mrow/>
+          </mfrac>
+        </td>
+      </span>
+    </span>
+  </ms>
+</math>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/431705-1.xhtml b/layout/style/crashtests/431705-1.xhtml
new file mode 100644
index 0000000000..8b64d4b3b2
--- /dev/null
+++ b/layout/style/crashtests/431705-1.xhtml
@@ -0,0 +1,6 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <span xmlns="http://www.w3.org/1999/xhtml" style="-moz-box-ordinal-group: 2;">
+    <mtext xmlns="http://www.w3.org/1998/Math/MathML" style="display: block;"/>
+  </span>
+  <div xmlns="http://www.w3.org/1999/xhtml" style="overflow: auto;"/>
+</window>
+\ No newline at end of file
diff --git a/layout/style/crashtests/432561-1.html b/layout/style/crashtests/432561-1.html
new file mode 100644
index 0000000000..81bb082e4f
--- /dev/null
+++ b/layout/style/crashtests/432561-1.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<title>Testcase, Bug 432561</title>
+</head>
+<body>
+<script>
+var str = '{';
+for (var i=0;i<22;i++)
+ str+=str;
+document.write('<style type="text/css">div '+str+'</style>');
+str = '{{[('
+for (var i=0;i<20;i++)
+ str+=str;
+document.write('<style type="text/css">div '+str+'</style>');
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/437170-1.html b/layout/style/crashtests/437170-1.html
new file mode 100644
index 0000000000..af6fa1d662
--- /dev/null
+++ b/layout/style/crashtests/437170-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+html img { color: blue; }
+</style>
+<script>
+
+function boom()
+{
+  var r = document.createRange();
+  r.selectNodeContents(document.documentElement);
+  r.cloneContents();
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<img src="data:image/gif,GIF87a%02%00%02%00%B3%00%00%00%00%00%FF%FF%FF%00%00%00%00%00%00%FF%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%2C%00%00%00%00%02%00%02%00%00%04%03%90H%12%00%3B" onload="window.getComputedStyle(this, null).getPropertyValue('color');">
+
+</body>
+</html>
diff --git a/layout/style/crashtests/437532-1.html b/layout/style/crashtests/437532-1.html
new file mode 100644
index 0000000000..52eefa530f
--- /dev/null
+++ b/layout/style/crashtests/437532-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/csS">
+
+a\[href$=".pdf"\] { }
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/439184-1.html b/layout/style/crashtests/439184-1.html
new file mode 100644
index 0000000000..f22660726c
--- /dev/null
+++ b/layout/style/crashtests/439184-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"
+	"http://www.w3.org/TR/html4/strict.dtd">
+<html lang="en-US">
+<head>
+	<title>Testcase, bug 439184</title>
+	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+	<meta http-equiv="Content-Style-Type" content="text/css">
+	<meta http-equiv="Content-Script-Type" content="text/javascript">
+	<style type="text/css" id="style">
+
+	</style>
+	<script type="text/javascript">
+
+	var styleText = "p { color: green; }";
+	
+	// We want to end up with a million rules or so, so double this text
+	// 20 times to make it 2^20 rules:
+	for (var i = 0; i < 20; ++i) {
+	  styleText += styleText;
+	}
+
+	document.getElementById("style").firstChild.data = styleText;
+
+	</script>
+</head>
+<body>
+
+<p>This should be green.</p>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/444237-1.html b/layout/style/crashtests/444237-1.html
new file mode 100644
index 0000000000..7eac32ed8e
--- /dev/null
+++ b/layout/style/crashtests/444237-1.html
@@ -0,0 +1 @@
+<input style="box-shadow: initial;">
diff --git a/layout/style/crashtests/444848-1.html b/layout/style/crashtests/444848-1.html
new file mode 100644
index 0000000000..d2c75d5766
--- /dev/null
+++ b/layout/style/crashtests/444848-1.html
@@ -0,0 +1,9 @@
+<style>
+  [^=foo
+</style>
+<style>
+  [*=bar
+</style>
+<style>
+  [$=baz
+</style>
diff --git a/layout/style/crashtests/447776-1.html b/layout/style/crashtests/447776-1.html
new file mode 100644
index 0000000000..dde700fae1
--- /dev/null
+++ b/layout/style/crashtests/447776-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<title>Hang with zero width and word-wrap</title>
+</head><body>
+<div style="width: 0px; word-wrap: break-word;">abc</div>
+</body></html>
diff --git a/layout/style/crashtests/447783-1.html b/layout/style/crashtests/447783-1.html
new file mode 100644
index 0000000000..1af063f16b
--- /dev/null
+++ b/layout/style/crashtests/447783-1.html
@@ -0,0 +1,8 @@
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<title>Hang with column-count and word-wrap</title>
+</head><body>
+<div style="border: 1px solid black; word-wrap: normal; column-count: 2; width: 110px;">
+a<span style="word-wrap: break-word;">abcde</span>
+</div>
+</body></html>
diff --git a/layout/style/crashtests/448161-1.html b/layout/style/crashtests/448161-1.html
new file mode 100644
index 0000000000..ef200462b5
--- /dev/null
+++ b/layout/style/crashtests/448161-1.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var r = document.createRange();
+  r.setStart(document.body, 0);
+  r.setEnd(document.getElementById("g"), 0);
+  r.deleteContents();
+
+  // Give spell-check a chance to run
+  setTimeout(function() { document.documentElement.className = ""; },
+             50);
+}
+
+</script>
+</head>
+
+<body onload="boom();" contenteditable="true"><span><span contenteditable="true"><a href="http://www.mozilla.org/">5</a></span></span><span id="g"></span></body>
+
+</html>
diff --git a/layout/style/crashtests/448161-2.html b/layout/style/crashtests/448161-2.html
new file mode 100644
index 0000000000..0dd8a8b530
--- /dev/null
+++ b/layout/style/crashtests/448161-2.html
@@ -0,0 +1,9 @@
+<html>
+  <body>
+    <script>
+      var node = document.createElement("a");
+      node.href = "http://www.mozilla.org";
+      document.defaultView.getComputedStyle(node).color
+    </script>
+  </body>
+</html>
diff --git a/layout/style/crashtests/452150-1.xhtml b/layout/style/crashtests/452150-1.xhtml
new file mode 100644
index 0000000000..4ff411c6de
--- /dev/null
+++ b/layout/style/crashtests/452150-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head></head>
+<body>
+<p><m:mo fontsize="268435456em"><m:mstyle scriptlevel="30"><m:mstyle scriptlevel="15"><span/></m:mstyle></m:mstyle></m:mo></p>
+</body>
+</html>
diff --git a/layout/style/crashtests/456196.html b/layout/style/crashtests/456196.html
new file mode 100644
index 0000000000..ed82ca0d4d
--- /dev/null
+++ b/layout/style/crashtests/456196.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+<title>Crash [@ nsCSSValueList::~nsCSSValueList] with adding a lot of values in css property</title>
+</head>
+<body>
+<div style="border: 1px solid black; width: 100px; height: 100px;"></div>
+<script>
+function forceFree() {
+  var str = ' rotate(1deg)';
+  for(var i=0;i<17;i++) {str += str;}
+ document.getElementsByTagName('div')[0].style.MozTransform = str;  
+}
+setTimeout(forceFree,100);
+</script>
+</body>
+</html>
diff --git a/layout/style/crashtests/460209-1.html b/layout/style/crashtests/460209-1.html
new file mode 100644
index 0000000000..d78235738a
--- /dev/null
+++ b/layout/style/crashtests/460209-1.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<style>
+@import "404.css" s x
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/460217-1.html b/layout/style/crashtests/460217-1.html
new file mode 100644
index 0000000000..e5918ad6ed
--- /dev/null
+++ b/layout/style/crashtests/460217-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+@font-face
+{
+}
+@font-face
+{ font-family: 1;
+}
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/460323-1.html b/layout/style/crashtests/460323-1.html
new file mode 100644
index 0000000000..0bae55aaf1
--- /dev/null
+++ b/layout/style/crashtests/460323-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <head>
+    <script>
+      var expectedLoads = 3;
+      function load_done() {
+        --expectedLoads;
+        if (expectedLoads == 0) {
+          document.documentElement.className = "";
+        }
+      }
+      function addLink() {
+        var l = document.createElement("link");
+        l.rel = "stylesheet";
+        l.type = "text/css";
+        l.href = "data:text/css,some { random: data }";
+        l.onload = load_done;
+        document.getElementsByTagName("head")[0].appendChild(l);
+      }
+      function doIt() {
+        document.styleSheets[0].insertRule('a {}', 0)
+        addLink();
+        addLink();
+      }
+      addLink();
+    </script>
+  </head>
+  <body onload="doIt()">
+  <body>
+</body>
diff --git a/layout/style/crashtests/466845-1.html b/layout/style/crashtests/466845-1.html
new file mode 100644
index 0000000000..f15c934f1b
--- /dev/null
+++ b/layout/style/crashtests/466845-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<title>Crash [@ nsViewManager::CreateView] with ::first-line position: absolute and -moz-transform</title>
+<style>
+#a::first-line {  -moz-transform: translate(50px);}
+</style>
+</head>
+<body style="position: absolute;">
+<span style="position: absolute;" id="a">
+<span style="-moz-transform: translate(50px);">&#1593; &#1593; &#1593;
+</span>
+</span>
+</body>
+</html>
diff --git a/layout/style/crashtests/469432-1.xhtml b/layout/style/crashtests/469432-1.xhtml
new file mode 100644
index 0000000000..9b11a88c42
--- /dev/null
+++ b/layout/style/crashtests/469432-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<xul:menuitem>
+<select/>
+<xul:tooltip/>
+<mathml:msup/>
+</xul:menuitem>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/472195-1.html b/layout/style/crashtests/472195-1.html
new file mode 100644
index 0000000000..0eff97e46d
--- /dev/null
+++ b/layout/style/crashtests/472195-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Copy of 473892-1.html for bug 472195</title>
+<style type="text/css">
+
+@media (min-width: 5rem) { body { color: green; } }
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/472237-1.html b/layout/style/crashtests/472237-1.html
new file mode 100644
index 0000000000..0d0e273db4
--- /dev/null
+++ b/layout/style/crashtests/472237-1.html
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+
+@font-face {
+      font-family: "Fontin-Sans SC";
+      /* the font url below is correct but won't be accessed due to cross-site restrictions */
+      src: url(../../reftests/fonts/markA.ttf) format("opentype");
+}
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("r").style.fontFamily = "'Fontin-Sans SC'";
+  document.documentElement.offsetHeight;
+  document.removeChild(document.documentElement);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div id="r">R</div></body>
+</html>
diff --git a/layout/style/crashtests/473720-1.html b/layout/style/crashtests/473720-1.html
new file mode 100644
index 0000000000..a29316181f
--- /dev/null
+++ b/layout/style/crashtests/473720-1.html
@@ -0,0 +1,15 @@
+<html><head><style>
+/* Recovery from an unparseable recognized @-rule is not the same thing
+   as recovery from an unrecognized @-rule.  */
+
+@charset # { }
+@import # { }
+@namespace # { }
+@media # { }
+@-moz-document # { }
+@font-face # { }
+@page # { }
+@-non-mozilla # { }
+@nonstandard # { }
+
+</style></head></html>
diff --git a/layout/style/crashtests/473892-1.html b/layout/style/crashtests/473892-1.html
new file mode 100644
index 0000000000..362e38a6d9
--- /dev/null
+++ b/layout/style/crashtests/473892-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+@media (width: 5ex) { }
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/473914-1.html b/layout/style/crashtests/473914-1.html
new file mode 100644
index 0000000000..47a7a98986
--- /dev/null
+++ b/layout/style/crashtests/473914-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style id="s"></style>
+<script type="text/javascript">
+
+// Duplicates the string 2^n times
+function exp(s, n)
+{
+  for (var i = 0; i < n; ++i)
+    s += s;
+  return s;
+}
+
+var stylesheet = exp("/**/", 20);
+document.getElementById("s").textContent = stylesheet;
+
+</script>
+</head>
+<body>
+<div></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/474377-1.xhtml b/layout/style/crashtests/474377-1.xhtml
new file mode 100644
index 0000000000..519a753cfa
--- /dev/null
+++ b/layout/style/crashtests/474377-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+
+#q:after {
+  content: 'A';
+}
+
+</style>
+</head>
+<body>
+
+<mrow xmlns="http://www.w3.org/1998/Math/MathML"></mrow>
+<span id="q"><span><div></div></span></span>
+
+</body>
+</html>
+
diff --git a/layout/style/crashtests/478321-1.xhtml b/layout/style/crashtests/478321-1.xhtml
new file mode 100644
index 0000000000..654e11c106
--- /dev/null
+++ b/layout/style/crashtests/478321-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="display: table; float: left; line-height: 1rem;"/>
diff --git a/layout/style/crashtests/481557.html b/layout/style/crashtests/481557.html
new file mode 100644
index 0000000000..cdc9bb88cc
--- /dev/null
+++ b/layout/style/crashtests/481557.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body onload="document.queryCommandValue('justifycenter');">
+
+<table contenteditable="true"><tbody><tr><td align="char"></td></tr></tbody></table>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/495269-1.html b/layout/style/crashtests/495269-1.html
new file mode 100644
index 0000000000..40090edc8c
--- /dev/null
+++ b/layout/style/crashtests/495269-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <link rel="stylesheet" href="data:text/css,@font-face {}';">
+    <link rel="stylesheet" href="data:text/css,@font-face {}';">
+    <script>
+      // Force a unique inner for the second linked sheet
+      document.styleSheets[1].cssRules[0];
+    </script>
+  </head>
+</html>
+
diff --git a/layout/style/crashtests/495269-2.html b/layout/style/crashtests/495269-2.html
new file mode 100644
index 0000000000..8deca08e81
--- /dev/null
+++ b/layout/style/crashtests/495269-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <link rel="stylesheet" href="data:text/css,@-moz-document domain(example.com) {}';">
+    <link rel="stylesheet" href="data:text/css,@-moz-document domain(example.com) {}';">
+    <script>
+      // Force a unique inner for the second linked sheet
+      document.styleSheets[1].cssRules[0];
+    </script>
+  </head>
+</html>
+
diff --git a/layout/style/crashtests/498036-1.html b/layout/style/crashtests/498036-1.html
new file mode 100644
index 0000000000..0128be7491
--- /dev/null
+++ b/layout/style/crashtests/498036-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<!-- bogus assertion when one stylesheet contains two @import rules
+     specifying malformed URIs -->
+<html>
+<head>
+<style type="text/css"> 
+
+@import 'data:css'; 
+@import 'data:css'; 
+
+</style>
+</head>
+<body>
+</body>
+</html>
diff --git a/layout/style/crashtests/509155-1.html b/layout/style/crashtests/509155-1.html
new file mode 100644
index 0000000000..d211373326
--- /dev/null
+++ b/layout/style/crashtests/509155-1.html
@@ -0,0 +1,4 @@
+<html style="outline-color: inherit;">
+<head></head>
+<body></body>
+</html>
diff --git a/layout/style/crashtests/509156-1.html b/layout/style/crashtests/509156-1.html
new file mode 100644
index 0000000000..f75776a5d3
--- /dev/null
+++ b/layout/style/crashtests/509156-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE HTML>
+<html>
+<head></head>
+<body><div style="text-align: -moz-right;"><div style="display: table;"></div></div></body>
+</html>
diff --git a/layout/style/crashtests/509569-1.html b/layout/style/crashtests/509569-1.html
new file mode 100644
index 0000000000..41a3cc5594
--- /dev/null
+++ b/layout/style/crashtests/509569-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html style="border-inline-start: inherit; border: none"><body></body></html>
diff --git a/layout/style/crashtests/512851-1.xhtml b/layout/style/crashtests/512851-1.xhtml
new file mode 100644
index 0000000000..d772390cd1
--- /dev/null
+++ b/layout/style/crashtests/512851-1.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<style type="text/css">
+mover { font-size: 326590449211mm; }
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("r").setAttribute("accentunder", "4");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<mover xmlns="http://www.w3.org/1998/Math/MathML" id="mover"><munderover id="r"><merror/><msqrt/></munderover></mover>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/524252-1.html b/layout/style/crashtests/524252-1.html
new file mode 100644
index 0000000000..4ea708bc39
--- /dev/null
+++ b/layout/style/crashtests/524252-1.html
@@ -0,0 +1,10 @@
+<html>
+<head><script>
+function boom()
+{
+  var f = document.getElementById("f");
+  window.getComputedStyle(f).getPropertyValue("text-decoration");
+}
+</script></head>
+<body onload="boom();"><font id="f" color="black">a</font></body>
+</html>
diff --git a/layout/style/crashtests/536789-1.html b/layout/style/crashtests/536789-1.html
new file mode 100644
index 0000000000..86fcb344f7
--- /dev/null
+++ b/layout/style/crashtests/536789-1.html
@@ -0,0 +1,11 @@
+<!-- Must be in quirks mode -->
+<html>
+  <body>
+  <script>
+    var docEl = document.documentElement;
+    var b = document.body;
+    docEl.removeChild(b);
+    docEl.appendChild(document.createElement("table"));
+    docEl.offsetWidth;
+  </script>
+</html>
diff --git a/layout/style/crashtests/539613-1.xhtml b/layout/style/crashtests/539613-1.xhtml
new file mode 100644
index 0000000000..386d7e1277
--- /dev/null
+++ b/layout/style/crashtests/539613-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<body>
+<m:ms fontsize="90071992547409pc"><span><m:mfrac><m:mtext fontsize="625%"><m:mfrac>f<m:mrow><m:mstyle scriptlevel="3"><m:msup/></m:mstyle></m:mrow></m:mfrac></m:mtext><m:malignmark/></m:mfrac></span></m:ms>
+</body>
+</html>
diff --git a/layout/style/crashtests/558943-1.xhtml b/layout/style/crashtests/558943-1.xhtml
new file mode 100644
index 0000000000..e3d978fd34
--- /dev/null
+++ b/layout/style/crashtests/558943-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<style>
+.x:first-line { }
+.y { }
+</style>
+</head>
+<body onload="setTimeout(function(){  document.documentElement.className = 'y'; }, 0)">
+<td class="x"><a href="#">Link</a></td>
+</body>
+</html>
diff --git a/layout/style/crashtests/559491.html b/layout/style/crashtests/559491.html
new file mode 100644
index 0000000000..19126e5603
--- /dev/null
+++ b/layout/style/crashtests/559491.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  for (var i = 0; i < 200; ++i) {
+    //dump(i + "\n");
+    r1 = document.createElementNS("http://www.w3.org/1999/xhtml", "a");
+    r1.setAttributeNS(null, "href", "404");
+    r1.style.color = "green";
+    r2 = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+    r2.style.color = "red";
+    document.removeChild(document.documentElement);
+    document.appendChild(r1);
+    document.removeChild(document.documentElement);
+    document.appendChild(r2);
+    document.removeChild(document.documentElement);
+    document.appendChild(r1);
+    document.documentElement.offsetHeight;
+  }
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/565248-1.html b/layout/style/crashtests/565248-1.html
new file mode 100644
index 0000000000..18c8add08e
--- /dev/null
+++ b/layout/style/crashtests/565248-1.html
@@ -0,0 +1,2 @@
+<html><body style="font-size: 18014398509481984%"></body></html>
+
diff --git a/layout/style/crashtests/571105-1.xhtml b/layout/style/crashtests/571105-1.xhtml
new file mode 100644
index 0000000000..4dce42dc8e
--- /dev/null
+++ b/layout/style/crashtests/571105-1.xhtml
@@ -0,0 +1 @@
+<link xmlns="http://www.w3.org/1999/xhtml" href="http://www.mozilla.org/"/>
+\ No newline at end of file
diff --git a/layout/style/crashtests/573127-1.html b/layout/style/crashtests/573127-1.html
new file mode 100644
index 0000000000..72fbaf63ef
--- /dev/null
+++ b/layout/style/crashtests/573127-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var mspace = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mspace");
+  var emptyset = document.createElementNS("http://www.w3.org/1998/Math/MathML", "emptyset");
+  emptyset.setAttributeNS(null, "mathvariant", "3");
+  mspace.appendChild(emptyset);
+  document.body.appendChild(mspace);
+  emptyset.removeAttribute('mathvariant');
+}
+
+</script>
+</head>
+
+<body onload="boom()"></body>
+</html>
diff --git a/layout/style/crashtests/575464-1.html b/layout/style/crashtests/575464-1.html
new file mode 100644
index 0000000000..e77649ed74
--- /dev/null
+++ b/layout/style/crashtests/575464-1.html
@@ -0,0 +1 @@
+<html><body style="font-size: 1823190rem;"><big><big><span style="text-shadow: 0pt 0pt 0.2em rgb(136, 255, 119);"></span></big></big></body></html>
diff --git a/layout/style/crashtests/580685.html b/layout/style/crashtests/580685.html
new file mode 100644
index 0000000000..2a9115cb60
--- /dev/null
+++ b/layout/style/crashtests/580685.html
@@ -0,0 +1,10 @@
+<html>
+<head></head>
+<body style="outline-offset: 0.1rem; ">
+<script>
+var body = document.body;
+document.removeChild(document.documentElement);
+var compstyle = window.getComputedStyle(body).getPropertyValue('outline-offset');
+</script>
+</body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/585185-1.html b/layout/style/crashtests/585185-1.html
new file mode 100644
index 0000000000..17eec73b36
--- /dev/null
+++ b/layout/style/crashtests/585185-1.html
@@ -0,0 +1 @@
+<a style="font: -2px Verdana;">
diff --git a/layout/style/crashtests/588627-1.html b/layout/style/crashtests/588627-1.html
new file mode 100644
index 0000000000..510a20dd58
--- /dev/null
+++ b/layout/style/crashtests/588627-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="column-rule: 137438953471mozmm groove transparent"></body>
+</html>
+\ No newline at end of file
diff --git a/layout/style/crashtests/592698-1.html b/layout/style/crashtests/592698-1.html
new file mode 100644
index 0000000000..b2620b512e
--- /dev/null
+++ b/layout/style/crashtests/592698-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <iframe id="x"
+          srcdoc="<div id='a'>aaa"></iframe>
+
+  <script>
+    window.onload = function() {
+      window.frames[0].document.getElementById("a").setAttribute("style",
+        '-moz-transition-property: color;' +
+        '-moz-transition-duration: 10s;' +
+        'transition-property: color;' +
+        'transition-duration: 10s; ' +
+        'color: red;');
+
+      // And start the transition
+      window.frames[0].document.documentElement.getBoundingClientRect();
+
+      // Now kill off the presshell
+      var frame = document.getElementById("x");
+      frame.style.display = "none";
+      document.documentElement.getBoundingClientRect();
+
+      // And wait for the refresh driver to fire
+      setTimeout(function() {
+          document.documentElement.className = "";
+      }, 100);
+    }
+  </script>
+</html>
diff --git a/layout/style/crashtests/601437-1.html b/layout/style/crashtests/601437-1.html
new file mode 100644
index 0000000000..8b5efd6cca
--- /dev/null
+++ b/layout/style/crashtests/601437-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link id="s" rel="stylesheet" href="data:text/css,@font-face { font-family: 'F'; src: url('file:///404/'); }">
+</head>
+<body onload="document.getElementById('s').sheet.media.appendMedium('x');"></body>
+</html>
diff --git a/layout/style/crashtests/601439-1.html b/layout/style/crashtests/601439-1.html
new file mode 100644
index 0000000000..e76e4520e9
--- /dev/null
+++ b/layout/style/crashtests/601439-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var elt = document.createElement("span");
+elt.setAttribute("style", "color: red ! important;");
+elt.style.getPropertyPriority("foo");
+
+</script>
diff --git a/layout/style/crashtests/605689-1.html b/layout/style/crashtests/605689-1.html
new file mode 100644
index 0000000000..be02ac2e71
--- /dev/null
+++ b/layout/style/crashtests/605689-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+  var r = document.documentElement;
+  r.style.display = "table-cell";
+  r.style.transitionProperty = "x";
+  window.getComputedStyle(r).transitionProperty;
+}
+
+</script>
+<body onload="boom();"></body>
diff --git a/layout/style/crashtests/611922-1.html b/layout/style/crashtests/611922-1.html
new file mode 100644
index 0000000000..f6affa0de1
--- /dev/null
+++ b/layout/style/crashtests/611922-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <body onload="setTimeout(boom, 100)">
+    <a id="x" href=""><span>This link starts out visited</span></a>
+    <script>
+      function boom() {
+        document.getElementById("x").removeAttribute("href");
+        document.body.offsetWidth;
+        document.documentElement.className = "";
+      }
+    </script>
+  </body>
+</body>
diff --git a/layout/style/crashtests/612213.html b/layout/style/crashtests/612213.html
new file mode 100644
index 0000000000..a97b21bca5
--- /dev/null
+++ b/layout/style/crashtests/612213.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+  var v = document.createElementNS("http://www.w3.org/1999/xhtml", "video");
+  document.body.appendChild(v);
+  var s = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+  s.setAttribute("style", "filter: url(#g);");
+  document.body.appendChild(s);
+
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body id="g" onload="setTimeout(boom, 0);"></body></html>
diff --git a/layout/style/crashtests/621596-1.html b/layout/style/crashtests/621596-1.html
new file mode 100644
index 0000000000..95bb498bf7
--- /dev/null
+++ b/layout/style/crashtests/621596-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.style.columnWidth = "1px";
+  document.documentElement.style.MozOutlineRadiusBottomleft = "100%";
+  document.documentElement.style.padding = "2251799813685249em";
+  window.getComputedStyle(document.documentElement).MozOutlineRadiusBottomleft;
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/622314-1.xhtml b/layout/style/crashtests/622314-1.xhtml
new file mode 100644
index 0000000000..4daf23169f
--- /dev/null
+++ b/layout/style/crashtests/622314-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <div>
+    <body link="orange" style="position: absolute;"></body>
+    <body link="yellow" style="position: absolute;"></body>
+    
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+    <span style="display: inline;"></span>
+
+  </div>
+</html>
diff --git a/layout/style/crashtests/635153.html b/layout/style/crashtests/635153.html
new file mode 100644
index 0000000000..50f05878a1
--- /dev/null
+++ b/layout/style/crashtests/635153.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var r = document.documentElement;
+  document.__proto__ = document.createTextNode("text");
+  r.style.counterReset = "a";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/637242.xhtml b/layout/style/crashtests/637242.xhtml
new file mode 100644
index 0000000000..a8d99a7325
--- /dev/null
+++ b/layout/style/crashtests/637242.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style id="style">p { color: red; }</style>
+<script>
+<![CDATA[
+
+function boom()
+{
+	var styleText = "p { color: green; }";
+	
+	// Make 2^17 rules
+	for (var i = 0; i < 17; ++i) {
+	  styleText += styleText;
+	}
+
+	document.getElementById("style").firstChild.data = styleText;
+    
+    document.body.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"));
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><p>This should be green</p></body>
+
+</html>
diff --git a/layout/style/crashtests/645142.html b/layout/style/crashtests/645142.html
new file mode 100644
index 0000000000..290355c187
--- /dev/null
+++ b/layout/style/crashtests/645142.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html><html>
+<head><title>Testcase for bug 645142</title></head>
+<body>
+<div style="font-size: 18446744073709552000mozmm"></div>
+<div style="font-size: 18446744073709552000px"></div>
+<div style="font-size: 18446744073709552000pc"></div>
+<div style="font-size: 18446744073709552000pt"></div>
+<div style="font-size: 18446744073709552000in"></div>
+<div style="font-size: 18446744073709552000mm"></div>
+<div style="font-size: 18446744073709552000cm"></div>
+</body></html>
diff --git a/layout/style/crashtests/652976-1.svg b/layout/style/crashtests/652976-1.svg
new file mode 100644
index 0000000000..1ca6ee28ec
--- /dev/null
+++ b/layout/style/crashtests/652976-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+window.addEventListener("load", function() {
+  setTimeout(function() { 
+    document.getElementById("a").style.MozAnimationName = "a";
+  }, 0);
+}, false);
+</script>
+<rect id="a"><animate attributeName="fill" by="#AAF573"/></rect>
+</svg>
diff --git a/layout/style/crashtests/653675.html b/layout/style/crashtests/653675.html
new file mode 100644
index 0000000000..da858ba76e
--- /dev/null
+++ b/layout/style/crashtests/653675.html
@@ -0,0 +1 @@
+<body style="-moz-transform: rotate(520327040619807469187028288680706778649deg); position:fixed;"> <body text=black>
diff --git a/layout/style/crashtests/665209-1.html b/layout/style/crashtests/665209-1.html
new file mode 100644
index 0000000000..30e8055ebb
--- /dev/null
+++ b/layout/style/crashtests/665209-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+  var w = '<div xmlns="http://www.w3.org/1999/xhtml" style="content: url(#);" />';
+  var v = 'url("data:image/svg+xml,' + encodeURIComponent(w) + '")';
+  document.documentElement.style.content = v;
+  document.documentElement.className = "";
+}
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/671799-1.html b/layout/style/crashtests/671799-1.html
new file mode 100644
index 0000000000..cc89495b36
--- /dev/null
+++ b/layout/style/crashtests/671799-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<iframe src="data:text/html,<style>@font-face { font-family: 'x'; src: url(x.ttf); } :root { font-family: 'x'; }</style>"></iframe>
+</body>
+</html>
diff --git a/layout/style/crashtests/671799-2.html b/layout/style/crashtests/671799-2.html
new file mode 100644
index 0000000000..a8398680e0
--- /dev/null
+++ b/layout/style/crashtests/671799-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+@font-face {
+  font-family: foo;
+  src: url("http://spaces in hostname/");
+}
+body {
+  font-family: foo, monospace;
+}
+</style>
+</head>
+<body>
+foo bar
+</body>
+</html>
diff --git a/layout/style/crashtests/690990-1.html b/layout/style/crashtests/690990-1.html
new file mode 100644
index 0000000000..19520e4f90
--- /dev/null
+++ b/layout/style/crashtests/690990-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+
+<link id="e" href="data:text/css,.ref { background-color: green; }" rel="stylesheet">
+
+<script>
+
+function boom()
+{
+  document.documentElement.appendChild(document.getElementById("e"));
+  document.styleSheets[0].cssRules[0];
+  // Remove reftest-wait async so we give the SheetComplete a chance to run
+  setTimeout(function() { document.documentElement.className = ""; }, 0);
+}
+
+</script>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/style/crashtests/694775.html b/layout/style/crashtests/694775.html
new file mode 100644
index 0000000000..2952d5e6e8
--- /dev/null
+++ b/layout/style/crashtests/694775.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<script>
+
+document.documentElement.style.direction = "rtl";
+document.__proto__ = null;
+
+</script>
diff --git a/layout/style/crashtests/696188-1.html b/layout/style/crashtests/696188-1.html
new file mode 100644
index 0000000000..e52a267474
--- /dev/null
+++ b/layout/style/crashtests/696188-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<script>
+
+function boom()
+{
+  var e = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  document.body.appendChild(e);
+  e.setAttribute("style", "-moz-transform: rotate3d(2, 3, 4, 45deg) scale(10);");
+  e.offsetHeight;
+  e.setAttribute("style", "-moz-transition-duration: 1ms;");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/696869-1.html b/layout/style/crashtests/696869-1.html
new file mode 100644
index 0000000000..e85a882a68
--- /dev/null
+++ b/layout/style/crashtests/696869-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<body style="-moz-transition: 4000000000000000s" onload="document.body.style.color = 'green';"></body>
+\ No newline at end of file
diff --git a/layout/style/crashtests/700116.html b/layout/style/crashtests/700116.html
new file mode 100644
index 0000000000..de35ce7029
--- /dev/null
+++ b/layout/style/crashtests/700116.html
@@ -0,0 +1,5 @@
+<head>
+  <script>
+    document.write('<link rel="stylesheet" href="#"><link rel="alternate stylesheet" title="x" href="data:text/css,"><link rel="stylesheet" title="x" href="data:text/css,">');
+  </script>
+</head>
diff --git a/layout/style/crashtests/729126-1.html b/layout/style/crashtests/729126-1.html
new file mode 100644
index 0000000000..a5c50abd0b
--- /dev/null
+++ b/layout/style/crashtests/729126-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body style="transition-duration: 1ms"></body>
+<script>
+var body = document.body;
+/* flush */ getComputedStyle(body, "").background;
+body.style.background = 'url(none.png), repeat';
+/* flush */ getComputedStyle(body, "").background;
+</script>
+</html>
diff --git a/layout/style/crashtests/729126-2.html b/layout/style/crashtests/729126-2.html
new file mode 100644
index 0000000000..63533ee302
--- /dev/null
+++ b/layout/style/crashtests/729126-2.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body style="background-size: cover; transition-duration: 1ms"></body>
+<script>
+var body = document.body;
+/* flush */ getComputedStyle(body, "").backgroundSize;
+body.style.backgroundSize = 'contain';
+/* flush */ getComputedStyle(body, "").backgroundSize;
+</script>
+</html>
diff --git a/layout/style/crashtests/786108-1.html b/layout/style/crashtests/786108-1.html
new file mode 100644
index 0000000000..2962e71177
--- /dev/null
+++ b/layout/style/crashtests/786108-1.html
@@ -0,0 +1,22 @@
+<html>
+  <head></head>
+  <body></body>
+  <script type="text/javascript">
+    // Detect severe performance and memory issues when large amounts of errors
+    // are reported from CSS embedded in a file with a long data URI. Addressed
+    // by 786108; should finish quickly with that patch and run for a very long
+    // time otherwise.
+
+    var img = new Array;
+    img.push('<img src="data:image/svg+xml,');
+    img.push(encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300px" height="300px">'));
+
+    for (var i = 0 ; i < 10000 ; i++)
+      img.push(encodeURIComponent('<circle cx="0" cy="0" r="1" style="xxx-invalid-property: 0;"/>'));
+
+    img.push(encodeURIComponent('</svg>'));
+    img.push('">');
+
+    document.getElementsByTagName('body')[0].innerHTML = img.join('');
+  </script>
+</html>
diff --git a/layout/style/crashtests/786108-2.html b/layout/style/crashtests/786108-2.html
new file mode 100644
index 0000000000..1b2892040b
--- /dev/null
+++ b/layout/style/crashtests/786108-2.html
@@ -0,0 +1,23 @@
+<html>
+  <head></head>
+  <body></body>
+  <script type="text/javascript">
+    // Detect severe performance and memory issues when large amounts of errors
+    // are reported from CSS embedded in a file with a long data URI. Addressed
+    // by 786108; should finish quickly with that patch and run for a very long
+    // time otherwise. This version is designed for slow / memory constrained
+    // platforms like Android.
+
+    var img = new Array;
+    img.push('<img src="data:image/svg+xml,');
+    img.push(encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300px" height="300px">'));
+
+    for (var i = 0 ; i < 2500 ; i++)
+      img.push(encodeURIComponent('<circle cx="0" cy="0" r="1" style="xxx-invalid-property: 0;"/>'));
+
+    img.push(encodeURIComponent('</svg>'));
+    img.push('">');
+
+    document.getElementsByTagName('body')[0].innerHTML = img.join('');
+  </script>
+</html>
diff --git a/layout/style/crashtests/788836.html b/layout/style/crashtests/788836.html
new file mode 100644
index 0000000000..938c216753
--- /dev/null
+++ b/layout/style/crashtests/788836.html
@@ -0,0 +1,3 @@
+<style>@\</style>
+<style>@\
+</style>
diff --git a/layout/style/crashtests/806310-1.html b/layout/style/crashtests/806310-1.html
new file mode 100644
index 0000000000..505b410769
--- /dev/null
+++ b/layout/style/crashtests/806310-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html lang="en-US" style="font: caption; font-size: 1rem;">
+<body></body>
+</html>
diff --git a/layout/style/crashtests/809762.html b/layout/style/crashtests/809762.html
new file mode 100644
index 0000000000..ad06540efd
--- /dev/null
+++ b/layout/style/crashtests/809762.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var ss = document.getElementsByTagName('style')[0];
+  var styleText = '@font-face { font-family: "MarkA"; src: url(markA.ttf); } :root { font-family: "MarkA"; }';
+
+  ss.firstChild.data = styleText;
+  setTimeout(function() {
+    ss.firstChild.data = styleText + " ";
+  }, 0);
+}
+
+</script>
+<style>
+</style>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/812824.html b/layout/style/crashtests/812824.html
new file mode 100644
index 0000000000..5367b6c308
--- /dev/null
+++ b/layout/style/crashtests/812824.html
@@ -0,0 +1 @@
+<html style="border: inherit;"><div></div><style>html, div { border-image-source: url('border.png'); }</style></html>
diff --git a/layout/style/crashtests/822766-1.html b/layout/style/crashtests/822766-1.html
new file mode 100644
index 0000000000..77bb1e25a8
--- /dev/null
+++ b/layout/style/crashtests/822766-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+@-moz-keyframes togreen {
+    100% {
+        color: green;
+    }
+}
+
+.a:after {
+    animation-name: togreen;
+    animation-duration: 10s;
+}
+
+</style>
+<script>
+
+function boom()
+{
+  document.documentElement.setAttribute("class", "a");
+  document.documentElement.offsetHeight;
+  document.documentElement.appendChild(document.createElement("span"));
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/822877.html b/layout/style/crashtests/822877.html
new file mode 100644
index 0000000000..8dfa192e49
--- /dev/null
+++ b/layout/style/crashtests/822877.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  document.documentElement.style.transitionDelay = "10s";
+  document.documentElement.style.borderBottomLeftRadius = "999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999%";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/827213-1.html b/layout/style/crashtests/827213-1.html
new file mode 100644
index 0000000000..16cc88a20f
--- /dev/null
+++ b/layout/style/crashtests/827213-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="height: 100px; background-image: repeating-radial-gradient(red -999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999%, blue 100%)">
+</div>
+
+</body>
+</html>
diff --git a/layout/style/crashtests/827220.html b/layout/style/crashtests/827220.html
new file mode 100644
index 0000000000..7c1717a1b6
--- /dev/null
+++ b/layout/style/crashtests/827220.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html style="font-size: 8em; clip: rect(auto, 3em, 0, 0); transition-timing-function: cubic-bezier(1, 1152921504606847000, 1, 1); transition-duration: 1s">
+<body onload="document.documentElement.style.fontSize = '';">
+</body>
+</html>
diff --git a/layout/style/crashtests/827591-1.html b/layout/style/crashtests/827591-1.html
new file mode 100644
index 0000000000..a0ab100913
--- /dev/null
+++ b/layout/style/crashtests/827591-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+@page {}
+
+</style>
+<script>
+
+function boom()
+{
+  document.styleSheets[0].cssRules[0].style.paddingLeft = "initial";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/829817.html b/layout/style/crashtests/829817.html
new file mode 100644
index 0000000000..a81fb6b79d
--- /dev/null
+++ b/layout/style/crashtests/829817.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+@page {}
+
+</style>
+<script>
+
+function boom()
+{
+    // This shouldn't cause a shutdown leak.
+    document.styleSheets[0].cssRules[0].style.someExpando = "set an expando to preserve the wrapper";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/842134.html b/layout/style/crashtests/842134.html
new file mode 100644
index 0000000000..f5bab1214b
--- /dev/null
+++ b/layout/style/crashtests/842134.html
@@ -0,0 +1 @@
+<!doctype html><style>body { marker: url(#m) url(#m); }</style>
diff --git a/layout/style/crashtests/861489-1.html b/layout/style/crashtests/861489-1.html
new file mode 100644
index 0000000000..bb394cef5b
--- /dev/null
+++ b/layout/style/crashtests/861489-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+
+@keyframes anim {
+  20% {
+    color: green;
+  }
+}
+
+a {
+  animation-name: anim;
+  animation-duration: 40s;
+}
+
+</style>
+<style>
+
+:link { background: red ! important; }
+
+</style>
+</head>
+
+<body onload="document.documentElement.style.border = 'initial';">
+<div><a href="data:text/html,unlikely to be visited"></a></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/862113.html b/layout/style/crashtests/862113.html
new file mode 100644
index 0000000000..319132b783
--- /dev/null
+++ b/layout/style/crashtests/862113.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  window.getComputedStyle(document.documentElement, ":foo");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/867487.html b/layout/style/crashtests/867487.html
new file mode 100644
index 0000000000..a259690d14
--- /dev/null
+++ b/layout/style/crashtests/867487.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="stylesheet" href="data:text/css,">
+<script>
+
+function boom()
+{
+    var s = document.styleSheets[0];
+    var n = s.ownerNode;
+    var p = n.parentNode;
+
+    s.insertRule("#a { }", 0);
+
+    for (var i = 0; i < 3; ++i) {
+        p.removeChild(n);
+        p.appendChild(n);
+    }
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/873222.html b/layout/style/crashtests/873222.html
new file mode 100644
index 0000000000..1ffcc623ae
--- /dev/null
+++ b/layout/style/crashtests/873222.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var r = document.documentElement;
+    r.style.font = "170% fantasy";
+    r.style.fontSynthesis = "none";
+    r.getAttribute("style");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/873260-1.html b/layout/style/crashtests/873260-1.html
new file mode 100644
index 0000000000..9461ef41ad
--- /dev/null
+++ b/layout/style/crashtests/873260-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var r = document.documentElement;
+    r.style.transitionDelay = "60s";
+    r.style.borderRadius = "9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999%";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/873260-2.html b/layout/style/crashtests/873260-2.html
new file mode 100644
index 0000000000..9634389198
--- /dev/null
+++ b/layout/style/crashtests/873260-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  document.documentElement.style.transitionDelay = "1ms";
+  document.documentElement.style.marginRight = "calc(-999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999*-140737488355327px + 1%)";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/style/crashtests/880862.html b/layout/style/crashtests/880862.html
new file mode 100644
index 0000000000..d89e24d90b
--- /dev/null
+++ b/layout/style/crashtests/880862.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  // This file tests if we create a shutdown leak.
+  document.getElementById("c").getContext("2d").fillText("x", 0, 0);
+  document.styleSheets[0].cssRules[0].style.whatever = "create an expando to preserve the wrapper";
+}
+
+</script>
+
+<style>
+
+@font-face {
+  font-family: missing;
+  src: local(missing);
+}
+
+</style>
+</head>
+
+<body onload="boom();">
+<canvas id="c"></canvas>
+</body>
+</html>
diff --git a/layout/style/crashtests/894245-1.html b/layout/style/crashtests/894245-1.html
new file mode 100644
index 0000000000..b04f0fae04
--- /dev/null
+++ b/layout/style/crashtests/894245-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<div style="background-color: -moz-mac-defaultbuttontext"></div>
+<div style="background-color: -moz-mac-focusring"></div>
+<div style="background-color: -moz-win-communicationstext"></div>
diff --git a/layout/style/crashtests/915440.html b/layout/style/crashtests/915440.html
new file mode 100644
index 0000000000..f3a291f1fe
--- /dev/null
+++ b/layout/style/crashtests/915440.html
@@ -0,0 +1,4 @@
+<!DOCTYPE HTML>
+<body>
+<iframe src="data:text/html,<!DOCTYPE HTML><style>@font-face { font-family: 'a'; src: url('not-found') format('woff'); }</style>"></iframe>
+</body>
diff --git a/layout/style/crashtests/927734-1.html b/layout/style/crashtests/927734-1.html
new file mode 100644
index 0000000000..bd99f9b9ee
--- /dev/null
+++ b/layout/style/crashtests/927734-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<table>
+  <tr>
+    <td>
+      <style scoped></style>
+      <span></span>
+    </td>
+  </tr>
+</table>
+<style>div {}</style>
diff --git a/layout/style/crashtests/930270-1.html b/layout/style/crashtests/930270-1.html
new file mode 100644
index 0000000000..cbdf5a9e38
--- /dev/null
+++ b/layout/style/crashtests/930270-1.html
@@ -0,0 +1,6 @@
+<nobr>
+<form>
+<style scoped></style>
+<input required="required">
+<button>
+<nobr>
diff --git a/layout/style/crashtests/930270-2.html b/layout/style/crashtests/930270-2.html
new file mode 100644
index 0000000000..0cd1dc99c6
--- /dev/null
+++ b/layout/style/crashtests/930270-2.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+<style scoped>span { color: red; }</style>
+<div><span></span></div>
+<script>
+var div = document.querySelector("div");
+div.remove();
+getComputedStyle(div.firstChild, "").color;
+</script>
diff --git a/layout/style/crashtests/945048-1.html b/layout/style/crashtests/945048-1.html
new file mode 100644
index 0000000000..753efb66f8
--- /dev/null
+++ b/layout/style/crashtests/945048-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<style>
+button::-moz-focus-inner:active { }
+</style>
+<button>hello</button>
diff --git a/layout/style/crashtests/972199-1.html b/layout/style/crashtests/972199-1.html
new file mode 100644
index 0000000000..a4e0de0d81
--- /dev/null
+++ b/layout/style/crashtests/972199-1.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+  <style type="text/css">
+    @keyframes anim {
+       0% { transform: translate(0px) }
+       100% { transform: translate(100px) }
+    }
+    div {
+      width: 100px;
+      height: 100px;
+      background-color: white;
+    }
+  </style>
+</head>
+<body>
+<div></div>
+<script type="application/javascript">
+
+window.addEventListener("load", function() {
+  document.querySelector("div").setAttribute("style",
+    "animation: 100s 300s anim linear");
+  advance_clock(200000);
+  advance_clock(300000);
+
+  Promise.resolve().then(function() {
+    SpecialPowers.DOMWindowUtils.restoreNormalRefresh();
+  }).then(function() {
+    document.documentElement.className = "";
+  });
+});
+
+function advance_clock(milliseconds) {
+  SpecialPowers.DOMWindowUtils.advanceTimeAndRefresh(milliseconds);
+}
+</script>
+</html>
diff --git a/layout/style/crashtests/989965-1.html b/layout/style/crashtests/989965-1.html
new file mode 100644
index 0000000000..a2879d973f
--- /dev/null
+++ b/layout/style/crashtests/989965-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+<style>
+::placeholder { color: red; }
+::placeholder:focus { color: green; }
+</style>
+<script>
+window.getComputedStyle(document.body, "::placeholder").color;
+</script>
diff --git a/layout/style/crashtests/992333-1.html b/layout/style/crashtests/992333-1.html
new file mode 100644
index 0000000000..86a1d57d73
--- /dev/null
+++ b/layout/style/crashtests/992333-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<style>
+p { --variable: value; transition: 1s --variable; }
+</style>
+<p>Hello.</p>
+<script>
+window.onload = function() {
+  document.querySelector("p").style.color = "green";
+};
+</script>
diff --git a/layout/style/crashtests/blue-32x32.png b/layout/style/crashtests/blue-32x32.png
new file mode 100644
index 0000000000..deefd19b2a
--- /dev/null
+++ b/layout/style/crashtests/blue-32x32.png
diff --git a/layout/style/crashtests/border-image-visited-link.html b/layout/style/crashtests/border-image-visited-link.html
new file mode 100644
index 0000000000..b6e3ae5d78
--- /dev/null
+++ b/layout/style/crashtests/border-image-visited-link.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<title>border-image on link with visited styles</title>
+<style>
+
+:link { color: blue }
+:visited { color: purple }
+:link, :visited { border: medium solid; border-image: url(blue-32x32.png) 4 4 4 4; }
+
+</style>
+<a href="http://example.com/">test</a>
diff --git a/layout/style/crashtests/content-only-on-link-before.html b/layout/style/crashtests/content-only-on-link-before.html
new file mode 100644
index 0000000000..949e13542f
--- /dev/null
+++ b/layout/style/crashtests/content-only-on-link-before.html
@@ -0,0 +1,5 @@
+<!DOCTYPE HTML>
+<style type="text/css">
+:link::before { content: "link: " }
+</style>
+<a href="http://www.example.com/">example</a>
diff --git a/layout/style/crashtests/content-only-on-visited-before.html b/layout/style/crashtests/content-only-on-visited-before.html
new file mode 100644
index 0000000000..4496bb86df
--- /dev/null
+++ b/layout/style/crashtests/content-only-on-visited-before.html
@@ -0,0 +1,5 @@
+<!DOCTYPE HTML>
+<style type="text/css">
+:visited::before { content: "link: " }
+</style>
+<a href="http://www.example.com/">example</a>
diff --git a/layout/style/crashtests/crashtests.list b/layout/style/crashtests/crashtests.list
new file mode 100644
index 0000000000..92412e83e4
--- /dev/null
+++ b/layout/style/crashtests/crashtests.list
@@ -0,0 +1,324 @@
+load 105619-1.html
+load 187671-1.html
+load 192408-1.html
+load 285727-1.html
+load 286707-1.html
+load 317561-1.html
+load 330998-1.html
+load 363950.html
+load 368175-1.html
+load 368740.html
+load 379788-1.html
+load 383979-1.xhtml
+load 383979-2.html
+load 386939-1.html
+load 391034-1.xhtml
+load 397022-1.html
+load 399289-1.svg
+load 404470-1.html
+load 411603-1.html
+load 412588-1.html
+load 413274-1.xhtml
+skip-if(Android) load chrome://reftest/content/crashtests/layout/style/crashtests/416461-1.xhtml
+load 418007-1.xhtml
+load chrome://reftest/content/crashtests/layout/style/crashtests/431705-1.xhtml
+load 432561-1.html
+load 437170-1.html
+load 437532-1.html
+skip-if(ThreadSanitizer) load 439184-1.html
+load 444237-1.html
+load 444848-1.html
+load 447776-1.html
+load 447783-1.html
+load 448161-1.html
+load 448161-2.html
+load 452150-1.xhtml
+load 456196.html
+load 460209-1.html
+load 460217-1.html
+load 460323-1.html
+load 466845-1.html
+load 469432-1.xhtml
+load 472195-1.html
+load 472237-1.html # will fail, test for leak (474704)
+HTTP(..) load 472237-1.html
+load 473720-1.html
+load 473892-1.html
+load 473914-1.html
+load 474377-1.xhtml
+load 478321-1.xhtml
+load 481557.html
+load 495269-1.html
+load 495269-2.html
+load 498036-1.html
+load 509155-1.html
+load 509156-1.html
+load 509569-1.html
+load 512851-1.xhtml
+load 524252-1.html
+load 536789-1.html
+load 539613-1.xhtml
+load 558943-1.xhtml
+load 559491.html
+load 565248-1.html
+load 571105-1.xhtml
+load 573127-1.html
+load 575464-1.html
+load 580685.html
+load 585185-1.html
+load 588627-1.html
+load 592698-1.html
+load 601437-1.html
+load 601439-1.html
+load 605689-1.html
+load 611922-1.html
+load 612213.html
+load 621596-1.html
+load 622314-1.xhtml
+load 635153.html
+load 637242.xhtml
+load 645142.html
+load 652976-1.svg
+load 653675.html
+load 665209-1.html
+load 671799-1.html
+load 671799-2.html
+load 690990-1.html
+load 694775.html
+load 696188-1.html
+load 696869-1.html
+load 700116.html
+load 729126-1.html
+load 729126-2.html
+load 786108-1.html
+load 786108-2.html
+load 788836.html
+load 806310-1.html
+load 809762.html
+load 812824.html
+load 822766-1.html
+load 822877.html
+load 827213-1.html
+load 827220.html
+load 827591-1.html
+load 829817.html
+load 842134.html
+load 861489-1.html
+load 862113.html
+load 867487.html
+load 873222.html
+load 873260-1.html
+load 873260-2.html
+load 880862.html
+load 894245-1.html
+load 915440.html
+load 927734-1.html
+load 930270-1.html
+load 930270-2.html
+load 945048-1.html
+load 972199-1.html
+load 989965-1.html
+load 992333-1.html
+load 1017798-1.html
+load 1028514-1.html
+load 1066089-1.html
+load 1074651-1.html
+load 1135534.html
+load 1089463-1.html
+load 1136010-1.html
+load 1146101-1.html
+load 1153693-1.html
+load 1156969.svg
+load 1161320-1.html
+pref(dom.animations-api.getAnimations.enabled,true) load 1161320-2.html
+load 1161366-1.html
+load 1163446-1.html
+load 1164813-1.html
+load 1167782-1.html
+load 1186768-1.xhtml
+load 1200568-1.html
+load 1206105-1.html
+load 1223688-1.html
+load 1223694-1.html
+load 1226400-1.html
+load 1227498.html
+load 1227501-1.html
+load 1228789-1.html
+load 1230408-1.html
+load 1233135-1.html
+load 1233135-2.html
+load 1236398.xhtml
+load 1238660-1.html
+load 1245260-1.html
+load 1247865-1.html
+load 1250791.html
+load 1264396-1.html
+load 1264949.html
+load 1265611-1.html
+load 1270795.html
+load 1275026.html
+load 1278463-1.html
+pref(dom.animations-api.getAnimations.enabled,true) load 1277908-1.html
+load 1277908-2.html
+load 1282076-1.html
+load 1282076-2.html
+load 1290994-1.html
+load 1290994-2.html
+load 1290994-3.html
+load 1290994-4.html
+load 1314531.html
+load 1315889-1.html
+load 1315894-1.html
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) pref(widget.windows.window_occlusion_tracking.enabled,false) load 1319072-1.html # Bug 1819154
+HTTP load 1320423-1.html
+load 1321357-1.html
+load 1328535-1.html
+load 1331272.html
+load 1332550.html
+HTTP load 1333001-1.html
+load 1340248.html
+pref(dom.animations-api.core.enabled,true) pref(dom.animations-api.implicit-keyframes.enabled,true) load 1340344.html
+load 1342316-1.html
+load 1344210.html
+load 1353312.html
+load 1356601-1.html
+load 1364139-1.html
+load 1371450-1.html
+load 1374175-1.html
+load 1375812-1.html
+load 1377053-1.html
+load 1377256-1.html
+load 1378064-1.html
+load 1378814.html
+load 1380800.html
+load link-transition-before.html
+load 1381420-1.html
+load 1381682.html
+load 1382672.html
+load 1382710.html
+pref(dom.animations-api.compositing.enabled,true) pref(dom.animations-api.implicit-keyframes.enabled,true) load 1383493-1.html
+load 1383001.html
+load 1383001-2.html
+load 1383319.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1383589-1.html
+load 1383975.html
+load border-image-visited-link.html
+load content-only-on-link-before.html
+load content-only-on-visited-before.html
+load font-face-truncated-src.html
+load large_border_image_width.html
+load link-transition-before.html
+skip-if(winWidget&&isDebugBuild&&/^Windows\x20NT\x206\.1/.test(http.oscpu)) load long-url-list-stack-overflow.html #Bug 1525117
+load scale-on-block-continuation.html
+skip-if(/^Windows\x20NT\x2010\.0/.test(http.oscpu)&&/^aarch64-msvc/.test(xulRuntime.XPCOMABI)) skip-if(AddressSanitizer) skip-if(ThreadSanitizer) load 1383981.html # Very sensitive to stack size.
+skip-if(/^Windows\x20NT\x2010\.0/.test(http.oscpu)&&/^aarch64-msvc/.test(xulRuntime.XPCOMABI)) skip-if(AddressSanitizer) skip-if(ThreadSanitizer) load 1383981-2.html
+skip-if(/^Windows\x20NT\x2010\.0/.test(http.oscpu)&&/^aarch64-msvc/.test(xulRuntime.XPCOMABI)) skip-if(AddressSanitizer) skip-if(ThreadSanitizer) load 1383981-3.html
+load 1384824-1.html
+load 1384824-2.html
+load 1386773.html
+load 1387481-1.html
+load 1387499.html
+load 1388234.html
+load 1391577.html
+load 1393189.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1393580.html
+load 1389645.html
+load 1390726.html
+load 1393791.html
+load 1384232.html
+load 1395725.html
+load 1396041.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) pref(dom.animations-api.compositing.enabled,true) load 1397363-1.html
+load 1397439-1.html
+load 1395719.html
+load 1397091.html
+load 1398479.html
+load 1398581.html
+load 1399006.html
+load 1399546.html
+load 1400035.html
+load 1400325.html
+load 1400926.html
+load 1400936-1.html
+load 1400936-2.html
+pref(dom.animations-api.implicit-keyframes.enabled,true) load 1401256.html
+load 1401706.html
+load 1401801.html
+load 1401825.html
+load 1402218-1.html
+load 1402366.html
+load 1402419.html
+load 1402472.html
+load 1403028.html
+load 1403433.html
+load 1403465.html
+load 1403592.html
+load 1403615.html
+load 1403712.html
+load 1404180-1.html
+load 1404316.html
+load 1406222-1.html
+load 1406222-2.html
+load 1404324-1.html
+load 1404324-2.html
+load 1404324-3.html
+load 1404057.html
+load 1405880.html
+load 1409502.html
+load 1409931.html
+load 1410226-1.html
+load 1410226-2.html
+load 1411008.html
+load 1411143.html
+load 1411478.html
+load 1413288.html
+load 1413361.html
+load 1413670.html
+load 1415353.html
+load 1418059.html
+test-pref(dom.animations-api.core.enabled,true) test-pref(dom.animations-api.implicit-keyframes.enabled,true) pref(dom.animations-api.getAnimations.enabled,true) load 1418867.html
+load 1419554.html
+load 1426312.html
+load 1439793.html
+load 1409183.html
+load 1445682.html
+load 1449243.html
+load 1450691.html
+load 1453206.html
+load 1454140.html
+load 1455108.html
+load 1457288.html
+load 1457985.html
+load 1468640.html
+load 1469076.html
+load 1475003.html
+load 1479681.html
+load 1488817.html
+load 1490012.html
+load 1502893.html
+load 1507674.html
+load 1509989.html
+load 1514086.html
+load 1533783.html
+load 1533891.html
+pref(gfx.omta.background-color,true) load 1533968.html
+load 1545177.html
+skip-if(geckoview) skip-if(Android) load 1546255.html # Bug 1563020 for GV+WR & Bug 1553971
+load 1552911.html
+load 1562361.html
+load 1566684.html
+load 1579788.html
+load 1580307.html
+load 1581579.html
+skip-if(release_or_beta) pref(dom.paintWorklet.enabled,true) pref(dom.worklet.enabled,true) load 1593766.html # bug 1581896
+pref(layout.css.motion-path.enabled,true) load 1594949.html
+pref(layout.css.motion-path.enabled,true) pref(layout.css.individual-transform.enabled,true) load 1594960.html
+load 1586444.html
+load 1599286.html
+pref(layout.css.motion-path.enabled,true) load 1609786.html
+pref(layout.css.constructable-stylesheets.enabled,true) load 1616433.html
+pref(layout.css.constructable-stylesheets.enabled,true) load 1616407.html
+load 1639533.html
+pref(layout.accessiblecaret.enabled,true) load 1640040.html
+load 1806189-1.html
+pref(layout.css.scroll-driven-animations.enabled,true) load 1821416.html
diff --git a/layout/style/crashtests/font-face-truncated-src.html b/layout/style/crashtests/font-face-truncated-src.html
new file mode 100644
index 0000000000..c3d7dbda5b
--- /dev/null
+++ b/layout/style/crashtests/font-face-truncated-src.html
@@ -0,0 +1,2 @@
+<!doctype html>
+<style>@font-face { src:</style>
diff --git a/layout/style/crashtests/large_border_image_width.html b/layout/style/crashtests/large_border_image_width.html
new file mode 100644
index 0000000000..d80b734654
--- /dev/null
+++ b/layout/style/crashtests/large_border_image_width.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<div style="border: 10px solid transparent; border-image-source: linear-gradient(90deg, blue 25px, green 25px); border-image-width: 5464618830153;"></div>
+</body>
+</html>
+
diff --git a/layout/style/crashtests/link-transition-before.html b/layout/style/crashtests/link-transition-before.html
new file mode 100644
index 0000000000..6a8b7e409e
--- /dev/null
+++ b/layout/style/crashtests/link-transition-before.html
@@ -0,0 +1,27 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<style type="text/css">
+a {
+  border-bottom: 1px solid transparent;
+  transition: all 2s linear;
+}
+a.start {
+  border-bottom: 1px solid #000000;
+}
+/* Can be anything, just need to ensure pseudos cascade */
+:before {
+  color: blue;
+}
+</style>
+<a href="http://www.example.com/">example</a>
+<script>
+let a0 = document.querySelectorAll("a")[0];
+a0.classList.add("start");
+setTimeout(() => {
+  a0.classList.remove("start");
+  setTimeout(() => {
+    a0.classList.add("start");
+    document.documentElement.removeAttribute("class");
+  }, 0);
+}, 0);
+</script>
+\ No newline at end of file
diff --git a/layout/style/crashtests/long-url-list-stack-overflow.html b/layout/style/crashtests/long-url-list-stack-overflow.html
new file mode 100644
index 0000000000..899e858df5
--- /dev/null
+++ b/layout/style/crashtests/long-url-list-stack-overflow.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style id="s"></style>
+<script type="text/javascript">
+
+// Duplicates the string 2^n times
+function exp(s, n)
+{
+  for (var i = 0; i < n; ++i)
+    s += s;
+  return s;
+}
+
+var stylesheet = "@-moz-document url(http://www.w3.org/)" + exp(", url-prefix(file:///)", 20) + " { }";
+document.getElementById("s").textContent = stylesheet;
+
+</script>
+</head>
+<body>
+<div></div>
+</body>
+</html>
diff --git a/layout/style/crashtests/scale-on-block-continuation.html b/layout/style/crashtests/scale-on-block-continuation.html
new file mode 100644
index 0000000000..e8f27e607d
--- /dev/null
+++ b/layout/style/crashtests/scale-on-block-continuation.html
@@ -0,0 +1,43 @@
+<!doctype html>
+<html class="reftest-wait">
+<meta charset=utf-8>
+<title>Test for applying a scale animation to a block continuation</title>
+<!--
+  Transform animations involve special frame handling since the animations are
+  applied to the primary frame but are stored on the style frame (a distinction
+  that only exists for display:table content).
+
+  This test exists to ensure that in the case of tranform animations on block
+  continuations we don't come unstuck since this is another case where there are
+  multiple frames with transform animations, but only one primary frame.
+
+  We choose to animate scale in this test because there are a number of methods
+  that take special interest in scale animations because of their impact on
+  prerendering. By using a scale animation we check that none of those code
+  paths trip up on block continuations.
+-->
+<style>
+.container {
+  /* This sizing should hopefully mean that the second paragraph is split across
+     two columns. */
+  column-width: 20em;
+  width: 42em;
+}
+#two {
+  animation: scale 1s infinite alternate;
+}
+@keyframes scale {
+  to { transform: scale(1.3); }
+}
+</style>
+<div class=container>
+  <p>Neque et soluta consectetur. Quia quo magnam ipsa modi. Aspernatur necessitatibus consequatur facere voluptates rerum omnis iusto earum. Beatae quisquam odio est. Deleniti distinctio doloribus veniam similique voluptas est aut. Dignissimos dignissimos voluptas illo odit.</p>
+  <p id=two>Laborum quae reprehenderit alias. Incidunt aliquam non sint non eaque et itaque aut. Est quaerat neque explicabo id voluptas reiciendis. Et animi odio eligendi ipsa repudiandae quam iure. Commodi asperiores sapiente dolorem assumenda debitis. Soluta quisquam porro fugiat fugiat sapiente et excepturi rem.</p>
+  <p>Ipsam eligendi neque perspiciatis est aut ea nihil. Eum sit ipsa sunt aut voluptatem optio. Qui quae autem aspernatur. Et perspiciatis alias voluptatem.</p>
+</div>
+<script>
+two.addEventListener('animationstart', () => {
+  document.documentElement.removeAttribute('class');
+});
+</script>
+</html>
author	Daniel Baumann <daniel.baumann@progress-linux.org>	2024-04-07 19:33:14 +0000
committer	Daniel Baumann <daniel.baumann@progress-linux.org>	2024-04-07 19:33:14 +0000
commit	36d22d82aa202bb199967e9512281e9a53db42c9 (patch)
tree	105e8c98ddea1c1e4784a60a5a6410fa416be2de /layout/style/crashtests
parent	Initial commit. (diff)
download	firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip