17 files changed, 191 insertions, 0 deletions
diff --git a/dom/xml/crashtests/1038887.xhtml b/dom/xml/crashtests/1038887.xhtml
new file mode 100644
index 0000000000..18b12083a9
--- /dev/null
+++ b/dom/xml/crashtests/1038887.xhtml
@@ -0,0 +1 @@
+<?xml-stylesheet type="text/xsl" href="http://notexistingurl"?><html xmlns="http://www.w3.org/1999/xhtml"></html>
diff --git a/dom/xml/crashtests/136896-1.xml b/dom/xml/crashtests/136896-1.xml
new file mode 100644
index 0000000000..a54f95393f
--- /dev/null
+++ b/dom/xml/crashtests/136896-1.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" standalone="yes"?>
+<!DOCTYPE SITES
+[
+    <!ELEMENT SITES (VERSION, SITE+)>
+    <!ELEMENT VERSION (#PCDATA)>
+    <!ELEMENT SITE (ID, NAME, MAXADDR, MAXALIASES, MAXQUOTA, TYPE, DOMAINS?, USERS?, ALIASES?)>
+    <!ELEMENT DOMAINS (DOMAIN*)>
+    <!ELEMENT DOMAIN (#PCDATA)>
+
+    <!ELEMENT USERS (USER*)>
+    <!ELEMENT USER (ID, NAME, ROA, ROC, QUOTA, TYPE)>
+
+    <!ELEMENT ALIASES (ALIAS*)>
+    <!ELEMENT ALIAS (LEFTPART, RIGHTPART)>
+    
+    <!ELEMENT ID (#PCDATA)>
+    <!ELEMENT NAME (#PCDATA)>
+    <!ELEMENT MAXADDR (#PCDATA)>
+    <!ELEMENT MAXALIASES (#PCDATA)>
+    <!ELEMENT MAXQUOTA (#PCDATA)>
+    <!ELEMENT TYPE (#PCDATA)>
+
+    <!ELEMENT ROA (#PCDATA)>
+    <!ELEMENT ROC (#PCDATA)>
+    <!ELEMENT QUOTA (#PCDATA)>
+
+    <!ELEMENT LEFTPART (#PCDATA)>
+    <!ELEMENT RIGHTPART (#PCDATA)>
+]
+>
+<SITES>
+<VERSION>1</VERSION>
+<SITE>
+	<ID>60</ID>
+	<NAME>abtauchen</NAME>
+	<MAXADDR>1</MAXADDR>
+	<MAXALIASES>1</MAXALIASES>
+	<MAXQUOTA>10240</MAXQUOTA>
+	<TYPE>p</TYPE>
+	<DOMAINS>
+		<DOMAIN>abtauchen.at</DOMAIN>
+		<DOMAIN>abtauchen.com</DOMAIN>
+		<DOMAIN>abtauchen.net</DOMAIN>
+	</DOMAINS>
+	<USERS>
+		<USER>
+			<ID>83</ID>
+			<NAME>info</NAME>
+			<ROA>y</ROA>
+			<ROC>n</ROC>
+			<QUOTA>10240</QUOTA>
+			<TYPE>p</TYPE>
+		</USER>
+	</USERS>
+	<ALIASES>
+		<ALIAS>
+			<LEFTPART>*</LEFTPART>
+			<RIGHTPART>info</RIGHTPART>
+		</ALIAS>
+	</ALIASES>
+</SITE>
+</SITES>
+\ No newline at end of file
diff --git a/dom/xml/crashtests/1405878.xml b/dom/xml/crashtests/1405878.xml
new file mode 100644
index 0000000000..12677ade93
--- /dev/null
+++ b/dom/xml/crashtests/1405878.xml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <body>
+    <select>
+      <script>document.documentElement.offsetHeight</script>
+    <option>Hello there</option>
+    </select>
+    <script>
+      document.querySelector("body").style.display = "inline";
+    </script>
+  </body>
+</html>
diff --git a/dom/xml/crashtests/1523655.xml b/dom/xml/crashtests/1523655.xml
new file mode 100644
index 0000000000..e905e9104d
--- /dev/null
+++ b/dom/xml/crashtests/1523655.xml
@@ -0,0 +1,3 @@
+<body>
+  <!-- XML root element with an known, allow-to-attch-shadow-root HTML tag name in non-HTML namespace should not trigger a crash -->
+</body>
diff --git a/dom/xml/crashtests/185285-1.xml b/dom/xml/crashtests/185285-1.xml
new file mode 100644
index 0000000000..9ab44d3356
--- /dev/null
+++ b/dom/xml/crashtests/185285-1.xml
@@ -0,0 +1,2 @@
+<link xmlns="http://www.w3.org/1999/xhtml" href="some.css" rel="stylesheet" />
+<x />
+\ No newline at end of file
diff --git a/dom/xml/crashtests/382636-1.xml b/dom/xml/crashtests/382636-1.xml
new file mode 100644
index 0000000000..da5110ad05
--- /dev/null
+++ b/dom/xml/crashtests/382636-1.xml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body onload="document.cloneNode(true);">
+
+<img src="tree.gif" />
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/dom/xml/crashtests/382636-2.svg b/dom/xml/crashtests/382636-2.svg
new file mode 100644
index 0000000000..2be0060eed
--- /dev/null
+++ b/dom/xml/crashtests/382636-2.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="document.cloneNode(true);">
+
+<image xlink:href="tree.gif" width="49" height="60" />
+
+</svg>
diff --git a/dom/xml/crashtests/382636-3.xhtml b/dom/xml/crashtests/382636-3.xhtml
new file mode 100644
index 0000000000..da5110ad05
--- /dev/null
+++ b/dom/xml/crashtests/382636-3.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body onload="document.cloneNode(true);">
+
+<img src="tree.gif" />
+
+</body>
+</html>
+\ No newline at end of file
diff --git a/dom/xml/crashtests/382636-4.xhtml b/dom/xml/crashtests/382636-4.xhtml
new file mode 100644
index 0000000000..e1c65b9030
--- /dev/null
+++ b/dom/xml/crashtests/382636-4.xhtml
@@ -0,0 +1,5 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="try { document.cloneNode(true); } catch (e) { }">
+
+<image src="tree.gif" width="49" height="60" style="-moz-box-flex: 0" />
+
+</window>
diff --git a/dom/xml/crashtests/420429.xhtml b/dom/xml/crashtests/420429.xhtml
new file mode 100644
index 0000000000..e71af4ef21
--- /dev/null
+++ b/dom/xml/crashtests/420429.xhtml
@@ -0,0 +1,18 @@
+<?xml version="1.0"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        onload="boom();">
+
+<?xml-stylesheet?>
+
+<script type="text/javascript">
+
+function boom()
+{
+  window.addEventListener("DOMCharacterDataModified", function(){}, false);
+  document.documentElement.cloneNode(true).getElementsByTagName("*").length;
+}
+
+</script>
+
+</window>
diff --git a/dom/xml/crashtests/431703-1.xhtml b/dom/xml/crashtests/431703-1.xhtml
new file mode 100644
index 0000000000..622e4455cc
--- /dev/null
+++ b/dom/xml/crashtests/431703-1.xhtml
@@ -0,0 +1,17 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+  document.body.innerHTML = '<circle xmlns="http://www.w3.org/2000/svg" onload=""/>';
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/dom/xml/crashtests/453278-frame.xml b/dom/xml/crashtests/453278-frame.xml
new file mode 100644
index 0000000000..7ced674cc5
--- /dev/null
+++ b/dom/xml/crashtests/453278-frame.xml
@@ -0,0 +1,3 @@
+<xml xmlns:xlink="http://www.w3.org/1999/xlink">
+<xml xlink:href="#"  xlink:actuate="onLoad" xlink:type="simple"/>
+</xml>
diff --git a/dom/xml/crashtests/453278.html b/dom/xml/crashtests/453278.html
new file mode 100644
index 0000000000..f30ea3833e
--- /dev/null
+++ b/dom/xml/crashtests/453278.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<title> Bug 453278 - Crash [@ nsContentUtils::TriggerLink] with xlink stuff in display: none iframe</title><style>
+</style>
+</head>
+<body>
+<iframe id="content" src="453278-frame.xml" style="display: none;"></iframe>
+</body>
+</html>
diff --git a/dom/xml/crashtests/803586.xhtml b/dom/xml/crashtests/803586.xhtml
new file mode 100644
index 0000000000..002de07724
--- /dev/null
+++ b/dom/xml/crashtests/803586.xhtml
@@ -0,0 +1,8 @@
+<?xml-stylesheet href="foo.css" ?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+document.firstChild.nodeValue = null
+</script>
+</head>
+</html>
diff --git a/dom/xml/crashtests/994740-1.xhtml b/dom/xml/crashtests/994740-1.xhtml
new file mode 100644
index 0000000000..4d71cef27f
--- /dev/null
+++ b/dom/xml/crashtests/994740-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+    document.createElement("head").innerHTML = "<";
+}
+
+]]>
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/xml/crashtests/crashtests.list b/dom/xml/crashtests/crashtests.list
new file mode 100644
index 0000000000..158342c84d
--- /dev/null
+++ b/dom/xml/crashtests/crashtests.list
@@ -0,0 +1,14 @@
+load 136896-1.xml
+load 185285-1.xml
+load 382636-1.xml
+load 382636-2.svg
+load 382636-3.xhtml
+load chrome://reftest/content/crashtests/dom/xml/crashtests/382636-4.xhtml # Throws (bug 455856)
+load chrome://reftest/content/crashtests/dom/xml/crashtests/420429.xhtml
+load 431703-1.xhtml
+load 453278.html
+load 803586.xhtml
+load 994740-1.xhtml
+load 1038887.xhtml
+load 1405878.xml
+load 1523655.xml
diff --git a/dom/xml/crashtests/tree.gif b/dom/xml/crashtests/tree.gif
new file mode 100644
index 0000000000..360897e910
--- /dev/null
+++ b/dom/xml/crashtests/tree.gif