9 files changed, 150 insertions, 0 deletions
diff --git a/editor/composer/crashtests/351236-1.html b/editor/composer/crashtests/351236-1.html
new file mode 100644
index 0000000000..99674f1814
--- /dev/null
+++ b/editor/composer/crashtests/351236-1.html
@@ -0,0 +1,37 @@
+<html><head>
+<title>Testcase bug 351236 - Crash [@ nsGetInterface::operator()] with designMode iframes, removing styles, removing iframes, reloading, etc</title>
+<script>
+function designmodes(i){
+try {
+window.frames[0].document.designMode='on';
+window.frames[0].focus();
+window.frames[0].getSelection().collapse(window.frames[0].document.body.childNodes[0],window.frames[0].document.body.childNodes[0].length-2)
+window.frames[0].document.execCommand('inserthtml', false, 'tesxt ');
+} catch(e) {}
+
+setTimeout(designmodes,50);
+}
+
+function removestyles(){
+document.getElementsByTagName('iframe')[0].removeAttribute('style');
+document.getElementsByTagName('q')[0].removeAttribute('style');
+}
+
+function doe() {
+setTimeout(designmodes,200);
+setTimeout(removestyles,500);
+setTimeout(function() {document.removeChild(document.documentElement);}, 1000);
+setTimeout(function() {window.location.reload();}, 1500);
+}
+window.onload=doe;
+</script>
+
+</head>
+<body>
+This page should not crash Mozilla within 2 seconds<br>
+<q style="display: table-row;">
+<iframe style="display: table-row;"></iframe>
+<iframe></iframe>
+</q>
+</body>
+</html>
diff --git a/editor/composer/crashtests/407062-1.html b/editor/composer/crashtests/407062-1.html
new file mode 100644
index 0000000000..9bd5d02e59
--- /dev/null
+++ b/editor/composer/crashtests/407062-1.html
@@ -0,0 +1,20 @@
+<html contentEditable="true">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var r = document.documentElement;
+  while(r.firstChild)
+    r.firstChild.remove();
+
+  document.execCommand("contentReadOnly", false, "");
+  document.documentElement.focus();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/editor/composer/crashtests/419563-1.xhtml b/editor/composer/crashtests/419563-1.xhtml
new file mode 100644
index 0000000000..417530c13a
--- /dev/null
+++ b/editor/composer/crashtests/419563-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.documentElement.appendChild(document.body);
+  document.getElementById("s").contentEditable = "true";
+  document.getElementById("v").focus();
+  document.body.focus();
+  document.execCommand("delete", false, null);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<span id="s">thesewords arenot realwords</span><body contenteditable="true" onload="setTimeout(boom, 0);"><span contenteditable="false"><div id="v" contenteditable="true"></div>Five</span></body>
+
+</html>
diff --git a/editor/composer/crashtests/428844-1-inner.xhtml b/editor/composer/crashtests/428844-1-inner.xhtml
new file mode 100644
index 0000000000..1cc72d0856
--- /dev/null
+++ b/editor/composer/crashtests/428844-1-inner.xhtml
@@ -0,0 +1,4 @@
+<?xml-stylesheet type="text/xsl" href="#a"?>
+<html xmlns="http://www.w3.org/1999/xhtml" onload="dump('Inner onload\n'); window.location.reload()" contenteditable="true">
+<xsl:stylesheet version="1.0" id="a" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"/>
+</html>
diff --git a/editor/composer/crashtests/428844-1.html b/editor/composer/crashtests/428844-1.html
new file mode 100644
index 0000000000..793aababd4
--- /dev/null
+++ b/editor/composer/crashtests/428844-1.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">
+<head>
+<script>
+function boom() {
+  var iframe = document.getElementById('inner');
+  iframe.addEventListener("load", function() {
+    document.documentElement.removeAttribute("class");
+  });
+  iframe.src = "data:text/html,";
+  dump("Outer onload\n");
+}
+</script>
+</head>
+<body onload="boom()">
+<iframe src="428844-1-inner.xhtml" id="inner"></iframe>
+</body>
+</html>
diff --git a/editor/composer/crashtests/461049-1.html b/editor/composer/crashtests/461049-1.html
new file mode 100644
index 0000000000..fea188e646
--- /dev/null
+++ b/editor/composer/crashtests/461049-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function uu()
+{
+  document.removeEventListener("DOMSubtreeModified", uu);
+  document.execCommand("undo", false, null);
+}
+
+function boom()
+{
+  document.execCommand("selectAll", false, null);
+  document.execCommand("strikethrough", false, null);
+  document.addEventListener("DOMSubtreeModified", uu);
+  document.execCommand("undo", false, null);
+}
+
+</script>
+</head>
+
+<body contenteditable="true" onload="boom();"><div></div></body>
+
+</html>
diff --git a/editor/composer/crashtests/crashtests.list b/editor/composer/crashtests/crashtests.list
new file mode 100644
index 0000000000..db84e0e5b1
--- /dev/null
+++ b/editor/composer/crashtests/crashtests.list
@@ -0,0 +1,6 @@
+load 351236-1.html
+load 407062-1.html
+load 419563-1.xhtml
+load 428844-1.html
+load 461049-1.html
+load removing-editable-xslt.html
diff --git a/editor/composer/crashtests/removing-editable-xslt-inner.xhtml b/editor/composer/crashtests/removing-editable-xslt-inner.xhtml
new file mode 100644
index 0000000000..cbf206d7ed
--- /dev/null
+++ b/editor/composer/crashtests/removing-editable-xslt-inner.xhtml
@@ -0,0 +1,4 @@
+<?xml-stylesheet type="text/xsl" href="#a"?>
+<html xmlns="http://www.w3.org/1999/xhtml"  contenteditable="true">
+<xsl:stylesheet version="1.0" id="a" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"/>
+</html>
diff --git a/editor/composer/crashtests/removing-editable-xslt.html b/editor/composer/crashtests/removing-editable-xslt.html
new file mode 100644
index 0000000000..cbf104ac99
--- /dev/null
+++ b/editor/composer/crashtests/removing-editable-xslt.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+  document.getElementById("i").src = "removing-editable-xslt-inner.xhtml";
+  setTimeout(function() { 
+    document.body.removeChild(document.getElementById("i"));
+    document.documentElement.removeAttribute("class");
+  }, 0);
+}
+</script>
+</head>
+<body onload="boom();">
+<iframe id="i"></iframe>
+</body>
+</html>