summaryrefslogtreecommitdiffstats
path: root/layout/forms/crashtests
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
commit36d22d82aa202bb199967e9512281e9a53db42c9 (patch)
tree105e8c98ddea1c1e4784a60a5a6410fa416be2de /layout/forms/crashtests
parentInitial commit. (diff)
downloadfirefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz
firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r--layout/forms/crashtests/1102791.html33
-rw-r--r--layout/forms/crashtests/1140216.html20
-rw-r--r--layout/forms/crashtests/1182414.html17
-rw-r--r--layout/forms/crashtests/1212688.html27
-rw-r--r--layout/forms/crashtests/1228670.xhtml7
-rw-r--r--layout/forms/crashtests/1279354.html21
-rw-r--r--layout/forms/crashtests/1388230-1.html3
-rw-r--r--layout/forms/crashtests/1388230-2.html1
-rw-r--r--layout/forms/crashtests/1405830.html19
-rw-r--r--layout/forms/crashtests/1418477.html4
-rw-r--r--layout/forms/crashtests/1432853.html8
-rw-r--r--layout/forms/crashtests/1460787-1.html7
-rw-r--r--layout/forms/crashtests/1464165-1.html14
-rw-r--r--layout/forms/crashtests/1471157.html11
-rw-r--r--layout/forms/crashtests/1488219.html26
-rw-r--r--layout/forms/crashtests/1600207.html9
-rw-r--r--layout/forms/crashtests/1600367.html8
-rw-r--r--layout/forms/crashtests/1617753.html21
-rw-r--r--layout/forms/crashtests/166750-1.html14
-rw-r--r--layout/forms/crashtests/1679471.html8
-rw-r--r--layout/forms/crashtests/1690166-1.html19
-rw-r--r--layout/forms/crashtests/1690166-2.html19
-rw-r--r--layout/forms/crashtests/200347-1.html8
-rw-r--r--layout/forms/crashtests/203041-1.html24
-rw-r--r--layout/forms/crashtests/213390-1.html23
-rw-r--r--layout/forms/crashtests/258101-1.html18
-rw-r--r--layout/forms/crashtests/266225-1.html7
-rw-r--r--layout/forms/crashtests/310426-1.xhtml9
-rw-r--r--layout/forms/crashtests/310520-1.xhtml19
-rw-r--r--layout/forms/crashtests/315752-1.xhtml21
-rw-r--r--layout/forms/crashtests/317502-1.xhtml13
-rw-r--r--layout/forms/crashtests/321894.html17
-rw-r--r--layout/forms/crashtests/343510-1.html4
-rw-r--r--layout/forms/crashtests/363696-1.xhtml10
-rw-r--r--layout/forms/crashtests/363696-2.html2
-rw-r--r--layout/forms/crashtests/363696-3.html5
-rw-r--r--layout/forms/crashtests/366205-1.html11
-rw-r--r--layout/forms/crashtests/366537-1.xhtml32
-rw-r--r--layout/forms/crashtests/367587-1.html37
-rw-r--r--layout/forms/crashtests/370703-1.html30
-rw-r--r--layout/forms/crashtests/370940-1.html28
-rw-r--r--layout/forms/crashtests/370967.html13
-rw-r--r--layout/forms/crashtests/378369.html19
-rw-r--r--layout/forms/crashtests/380116-1.xhtml11
-rw-r--r--layout/forms/crashtests/382610-1.html11
-rw-r--r--layout/forms/crashtests/383887-1.html20
-rw-r--r--layout/forms/crashtests/386554-1.html14
-rw-r--r--layout/forms/crashtests/388374-1.xhtml22
-rw-r--r--layout/forms/crashtests/388374-2.html25
-rw-r--r--layout/forms/crashtests/393656-1.xhtml13
-rw-r--r--layout/forms/crashtests/393656-2.xhtml22
-rw-r--r--layout/forms/crashtests/399262.html50
-rw-r--r--layout/forms/crashtests/402852-1.html2
-rw-r--r--layout/forms/crashtests/403148-1.html22
-rw-r--r--layout/forms/crashtests/404118-1.html5
-rw-r--r--layout/forms/crashtests/404123-1.html12
-rw-r--r--layout/forms/crashtests/407066.html1
-rw-r--r--layout/forms/crashtests/451316.html7
-rw-r--r--layout/forms/crashtests/455451-1.html17
-rw-r--r--layout/forms/crashtests/457537-1.html17
-rw-r--r--layout/forms/crashtests/457537-2.html17
-rw-r--r--layout/forms/crashtests/498698-1.html6
-rw-r--r--layout/forms/crashtests/513113-1.html6
-rw-r--r--layout/forms/crashtests/538062-1.xhtml20
-rw-r--r--layout/forms/crashtests/570624-1.html15
-rw-r--r--layout/forms/crashtests/578604-1.html17
-rw-r--r--layout/forms/crashtests/590302-1.xhtml4
-rw-r--r--layout/forms/crashtests/626014.xhtml20
-rw-r--r--layout/forms/crashtests/639733.xhtml26
-rw-r--r--layout/forms/crashtests/669767.html14
-rw-r--r--layout/forms/crashtests/682684-binding.xml4
-rw-r--r--layout/forms/crashtests/682684.xhtml3
-rw-r--r--layout/forms/crashtests/865602.html9
-rw-r--r--layout/forms/crashtests/893331.html9
-rw-r--r--layout/forms/crashtests/893332-1.html10
-rw-r--r--layout/forms/crashtests/944198.html9
-rw-r--r--layout/forms/crashtests/949891.xhtml5
-rw-r--r--layout/forms/crashtests/959311.html17
-rw-r--r--layout/forms/crashtests/960277-2.html14
-rw-r--r--layout/forms/crashtests/997709-1.html5
-rw-r--r--layout/forms/crashtests/crashtests.list79
81 files changed, 1246 insertions, 0 deletions
diff --git a/layout/forms/crashtests/1102791.html b/layout/forms/crashtests/1102791.html
new file mode 100644
index 0000000000..0fd64d7553
--- /dev/null
+++ b/layout/forms/crashtests/1102791.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged"><head>
+ <meta charset="utf-8">
+ <title>Testcase for bug 1102791</title>
+ <style type="text/css">
+
+html,body {
+ color:black; background-color:white; font-size:16px; padding:0; margin:0;
+}
+
+button {
+ position: absolute;
+ -moz-appearance: none;
+ background: transparent;
+ padding: 0;
+ border-style:none;
+}
+button::before {
+ position: absolute;
+ content: "::before";
+ width: 10px;
+ height: 200em;
+ border: 1px solid black;
+}
+
+ </style>
+</head>
+<body>
+
+<button></button>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/1140216.html b/layout/forms/crashtests/1140216.html
new file mode 100644
index 0000000000..72612b8b3c
--- /dev/null
+++ b/layout/forms/crashtests/1140216.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+input { -moz-appearance: textfield; }
+
+</style>
+<script>
+
+function boom()
+{
+ window.getComputedStyle(x, "::-moz-number-spin-down").getPropertyValue("color");
+}
+
+</script>
+<body onload="boom();">
+<input type="number" id="x">
+</body>
+</html>
diff --git a/layout/forms/crashtests/1182414.html b/layout/forms/crashtests/1182414.html
new file mode 100644
index 0000000000..3aaa0bbfcc
--- /dev/null
+++ b/layout/forms/crashtests/1182414.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-paged">
+<head>
+<meta charset="UTF-8">
+<style type="text/css">
+#menu { position: fixed; left: 0px; top: 0px; }
+</style>
+</head>
+<body>
+ <svg id="canvas" width="2427" height="2295.5" version="1.1" xmlns="http://www.w3.org/2000/svg"></svg>
+
+<div id="menu">
+ <input id="chooseSize" type="range">
+</div>
+</body>
+</html>
+
diff --git a/layout/forms/crashtests/1212688.html b/layout/forms/crashtests/1212688.html
new file mode 100644
index 0000000000..68262d907f
--- /dev/null
+++ b/layout/forms/crashtests/1212688.html
@@ -0,0 +1,27 @@
+<style type="text/css">
+ optgroup {overflow-x: hidden;}
+</style>
+<select>
+ <optgroup label="optgroup">
+ <option>1</option>
+ <option>2</option>
+ <option>3</option>
+ <option>4</option>
+ <option>5</option>
+ <option>6</option>
+ <option>7</option>
+ <option>8</option>
+ <option>9</option>
+ <option>10</option>
+ <option>11</option>
+ <option>12</option>
+ <option>13</option>
+ <option>14</option>
+ <option>15</option>
+ <option>16</option>
+ <option>17</option>
+ <option>18</option>
+ <option>19</option>
+ <option>20</option>
+</optgroup>
+</select>
diff --git a/layout/forms/crashtests/1228670.xhtml b/layout/forms/crashtests/1228670.xhtml
new file mode 100644
index 0000000000..cc8d309c0e
--- /dev/null
+++ b/layout/forms/crashtests/1228670.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body>
+ <select>
+ <optgroup style="display: list-item; list-style: inside;"></optgroup>
+ </select>
+ </body>
+</html>
diff --git a/layout/forms/crashtests/1279354.html b/layout/forms/crashtests/1279354.html
new file mode 100644
index 0000000000..5013392526
--- /dev/null
+++ b/layout/forms/crashtests/1279354.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<!--
+ Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html class="reftest-paged"><head>
+ <meta charset="utf-8">
+ <title>Testcase for bug 1279354</title>
+</head>
+<body>
+
+<div style="position:fixed"><progress></progress></div>
+1
+<br style="page-break-after: always">
+2
+<br style="page-break-after: always">
+3
+<br style="page-break-after: always">
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/1388230-1.html b/layout/forms/crashtests/1388230-1.html
new file mode 100644
index 0000000000..6662a6ef01
--- /dev/null
+++ b/layout/forms/crashtests/1388230-1.html
@@ -0,0 +1,3 @@
+<cite contenteditable='true'>
+ <input type='color'/>
+</cite>
diff --git a/layout/forms/crashtests/1388230-2.html b/layout/forms/crashtests/1388230-2.html
new file mode 100644
index 0000000000..630031d750
--- /dev/null
+++ b/layout/forms/crashtests/1388230-2.html
@@ -0,0 +1 @@
+<input contenteditable='true' type='color'>
diff --git a/layout/forms/crashtests/1405830.html b/layout/forms/crashtests/1405830.html
new file mode 100644
index 0000000000..c16eeca86a
--- /dev/null
+++ b/layout/forms/crashtests/1405830.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<style>
+#a { display: -webkit-box }
+* { column-width: 0em }
+</style>
+<script>
+function go() {
+ document.body.appendChild(a);
+}
+</script>
+<body onload=go()>
+<select id="a" multiple=""></select>
+0
+Q
+-
+w
+g
+k
diff --git a/layout/forms/crashtests/1418477.html b/layout/forms/crashtests/1418477.html
new file mode 100644
index 0000000000..0be4732d58
--- /dev/null
+++ b/layout/forms/crashtests/1418477.html
@@ -0,0 +1,4 @@
+<head>
+<meta charset="UTF-8">
+<meta http-equiv='content-language' content='onnect-src http://e/%2e%2f%2f%0B%1Bs%EF\u0073%09'>
+<input type='number' value='9'>
diff --git a/layout/forms/crashtests/1432853.html b/layout/forms/crashtests/1432853.html
new file mode 100644
index 0000000000..bc0735c47f
--- /dev/null
+++ b/layout/forms/crashtests/1432853.html
@@ -0,0 +1,8 @@
+<style>
+.c1 { height: 10ch; position: fixed }
+#a { column-width: 0em }
+.c2 { -webkit-transform-style: preserve-3d }
+</style>
+<details id="a" open="">
+<h4 class="c2">
+<select class="c1">
diff --git a/layout/forms/crashtests/1460787-1.html b/layout/forms/crashtests/1460787-1.html
new file mode 100644
index 0000000000..5b330555e2
--- /dev/null
+++ b/layout/forms/crashtests/1460787-1.html
@@ -0,0 +1,7 @@
+<script>
+document.addEventListener("DOMContentLoaded", function(){
+ document.getElementById('a').style.cssText="padding-inline-end:599352cm";
+});
+</script>
+<fieldset>
+<kbd id='a'>
diff --git a/layout/forms/crashtests/1464165-1.html b/layout/forms/crashtests/1464165-1.html
new file mode 100644
index 0000000000..2de4360f3c
--- /dev/null
+++ b/layout/forms/crashtests/1464165-1.html
@@ -0,0 +1,14 @@
+<html>
+ <head>
+ <script>
+ function start () {
+ try { o1 = document.createElementNS('http://www.w3.org/1999/xhtml', 'select') } catch(e) { }
+ try { o2 = document.createElementNS('http://www.w3.org/1999/xhtml', 'style') } catch(e) { }
+ try { document.documentElement.appendChild(o1) } catch(e) { }
+ try { document.documentElement.appendChild(o2) } catch(e) { }
+ try { o2.sheet.insertRule('* { border-left: green; -moz-padding-start: 5% !important; padding: 171798691; -moz-border-end: solid;', 0) } catch(e) { }
+ }
+ document.addEventListener('DOMContentLoaded', start)
+ </script>
+ </head>
+</html>
diff --git a/layout/forms/crashtests/1471157.html b/layout/forms/crashtests/1471157.html
new file mode 100644
index 0000000000..5cde3d0b84
--- /dev/null
+++ b/layout/forms/crashtests/1471157.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<input type="file">
+<script>
+ onload = function() {
+ var input = document.querySelector("input");
+ console.log(input.offsetWidth); // Force layout flush and hence layout box
+ // creation.
+ input.dispatchEvent(new DragEvent("drop"));
+ }
+</script>
+
diff --git a/layout/forms/crashtests/1488219.html b/layout/forms/crashtests/1488219.html
new file mode 100644
index 0000000000..d10d3ef014
--- /dev/null
+++ b/layout/forms/crashtests/1488219.html
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<script>
+function doTest(){
+ document.getElementById('c').appendChild(document.getElementById('b').cloneNode(true));
+ window.frames[0].document.body.appendChild(document.getElementById('a'));
+ document.documentElement.removeAttribute('class');
+}
+document.addEventListener("MozReftestInvalidate", doTest);
+</script>
+
+<iframe hidden></iframe>
+<style>
+:last-of-type {
+ column-count:71;
+ float:left;
+}
+</style>
+<bdo id='a'>A</bdo>
+<address>
+<blockquote>
+</address>
+<footer id='b'>
+</footer>
+<input id='c' type='time'>
+</html>
diff --git a/layout/forms/crashtests/1600207.html b/layout/forms/crashtests/1600207.html
new file mode 100644
index 0000000000..a54a0d0c7d
--- /dev/null
+++ b/layout/forms/crashtests/1600207.html
@@ -0,0 +1,9 @@
+<style>
+:not(isindex) {
+ columns: 0px;
+ margin-top: 1%;
+}
+</style>
+<fieldset>
+<output>
+<br></br>
diff --git a/layout/forms/crashtests/1600367.html b/layout/forms/crashtests/1600367.html
new file mode 100644
index 0000000000..7a481f814e
--- /dev/null
+++ b/layout/forms/crashtests/1600367.html
@@ -0,0 +1,8 @@
+<style>
+FIELDSET {
+ border: 35482ex groove ! important;
+ all: unset;
+}
+</style>
+<i style="font-size-adjust: 113;" readonly>
+<fieldset>
diff --git a/layout/forms/crashtests/1617753.html b/layout/forms/crashtests/1617753.html
new file mode 100644
index 0000000000..213c483451
--- /dev/null
+++ b/layout/forms/crashtests/1617753.html
@@ -0,0 +1,21 @@
+<style>
+ LEGEND, FORM {
+ white-space: pre-wrap;
+ }
+
+ LEGEND {
+ max-height: 0em;
+ }
+
+ FORM {
+ column-width: 1px;
+ }
+
+ FIELDSET {
+ column-width: 1em;
+ }
+</style>
+<form id="htmlvar00005" class="class3">
+ <fieldset>
+ <legend>
+ <!-- COMMENT -->
diff --git a/layout/forms/crashtests/166750-1.html b/layout/forms/crashtests/166750-1.html
new file mode 100644
index 0000000000..d873be1b29
--- /dev/null
+++ b/layout/forms/crashtests/166750-1.html
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head><title>Killer</title></head>
+<body>
+ <form style="overflow: auto;">
+ <select style="position: fixed;">
+ <option>First</option>
+ <option>Second</option>
+ <option>Third</option>
+ </select>
+ </form>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/forms/crashtests/1679471.html b/layout/forms/crashtests/1679471.html
new file mode 100644
index 0000000000..8d2bbc8eb0
--- /dev/null
+++ b/layout/forms/crashtests/1679471.html
@@ -0,0 +1,8 @@
+<style>
+* {
+ rotate: 0.8339rad;
+ inset: 84pt -15742cm 8% ! important;
+ position: fixed;
+}
+</style>
+<button>
diff --git a/layout/forms/crashtests/1690166-1.html b/layout/forms/crashtests/1690166-1.html
new file mode 100644
index 0000000000..85e9b56702
--- /dev/null
+++ b/layout/forms/crashtests/1690166-1.html
@@ -0,0 +1,19 @@
+<style>
+body {
+ columns: 0px;
+}
+* {
+ column-width: 95em;
+ break-before: page;
+}
+</style>
+<script>
+window.onload = () => {
+ document.vlinkColor = "x"
+}
+</script>
+<body>
+<canvas></canvas>
+<form style="-webkit-perspective: 16px">
+<fieldset style="position: fixed">
+<legend>x</legend>
diff --git a/layout/forms/crashtests/1690166-2.html b/layout/forms/crashtests/1690166-2.html
new file mode 100644
index 0000000000..c39d53873c
--- /dev/null
+++ b/layout/forms/crashtests/1690166-2.html
@@ -0,0 +1,19 @@
+<style>
+body {
+ columns: 0px;
+}
+* {
+ column-width: 95em;
+ break-before: page;
+}
+</style>
+<script>
+window.onload = () => {
+ document.vlinkColor = "x"
+}
+</script>
+<body>
+<canvas></canvas>
+<form style="-webkit-perspective: 16px">
+<fieldset style="float: left">
+<legend>x</legend>
diff --git a/layout/forms/crashtests/200347-1.html b/layout/forms/crashtests/200347-1.html
new file mode 100644
index 0000000000..b41ec8365a
--- /dev/null
+++ b/layout/forms/crashtests/200347-1.html
@@ -0,0 +1,8 @@
+<html>
+ <body>
+ <fieldset style="width: 300px; position: fixed">
+ <legend>Crash test</legend>
+ <div style="float: right; background-color: orange; border: 1px solid black">Hello, my name is Inigo Montoya.</div> hello world content is the best content around, I love hello world content to death, especially when it wraps; that just gives me the chills. Anything less than hello world content is uncivilized.
+ </fieldset>
+ </body>
+</html>
diff --git a/layout/forms/crashtests/203041-1.html b/layout/forms/crashtests/203041-1.html
new file mode 100644
index 0000000000..32d95b40e6
--- /dev/null
+++ b/layout/forms/crashtests/203041-1.html
@@ -0,0 +1,24 @@
+<html>
+
+<head></head>
+
+<body>
+<form method="post" action="#" enctype="multipart/form-data" name="content">
+
+ <div id="sshot" style="position:absolute; left:0; top:70; width:600;
+visibility:visible">
+ <input type="file" name="sshot-1" size="20">
+ </div>
+
+ <div id="comment" style="position:absolute; left:0; top:70; width:600;
+visibility:hidden"></div>
+
+ <script language="JavaScript">
+ <!--
+ document.documentElement.offsetHeight;
+ document.getElementById('sshot').style.display = 'none';
+ document.getElementById('comment').style.display = 'none';
+ // -->
+ </script>
+</form>
+</body></html> \ No newline at end of file
diff --git a/layout/forms/crashtests/213390-1.html b/layout/forms/crashtests/213390-1.html
new file mode 100644
index 0000000000..0ff94ec542
--- /dev/null
+++ b/layout/forms/crashtests/213390-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd">
+
+<HTML>
+ <BODY>
+
+ <EMBED>
+
+ <TABLE>
+ <TR>
+ <TD STYLE="FONT: 10px Arial;">
+ <A STYLE="FONT: 11px Arial;">1</A>
+ </TD>
+ </TR>
+ </TABLE>
+
+ <DIV STYLE="POSITION: absolute;">
+ <FORM>
+ <SELECT STYLE="FONT: 11px Arial;">
+ </FORM>
+ </DIV>
+
+ </BODY>
+</HTML>
diff --git a/layout/forms/crashtests/258101-1.html b/layout/forms/crashtests/258101-1.html
new file mode 100644
index 0000000000..245917cbf7
--- /dev/null
+++ b/layout/forms/crashtests/258101-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+ <meta content="text/html; charset=ISO-8859-1"
+ http-equiv="content-type">
+ <title>Crash Testcase</title>
+ <script type="text/javascript">
+function crash()
+{
+ var inp = document.getElementById("theinp");
+ inp.type = "file";
+}
+ </script>
+</head>
+<body onload="crash();">
+<input id="theinp" type="text">
+</body>
+</html>
diff --git a/layout/forms/crashtests/266225-1.html b/layout/forms/crashtests/266225-1.html
new file mode 100644
index 0000000000..c714125dd5
--- /dev/null
+++ b/layout/forms/crashtests/266225-1.html
@@ -0,0 +1,7 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<FIELDSET STYLE="float:right; text-indent:999px;">Test</FIELDSET>
+</BODY>
+</HTML>
diff --git a/layout/forms/crashtests/310426-1.xhtml b/layout/forms/crashtests/310426-1.xhtml
new file mode 100644
index 0000000000..683dba679f
--- /dev/null
+++ b/layout/forms/crashtests/310426-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<body>
+
+<select><span style="position: absolute;" /></select>
+
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/310520-1.xhtml b/layout/forms/crashtests/310520-1.xhtml
new file mode 100644
index 0000000000..6e111832a4
--- /dev/null
+++ b/layout/forms/crashtests/310520-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script><![CDATA[
+
+function init()
+{
+ var select = document.getElementsByTagName("select")[0];
+ select.remove();
+}
+
+window.addEventListener("load", init);
+
+]]></script>
+
+
+</head>
+<body><select><input/></select></body>
+</html>
diff --git a/layout/forms/crashtests/315752-1.xhtml b/layout/forms/crashtests/315752-1.xhtml
new file mode 100644
index 0000000000..66d3d793d7
--- /dev/null
+++ b/layout/forms/crashtests/315752-1.xhtml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html lang="en" xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" xmlns:xml="http://www.w3.org/XML/1998/namespace">
+<head>
+<title>Settings - Unclassified NewsBoard</title>
+
+
+</head>
+<body>
+
+<select name="Language">
+ <option value="" style="clear: right;">
+ Automatic </option>
+ <option value="de" style="clear: right;">
+ <span alt="" style="float: right; margin-top: 1px;"> Deutsch</span> <small>(de)</small> </option>
+ <option value="en" selected="selected" style="clear: right;">
+ <span alt="" style="float: right; margin-top: 1px;"> English</span> <small>(en)</small> </option>
+</select>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/forms/crashtests/317502-1.xhtml b/layout/forms/crashtests/317502-1.xhtml
new file mode 100644
index 0000000000..7ef5f0b4c1
--- /dev/null
+++ b/layout/forms/crashtests/317502-1.xhtml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
+<head>
+ <title>Testcase, bug 317502</title>
+</head>
+<body onload="document.getElementsByTagName('input')[0].style.width='200px'">
+
+<input type="file" style="position: fixed" />
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/321894.html b/layout/forms/crashtests/321894.html
new file mode 100644
index 0000000000..0a82645ba4
--- /dev/null
+++ b/layout/forms/crashtests/321894.html
@@ -0,0 +1,17 @@
+<html><head>
+<title>
+Testcase bug 321894 - ASSERTION: RemovedAsPrimaryFrame called after PreDestroy: 'PR_FALSE'
+</title>
+</head>
+<body>
+This shouldn't assert in a debug build
+<span>
+ <script>var x=document.body.offsetHeight;</script>
+ <div>
+ <span style="float:left;">
+ <input type="text">
+ </span>
+ </div>
+</span>
+</body>
+</html>
diff --git a/layout/forms/crashtests/343510-1.html b/layout/forms/crashtests/343510-1.html
new file mode 100644
index 0000000000..00cb94f211
--- /dev/null
+++ b/layout/forms/crashtests/343510-1.html
@@ -0,0 +1,4 @@
+<select style="position: absolute;">
+<meta>
+<option style="position: absolute;">
+<body style="display: block;">
diff --git a/layout/forms/crashtests/363696-1.xhtml b/layout/forms/crashtests/363696-1.xhtml
new file mode 100644
index 0000000000..19f938deba
--- /dev/null
+++ b/layout/forms/crashtests/363696-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body>
+
+<xul:hbox>
+ <input type="file" />
+</xul:hbox>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/forms/crashtests/363696-2.html b/layout/forms/crashtests/363696-2.html
new file mode 100644
index 0000000000..9d93edd185
--- /dev/null
+++ b/layout/forms/crashtests/363696-2.html
@@ -0,0 +1,2 @@
+<div style="display: -moz-box;">
+<input type="file">
diff --git a/layout/forms/crashtests/363696-3.html b/layout/forms/crashtests/363696-3.html
new file mode 100644
index 0000000000..e1d38076ed
--- /dev/null
+++ b/layout/forms/crashtests/363696-3.html
@@ -0,0 +1,5 @@
+<html><head></head><body>
+
+<span style="display: -moz-box;"><input type="file"><textarea></textarea></span>
+
+</body></html> \ No newline at end of file
diff --git a/layout/forms/crashtests/366205-1.html b/layout/forms/crashtests/366205-1.html
new file mode 100644
index 0000000000..2a3786afe0
--- /dev/null
+++ b/layout/forms/crashtests/366205-1.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+</head>
+<body onload='var yar=document.getElementById("yar"); yar.parentNode.removeChild(yar); document.getElementById("foo").removeAttribute("multiple");'>
+
+<div id="yar">Clicking the button below should not trigger an assertion</div>
+
+<select id="foo" multiple><option>A</option></select>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/forms/crashtests/366537-1.xhtml b/layout/forms/crashtests/366537-1.xhtml
new file mode 100644
index 0000000000..b799cd2ca2
--- /dev/null
+++ b/layout/forms/crashtests/366537-1.xhtml
@@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+
+function boom()
+{
+ var fieldset = document.getElementById("fieldset");
+ var h3 = document.getElementById("h3");
+ var legend = document.getElementById("legend");
+
+ fieldset.appendChild(legend);
+ fieldset.appendChild(h3);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+
+<body onload="setTimeout(boom, 30);">
+
+<legend id="legend">legend</legend>
+
+<h3 id="h3">H3</h3>
+
+<select><option>option<fieldset id="fieldset"></fieldset></option></select>
+
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/367587-1.html b/layout/forms/crashtests/367587-1.html
new file mode 100644
index 0000000000..9bffe569ed
--- /dev/null
+++ b/layout/forms/crashtests/367587-1.html
@@ -0,0 +1,37 @@
+<html class="reftest-wait">
+<head>
+
+<style>
+
+#opt1 { display: table-footer-group; }
+#opt1 { visibility: collapse; }
+#opt1 { overflow: hidden scroll; }
+
+#opt2 { display: table-cell; }
+#opt2 { clear: left; }
+
+select { width: 1px; }
+
+</style>
+
+<script>
+
+function boom()
+{
+ document.getElementById("opt2").style.clear = "none";
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<select multiple>
+<option id="opt1">A</option>
+<option id="opt2">B</option>
+</select>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/370703-1.html b/layout/forms/crashtests/370703-1.html
new file mode 100644
index 0000000000..b447b180b5
--- /dev/null
+++ b/layout/forms/crashtests/370703-1.html
@@ -0,0 +1,30 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("M").style.width = "6em";
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<body onload="setTimeout(boom, 30);">
+
+<div style="position:absolute; top: 50px; left: 50px; border: 2px solid orange;">
+
+ <select>
+ <option id="M">M</option>
+ </select>
+
+ <br>
+
+ <select style="width: 200%">
+ <option style="visibility: collapse; overflow: auto; display: table-footer-group;">X</option>
+ </select>
+
+</div>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/370940-1.html b/layout/forms/crashtests/370940-1.html
new file mode 100644
index 0000000000..ccaeb9643b
--- /dev/null
+++ b/layout/forms/crashtests/370940-1.html
@@ -0,0 +1,28 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+
+function boom1()
+{
+ var newSpan = document.createElementNS(HTML_NS, "span");
+ document.body.appendChild(newSpan);
+
+ setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+ var newDiv = document.createElementNS(HTML_NS, "div");
+ document.getElementById("s").appendChild(newDiv);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="setTimeout(boom1, 30);">
+ <p>العربي</p>
+ <span id="s"></span><input><select></select><isindex><span></span>
+</body>
+</html>
diff --git a/layout/forms/crashtests/370967.html b/layout/forms/crashtests/370967.html
new file mode 100644
index 0000000000..be7854b41c
--- /dev/null
+++ b/layout/forms/crashtests/370967.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+
+<html>
+<head>
+<title>Untitled</title>
+</head>
+<body>
+Focus the input of the isindex, then do a reload, Mozilla should not crash
+<isindex autofocus>
+</label>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/378369.html b/layout/forms/crashtests/378369.html
new file mode 100644
index 0000000000..90327735ef
--- /dev/null
+++ b/layout/forms/crashtests/378369.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<title>Testcase bug - Crash [@ nsEventListenerManager::FixContextMenuEvent] when firing contextmenu event in display: none iframe</title>
+</head>
+<body>
+This page should not crash Mozilla
+<iframe style="display: none;"></iframe>
+
+<script>
+function docontextmenu(i){
+var doc = window.frames[0].document;
+ var ev = doc.createEvent ('MouseEvents');
+ ev.initMouseEvent('contextmenu', true,true, window, 3,5, 5, 400, 400, 0, 0, 0,0,0,null);
+ doc.dispatchEvent(ev);
+}
+setTimeout(docontextmenu,0);
+</script>
+</body>
+</html>
diff --git a/layout/forms/crashtests/380116-1.xhtml b/layout/forms/crashtests/380116-1.xhtml
new file mode 100644
index 0000000000..cb37ff079a
--- /dev/null
+++ b/layout/forms/crashtests/380116-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.getElementById('t').style.display = 'block';">
+
+<table border="1" id="t">
+ <tr>
+ <td><select><option>foopy</option></select></td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/382610-1.html b/layout/forms/crashtests/382610-1.html
new file mode 100644
index 0000000000..9fe9c5b5c1
--- /dev/null
+++ b/layout/forms/crashtests/382610-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="position: absolute">
+ <input type="file" style="position: absolute; -moz-appearance: menulist;">
+</div>
+
+</body>
+</html>
+
diff --git a/layout/forms/crashtests/383887-1.html b/layout/forms/crashtests/383887-1.html
new file mode 100644
index 0000000000..65d4751f7d
--- /dev/null
+++ b/layout/forms/crashtests/383887-1.html
@@ -0,0 +1,20 @@
+<html>
+<body>
+
+<table>
+ <tr>
+ <td>
+ <select>
+ <option style="padding: 200%;">
+ </select>
+ </td>
+ </tr>
+ <tr>
+ <td>
+ <div style="padding: 200%"><span style="float: left; border: 1px solid red;"></span></div>
+ </td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/386554-1.html b/layout/forms/crashtests/386554-1.html
new file mode 100644
index 0000000000..585f1e5b54
--- /dev/null
+++ b/layout/forms/crashtests/386554-1.html
@@ -0,0 +1,14 @@
+<html>
+<head></head>
+
+<body>
+
+<div style="position: absolute"><input id="input" type="file" style="top: 100%"></div>
+
+<script>
+document.body.offsetHeight;
+document.getElementById("input").style.position = "absolute";
+</script>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/388374-1.xhtml b/layout/forms/crashtests/388374-1.xhtml
new file mode 100644
index 0000000000..2a871f68b4
--- /dev/null
+++ b/layout/forms/crashtests/388374-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+ var newText = document.createTextNode('x');
+ document.getElementById("a").parentNode.appendChild(newText);
+}
+</script>
+</head>
+
+<body onload="boom()">
+
+<table border="1">
+ <tr>
+ <td>1</td>
+ <td id="a" style="padding-left: 10%"><select style="padding-left: 20%; bottom: 10%;"><option style="padding: 0 0 10% 20%;">pppp</option></select></td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/388374-2.html b/layout/forms/crashtests/388374-2.html
new file mode 100644
index 0000000000..81918c37cd
--- /dev/null
+++ b/layout/forms/crashtests/388374-2.html
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+ var newDiv = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ newDiv.style.width = "100px";
+ newDiv.style.height = "8px";
+ newDiv.style.background = "lightgreen";
+ document.getElementById("tr").appendChild(newDiv);
+}
+</script>
+</head>
+
+<body onload="boom()">
+
+<table border="1">
+ <tr id="tr">
+ <td></td>
+ <td style="padding-left: 10%"><select style="padding-left: 20%; bottom: 10%;"><option style="padding: 0 0 10% 20%; width: 25px;"></option></select></td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/393656-1.xhtml b/layout/forms/crashtests/393656-1.xhtml
new file mode 100644
index 0000000000..22a9326c5f
--- /dev/null
+++ b/layout/forms/crashtests/393656-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+ <select style="float: right; clear: right;">
+ <option><a style="float: right;"></a></option>
+ <option style="margin: 100%;"></option>
+ <option><div style="clear: both"></div></option>
+ </select>
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/393656-2.xhtml b/layout/forms/crashtests/393656-2.xhtml
new file mode 100644
index 0000000000..7d9adaf20d
--- /dev/null
+++ b/layout/forms/crashtests/393656-2.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+ <div style="overflow: hidden;">
+ <div style="float: right;"><span>XXX</span></div>
+ <select style="float: right; clear: right;">
+ <option><a style="float: right;"></a></option>
+ <option style="margin: 100%;"></option>
+ <option><div style="clear: both"></div></option>
+ </select>
+ <dl style="float: left;"></dl>
+ <div>
+ <div style="float: left;"></div>
+ <div style="display: block; clear: both"></div>
+ <dl style="float: left;"></dl>
+ </div>
+ </div>
+</body>
+
+</html>
diff --git a/layout/forms/crashtests/399262.html b/layout/forms/crashtests/399262.html
new file mode 100644
index 0000000000..77bc0a16db
--- /dev/null
+++ b/layout/forms/crashtests/399262.html
@@ -0,0 +1,50 @@
+<style>
+select::first-letter, option::first-letter { color:green; }
+.block select, .block option{ display:block; }
+.scroll select, .scroll option{ display:block; overflow:hidden; }
+</style>
+
+<select></select>
+<select>F</select>
+<select>Ff</select>
+<select><option>F</select>
+<select><option>Ff</select>
+
+<div class="block">
+<select></select>
+<select>F</select>
+<select>Ff</select>
+<select><option>F</select>
+<select><option>Ff</select>
+</div>
+
+<div class="scroll">
+<select></select>
+<select>F</select>
+<select>Ff</select>
+<select><option>F</select>
+<select><option>Ff</select>
+</div>
+
+<select size=2></select>
+<select size=2>F</select>
+<select size=2>Ff</select>
+<select size=2><option>F</select>
+<select size=2><option>Ff</select>
+
+<div class="block">
+<select size=2></select>
+<select size=2>F</select>
+<select size=2>Ff</select>
+<select size=2><option>F</select>
+<select size=2><option>Ff</select>
+</div>
+
+<div class="scroll">
+<select size=2></select>
+<select size=2>F</select>
+<select size=2>Ff</select>
+<select size=2><option>F</select>
+<select size=2><option>Ff</select>
+</div>
+
diff --git a/layout/forms/crashtests/402852-1.html b/layout/forms/crashtests/402852-1.html
new file mode 100644
index 0000000000..e5ba9adb13
--- /dev/null
+++ b/layout/forms/crashtests/402852-1.html
@@ -0,0 +1,2 @@
+<body style="text-indent: 99999999999999999999px;">
+<fieldset>
diff --git a/layout/forms/crashtests/403148-1.html b/layout/forms/crashtests/403148-1.html
new file mode 100644
index 0000000000..cfb38fdb13
--- /dev/null
+++ b/layout/forms/crashtests/403148-1.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("ce").contentEditable = true;
+ document.documentElement.offsetHeight;
+ document.getElementById("finput").setAttribute("type", "");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<input id="finput" type="file" disabled>
+
+<span id="ce"></span>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/404118-1.html b/layout/forms/crashtests/404118-1.html
new file mode 100644
index 0000000000..40a2ac72b0
--- /dev/null
+++ b/layout/forms/crashtests/404118-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<input type="file" style="position: fixed; height: 0; width: 10px; white-space: normal;">
+</body>
+</html>
diff --git a/layout/forms/crashtests/404123-1.html b/layout/forms/crashtests/404123-1.html
new file mode 100644
index 0000000000..73fbaa363c
--- /dev/null
+++ b/layout/forms/crashtests/404123-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<fieldset>
+<legend style="padding: 0pt 100%;"></legend>
+</fieldset>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/407066.html b/layout/forms/crashtests/407066.html
new file mode 100644
index 0000000000..98c4d0f4ae
--- /dev/null
+++ b/layout/forms/crashtests/407066.html
@@ -0,0 +1 @@
+<div style="display: inline-block; column-count: 2;">text<input type="reset" style="float: right;">
diff --git a/layout/forms/crashtests/451316.html b/layout/forms/crashtests/451316.html
new file mode 100644
index 0000000000..51fda22bc0
--- /dev/null
+++ b/layout/forms/crashtests/451316.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="column-width: 1px;"><select style="height: 12em; display: block;"></select></div>
+<div style="column-width: 1px;"><select multiple style="height: 12em; display: block;"></select></div>
+</body>
+</html>
diff --git a/layout/forms/crashtests/455451-1.html b/layout/forms/crashtests/455451-1.html
new file mode 100644
index 0000000000..fd7d7b6b37
--- /dev/null
+++ b/layout/forms/crashtests/455451-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ window.addEventListener("DOMCharacterDataModified", function(){});
+ document.body.appendChild(document.createElement("isindex"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/forms/crashtests/457537-1.html b/layout/forms/crashtests/457537-1.html
new file mode 100644
index 0000000000..167d3b7076
--- /dev/null
+++ b/layout/forms/crashtests/457537-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ window.addEventListener("DOMAttrModified", function(){});
+ document.body.appendChild(document.createElement("input"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/forms/crashtests/457537-2.html b/layout/forms/crashtests/457537-2.html
new file mode 100644
index 0000000000..626b035b48
--- /dev/null
+++ b/layout/forms/crashtests/457537-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ window.addEventListener("DOMAttrModified", function(){});
+ document.body.appendChild(document.createElement("isindex"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/layout/forms/crashtests/498698-1.html b/layout/forms/crashtests/498698-1.html
new file mode 100644
index 0000000000..fa8e2e17a8
--- /dev/null
+++ b/layout/forms/crashtests/498698-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<select style="height: 3401091640591pc"></select>
+</body>
+</html>
diff --git a/layout/forms/crashtests/513113-1.html b/layout/forms/crashtests/513113-1.html
new file mode 100644
index 0000000000..dc04ef6b6e
--- /dev/null
+++ b/layout/forms/crashtests/513113-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html><body onload="document.body.style.display = 'table';" style="column-count: 1; white-space: pre-line; -moz-appearance: resizer; height: 23698324514pc;">
+
+
+
+<input></body></html>
diff --git a/layout/forms/crashtests/538062-1.xhtml b/layout/forms/crashtests/538062-1.xhtml
new file mode 100644
index 0000000000..431f7ab847
--- /dev/null
+++ b/layout/forms/crashtests/538062-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+ var option = document.getElementsByTagName("option")[0];
+ var b = option.firstChild;
+ option.appendChild(document.createTextNode("\u064A"));
+ document.documentElement.offsetHeight;
+ option.removeChild(b);
+}
+
+]]>
+</script>
+</head>
+
+<body onload="boom();"><select><option>B </option></select></body>
+</html>
diff --git a/layout/forms/crashtests/570624-1.html b/layout/forms/crashtests/570624-1.html
new file mode 100644
index 0000000000..47a2777282
--- /dev/null
+++ b/layout/forms/crashtests/570624-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+ var xt = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'textbox');
+ document.body.appendChild(xt);
+ xt.setAttribute('disabled', "true");
+ xt.setAttribute('value', "foo");
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/layout/forms/crashtests/578604-1.html b/layout/forms/crashtests/578604-1.html
new file mode 100644
index 0000000000..a7e3a870dd
--- /dev/null
+++ b/layout/forms/crashtests/578604-1.html
@@ -0,0 +1,17 @@
+<html class="reftest-paged">
+<head>
+<style>
+ h2 { page-break-before: always; }
+ #reviewer { position: fixed;}
+</style>
+</head>
+
+<body>
+
+<h2>Crash Test Case</h2>
+<div>
+<input id='reviewer'>
+</div>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/590302-1.xhtml b/layout/forms/crashtests/590302-1.xhtml
new file mode 100644
index 0000000000..85d49cb76c
--- /dev/null
+++ b/layout/forms/crashtests/590302-1.xhtml
@@ -0,0 +1,4 @@
+<html class="reftest-paged" xmlns="http://www.w3.org/1999/xhtml" style=" float: left; white-space: pre; ">
+<div style="page-break-before: always;"></div>
+<textarea style="position: fixed;"></textarea>
+</html>
diff --git a/layout/forms/crashtests/626014.xhtml b/layout/forms/crashtests/626014.xhtml
new file mode 100644
index 0000000000..05a2361d3d
--- /dev/null
+++ b/layout/forms/crashtests/626014.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+ document.getElementById("i").selectionEnd;
+ document.getElementById("a").appendChild(document.getElementById("b"));
+}
+
+]]>
+</script>
+</head>
+<body onload="boom();">
+
+<mrow xmlns="http://www.w3.org/1998/Math/MathML" id="a"><mrow id="b"/><input xmlns="http://www.w3.org/1999/xhtml" id="i" /></mrow>
+
+</body>
+</html>
diff --git a/layout/forms/crashtests/639733.xhtml b/layout/forms/crashtests/639733.xhtml
new file mode 100644
index 0000000000..a6d5b01a8d
--- /dev/null
+++ b/layout/forms/crashtests/639733.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function remove(n)
+{
+ n.remove();
+}
+
+function boom()
+{
+
+ document.documentElement.offsetHeight;
+ remove(document.getElementById("s"));
+ remove(document.getElementById("e"));
+ document.documentElement.offsetHeight;
+}
+
+]]>
+</script>
+</head>
+<body onload="boom();">
+<embed id="e" src="data:text/html,A"></embed><span id="s"><div></div></span><isindex/>
+</body>
+</html>
diff --git a/layout/forms/crashtests/669767.html b/layout/forms/crashtests/669767.html
new file mode 100644
index 0000000000..f41a9125c2
--- /dev/null
+++ b/layout/forms/crashtests/669767.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<title>Untitled</title>
+
+
+</head>
+<body>
+<iframe src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%0A%3Ctextarea%3E%3C/textarea%3E%0A%0A%0A%3Cstyle%3E%0A@font-face%20%7B%0A%20%20%20%20%20%20font-family%3A%20%22cutabovetherest%22%3B%0A%20%20%20%20%20%20src%3A%20url%28%22http%3A//www.webpagepublicity.com/free-fonts/a/A%2520Cut%2520Above%2520The%2520Rest.ttf%22%29%3B%0A%7D%20%20%20%20%0A%0A%3C/style%3E%0A%0A%3Coptgroup%20contenteditable%3D%22true%22%20style%3D%22display%3A%20inline%3B%22%3E%3C/optgroup%3E%0A%0A%3C/body%3E%3C/html%3E"></iframe>
+<script>
+
+
+</script>
+</body>
+</html>
diff --git a/layout/forms/crashtests/682684-binding.xml b/layout/forms/crashtests/682684-binding.xml
new file mode 100644
index 0000000000..910eec33c8
--- /dev/null
+++ b/layout/forms/crashtests/682684-binding.xml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<style>html::before { content:"b"; }</style>
+<input contenteditable="true" spellcheck="true"/>
+</html> \ No newline at end of file
diff --git a/layout/forms/crashtests/682684.xhtml b/layout/forms/crashtests/682684.xhtml
new file mode 100644
index 0000000000..2b7b2c83fa
--- /dev/null
+++ b/layout/forms/crashtests/682684.xhtml
@@ -0,0 +1,3 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<span style="mask: url(682684-binding.xml#a);"/>
+</html>
diff --git a/layout/forms/crashtests/865602.html b/layout/forms/crashtests/865602.html
new file mode 100644
index 0000000000..f560e7a385
--- /dev/null
+++ b/layout/forms/crashtests/865602.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html><body>
+
+<div style="column-count: 2;"><fieldset style="transform-style: preserve-3d;"><fieldset style="white-space: pre-line; position: fixed;"><div style="position: fixed;">
+
+
+</div></fieldset></fieldset></div>
+
+</body></html>
diff --git a/layout/forms/crashtests/893331.html b/layout/forms/crashtests/893331.html
new file mode 100644
index 0000000000..86a01f363e
--- /dev/null
+++ b/layout/forms/crashtests/893331.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<input type="range" min="10000.00000000003">
+</body>
+</html>
diff --git a/layout/forms/crashtests/893332-1.html b/layout/forms/crashtests/893332-1.html
new file mode 100644
index 0000000000..1cd17c0b1c
--- /dev/null
+++ b/layout/forms/crashtests/893332-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <meta charset="UTF-8">
+ </head>
+ <body>
+ <input min="-10" max="10" step="0.1" type="range" value="-5"/>
+ <input max="50" min="10" step="2" type="range" value="7"/>
+ </body>
+</html>
diff --git a/layout/forms/crashtests/944198.html b/layout/forms/crashtests/944198.html
new file mode 100644
index 0000000000..0da7bc54dd
--- /dev/null
+++ b/layout/forms/crashtests/944198.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body onload="c.removeAttribute('type'); c.removeAttribute('value');">
+<input id="c" type="color">
+</body>
+</html>
diff --git a/layout/forms/crashtests/949891.xhtml b/layout/forms/crashtests/949891.xhtml
new file mode 100644
index 0000000000..8fbfe1e422
--- /dev/null
+++ b/layout/forms/crashtests/949891.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<input type="number"> </input>
+</body>
+</html>
diff --git a/layout/forms/crashtests/959311.html b/layout/forms/crashtests/959311.html
new file mode 100644
index 0000000000..1b4817221b
--- /dev/null
+++ b/layout/forms/crashtests/959311.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-paged">
+<head>
+<meta charset="utf-8">
+<style type="text/css">
+@page { size:5in 3in; margin:0in; }
+div { height: 2.5in; }
+select { height: 0.5in; display:block; padding:20px; page-break-inside:initial; }
+</style>
+</head>
+<body>
+ <div></div>
+ <select>
+ <option>Text</option>
+ </select>
+ </body>
+</html>
diff --git a/layout/forms/crashtests/960277-2.html b/layout/forms/crashtests/960277-2.html
new file mode 100644
index 0000000000..ea771ae798
--- /dev/null
+++ b/layout/forms/crashtests/960277-2.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML>
+<style>
+#d { overflow:scroll; width:200px; height:200px; background:yellow; }
+#d2 { right:0; width:100px; height:100px; background:purple; }
+</style>
+<fieldset id="d">
+ <div id="d2"></div>
+</fieldset>
+<script>
+d.getBoundingClientRect();
+d.style.transform = "translateX(100px)";
+d.getBoundingClientRect();
+d2.style.position = "absolute";
+</script>
diff --git a/layout/forms/crashtests/997709-1.html b/layout/forms/crashtests/997709-1.html
new file mode 100644
index 0000000000..baf5d0b14b
--- /dev/null
+++ b/layout/forms/crashtests/997709-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged"><body><div style="position: fixed;">
+<div style="page-break-after: always"></div>
+<select style="display:flex; position: fixed;"><option>A</select>
+</div></body></html>
diff --git a/layout/forms/crashtests/crashtests.list b/layout/forms/crashtests/crashtests.list
new file mode 100644
index 0000000000..5a8d7529b2
--- /dev/null
+++ b/layout/forms/crashtests/crashtests.list
@@ -0,0 +1,79 @@
+load 166750-1.html
+load 200347-1.html
+load 203041-1.html
+load 213390-1.html
+load 258101-1.html
+load 266225-1.html
+load 310426-1.xhtml
+load 310520-1.xhtml
+load 315752-1.xhtml
+load 317502-1.xhtml
+load 321894.html
+load 343510-1.html
+load chrome://reftest/content/crashtests/layout/forms/crashtests/363696-1.xhtml
+load 363696-2.html
+load 363696-3.html
+load 366205-1.html
+load 366537-1.xhtml
+load 367587-1.html
+load 370703-1.html
+load 370940-1.html
+load 370967.html
+load 378369.html
+load 380116-1.xhtml
+load 382610-1.html
+load 383887-1.html
+load 386554-1.html
+load 388374-1.xhtml
+load 388374-2.html
+load 393656-1.xhtml
+load 393656-2.xhtml
+load 399262.html
+load 402852-1.html
+load 403148-1.html
+load 404118-1.html
+load 404123-1.html
+load 407066.html
+load 451316.html
+load 455451-1.html
+load 457537-1.html
+load 457537-2.html
+load 498698-1.html
+load 513113-1.html
+load 538062-1.xhtml
+load 570624-1.html
+asserts(1) load 578604-1.html # bug 584564
+asserts(4-7) load 590302-1.xhtml # bug 584564
+load 626014.xhtml
+load 639733.xhtml
+load 669767.html
+load 682684.xhtml
+load 865602.html
+load 893331.html
+load 893332-1.html
+load 944198.html
+load 949891.xhtml
+load 959311.html
+load 960277-2.html
+load 997709-1.html
+load 1102791.html
+load 1140216.html
+load 1182414.html
+load 1212688.html
+load 1228670.xhtml
+load 1279354.html
+load 1388230-1.html
+load 1388230-2.html
+load 1405830.html
+load 1418477.html
+load 1432853.html
+asserts(1-4) load 1460787-1.html
+load 1464165-1.html
+load 1471157.html
+load 1488219.html
+load 1600207.html
+load 1600367.html
+load 1617753.html
+load 1679471.html
+load 1690166-1.html
+load 1690166-2.html