From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 7 Apr 2024 21:33:14 +0200
Subject: Adding upstream version 115.7.0esr.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 dom/base/crashtests/1024428-1.html                 |  11 +
 dom/base/crashtests/1027461-1.html                 |   9 +
 dom/base/crashtests/1027461-inner.xhtml            |   2 +
 dom/base/crashtests/1029710.html                   |  11 +
 dom/base/crashtests/1154598.xhtml                  |   9 +
 dom/base/crashtests/1157995.html                   |   9 +
 dom/base/crashtests/1158412.html                   |  22 ++
 dom/base/crashtests/116848-1.html                  |  30 +++
 dom/base/crashtests/1181619.html                   |  14 ++
 dom/base/crashtests/1228882.html                   |   6 +
 dom/base/crashtests/1230422.html                   |  28 +++
 dom/base/crashtests/1251361.html                   |  33 +++
 dom/base/crashtests/1281715.html                   |  24 ++
 dom/base/crashtests/1291535-iframe.html            |   4 +
 dom/base/crashtests/1291535.html                   |   1 +
 dom/base/crashtests/1304437.html                   |  13 +
 dom/base/crashtests/1324209.html                   |  27 +++
 dom/base/crashtests/1324500.html                   |   4 +
 dom/base/crashtests/1326194-1.html                 |  20 ++
 dom/base/crashtests/1326194-2.html                 |  20 ++
 dom/base/crashtests/1332939.html                   |  16 ++
 dom/base/crashtests/1341693.html                   |  13 +
 dom/base/crashtests/1352453.html                   |  22 ++
 dom/base/crashtests/1353529-inner.html             |  12 +
 dom/base/crashtests/1353529.xhtml                  |   8 +
 dom/base/crashtests/1368327-iframe.html            |  10 +
 dom/base/crashtests/1368327.html                   |  24 ++
 dom/base/crashtests/1369363.xhtml                  |  16 ++
 dom/base/crashtests/1370072.html                   |  18 ++
 dom/base/crashtests/1370737.html                   |  41 ++++
 dom/base/crashtests/1370968-inner.xhtml            |   6 +
 dom/base/crashtests/1370968.html                   |  14 ++
 dom/base/crashtests/1373750.html                   |  14 ++
 dom/base/crashtests/1377826.html                   |   5 +
 dom/base/crashtests/1383478.html                   |  49 ++++
 dom/base/crashtests/1383780.html                   |  21 ++
 dom/base/crashtests/1385272-1.html                 |  29 +++
 dom/base/crashtests/1393806.html                   |  17 ++
 dom/base/crashtests/1396466.html                   |  20 ++
 dom/base/crashtests/1397795.html                   |  23 ++
 dom/base/crashtests/1400701.html                   |  15 ++
 dom/base/crashtests/1403377.html                   |  18 ++
 dom/base/crashtests/1405771.html                   |  20 ++
 dom/base/crashtests/1406109-1.html                 |  10 +
 dom/base/crashtests/1411473.html                   |  12 +
 dom/base/crashtests/1413815.html                   |  20 ++
 dom/base/crashtests/1419799.html                   |  17 ++
 dom/base/crashtests/1419902.html                   |  23 ++
 dom/base/crashtests/1422883.html                   |  10 +
 dom/base/crashtests/1428053.html                   |  23 ++
 dom/base/crashtests/1441029.html                   |   1 +
 dom/base/crashtests/1445670.html                   |  20 ++
 dom/base/crashtests/1449601.html                   |  16 ++
 dom/base/crashtests/1458016.html                   |  12 +
 dom/base/crashtests/1459688.html                   |   6 +
 dom/base/crashtests/1460794.html                   |  19 ++
 dom/base/crashtests/1462548.html                   |  13 +
 dom/base/crashtests/149320-1.html                  |  16 ++
 dom/base/crashtests/1505811.html                   |  24 ++
 dom/base/crashtests/1505875.html                   |  10 +
 dom/base/crashtests/1508845.html                   |  17 ++
 dom/base/crashtests/1516289.html                   |  14 ++
 dom/base/crashtests/1516560.html                   |   3 +
 dom/base/crashtests/1517025.html                   |   5 +
 dom/base/crashtests/1528675.html                   |  28 +++
 dom/base/crashtests/1529203-1.html                 |  17 ++
 dom/base/crashtests/1529203-2.html                 |  21 ++
 dom/base/crashtests/1529203-3.html                 |  21 ++
 dom/base/crashtests/1555786.html                   |  23 ++
 dom/base/crashtests/1566310.html                   |  24 ++
 dom/base/crashtests/1577191.html                   |  15 ++
 dom/base/crashtests/1588259.html                   |  21 ++
 dom/base/crashtests/1611853.html                   |  19 ++
 dom/base/crashtests/1619322.html                   |  17 ++
 dom/base/crashtests/1623918.html                   |  16 ++
 dom/base/crashtests/1656925.html                   |  18 ++
 dom/base/crashtests/1665792.html                   |  13 +
 dom/base/crashtests/1681729-inner1.html            |   1 +
 dom/base/crashtests/1681729-inner2.html            |   1 +
 dom/base/crashtests/1681729.html                   |  30 +++
 dom/base/crashtests/1693049.html                   |  30 +++
 dom/base/crashtests/1697256.html                   |  14 ++
 dom/base/crashtests/1697525.html                   |   6 +
 dom/base/crashtests/1700237.html                   |  31 +++
 dom/base/crashtests/1712198.html                   |   9 +
 dom/base/crashtests/1728670-1-child.html           |  12 +
 dom/base/crashtests/1728670-1.html                 |   3 +
 dom/base/crashtests/1757923.html                   |  22 ++
 dom/base/crashtests/1766472.html                   |  20 ++
 dom/base/crashtests/1780790.html                   |  15 ++
 dom/base/crashtests/1811939.html                   |   7 +
 dom/base/crashtests/1822717-module.js              |  56 +++++
 dom/base/crashtests/1822717.html                   |   1 +
 dom/base/crashtests/1838484.html                   |   9 +
 dom/base/crashtests/205225-1.html                  |   9 +
 dom/base/crashtests/231475-1.html                  |  12 +
 dom/base/crashtests/244933-1.html                  |  13 +
 dom/base/crashtests/275912-1.html                  |   2 +
 dom/base/crashtests/293388-1.html                  |  26 ++
 dom/base/crashtests/325730-1.html                  |  27 +++
 dom/base/crashtests/326618-1.html                  |  14 ++
 dom/base/crashtests/326646-1.html                  |  22 ++
 dom/base/crashtests/326865-1.html                  |  12 +
 dom/base/crashtests/327571-1.html                  |  22 ++
 dom/base/crashtests/327694.html                    |  17 ++
 dom/base/crashtests/327695-1.html                  |  10 +
 dom/base/crashtests/329481-1.xhtml                 |  12 +
 dom/base/crashtests/336381-1.xhtml                 |  29 +++
 dom/base/crashtests/336715-1.xhtml                 |  40 +++
 dom/base/crashtests/338391-1.xhtml                 |  33 +++
 dom/base/crashtests/338674-1.xhtml                 |  36 +++
 dom/base/crashtests/340733-1.html                  |  28 +++
 dom/base/crashtests/343730-1.xhtml                 |  35 +++
 dom/base/crashtests/343850-1.xhtml                 |  28 +++
 dom/base/crashtests/343889-1.html                  |  18 ++
 dom/base/crashtests/344434-1.xhtml                 |  24 ++
 dom/base/crashtests/344882-1.html                  |  33 +++
 dom/base/crashtests/345837-1.xhtml                 |  35 +++
 dom/base/crashtests/346381-1.html                  |  16 ++
 dom/base/crashtests/349355-1.html                  |  41 ++++
 dom/base/crashtests/359432-1.xhtml                 |  27 +++
 dom/base/crashtests/360599-1.html                  |  25 ++
 dom/base/crashtests/366200-1.xhtml                 |  34 +++
 dom/base/crashtests/369219-1.xhtml                 |  19 ++
 dom/base/crashtests/369413-1.html                  |  12 +
 dom/base/crashtests/371124-1-inner.html            |  21 ++
 dom/base/crashtests/371124-1.html                  |   9 +
 dom/base/crashtests/371124-2-inner.html            |  10 +
 dom/base/crashtests/371124-2.html                  |   9 +
 dom/base/crashtests/371466-1.xhtml                 |  24 ++
 dom/base/crashtests/372554-1.html                  |  22 ++
 dom/base/crashtests/375399-1-inner.xhtml           |  12 +
 dom/base/crashtests/375399-1.html                  |  11 +
 dom/base/crashtests/377360-1.xhtml                 |  19 ++
 dom/base/crashtests/377960-1.html                  |  12 +
 dom/base/crashtests/377960-2.html                  |   7 +
 dom/base/crashtests/384663-1-inner.xhtml           |  18 ++
 dom/base/crashtests/384663-1.html                  |   9 +
 dom/base/crashtests/386000-1.html                  |  36 +++
 dom/base/crashtests/386794-1.html                  |  17 ++
 dom/base/crashtests/387460-1-inner.xhtml           |  22 ++
 dom/base/crashtests/387460-1.html                  |   9 +
 dom/base/crashtests/399712-1.html                  |  29 +++
 dom/base/crashtests/400763-1.html                  |   7 +
 dom/base/crashtests/407818.html                    |   5 +
 dom/base/crashtests/410860-1.xml                   |   8 +
 dom/base/crashtests/411882-1.xhtml                 |   1 +
 dom/base/crashtests/416734-1.html                  |  13 +
 dom/base/crashtests/417852-1.html                  |  13 +
 dom/base/crashtests/418928-1.html                  |  10 +
 dom/base/crashtests/420620-1.html                  |  29 +++
 dom/base/crashtests/424276-1.html                  |  17 ++
 dom/base/crashtests/426987-1.html                  |   7 +
 dom/base/crashtests/43040-1.html                   |  19 ++
 dom/base/crashtests/439206-1.html                  |  19 ++
 dom/base/crashtests/443538-1.svg                   |   7 +
 dom/base/crashtests/448615-1.html                  |  13 +
 dom/base/crashtests/450383-1.html                  |   9 +
 dom/base/crashtests/450385-1.html                  |  11 +
 dom/base/crashtests/458637-1-inner.xhtml           |   4 +
 dom/base/crashtests/458637-1.html                  |  29 +++
 dom/base/crashtests/462947.html                    |  13 +
 dom/base/crashtests/467392.html                    |   4 +
 dom/base/crashtests/472593-1.html                  |   7 +
 dom/base/crashtests/474041-1.svg                   |  17 ++
 dom/base/crashtests/476526.html                    |  10 +
 dom/base/crashtests/483818-1.html                  |  14 ++
 dom/base/crashtests/490760-1.xhtml                 |  25 ++
 dom/base/crashtests/493281-1.html                  |   7 +
 dom/base/crashtests/493281-2.html                  |  12 +
 dom/base/crashtests/494810-1.html                  |  15 ++
 dom/base/crashtests/499006-1.html                  |  26 ++
 dom/base/crashtests/499006-2.html                  |  35 +++
 dom/base/crashtests/502617.html                    |  13 +
 dom/base/crashtests/504224.html                    |  29 +++
 dom/base/crashtests/509536-1.html                  |  17 ++
 dom/base/crashtests/522516-1.html                  |  10 +
 dom/base/crashtests/529670.html                    |  18 ++
 dom/base/crashtests/535926-1.html                  |  28 +++
 dom/base/crashtests/543645.html                    |  14 ++
 dom/base/crashtests/551631-1.html                  |  22 ++
 dom/base/crashtests/552651.html                    |  25 ++
 dom/base/crashtests/552651.xml                     |   2 +
 dom/base/crashtests/554230-1.xhtml                 |  15 ++
 dom/base/crashtests/558973.html                    |  17 ++
 dom/base/crashtests/564079-1.html                  |  10 +
 dom/base/crashtests/564114.html                    |  11 +
 dom/base/crashtests/565125-1.html                  |  27 +++
 dom/base/crashtests/575462.svg                     |  27 +++
 dom/base/crashtests/582601.html                    |  12 +
 dom/base/crashtests/590395-1.html                  |   5 +
 dom/base/crashtests/593302-1.html                  |  29 +++
 dom/base/crashtests/593302-2.html                  |  12 +
 dom/base/crashtests/595606-1.html                  |  17 ++
 dom/base/crashtests/595606-2.html                  |  18 ++
 dom/base/crashtests/601247.html                    |   8 +
 dom/base/crashtests/603531.html                    |  18 ++
 dom/base/crashtests/604262-1.html                  |   8 +
 dom/base/crashtests/605672-1.svg                   |  17 ++
 dom/base/crashtests/606729-1.html                  |   1 +
 dom/base/crashtests/607222.html                    |  21 ++
 dom/base/crashtests/609560-1.xhtml                 |  31 +++
 dom/base/crashtests/610571-1.html                  |  26 ++
 dom/base/crashtests/612018-1.html                  |  21 ++
 dom/base/crashtests/628599-1.html                  |  31 +++
 dom/base/crashtests/637116.html                    |  29 +++
 dom/base/crashtests/637214-1.svg                   |  26 ++
 dom/base/crashtests/637214-2.svg                   |  26 ++
 dom/base/crashtests/642022-1.html                  |   4 +
 dom/base/crashtests/646184.html                    |  17 ++
 dom/base/crashtests/658845-1.svg                   |   3 +
 dom/base/crashtests/666869.html                    |  17 ++
 dom/base/crashtests/667336-1.html                  |   4 +
 dom/base/crashtests/675516.xhtml                   |  31 +++
 dom/base/crashtests/675621-1.html                  |   7 +
 dom/base/crashtests/677194.html                    |   6 +
 dom/base/crashtests/679459.html                    |  21 ++
 dom/base/crashtests/679689-1.html                  |   2 +
 dom/base/crashtests/682463.html                    |  20 ++
 dom/base/crashtests/693212.xhtml                   |  16 ++
 dom/base/crashtests/693811-1.html                  |  14 ++
 dom/base/crashtests/693811-2.html                  |  16 ++
 dom/base/crashtests/693811-3.html                  |   4 +
 dom/base/crashtests/693894.html                    |   8 +
 dom/base/crashtests/695867.html                    |   9 +
 dom/base/crashtests/697643.html                    |   5 +
 dom/base/crashtests/698974-1.html                  |   4 +
 dom/base/crashtests/700090-1.html                  |  32 +++
 dom/base/crashtests/700090-2.html                  |  29 +++
 dom/base/crashtests/700512-worker.js               |   7 +
 dom/base/crashtests/700512.html                    |  11 +
 dom/base/crashtests/706283-1.html                  |   6 +
 dom/base/crashtests/709384.html                    |   5 +
 dom/base/crashtests/709954.html                    |  21 ++
 dom/base/crashtests/713417-1.html                  |  23 ++
 dom/base/crashtests/713417-2.html                  |  26 ++
 dom/base/crashtests/715056.html                    |  21 ++
 dom/base/crashtests/729431-1.xhtml                 |  36 +++
 dom/base/crashtests/741163-1.html                  |   7 +
 dom/base/crashtests/745495.html                    |  19 ++
 dom/base/crashtests/752226-1.html                  |   4 +
 dom/base/crashtests/752226-2.html                  |   4 +
 dom/base/crashtests/766426.html                    |  32 +++
 dom/base/crashtests/771639.html                    |  16 ++
 dom/base/crashtests/786854.html                    |   4 +
 dom/base/crashtests/815043.html                    |   8 +
 dom/base/crashtests/815276.html                    |   6 +
 dom/base/crashtests/815477.html                    |  15 ++
 dom/base/crashtests/815500.html                    |  14 ++
 dom/base/crashtests/816253.html                    |  31 +++
 dom/base/crashtests/819014.html                    |  22 ++
 dom/base/crashtests/822723.html                    |  20 ++
 dom/base/crashtests/824719.html                    |  26 ++
 dom/base/crashtests/827190.html                    |  13 +
 dom/base/crashtests/828054.html                    |  19 ++
 dom/base/crashtests/828903-iframe.html             |  46 ++++
 dom/base/crashtests/828903.html                    |  28 +++
 dom/base/crashtests/829428.html                    |   8 +
 dom/base/crashtests/830098.html                    |  14 ++
 dom/base/crashtests/831287.html                    |  11 +
 dom/base/crashtests/832644.html                    |   8 +
 dom/base/crashtests/836890.html                    |  19 ++
 dom/base/crashtests/838489-1.html                  |  11 +
 dom/base/crashtests/838489-2.html                  |  16 ++
 dom/base/crashtests/841205.html                    |  25 ++
 dom/base/crashtests/844404.html                    |  23 ++
 dom/base/crashtests/845093-1.html                  |  10 +
 dom/base/crashtests/845093-2.html                  |   7 +
 dom/base/crashtests/847127.html                    |  19 ++
 dom/base/crashtests/849601.html                    |  38 +++
 dom/base/crashtests/849727.html                    |   9 +
 dom/base/crashtests/849732.html                    |  18 ++
 dom/base/crashtests/851353-1.html                  |  25 ++
 dom/base/crashtests/852381.html                    |  19 ++
 dom/base/crashtests/863950.html                    |  18 ++
 dom/base/crashtests/864448.html                    |  22 ++
 dom/base/crashtests/886213.html                    |  22 ++
 dom/base/crashtests/898906.html                    |  14 ++
 dom/base/crashtests/90613-1.html                   |   7 +
 dom/base/crashtests/930250.html                    |   8 +
 dom/base/crashtests/942979.html                    |  42 ++++
 dom/base/crashtests/973401.html                    |  20 ++
 dom/base/crashtests/978646.html                    |  15 ++
 dom/base/crashtests/crashtests.list                | 270 +++++++++++++++++++++
 ...Source_invalid_scheme_worker_shutdown-worker.js |   4 +
 ...eventSource_invalid_scheme_worker_shutdown.html |  36 +++
 dom/base/crashtests/file_504224.html               |   7 +
 dom/base/crashtests/module-with-syntax-error.js    |   1 +
 .../structured_clone_container_throws.html         |   9 +
 .../crashtests/xhr-with-pagehide-1-helper.html     |  21 ++
 dom/base/crashtests/xhr-with-pagehide-1.html       |  21 ++
 dom/base/crashtests/xhr_empty_datauri.html         |   5 +
 dom/base/crashtests/xhr_html_nullresponse.html     |   5 +
 293 files changed, 5179 insertions(+)
 create mode 100644 dom/base/crashtests/1024428-1.html
 create mode 100644 dom/base/crashtests/1027461-1.html
 create mode 100644 dom/base/crashtests/1027461-inner.xhtml
 create mode 100644 dom/base/crashtests/1029710.html
 create mode 100644 dom/base/crashtests/1154598.xhtml
 create mode 100644 dom/base/crashtests/1157995.html
 create mode 100644 dom/base/crashtests/1158412.html
 create mode 100644 dom/base/crashtests/116848-1.html
 create mode 100644 dom/base/crashtests/1181619.html
 create mode 100644 dom/base/crashtests/1228882.html
 create mode 100644 dom/base/crashtests/1230422.html
 create mode 100644 dom/base/crashtests/1251361.html
 create mode 100644 dom/base/crashtests/1281715.html
 create mode 100644 dom/base/crashtests/1291535-iframe.html
 create mode 100644 dom/base/crashtests/1291535.html
 create mode 100644 dom/base/crashtests/1304437.html
 create mode 100644 dom/base/crashtests/1324209.html
 create mode 100644 dom/base/crashtests/1324500.html
 create mode 100644 dom/base/crashtests/1326194-1.html
 create mode 100644 dom/base/crashtests/1326194-2.html
 create mode 100644 dom/base/crashtests/1332939.html
 create mode 100644 dom/base/crashtests/1341693.html
 create mode 100644 dom/base/crashtests/1352453.html
 create mode 100644 dom/base/crashtests/1353529-inner.html
 create mode 100644 dom/base/crashtests/1353529.xhtml
 create mode 100644 dom/base/crashtests/1368327-iframe.html
 create mode 100644 dom/base/crashtests/1368327.html
 create mode 100644 dom/base/crashtests/1369363.xhtml
 create mode 100644 dom/base/crashtests/1370072.html
 create mode 100644 dom/base/crashtests/1370737.html
 create mode 100644 dom/base/crashtests/1370968-inner.xhtml
 create mode 100644 dom/base/crashtests/1370968.html
 create mode 100644 dom/base/crashtests/1373750.html
 create mode 100644 dom/base/crashtests/1377826.html
 create mode 100644 dom/base/crashtests/1383478.html
 create mode 100644 dom/base/crashtests/1383780.html
 create mode 100644 dom/base/crashtests/1385272-1.html
 create mode 100644 dom/base/crashtests/1393806.html
 create mode 100644 dom/base/crashtests/1396466.html
 create mode 100644 dom/base/crashtests/1397795.html
 create mode 100644 dom/base/crashtests/1400701.html
 create mode 100644 dom/base/crashtests/1403377.html
 create mode 100644 dom/base/crashtests/1405771.html
 create mode 100644 dom/base/crashtests/1406109-1.html
 create mode 100644 dom/base/crashtests/1411473.html
 create mode 100644 dom/base/crashtests/1413815.html
 create mode 100644 dom/base/crashtests/1419799.html
 create mode 100644 dom/base/crashtests/1419902.html
 create mode 100644 dom/base/crashtests/1422883.html
 create mode 100644 dom/base/crashtests/1428053.html
 create mode 100644 dom/base/crashtests/1441029.html
 create mode 100644 dom/base/crashtests/1445670.html
 create mode 100644 dom/base/crashtests/1449601.html
 create mode 100644 dom/base/crashtests/1458016.html
 create mode 100644 dom/base/crashtests/1459688.html
 create mode 100644 dom/base/crashtests/1460794.html
 create mode 100644 dom/base/crashtests/1462548.html
 create mode 100644 dom/base/crashtests/149320-1.html
 create mode 100644 dom/base/crashtests/1505811.html
 create mode 100644 dom/base/crashtests/1505875.html
 create mode 100644 dom/base/crashtests/1508845.html
 create mode 100644 dom/base/crashtests/1516289.html
 create mode 100644 dom/base/crashtests/1516560.html
 create mode 100644 dom/base/crashtests/1517025.html
 create mode 100644 dom/base/crashtests/1528675.html
 create mode 100644 dom/base/crashtests/1529203-1.html
 create mode 100644 dom/base/crashtests/1529203-2.html
 create mode 100644 dom/base/crashtests/1529203-3.html
 create mode 100644 dom/base/crashtests/1555786.html
 create mode 100644 dom/base/crashtests/1566310.html
 create mode 100644 dom/base/crashtests/1577191.html
 create mode 100644 dom/base/crashtests/1588259.html
 create mode 100644 dom/base/crashtests/1611853.html
 create mode 100644 dom/base/crashtests/1619322.html
 create mode 100644 dom/base/crashtests/1623918.html
 create mode 100644 dom/base/crashtests/1656925.html
 create mode 100644 dom/base/crashtests/1665792.html
 create mode 100644 dom/base/crashtests/1681729-inner1.html
 create mode 100644 dom/base/crashtests/1681729-inner2.html
 create mode 100644 dom/base/crashtests/1681729.html
 create mode 100644 dom/base/crashtests/1693049.html
 create mode 100644 dom/base/crashtests/1697256.html
 create mode 100644 dom/base/crashtests/1697525.html
 create mode 100644 dom/base/crashtests/1700237.html
 create mode 100644 dom/base/crashtests/1712198.html
 create mode 100644 dom/base/crashtests/1728670-1-child.html
 create mode 100644 dom/base/crashtests/1728670-1.html
 create mode 100644 dom/base/crashtests/1757923.html
 create mode 100644 dom/base/crashtests/1766472.html
 create mode 100644 dom/base/crashtests/1780790.html
 create mode 100644 dom/base/crashtests/1811939.html
 create mode 100644 dom/base/crashtests/1822717-module.js
 create mode 100644 dom/base/crashtests/1822717.html
 create mode 100644 dom/base/crashtests/1838484.html
 create mode 100644 dom/base/crashtests/205225-1.html
 create mode 100644 dom/base/crashtests/231475-1.html
 create mode 100644 dom/base/crashtests/244933-1.html
 create mode 100644 dom/base/crashtests/275912-1.html
 create mode 100644 dom/base/crashtests/293388-1.html
 create mode 100644 dom/base/crashtests/325730-1.html
 create mode 100644 dom/base/crashtests/326618-1.html
 create mode 100644 dom/base/crashtests/326646-1.html
 create mode 100644 dom/base/crashtests/326865-1.html
 create mode 100644 dom/base/crashtests/327571-1.html
 create mode 100644 dom/base/crashtests/327694.html
 create mode 100644 dom/base/crashtests/327695-1.html
 create mode 100644 dom/base/crashtests/329481-1.xhtml
 create mode 100644 dom/base/crashtests/336381-1.xhtml
 create mode 100644 dom/base/crashtests/336715-1.xhtml
 create mode 100644 dom/base/crashtests/338391-1.xhtml
 create mode 100644 dom/base/crashtests/338674-1.xhtml
 create mode 100644 dom/base/crashtests/340733-1.html
 create mode 100644 dom/base/crashtests/343730-1.xhtml
 create mode 100644 dom/base/crashtests/343850-1.xhtml
 create mode 100644 dom/base/crashtests/343889-1.html
 create mode 100644 dom/base/crashtests/344434-1.xhtml
 create mode 100644 dom/base/crashtests/344882-1.html
 create mode 100644 dom/base/crashtests/345837-1.xhtml
 create mode 100644 dom/base/crashtests/346381-1.html
 create mode 100644 dom/base/crashtests/349355-1.html
 create mode 100644 dom/base/crashtests/359432-1.xhtml
 create mode 100644 dom/base/crashtests/360599-1.html
 create mode 100644 dom/base/crashtests/366200-1.xhtml
 create mode 100644 dom/base/crashtests/369219-1.xhtml
 create mode 100644 dom/base/crashtests/369413-1.html
 create mode 100644 dom/base/crashtests/371124-1-inner.html
 create mode 100644 dom/base/crashtests/371124-1.html
 create mode 100644 dom/base/crashtests/371124-2-inner.html
 create mode 100644 dom/base/crashtests/371124-2.html
 create mode 100644 dom/base/crashtests/371466-1.xhtml
 create mode 100644 dom/base/crashtests/372554-1.html
 create mode 100644 dom/base/crashtests/375399-1-inner.xhtml
 create mode 100644 dom/base/crashtests/375399-1.html
 create mode 100644 dom/base/crashtests/377360-1.xhtml
 create mode 100644 dom/base/crashtests/377960-1.html
 create mode 100644 dom/base/crashtests/377960-2.html
 create mode 100644 dom/base/crashtests/384663-1-inner.xhtml
 create mode 100644 dom/base/crashtests/384663-1.html
 create mode 100644 dom/base/crashtests/386000-1.html
 create mode 100644 dom/base/crashtests/386794-1.html
 create mode 100644 dom/base/crashtests/387460-1-inner.xhtml
 create mode 100644 dom/base/crashtests/387460-1.html
 create mode 100644 dom/base/crashtests/399712-1.html
 create mode 100644 dom/base/crashtests/400763-1.html
 create mode 100644 dom/base/crashtests/407818.html
 create mode 100644 dom/base/crashtests/410860-1.xml
 create mode 100644 dom/base/crashtests/411882-1.xhtml
 create mode 100644 dom/base/crashtests/416734-1.html
 create mode 100644 dom/base/crashtests/417852-1.html
 create mode 100644 dom/base/crashtests/418928-1.html
 create mode 100644 dom/base/crashtests/420620-1.html
 create mode 100644 dom/base/crashtests/424276-1.html
 create mode 100644 dom/base/crashtests/426987-1.html
 create mode 100644 dom/base/crashtests/43040-1.html
 create mode 100644 dom/base/crashtests/439206-1.html
 create mode 100644 dom/base/crashtests/443538-1.svg
 create mode 100644 dom/base/crashtests/448615-1.html
 create mode 100644 dom/base/crashtests/450383-1.html
 create mode 100644 dom/base/crashtests/450385-1.html
 create mode 100644 dom/base/crashtests/458637-1-inner.xhtml
 create mode 100644 dom/base/crashtests/458637-1.html
 create mode 100644 dom/base/crashtests/462947.html
 create mode 100644 dom/base/crashtests/467392.html
 create mode 100644 dom/base/crashtests/472593-1.html
 create mode 100644 dom/base/crashtests/474041-1.svg
 create mode 100644 dom/base/crashtests/476526.html
 create mode 100644 dom/base/crashtests/483818-1.html
 create mode 100644 dom/base/crashtests/490760-1.xhtml
 create mode 100644 dom/base/crashtests/493281-1.html
 create mode 100644 dom/base/crashtests/493281-2.html
 create mode 100644 dom/base/crashtests/494810-1.html
 create mode 100644 dom/base/crashtests/499006-1.html
 create mode 100644 dom/base/crashtests/499006-2.html
 create mode 100644 dom/base/crashtests/502617.html
 create mode 100644 dom/base/crashtests/504224.html
 create mode 100644 dom/base/crashtests/509536-1.html
 create mode 100644 dom/base/crashtests/522516-1.html
 create mode 100644 dom/base/crashtests/529670.html
 create mode 100644 dom/base/crashtests/535926-1.html
 create mode 100644 dom/base/crashtests/543645.html
 create mode 100644 dom/base/crashtests/551631-1.html
 create mode 100644 dom/base/crashtests/552651.html
 create mode 100644 dom/base/crashtests/552651.xml
 create mode 100644 dom/base/crashtests/554230-1.xhtml
 create mode 100644 dom/base/crashtests/558973.html
 create mode 100644 dom/base/crashtests/564079-1.html
 create mode 100644 dom/base/crashtests/564114.html
 create mode 100644 dom/base/crashtests/565125-1.html
 create mode 100644 dom/base/crashtests/575462.svg
 create mode 100644 dom/base/crashtests/582601.html
 create mode 100644 dom/base/crashtests/590395-1.html
 create mode 100644 dom/base/crashtests/593302-1.html
 create mode 100644 dom/base/crashtests/593302-2.html
 create mode 100644 dom/base/crashtests/595606-1.html
 create mode 100644 dom/base/crashtests/595606-2.html
 create mode 100644 dom/base/crashtests/601247.html
 create mode 100644 dom/base/crashtests/603531.html
 create mode 100644 dom/base/crashtests/604262-1.html
 create mode 100644 dom/base/crashtests/605672-1.svg
 create mode 100644 dom/base/crashtests/606729-1.html
 create mode 100644 dom/base/crashtests/607222.html
 create mode 100644 dom/base/crashtests/609560-1.xhtml
 create mode 100644 dom/base/crashtests/610571-1.html
 create mode 100644 dom/base/crashtests/612018-1.html
 create mode 100644 dom/base/crashtests/628599-1.html
 create mode 100644 dom/base/crashtests/637116.html
 create mode 100644 dom/base/crashtests/637214-1.svg
 create mode 100644 dom/base/crashtests/637214-2.svg
 create mode 100644 dom/base/crashtests/642022-1.html
 create mode 100644 dom/base/crashtests/646184.html
 create mode 100644 dom/base/crashtests/658845-1.svg
 create mode 100644 dom/base/crashtests/666869.html
 create mode 100644 dom/base/crashtests/667336-1.html
 create mode 100644 dom/base/crashtests/675516.xhtml
 create mode 100644 dom/base/crashtests/675621-1.html
 create mode 100644 dom/base/crashtests/677194.html
 create mode 100644 dom/base/crashtests/679459.html
 create mode 100644 dom/base/crashtests/679689-1.html
 create mode 100644 dom/base/crashtests/682463.html
 create mode 100644 dom/base/crashtests/693212.xhtml
 create mode 100644 dom/base/crashtests/693811-1.html
 create mode 100644 dom/base/crashtests/693811-2.html
 create mode 100644 dom/base/crashtests/693811-3.html
 create mode 100644 dom/base/crashtests/693894.html
 create mode 100644 dom/base/crashtests/695867.html
 create mode 100644 dom/base/crashtests/697643.html
 create mode 100644 dom/base/crashtests/698974-1.html
 create mode 100644 dom/base/crashtests/700090-1.html
 create mode 100644 dom/base/crashtests/700090-2.html
 create mode 100644 dom/base/crashtests/700512-worker.js
 create mode 100644 dom/base/crashtests/700512.html
 create mode 100644 dom/base/crashtests/706283-1.html
 create mode 100644 dom/base/crashtests/709384.html
 create mode 100644 dom/base/crashtests/709954.html
 create mode 100644 dom/base/crashtests/713417-1.html
 create mode 100644 dom/base/crashtests/713417-2.html
 create mode 100644 dom/base/crashtests/715056.html
 create mode 100644 dom/base/crashtests/729431-1.xhtml
 create mode 100644 dom/base/crashtests/741163-1.html
 create mode 100644 dom/base/crashtests/745495.html
 create mode 100644 dom/base/crashtests/752226-1.html
 create mode 100644 dom/base/crashtests/752226-2.html
 create mode 100644 dom/base/crashtests/766426.html
 create mode 100644 dom/base/crashtests/771639.html
 create mode 100644 dom/base/crashtests/786854.html
 create mode 100644 dom/base/crashtests/815043.html
 create mode 100644 dom/base/crashtests/815276.html
 create mode 100644 dom/base/crashtests/815477.html
 create mode 100644 dom/base/crashtests/815500.html
 create mode 100644 dom/base/crashtests/816253.html
 create mode 100644 dom/base/crashtests/819014.html
 create mode 100644 dom/base/crashtests/822723.html
 create mode 100644 dom/base/crashtests/824719.html
 create mode 100644 dom/base/crashtests/827190.html
 create mode 100644 dom/base/crashtests/828054.html
 create mode 100644 dom/base/crashtests/828903-iframe.html
 create mode 100644 dom/base/crashtests/828903.html
 create mode 100644 dom/base/crashtests/829428.html
 create mode 100644 dom/base/crashtests/830098.html
 create mode 100644 dom/base/crashtests/831287.html
 create mode 100644 dom/base/crashtests/832644.html
 create mode 100644 dom/base/crashtests/836890.html
 create mode 100644 dom/base/crashtests/838489-1.html
 create mode 100644 dom/base/crashtests/838489-2.html
 create mode 100644 dom/base/crashtests/841205.html
 create mode 100644 dom/base/crashtests/844404.html
 create mode 100644 dom/base/crashtests/845093-1.html
 create mode 100644 dom/base/crashtests/845093-2.html
 create mode 100644 dom/base/crashtests/847127.html
 create mode 100644 dom/base/crashtests/849601.html
 create mode 100644 dom/base/crashtests/849727.html
 create mode 100644 dom/base/crashtests/849732.html
 create mode 100644 dom/base/crashtests/851353-1.html
 create mode 100644 dom/base/crashtests/852381.html
 create mode 100644 dom/base/crashtests/863950.html
 create mode 100644 dom/base/crashtests/864448.html
 create mode 100644 dom/base/crashtests/886213.html
 create mode 100644 dom/base/crashtests/898906.html
 create mode 100644 dom/base/crashtests/90613-1.html
 create mode 100644 dom/base/crashtests/930250.html
 create mode 100644 dom/base/crashtests/942979.html
 create mode 100644 dom/base/crashtests/973401.html
 create mode 100644 dom/base/crashtests/978646.html
 create mode 100644 dom/base/crashtests/crashtests.list
 create mode 100644 dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown-worker.js
 create mode 100644 dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown.html
 create mode 100644 dom/base/crashtests/file_504224.html
 create mode 100644 dom/base/crashtests/module-with-syntax-error.js
 create mode 100644 dom/base/crashtests/structured_clone_container_throws.html
 create mode 100644 dom/base/crashtests/xhr-with-pagehide-1-helper.html
 create mode 100644 dom/base/crashtests/xhr-with-pagehide-1.html
 create mode 100644 dom/base/crashtests/xhr_empty_datauri.html
 create mode 100644 dom/base/crashtests/xhr_html_nullresponse.html

(limited to 'dom/base/crashtests')

diff --git a/dom/base/crashtests/1024428-1.html b/dom/base/crashtests/1024428-1.html
new file mode 100644
index 0000000000..075077591c
--- /dev/null
+++ b/dom/base/crashtests/1024428-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<div id="host"></div>
+<script>
+  host.attachShadow({ mode: "open" }).innerHTML = '<input type="range" />';
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1027461-1.html b/dom/base/crashtests/1027461-1.html
new file mode 100644
index 0000000000..849a66c164
--- /dev/null
+++ b/dom/base/crashtests/1027461-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <meta charset="UTF-8">
+        <link rel="import" href="1027461-inner.xhtml">
+    </head>
+    <body>
+    </body>
+</html>
diff --git a/dom/base/crashtests/1027461-inner.xhtml b/dom/base/crashtests/1027461-inner.xhtml
new file mode 100644
index 0000000000..84ee2d222a
--- /dev/null
+++ b/dom/base/crashtests/1027461-inner.xhtml
@@ -0,0 +1,2 @@
+<?xml?>
+<empty-xul-file />
diff --git a/dom/base/crashtests/1029710.html b/dom/base/crashtests/1029710.html
new file mode 100644
index 0000000000..bb78b561e4
--- /dev/null
+++ b/dom/base/crashtests/1029710.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+  var x = document.createElement('span');
+  x.attachShadow({ mode: "open" });
+  x.id = 'a';
+</script>
+</body>
+</html>
+
diff --git a/dom/base/crashtests/1154598.xhtml b/dom/base/crashtests/1154598.xhtml
new file mode 100644
index 0000000000..64d5506540
--- /dev/null
+++ b/dom/base/crashtests/1154598.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body><body>
+<script>
+s = document.createElement('script');
+s.src="";
+document.body.appendChild(s);
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1157995.html b/dom/base/crashtests/1157995.html
new file mode 100644
index 0000000000..5d822c0a68
--- /dev/null
+++ b/dom/base/crashtests/1157995.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+  <script>
+    // This should not leak.
+    var a = navigator;
+    navigator.mediaDevices._ = null;
+  </script>
+</body>
diff --git a/dom/base/crashtests/1158412.html b/dom/base/crashtests/1158412.html
new file mode 100644
index 0000000000..e62fce1ab9
--- /dev/null
+++ b/dom/base/crashtests/1158412.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    document.styleSheetSets.expando = null;
+    var otherDoc = document.implementation.createDocument("", "", null);
+    var otherSpan = otherDoc.createElementNS("http://www.w3.org/1999/xhtml", "span");
+
+    var img = document.createElementNS("http://www.w3.org/1999/xhtml", "img");
+    img.srcset = "data:,a 1w, data:,b 1w";
+    img.sizes = "1px";
+    otherSpan.appendChild(img);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/116848-1.html b/dom/base/crashtests/116848-1.html
new file mode 100644
index 0000000000..785d97fe64
--- /dev/null
+++ b/dom/base/crashtests/116848-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+   <title>Test case boiled down from www.sjetmarka.no</title>
+</head>
+<body>
+  <table>
+    <tr>
+      <td>
+        <SCRIPT language="JavaScript1.2">
+          document.write('<div>')
+         </script>
+         Hei og velkommen til Mozilla
+         <head>
+           <script language="JavaScript1.2">
+             document.write('</div>')
+           </script>
+         </head>
+      </td>
+    </tr>
+  </table>
+  <table>
+    <tr>
+      <td>
+        God jul til alle
+      </td>
+    </tr>
+  </table>
+</body>
+</html>
diff --git a/dom/base/crashtests/1181619.html b/dom/base/crashtests/1181619.html
new file mode 100644
index 0000000000..929207964d
--- /dev/null
+++ b/dom/base/crashtests/1181619.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <script>
+    var obs = new MutationObserver(function() {
+      // Just need something here to assert exception is not pending.  Any
+      // binding method will do.
+      console.log("hello");
+    });
+    obs.observe(document.body, { childList: true });
+  </script>
+  <script>
+    noSuchMethodYo();
+  </script>
+</body>
diff --git a/dom/base/crashtests/1228882.html b/dom/base/crashtests/1228882.html
new file mode 100644
index 0000000000..42dc5a6570
--- /dev/null
+++ b/dom/base/crashtests/1228882.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="b.dir='auto'; a.dir='auto'; b.remove();">
+<bdi id="a"><span id="b">f</span>g</bdi>
+</body>
+</html>
diff --git a/dom/base/crashtests/1230422.html b/dom/base/crashtests/1230422.html
new file mode 100644
index 0000000000..fbaa63d385
--- /dev/null
+++ b/dom/base/crashtests/1230422.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+<script>
+
+var a = new FileReader();
+
+function f() {
+  a.removeEventListener("loadend", f);
+  g();
+}
+
+function g() {
+  a.readAsBinaryString(new Blob());
+}
+
+a.addEventListener("loadend", f);
+
+try {
+  g();
+  g();
+} catch(e) {}
+
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1251361.html b/dom/base/crashtests/1251361.html
new file mode 100644
index 0000000000..57c76121f5
--- /dev/null
+++ b/dom/base/crashtests/1251361.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+var frameRoot;
+
+function boom()
+{
+    var frameWin = f.contentWindow;
+    frameRoot = frameWin.document.documentElement;
+    frameWin.location.replace("data:text/html;charset=UTF-8,<body onload='parent.g();'>2");
+}
+
+function g()
+{
+    setTimeout(h, 0);
+}
+
+function h()
+{
+    var newDoc = document.implementation.createDocument('', '', null);
+    newDoc.adoptNode(frameRoot);
+}
+
+</script>
+<body onload="boom();">
+
+<iframe id="f" src="data:text/html;charset=UTF-8,<marquee>1"></iframe>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/1281715.html b/dom/base/crashtests/1281715.html
new file mode 100644
index 0000000000..17352a30bd
--- /dev/null
+++ b/dom/base/crashtests/1281715.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+html {
+    color: orange;
+}
+</style>
+
+<script>
+function boom()
+{
+  document.documentElement.offsetHeight;
+  document.getElementById("hostW").attachShadow({ mode: "open" }).innerHTML = '<z></z>';
+  document.getElementsByTagName("style")[0].remove();
+}
+</script>
+
+</head>
+
+<body onload="boom();"><div style="display: contents;" id="hostW"></div></body>
+
+</html>
diff --git a/dom/base/crashtests/1291535-iframe.html b/dom/base/crashtests/1291535-iframe.html
new file mode 100644
index 0000000000..60ba42891a
--- /dev/null
+++ b/dom/base/crashtests/1291535-iframe.html
@@ -0,0 +1,4 @@
+<script>
+  import("data:text/javascript,0").catch(x => 0);
+  window.stop();
+</script>
diff --git a/dom/base/crashtests/1291535.html b/dom/base/crashtests/1291535.html
new file mode 100644
index 0000000000..d57b3d762a
--- /dev/null
+++ b/dom/base/crashtests/1291535.html
@@ -0,0 +1 @@
+<iframe src="1291535-iframe.html"></iframe>
diff --git a/dom/base/crashtests/1304437.html b/dom/base/crashtests/1304437.html
new file mode 100644
index 0000000000..a4e9d5110c
--- /dev/null
+++ b/dom/base/crashtests/1304437.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+  var e=document.createElement("q");
+  document.documentElement.appendChild(e);
+  e.style="mask-image:url(data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs=),url(data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==)";
+  setTimeout(function(){
+    e.style="mask-image:url(data:image/gif;base64,R0lGODlhAQABAIABAP///wAAACwAAAAAAQABAAACAkQBADs=)";
+  },0);
+};
+</script>
+</html>
diff --git a/dom/base/crashtests/1324209.html b/dom/base/crashtests/1324209.html
new file mode 100644
index 0000000000..99628e38d3
--- /dev/null
+++ b/dom/base/crashtests/1324209.html
@@ -0,0 +1,27 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="application/javascript">
+
+function crash() {
+	var target1 = document.getElementById("target1");
+	var target2 = document.getElementById("target2");
+	var observer1 = new IntersectionObserver(function (entries) {
+	  console.log(entries);
+	  observer1.disconnect();
+	  observer2.disconnect();
+	});
+	var observer2 = new IntersectionObserver(function (entries) {
+	  console.log(entries); 
+	});
+	observer1.observe(target1);
+	observer2.observe(target2);
+}
+
+</script>
+</head>
+<body onload="crash()">
+	<div id="target1" style="background: red; width: 50px; height: 50px"></div>
+	<div id="target2" style="background: green; width: 50px; height: 50px"></div>
+</body>
+</html>
diff --git a/dom/base/crashtests/1324500.html b/dom/base/crashtests/1324500.html
new file mode 100644
index 0000000000..83072c9bd1
--- /dev/null
+++ b/dom/base/crashtests/1324500.html
@@ -0,0 +1,4 @@
+<script>
+setTimeout(function(){document.getElementById('id0510').removeAttribute('max');}, 46);
+</script>
+<input id='id0510'type='range'max=765>
diff --git a/dom/base/crashtests/1326194-1.html b/dom/base/crashtests/1326194-1.html
new file mode 100644
index 0000000000..802ae7c385
--- /dev/null
+++ b/dom/base/crashtests/1326194-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="application/javascript">
+
+// Crashes if 'target' doesn't get properly unlinked in nsINode::LastRelease
+
+function crash() {
+	var target = document.getElementById('target');
+	var io = new IntersectionObserver(function () { }, { });
+	io.observe(target);
+	document.body.removeChild(target);
+}
+
+</script>
+</head>
+<body onload="crash()">
+	<div id="target" style="background: red; width: 50px; height: 50px"></div>
+</body>
+</html>
diff --git a/dom/base/crashtests/1326194-2.html b/dom/base/crashtests/1326194-2.html
new file mode 100644
index 0000000000..dbced2f8ff
--- /dev/null
+++ b/dom/base/crashtests/1326194-2.html
@@ -0,0 +1,20 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="application/javascript">
+
+// Crashes if 'target' doesn't get properly unlinked in FragmentOrElement::Unlink
+
+function crash() {
+	var target = document.createElement('div');
+	// By setting a custom prop we create a cycle between JS and C++ that requires the CC to break.
+	target.foo = 'bar';
+	var io = new IntersectionObserver(function () { }, { });
+	io.observe(target);
+}
+
+</script>
+</head>
+<body onload="crash()">
+</body>
+</html>
diff --git a/dom/base/crashtests/1332939.html b/dom/base/crashtests/1332939.html
new file mode 100644
index 0000000000..3b253912d6
--- /dev/null
+++ b/dom/base/crashtests/1332939.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="application/javascript">
+
+var target = document.createElement("div");
+target.foo = 'bar';
+var observer = new IntersectionObserver(function () { });
+observer.observe(target);
+observer.unobserve(target);
+observer = null;
+target = null;
+
+</script>
+</head>
+</html>
diff --git a/dom/base/crashtests/1341693.html b/dom/base/crashtests/1341693.html
new file mode 100644
index 0000000000..677305ba56
--- /dev/null
+++ b/dom/base/crashtests/1341693.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+  var o1 = document.documentElement;
+  var o2 = document.createElement("frame");
+  document.documentElement.appendChild(o2);
+  var o3 = o2.contentWindow;
+  o1.parentNode.removeChild(o1);
+  o3.customElements;
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1352453.html b/dom/base/crashtests/1352453.html
new file mode 100644
index 0000000000..3fc2933e91
--- /dev/null
+++ b/dom/base/crashtests/1352453.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <style>
+      tr {
+        font: medium / 1000 cursive;
+      }
+
+      :only-of-type {
+        border-image: repeating-linear-gradient(45deg, blue, red) space 1% / 1pt auto;
+      }
+    </style>
+    <script>
+      o1 = document.createElement('tr');
+      o2 = document.createElement('th');
+      o3 = document.createElement('rt');
+      document.documentElement.appendChild(o1);
+      o1.appendChild(o2);
+      o2.appendChild(o3);
+    </script>
+  </head>
+</html>
diff --git a/dom/base/crashtests/1353529-inner.html b/dom/base/crashtests/1353529-inner.html
new file mode 100644
index 0000000000..2c10a1e3da
--- /dev/null
+++ b/dom/base/crashtests/1353529-inner.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<body onload="boom()">
+<div id="target"></div>
+<script>
+    function boom() {
+        var io = new IntersectionObserver(function () { }, { });
+        io.observe(document.getElementById('target'));
+    }
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1353529.xhtml b/dom/base/crashtests/1353529.xhtml
new file mode 100644
index 0000000000..65b55c7822
--- /dev/null
+++ b/dom/base/crashtests/1353529.xhtml
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" 
+        xmlns:xhtml="http://www.w3.org/1999/xhtml">
+<xhtml:div>
+    <iframe src="1353529-inner.html"></iframe>
+</xhtml:div>
+</window>
diff --git a/dom/base/crashtests/1368327-iframe.html b/dom/base/crashtests/1368327-iframe.html
new file mode 100644
index 0000000000..dbbdd99f38
--- /dev/null
+++ b/dom/base/crashtests/1368327-iframe.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <title>iframe</title>
+  </head>
+  <body>
+    <p><h1>iframe</h1></p>
+  </body>
+</html>
diff --git a/dom/base/crashtests/1368327.html b/dom/base/crashtests/1368327.html
new file mode 100644
index 0000000000..ab2755f644
--- /dev/null
+++ b/dom/base/crashtests/1368327.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <head>
+    <meta charset="utf-8">
+    <title>Test window.location</title>
+    <script type="application/javascript">
+    function test() {
+      content = document.querySelector("#content");
+      testFrame = document.querySelector("#testframe");
+      frameWindow = testFrame.contentWindow;
+      testframe.remove();
+
+      // Shouldn't crash at this line.
+      content.textContent = "location=" + frameWindow.location;
+
+      document.documentElement.className = "";
+    }
+    </script>
+  </head>
+  <body>
+    <p id="content"></p>
+    <iframe id="testframe" src="1368327-iframe.html" onload="setTimeout(test, 0);"></iframe>
+  </body>
+</html>
diff --git a/dom/base/crashtests/1369363.xhtml b/dom/base/crashtests/1369363.xhtml
new file mode 100644
index 0000000000..fd7ddf9f14
--- /dev/null
+++ b/dom/base/crashtests/1369363.xhtml
@@ -0,0 +1,16 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" 
+        xmlns:xhtml="http://www.w3.org/1999/xhtml">
+<xhtml:div id="root">
+<xhtml:div id="target">
+</xhtml:div>
+</xhtml:div>
+<script>
+<![CDATA[
+    var io = new IntersectionObserver(function () {
+    }, { root: document.getElementById('root') });
+    io.observe(document.getElementById('target'));
+]]>
+</script>
+</window>
diff --git a/dom/base/crashtests/1370072.html b/dom/base/crashtests/1370072.html
new file mode 100644
index 0000000000..baecc8f35a
--- /dev/null
+++ b/dom/base/crashtests/1370072.html
@@ -0,0 +1,18 @@
+<script>
+function start() {
+	o1=document.createElement('iframe');
+	o1.addEventListener('load',fun0);
+	document.body.appendChild(o1);
+}
+function fun0() {
+	o5=o1.contentDocument;
+	o52=function() {let x=o5.querySelectorAll('*:not([id])');return x[x.length-1]}();
+	o1.contentWindow.onresize=fun1;
+	o1.height='5px';
+	o52.clientTop;
+}
+function fun1() {
+	document.documentElement.appendChild(o1);
+}
+</script>
+<body onload="start()"></body>
diff --git a/dom/base/crashtests/1370737.html b/dom/base/crashtests/1370737.html
new file mode 100644
index 0000000000..0e0e1a0e0e
--- /dev/null
+++ b/dom/base/crashtests/1370737.html
@@ -0,0 +1,41 @@
+<html class="reftest-wait">
+<script>
+document.addEventListener("DOMContentLoaded", function(){
+  let n=document.getElementById('a');
+  n.parentNode.removeChild(n);
+  let o=document.getElementById('b');
+  let p=document.getElementById('c');
+  p.id=[o.id, o.id=p.id][0];
+  let l=['d'];
+  let s=window.getSelection();
+  for(let i=0; i<l.length; i++){
+    let e=document.getElementById(l[i]);
+    let r=document.createRange();
+    r.selectNode(e);
+    s.addRange(r);
+  }
+  n=document.getElementById('b');
+  n.parentNode.removeChild(n);
+  window.getSelection().modify('extend','right','word');
+  n.setAttribute('id','e');
+  document.getElementById('f').appendChild(n);
+  l=['e'];
+  for(let i=0; i<l.length; i++){
+    let e=document.getElementById(l[i]);
+    let r=document.createRange();
+    r.selectNode(e);
+    s.addRange(r);
+  }
+  document.documentElement.removeAttribute("class");
+});
+</script>
+<table>
+<tbody hidden>
+<th id='c'>
+<i id='d'>
+<bdo id='b'></bdo>
+<td></td>
+<tbody id='f'>
+<td id='a' contenteditable='true'>
+<td>
+</html>
diff --git a/dom/base/crashtests/1370968-inner.xhtml b/dom/base/crashtests/1370968-inner.xhtml
new file mode 100644
index 0000000000..6d9d6aa882
--- /dev/null
+++ b/dom/base/crashtests/1370968-inner.xhtml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" 
+        xmlns:xhtml="http://www.w3.org/1999/xhtml">
+<xhtml:div id="target"></xhtml:div>
+</window>
diff --git a/dom/base/crashtests/1370968.html b/dom/base/crashtests/1370968.html
new file mode 100644
index 0000000000..81973b413c
--- /dev/null
+++ b/dom/base/crashtests/1370968.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<body>
+<iframe id="iframe" src="1370968-inner.xhtml"></iframe>
+<script>
+    var io = new IntersectionObserver(function () {
+    }, { });
+    var iframe = document.getElementById('iframe');
+    iframe.onload = function () {
+        io.observe(iframe.contentDocument.getElementById('target'));
+    };
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1373750.html b/dom/base/crashtests/1373750.html
new file mode 100644
index 0000000000..f9fdb2a9b2
--- /dev/null
+++ b/dom/base/crashtests/1373750.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+div {
+  /* Add two mask layers and apply border-radius to the bottom-most layer. */
+  mask: linear-gradient(red, blue) border-box no-clip, 6%;
+  border-style: solid;
+  border-top-left-radius: 24%;
+}
+</style>
+</head>
+<div></div>
+</html>
diff --git a/dom/base/crashtests/1377826.html b/dom/base/crashtests/1377826.html
new file mode 100644
index 0000000000..7934771889
--- /dev/null
+++ b/dom/base/crashtests/1377826.html
@@ -0,0 +1,5 @@
+<li id='a' dir='auto'>
+<select>
+<option dir='rtl'>
+&#x8C3;
+</html>
diff --git a/dom/base/crashtests/1383478.html b/dom/base/crashtests/1383478.html
new file mode 100644
index 0000000000..ca90494b17
--- /dev/null
+++ b/dom/base/crashtests/1383478.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<html lang="en" dir="ltr">
+  <head>
+    <meta charset="utf-8" />
+    <title>This browser is crashing</title>
+  </head>
+  <body>
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+<Object class="crashDroid" />
+          </body>
+</html>
diff --git a/dom/base/crashtests/1383780.html b/dom/base/crashtests/1383780.html
new file mode 100644
index 0000000000..54738cc53f
--- /dev/null
+++ b/dom/base/crashtests/1383780.html
@@ -0,0 +1,21 @@
+<html>
+  <head>
+    <script>
+      try { o1 = document.createElementNS('http://www.w3.org/2000/svg', 'use') } catch(e) { }
+      try { o2 = document.createElement('img') } catch(e) { }
+      try { o4 = document.createElement('area') } catch(e) { }
+      try { o5 = document.createElement('tr') } catch(e) { }
+      try { o6 = document.createRange(); } catch(e) { }
+      try { o7 = window.getSelection() } catch(e) { }
+      try { document.documentElement.appendChild(o1) } catch(e) { }
+      try { document.head.outerHTML = '<progress></progress>'; } catch(e) { }
+      try { o1.appendChild(o2); } catch(e) { }
+      try { o2.appendChild(o4) } catch(e) { }
+      try { o4.appendChild(o5); } catch(e) { }
+      try { document.designMode = 'on'; } catch(e) { }
+      try { o6.selectNode(o5); } catch(e) { }
+      try { o7.addRange(o6); } catch(e) { }
+      try { document.execCommand('justifyleft', false, null) } catch(e) { }
+    </script>
+  </head>
+</html>
diff --git a/dom/base/crashtests/1385272-1.html b/dom/base/crashtests/1385272-1.html
new file mode 100644
index 0000000000..5bdd407998
--- /dev/null
+++ b/dom/base/crashtests/1385272-1.html
@@ -0,0 +1,29 @@
+<html>
+    <head>
+       <script>
+            try { o1 = document.createElement("tr") } catch(e) { }
+            try { o2 = document.createElement("td") } catch(e) { }
+            try { o3 = document.createElement("tr") } catch(e) { }
+            try { o4 = document.createElement("div") } catch(e) { }
+            try { o5 = document.createElement("input") } catch(e) { }
+            try { o6 = document.createElement('map') } catch(e) { }
+            try { o7 = document.createElement('select') } catch(e) { }
+            try { o8 = document.createElement("canvas") } catch(e) { }
+            try { o9 = document.createElement("area") } catch(e) { };
+            try { o1.appendChild(o2) } catch(e) { }
+            try { document.documentElement.appendChild(o3)  } catch(e) { }
+            try { document.documentElement.appendChild(o4)  } catch(e) { }
+            try { document.documentElement.appendChild(o6) } catch(e) { }
+            try { o3.appendChild(o7) } catch(e) { }
+            try { o4.appendChild(o8) } catch(e) { }
+            try { o3.appendChild(o5); } catch(e) { }
+            try { o3.appendChild(o1); } catch(e) { }
+            try { o6.contentEditable = "true" } catch(e) { };
+            try { o6.offsetHeight } catch(e) { };
+            try { o4.appendChild(o9) } catch(e) { };
+            try { o2.insertAdjacentHTML("beforeBegin", "<button id='id0'></button>\n"); } catch(e) { }
+            try { document.replaceChild(document.documentElement, document.documentElement); } catch(e) { }
+            try { document.execCommand("selectall",false,null) } catch(e) { }
+        </script>
+    </head>
+</html>
diff --git a/dom/base/crashtests/1393806.html b/dom/base/crashtests/1393806.html
new file mode 100644
index 0000000000..4e859bf602
--- /dev/null
+++ b/dom/base/crashtests/1393806.html
@@ -0,0 +1,17 @@
+<html>
+  <head>
+    <script>
+      function fun_0() {
+        document.implementation.createDocument('', '', null).adoptNode(o2);
+      }
+
+      o1 = document.createElement('map');
+      o2 = document.createElement('iframe');
+      document.documentElement.appendChild(o1);
+      document.documentElement.appendChild(o2);
+      o1.textContent = 'x';
+      document.addEventListener('DOMNodeRemoved', fun_0, false);
+      o1.innerText = 'x';
+    </script>
+  </head>
+</html>
diff --git a/dom/base/crashtests/1396466.html b/dom/base/crashtests/1396466.html
new file mode 100644
index 0000000000..09f36fa0d4
--- /dev/null
+++ b/dom/base/crashtests/1396466.html
@@ -0,0 +1,20 @@
+<script>
+function addNew(i,t){
+  let n=document.createElement(t);
+  n.setAttribute('id', i);
+  document.getElementById('a').appendChild(n);
+}
+document.addEventListener("DOMContentLoaded", function(){
+  addNew('b','multicol');
+  addNew('c','marquee');
+  addNew('d','spacer');
+  document.getElementById('a').appendChild(document.createElement('iframe'));
+  document.getElementById('b').focus();
+  window.frames[0].document.body.appendChild(document.getElementById('c'));
+  let o=window.frames[0].document.body.childNodes[0];
+  document.getElementById('d').appendChild(o.parentNode.removeChild(o));
+  try{window.find('x')}catch(e){}
+  window.frames[0].document.body.appendChild(document.getElementById('c'));
+});
+</script>
+<body id='a'></body>
diff --git a/dom/base/crashtests/1397795.html b/dom/base/crashtests/1397795.html
new file mode 100644
index 0000000000..4ba525a9c1
--- /dev/null
+++ b/dom/base/crashtests/1397795.html
@@ -0,0 +1,23 @@
+<html>
+  <style>
+    html {
+      writing-mode: vertical-rl;
+    }
+    body {
+      column-count: 2;
+    }
+    svg {
+      -moz-box-shadow: green 2px 2px 8px;
+      box-shadow: green 2px 2px 8px;
+      -moz-appearance: button;
+      appearance: button;
+    }
+
+  </style>
+  <body>
+    <div id='id0'>
+      <svg width='800' filter='url(#id0')></svg>
+    </div>
+  </body>
+</html>
+
diff --git a/dom/base/crashtests/1400701.html b/dom/base/crashtests/1400701.html
new file mode 100644
index 0000000000..fe1eef5d50
--- /dev/null
+++ b/dom/base/crashtests/1400701.html
@@ -0,0 +1,15 @@
+<html>
+<script>
+window.onload=function(){
+  document.getElementById('b').textContent='Or';
+  document.getElementById('a').insertBefore(document.getElementById('c'), undefined);
+  document.getElementById('b').dir='ltr';
+  let o=document.getElementById('b');
+  o.parentNode.replaceChild(document.createElement('code'), o);
+}
+</script>
+<body dir='auto' id='a'>
+<bdi id='b' dir='auto'>
+</bdi>
+<q id='c'>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/1403377.html b/dom/base/crashtests/1403377.html
new file mode 100644
index 0000000000..2afbb66f1f
--- /dev/null
+++ b/dom/base/crashtests/1403377.html
@@ -0,0 +1,18 @@
+<script>
+function fzfn(e){
+  let nc=window.frames[0].document.body.childElementCount;
+  let o=window.frames[0].document.body.childNodes[1%nc];
+  document.getElementById('b').appendChild(o.parentNode.removeChild(o));
+}
+window.onload=function(){
+  document.body.onerror=fzfn;
+  document.getElementById('c').addEventListener('DOMNodeRemoved', fzfn, true);
+  document.getElementById('c').attributes[0].name=='id';
+  window.frames[0].document.body.appendChild(document.getElementById('c'));
+  document.getElementById('a').innerHTML=document.createElement('multicol').outerHTML;
+}
+</script>
+<iframe></iframe>
+<script id='a'></script>
+<script id='b'></script>
+<script id='c'></script>
diff --git a/dom/base/crashtests/1405771.html b/dom/base/crashtests/1405771.html
new file mode 100644
index 0000000000..120fcaf294
--- /dev/null
+++ b/dom/base/crashtests/1405771.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script></script>
+<!-- a -->
+<script>
+window.onload=function(){
+  let s=window.getSelection();
+  let r=document.createRange();
+  r.selectNode(document.getElementById('b'));
+  s.addRange(r);
+  try{window.getSelection().modify('extend','forward','word')}catch(e){}
+  let o=document.getElementById('a');
+  o.parentNode.replaceChild(document.createElement('col'), o);
+}
+</script>
+>
+<template id='a' contenteditable='true'></template>
+<header id='b'></header>
+<!-- a -->
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/1406109-1.html b/dom/base/crashtests/1406109-1.html
new file mode 100644
index 0000000000..4ec653dd6f
--- /dev/null
+++ b/dom/base/crashtests/1406109-1.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+<script>
+function jsfuzzer() {
+  try { a.matches("1"); } catch(e) { }
+  try { document.createElement("p").closest("1"); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<feBlend id="a" />
diff --git a/dom/base/crashtests/1411473.html b/dom/base/crashtests/1411473.html
new file mode 100644
index 0000000000..93e42bd8a2
--- /dev/null
+++ b/dom/base/crashtests/1411473.html
@@ -0,0 +1,12 @@
+<html>
+  <head class="reftest-wait">
+    <script>
+      var img = new Image(-256, 1024);
+      img.src = 'data:;base64,R0lGODlhAQABAAAAACwAAAAAAQABAAA';
+      img.onload = function () {
+        img.crossOrigin ="Anonymous";
+        document.implementation.createDocument('', '', null).adoptNode(img);
+      };
+    </script>
+  </head>
+</html>
diff --git a/dom/base/crashtests/1413815.html b/dom/base/crashtests/1413815.html
new file mode 100644
index 0000000000..309e54d082
--- /dev/null
+++ b/dom/base/crashtests/1413815.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script type="text/javascript">
+class XFoo extends HTMLElement {
+  constructor() {
+    super();
+  }
+
+  static get observedAttributes() {
+    return [3.76277868767527e-310, Symbol("Ashitaka"), {}];
+  }
+
+  attributeChangedCallback(aName, aOldValue, aNewValue) {
+  }
+}
+
+customElements.define('x-foo', XFoo);
+</script>
+</html>
diff --git a/dom/base/crashtests/1419799.html b/dom/base/crashtests/1419799.html
new file mode 100644
index 0000000000..b6d34a1a97
--- /dev/null
+++ b/dom/base/crashtests/1419799.html
@@ -0,0 +1,17 @@
+<html>
+  <head>
+    <script>
+      try { o1 = document.createElement('textarea') } catch(e) { }
+      try { o2 = document.createElement('div') } catch(e) { }
+      try { o3 = document.createElement('map') } catch(e) { }
+      try { document.documentElement.appendChild(o2) } catch(e) { }
+      try { o2.appendChild(o1) } catch(e) { }
+      try { document.documentElement.getClientRects() } catch(e) { }
+      try { o4 = o2.attachShadow({ mode: "open" }); } catch(e) { }
+      try { o1.appendChild(o3) } catch(e) { }
+      try { o5 = o3.parentElement } catch(e) { }
+      try { o3.outerHTML = "\n" } catch(e) { }
+      try { o4.prepend("", o5, "") } catch(e) { }
+    </script>
+  </head>
+</html>
diff --git a/dom/base/crashtests/1419902.html b/dom/base/crashtests/1419902.html
new file mode 100644
index 0000000000..b0742b5be0
--- /dev/null
+++ b/dom/base/crashtests/1419902.html
@@ -0,0 +1,23 @@
+<html>
+  <head>
+    <script>
+      var winsToClose = []
+      onbeforeunload = function() {
+        for (let win of winsToClose) {
+          if (win) {
+            win.close();
+          }
+        }
+      };
+      for (let i = 0; i < 38; i++) {
+        customElements.define("custom-element_0", class extends HTMLElement {
+          constructor() {
+            try { o1 = document.createElement("custom-element_0") } catch (e) {}
+            try { winsToClose.push(window.open("javascript:'<html><body>dummy</body></html>';")); } catch (e) {}
+          }
+        })
+        try { o3 = document.createElement("custom-element_0") } catch (e) {}
+      }
+    </script>
+  </head>
+</html>
diff --git a/dom/base/crashtests/1422883.html b/dom/base/crashtests/1422883.html
new file mode 100644
index 0000000000..f074592e91
--- /dev/null
+++ b/dom/base/crashtests/1422883.html
@@ -0,0 +1,10 @@
+<style>
+:after{-webkit-mask:url(#);content:counter(a)}
+</style>
+<script>
+function go(){
+  a.attachShadow({mode:"closed"})
+}
+</script>
+<body onload=go()>
+<h2 id="a">
diff --git a/dom/base/crashtests/1428053.html b/dom/base/crashtests/1428053.html
new file mode 100644
index 0000000000..d40496da6d
--- /dev/null
+++ b/dom/base/crashtests/1428053.html
@@ -0,0 +1,23 @@
+<script>
+  try { o1 = document.createElement("h1") } catch (e) {}
+  try { o2 = document.createElement("slot") } catch (e) {}
+  try { o3 = document.createElement("o") } catch (e) {}
+  try { document.documentElement.appendChild(o1) } catch (e) {}
+  try { document.documentElement.appendChild(o3) } catch (e) {}
+  try { o4 = o1.attachShadow({mode: "open"}) } catch (e) {}
+  try { o5 = new Range() } catch (e) {}
+  try { o6 = new MutationObserver(function(arg_0, arg_1) {
+      try { o4.append("", o2, "") } catch (e) {};
+  }) } catch (e) {}
+  try { o5.selectNode(o3); } catch (e) {}
+  try { customElements.define("custom-element_0", class extends HTMLElement {
+      connectedCallback() {
+          try { this.offsetHeight } catch (e) {}
+      }
+  }) } catch (e) {}
+  try { o8 = document.createElement("custom-element_0") } catch (e) {}
+  try { document.documentElement.appendChild(o8) } catch (e) {}
+  try { o6.observe(document, { "childList": [""] }); } catch (e) {}
+  try { document.replaceChild(o5.endContainer, document.documentElement); } catch (e) {}
+  try { o1.insertAdjacentHTML("afterBegin", "<</#"); } catch (e) {}
+</script>
diff --git a/dom/base/crashtests/1441029.html b/dom/base/crashtests/1441029.html
new file mode 100644
index 0000000000..1d222fdd29
--- /dev/null
+++ b/dom/base/crashtests/1441029.html
@@ -0,0 +1 @@
+<div is="div">
diff --git a/dom/base/crashtests/1445670.html b/dom/base/crashtests/1445670.html
new file mode 100644
index 0000000000..8afbcfbea2
--- /dev/null
+++ b/dom/base/crashtests/1445670.html
@@ -0,0 +1,20 @@
+<html>
+  <head>
+    <script>
+      function go () {
+        try { o1 = document.getElementById('x') } catch(e) { }
+        try { o1.src = '=' } catch(e) { }
+        try { o2 = document.cloneNode(false) } catch(e) { }
+        try { o3 = new XMLHttpRequest({mozAnon: true}) } catch(e) { }
+        try { o3.open('GET', 1, false) } catch(e) { }
+        try { o3.send() } catch(e) { }
+        try { o2.prepend('', o1, '', o2) } catch(e) { }
+      }
+      document.addEventListener('DOMContentLoaded', go)
+    </script>
+  </head>
+  <body>
+    <picture>
+      <img id='x' src='data:image/png;base64,R0lGODlhAQABAAD/ACH/C05FVFNDQVBFMi4wAwEAAAAsAAAAAEAAQAAAgA'/>
+  </body>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/1449601.html b/dom/base/crashtests/1449601.html
new file mode 100644
index 0000000000..7dcd22706d
--- /dev/null
+++ b/dom/base/crashtests/1449601.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <script>
+      var blob = new Blob(["foo"], { type: "text/plain" });
+      var url = URL.createObjectURL(blob);
+      var ifr = document.createElement("iframe");
+      ifr.src = url;
+      document.body.appendChild(ifr);
+
+      onload = function() {
+        try { window.find('foo',false,true,true,true,true) } catch(e) { }
+      }
+    </script>
+  </body>
+</html>
diff --git a/dom/base/crashtests/1458016.html b/dom/base/crashtests/1458016.html
new file mode 100644
index 0000000000..1876938136
--- /dev/null
+++ b/dom/base/crashtests/1458016.html
@@ -0,0 +1,12 @@
+<script>
+function go() {
+  b.appendChild(document.body.firstChild);
+  var c = document.getSelection();
+  c.setPosition(a,1);
+  c.containsNode(document.body.firstChild);
+}
+</script>
+<body onload=go()>
+<!--a-->
+<time id="a" additive="replace">
+<option id="b">
diff --git a/dom/base/crashtests/1459688.html b/dom/base/crashtests/1459688.html
new file mode 100644
index 0000000000..63bd08b5c6
--- /dev/null
+++ b/dom/base/crashtests/1459688.html
@@ -0,0 +1,6 @@
+<!doctype html>
+<div id="host"></div>
+<script>
+  host.attachShadow({ mode: "open" }).innerHTML = `<style></style>`;
+  host.shadowRoot.styleSheets[0].foobie = host.shadowRoot;
+</script>
diff --git a/dom/base/crashtests/1460794.html b/dom/base/crashtests/1460794.html
new file mode 100644
index 0000000000..200e5801cf
--- /dev/null
+++ b/dom/base/crashtests/1460794.html
@@ -0,0 +1,19 @@
+<script>
+function go() {
+  b.addEventListener("DOMAttrModified", eh2);
+  e.setAttribute("lang", "en-us");
+}
+function eh1() {
+  a.getSVGDocument().adoptNode(c);
+}
+function eh2() {
+  d.addEventListener("DOMNodeRemoved", eh1);
+  d.innerHTML = undefined;
+}
+</script>
+<body onload=go()>
+<iframe id="a"></iframe>
+<a id="c"/>
+<g id="d">
+<mask id="b"/>
+<font-face-format id="e">
diff --git a/dom/base/crashtests/1462548.html b/dom/base/crashtests/1462548.html
new file mode 100644
index 0000000000..24eace10d1
--- /dev/null
+++ b/dom/base/crashtests/1462548.html
@@ -0,0 +1,13 @@
+<script>
+window.requestIdleCallback(function(){SpecialPowers.forceCC()});
+var limit = 0;
+function go() {
+limit++; if(limit > 2) { return; }
+  var b = document.createElement("blockquote").attachShadow({mode: "open"});
+  b.innerHTML = a.innerHTML;
+}
+</script>
+<data id="a">
+<audio>
+<source onerror="go()">
+<link>
diff --git a/dom/base/crashtests/149320-1.html b/dom/base/crashtests/149320-1.html
new file mode 100644
index 0000000000..d09b2c5ada
--- /dev/null
+++ b/dom/base/crashtests/149320-1.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+</head>
+<body>
+<div>Selection is HERE only</div>
+<script type="text/javascript">
+	selectedNode = document.getElementsByTagName("div").item(0);
+	testRange = document.createRange();
+
+	testRange.setStart(selectedNode, 13);
+	testRange.setEnd(selectedNode, 17);
+
+	document.body.appendChild(document.createTextNode("Text of Range: "+testRange));
+</script>
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/1505811.html b/dom/base/crashtests/1505811.html
new file mode 100644
index 0000000000..10be85c6dd
--- /dev/null
+++ b/dom/base/crashtests/1505811.html
@@ -0,0 +1,24 @@
+<html>
+
+<head>
+  <script>
+    function start() {
+      window.CustomElement0 = class extends HTMLElement {
+        constructor() {
+          super()
+        }
+        connectedCallback() {
+          this.before('', custom)
+          this.outerHTML = '<input pattern=""value=ð>'
+        }
+      }
+      customElements.define('custom-element-0', CustomElement0)
+      custom = document.createElementNS('http://www.w3.org/1999/xhtml', 'custom-element-0')
+      document.documentElement.appendChild(custom)
+    }
+
+    document.addEventListener('DOMContentLoaded', start)
+  </script>
+</head>
+
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/1505875.html b/dom/base/crashtests/1505875.html
new file mode 100644
index 0000000000..24a7d82a09
--- /dev/null
+++ b/dom/base/crashtests/1505875.html
@@ -0,0 +1,10 @@
+<script>
+function go() {
+  var r = document.getSelection().getRangeAt(0).cloneRange();
+  a.type = "";
+  r.insertNode(b);
+}
+</script>
+<body onload=go()>
+<input id="a" autofocus type="date">
+<summary id="b">x</summary>
diff --git a/dom/base/crashtests/1508845.html b/dom/base/crashtests/1508845.html
new file mode 100644
index 0000000000..470b19b674
--- /dev/null
+++ b/dom/base/crashtests/1508845.html
@@ -0,0 +1,17 @@
+<script>
+window.onload=function(){
+  let bigShadowTree = `<div>`;
+  for (let i = 0; i < 10; ++i)
+    bigShadowTree = bigShadowTree + bigShadowTree;
+  b.attachShadow({ mode: 'open' }).innerHTML = bigShadowTree;
+  // Create wrappers for all those elements.
+  [...b.shadowRoot.querySelectorAll('*')].forEach(() => {});
+  document.documentElement.addEventListener('DOMNodeRemoved', function(){
+    window.frames[0].document.body.appendChild(b)
+  })
+  window.frames[0].document.body.appendChild(a)
+}
+</script>
+<mark id='a'>
+<iframe></iframe>
+<div id='b'>
diff --git a/dom/base/crashtests/1516289.html b/dom/base/crashtests/1516289.html
new file mode 100644
index 0000000000..f6d4255213
--- /dev/null
+++ b/dom/base/crashtests/1516289.html
@@ -0,0 +1,14 @@
+<script>
+function eh1() {
+  a.remove()
+  window.event.composedPath()
+}
+function eh2() {
+  b.addEventListener("DOMNodeInserted", eh1)
+  c.insertAdjacentElement("afterBegin", document.createElement("s"))
+}
+</script>
+<image srcset="A" onerror="eh2()"></image>
+<marquee id="a">
+<time id="b">
+<dialog id="c">AA</dialog>
diff --git a/dom/base/crashtests/1516560.html b/dom/base/crashtests/1516560.html
new file mode 100644
index 0000000000..61c57e63d6
--- /dev/null
+++ b/dom/base/crashtests/1516560.html
@@ -0,0 +1,3 @@
+<script>
+  for (var i = 0; i < 10000; ++i) location.noSuchProp;
+</script>
diff --git a/dom/base/crashtests/1517025.html b/dom/base/crashtests/1517025.html
new file mode 100644
index 0000000000..795af0a3a9
--- /dev/null
+++ b/dom/base/crashtests/1517025.html
@@ -0,0 +1,5 @@
+<html>
+  <body>
+    <iframe src="/\b%9ª">
+  </body>
+</html>
diff --git a/dom/base/crashtests/1528675.html b/dom/base/crashtests/1528675.html
new file mode 100644
index 0000000000..122935c1f5
--- /dev/null
+++ b/dom/base/crashtests/1528675.html
@@ -0,0 +1,28 @@
+<script>
+function start() {
+  o14=window.document;
+  o432=document.createElement('audio');
+  o433=document.createElement('track');
+  o432.appendChild(o433);
+  o493=o432.textTracks;
+    o14.write('<html></html>');
+  o757=document.createElement('iframe');
+  o757.addEventListener('load', fun0, false);
+    document.documentElement.appendChild(o757);
+  o432.controls^=1;
+}
+function fun0(e) {
+  o1062=e.target;
+  o1063=o1062.contentWindow;
+  o1064=o1063.document;
+  document.documentElement.appendChild(o432);
+  setTimeout(fun1,240);
+}
+function fun1() {
+  o433.parentNode.removeChild(o433);
+  document.replaceChild(o1064.documentElement,document.documentElement);
+  SpecialPowers.forceGC();
+  SpecialPowers.forceCC();
+}
+</script>
+<body onload="start()"></body>
diff --git a/dom/base/crashtests/1529203-1.html b/dom/base/crashtests/1529203-1.html
new file mode 100644
index 0000000000..322a98f628
--- /dev/null
+++ b/dom/base/crashtests/1529203-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<iframe></iframe>
+<script>
+  function doIt() {
+    var doc = document.querySelector("iframe").contentDocument;
+    doc.open();
+    doc.write('<script>import("data:text/javascript,")</' + 'script>');
+    doc.close();
+  }
+  doIt();
+  setTimeout(() => {
+      doIt();
+      document.documentElement.removeAttribute("class");
+  }, 100);
+</script>
+</html>
diff --git a/dom/base/crashtests/1529203-2.html b/dom/base/crashtests/1529203-2.html
new file mode 100644
index 0000000000..edf071488a
--- /dev/null
+++ b/dom/base/crashtests/1529203-2.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<script>
+  var win = null;
+  function doIt() {
+    if (win === null) {
+      win = window.open();
+    }
+    var doc = win.document;
+    doc.open();
+    doc.write('<script>import("data:text/javascript,")</' + 'script>');
+    doc.close();
+  }
+  doIt();
+  setTimeout(() => {
+      doIt();
+      win.close();
+      document.documentElement.removeAttribute("class");
+  }, 100);
+</script>
+</html>
diff --git a/dom/base/crashtests/1529203-3.html b/dom/base/crashtests/1529203-3.html
new file mode 100644
index 0000000000..ce8c2a5633
--- /dev/null
+++ b/dom/base/crashtests/1529203-3.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<script>
+  var win;
+  function doIt() {
+    if (!win) {
+      win = window.open();
+    }
+    var doc = win.document;
+    doc.open();
+    doc.write('<script type="module" src="./module-with-syntax-error.js"></' + 'script>');
+    doc.close();
+  }
+  doIt()
+  setTimeout(() => {
+      doIt();
+      win.close();
+      document.documentElement.removeAttribute("class");
+  }, 100);
+</script>
+</html>
diff --git a/dom/base/crashtests/1555786.html b/dom/base/crashtests/1555786.html
new file mode 100644
index 0000000000..97740ad795
--- /dev/null
+++ b/dom/base/crashtests/1555786.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+  <script>
+    function start() {
+      const xhr = new XMLHttpRequest();
+      const observer = new ResizeObserver(entries => {
+        xhr.open('GET', '', false);
+        xhr.send();
+        typeof entries[0].borderBoxSize;
+        typeof entries[0].contentRect;
+        typeof entries[0].borderBoxSize;
+      })
+      observer.observe(document.getElementById('list'), {});
+      window.close();
+    }
+
+    document.addEventListener('DOMContentLoaded', start);
+  </script>
+</head>
+<body>
+  <li class="" id="list">
+</body>
+</html>
diff --git a/dom/base/crashtests/1566310.html b/dom/base/crashtests/1566310.html
new file mode 100644
index 0000000000..f00b168b70
--- /dev/null
+++ b/dom/base/crashtests/1566310.html
@@ -0,0 +1,24 @@
+<!doctype html>
+<html>
+<head>
+<script type="text/javascript">
+function noop() {}
+function crash() {
+  let div = document.querySelector("div");
+  let ifr = document.querySelector("iframe");
+
+  // We need a reference to the iframe's window from *before* it gets detached.
+  let win = ifr.contentWindow;
+
+  div.appendChild(ifr);
+
+  win.addEventListener("beforeunload", noop);
+  win.removeEventListener("beforeunload", noop);
+}
+</script>
+</head>
+<body onload="crash()">
+  <div></div>
+  <iframe></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/1577191.html b/dom/base/crashtests/1577191.html
new file mode 100644
index 0000000000..603157dd52
--- /dev/null
+++ b/dom/base/crashtests/1577191.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<script>
+  function start () {
+    const frame = document.createElement('frame')
+    document.documentElement.appendChild(frame)
+    const o1 = document.createElement('c')
+    o1.insertBefore(frame, o1.childNodes[0])
+    SpecialPowers.gc();
+    const xhr = new XMLHttpRequest()
+    xhr.open('P', '', false)
+    xhr.send()
+  }
+
+  document.addEventListener('DOMContentLoaded', start)
+</script>
diff --git a/dom/base/crashtests/1588259.html b/dom/base/crashtests/1588259.html
new file mode 100644
index 0000000000..6192b78ad1
--- /dev/null
+++ b/dom/base/crashtests/1588259.html
@@ -0,0 +1,21 @@
+<html class="reftest-wait">
+<script>
+if (location.search == "?x=") {
+  setTimeout(() => window.close(), 1000);
+} else {
+  document.fonts.onloadingdone = () => {
+    document.forms[1].submit();
+  };
+  window.onload = () => {
+    document.forms[0].submit();
+    setTimeout(() => {
+      document.documentElement.removeAttribute("class");
+    }, 1000);
+  };
+}
+</script>
+<body>
+<form target="bug1588259"><input name="x"></form>
+<form target="bug1588259"><input name="x"></form>
+</body>
+</html>
diff --git a/dom/base/crashtests/1611853.html b/dom/base/crashtests/1611853.html
new file mode 100644
index 0000000000..2d1a153d59
--- /dev/null
+++ b/dom/base/crashtests/1611853.html
@@ -0,0 +1,19 @@
+<html class="reftest-wait">
+<head>
+    <style>
+        * {
+            user-select: none;
+        }
+    </style>
+    <script>
+      function start () {
+        document.execCommand('selectAll', false);
+        document.documentElement.removeAttribute("class");
+      }
+    </script>
+</head>
+<body onload="start()">
+<div contentEditable="true"></div>
+</body>
+</html>
+
diff --git a/dom/base/crashtests/1619322.html b/dom/base/crashtests/1619322.html
new file mode 100644
index 0000000000..1e627a4bad
--- /dev/null
+++ b/dom/base/crashtests/1619322.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">
+    <iframe></iframe>
+    <script>
+      window.addEventListener('load', () => {
+        let doc = frames[0].document;
+        let count = 0;
+        let id = setInterval(function () {
+          if (!doc.documentElement) {
+            clearInterval(id);
+            document.documentElement.className = "";
+          }
+          doc.documentElement.replaceWith();
+        }, 312)
+        doc.addEventListener('DOMSubtreeModified', (e) => e.originalTarget.writeln(), false)
+      })
+    </script>
+</html>
diff --git a/dom/base/crashtests/1623918.html b/dom/base/crashtests/1623918.html
new file mode 100644
index 0000000000..0c991acbbc
--- /dev/null
+++ b/dom/base/crashtests/1623918.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+    <script>
+      window.addEventListener('load', () => {
+        const anchor = document.getElementById('id_7')
+        anchor.contentEditable = 'true'
+        anchor.spellcheck = false
+        const input = document.createElementNS('http://www.w3.org/1999/xhtml', 'input')
+        anchor.appendChild(input)
+        const selection = self.getSelection()
+        selection.selectAllChildren(input)
+      })
+    </script>
+</head>
+<a id='id_7'></a>
+</html>
diff --git a/dom/base/crashtests/1656925.html b/dom/base/crashtests/1656925.html
new file mode 100644
index 0000000000..3ebd9b53cb
--- /dev/null
+++ b/dom/base/crashtests/1656925.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+<script>
+      document.addEventListener('DOMContentLoaded', () => {
+        const area = document.createElementNS('http://www.w3.org/1999/xhtml', 'area')
+        document.documentElement.appendChild(area)
+        area.setAttribute('href', '')
+        for (let i = 0; i < 16; i++) {
+          area.setAttribute('download', '')
+        }
+        area.click()
+        object = document.createElementNS('http://www.w3.org/1999/xhtml', 'object')
+        document.documentElement.appendChild(object)
+        setTimeout("location.reload()", 100)
+      })
+    </script>
+</head>
+</html>
diff --git a/dom/base/crashtests/1665792.html b/dom/base/crashtests/1665792.html
new file mode 100644
index 0000000000..a1955a5d50
--- /dev/null
+++ b/dom/base/crashtests/1665792.html
@@ -0,0 +1,13 @@
+<html class="reftest-wait">
+<script>
+window.onload = () => {
+  window[0].stop()
+  window[0].onpagehide = document.createElement("frameset").onload
+  a.src = ""
+  setTimeout(function() {
+    SpecialPowers.wrap(window).printPreview()?.close()
+    document.documentElement.className = "";
+  }, 0);
+}
+</script>
+<iframe id="a"></iframe>
diff --git a/dom/base/crashtests/1681729-inner1.html b/dom/base/crashtests/1681729-inner1.html
new file mode 100644
index 0000000000..5aca8e6221
--- /dev/null
+++ b/dom/base/crashtests/1681729-inner1.html
@@ -0,0 +1 @@
+<iframe srcdoc="<iframe srcdoc=&quot;<p>Test&quot;>">
diff --git a/dom/base/crashtests/1681729-inner2.html b/dom/base/crashtests/1681729-inner2.html
new file mode 100644
index 0000000000..5aca8e6221
--- /dev/null
+++ b/dom/base/crashtests/1681729-inner2.html
@@ -0,0 +1 @@
+<iframe srcdoc="<iframe srcdoc=&quot;<p>Test&quot;>">
diff --git a/dom/base/crashtests/1681729.html b/dom/base/crashtests/1681729.html
new file mode 100644
index 0000000000..beb608eec9
--- /dev/null
+++ b/dom/base/crashtests/1681729.html
@@ -0,0 +1,30 @@
+<html class="reftest-wait">
+<head>
+<script>
+  async function test() {
+    // We need to go through the event loop first, so we're running this from 
+    // a timeout set from the load event. If we were adding a load from the load
+    // event directly we'd just replace the iframe's session history entry
+    // instead of cloning it (and replacing its children).
+    let frame = document.getElementById("frame");
+
+    let p = new Promise((r) => {
+      frame.addEventListener("load", r, { once: true });
+    });
+    frame.src = "1681729-inner2.html";
+    await p;
+
+    p = new Promise((r) => {
+      frame.contentWindow.addEventListener("pageshow", r, { once: true });
+    });
+    history.back();
+    await p;
+
+    document.documentElement.removeAttribute("class");
+  }
+</script>
+</head>
+<body onload="setTimeout(test, 0);">
+<iframe id="frame" src="1681729-inner1.html"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/1693049.html b/dom/base/crashtests/1693049.html
new file mode 100644
index 0000000000..9495aa39a2
--- /dev/null
+++ b/dom/base/crashtests/1693049.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <style>
+
+        * {
+            all: initial;
+            display: table-row-group !important
+        }
+    </style>
+    <script>
+      window.addEventListener('load', () => {
+        const mspace = document.getElementById('id_0')
+        const tfoot = document.createElement('tfoot')
+        const h5 = document.createElement('h5')
+        document.documentElement.appendChild(tfoot)
+        document.documentElement.appendChild(h5)
+        const range = new Range()
+        range.setStart(tfoot, NaN)
+        setTimeout(async () => selection.extend(h5, Nan), 107)
+        const selection = document.getSelection()
+        selection.addRange(range)
+        selection.modify('move', 'backward', 'character')
+        range.surroundContents(mspace)
+      })
+    </script>
+</head>
+<mspace id='id_0'></mspace>
+<input type='reset'>
+</html>
diff --git a/dom/base/crashtests/1697256.html b/dom/base/crashtests/1697256.html
new file mode 100644
index 0000000000..25024083e3
--- /dev/null
+++ b/dom/base/crashtests/1697256.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<meta charset="utf-8">
+<script>
+  window.onload = () => {
+    window.requestIdleCallback(() => {
+      SpecialPowers.wrap(self).printPreview()
+      setTimeout(() => {
+        document.documentElement.classList.remove("reftest-wait");
+      }, 250)
+    })
+  }
+</script>
+<select autofocus='true'>
diff --git a/dom/base/crashtests/1697525.html b/dom/base/crashtests/1697525.html
new file mode 100644
index 0000000000..b8180700d3
--- /dev/null
+++ b/dom/base/crashtests/1697525.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<script>
+  window.addEventListener('load', () => {
+    SpecialPowers.wrap(self).printPreview()?.print()
+  })
+</script>
diff --git a/dom/base/crashtests/1700237.html b/dom/base/crashtests/1700237.html
new file mode 100644
index 0000000000..779998b4f8
--- /dev/null
+++ b/dom/base/crashtests/1700237.html
@@ -0,0 +1,31 @@
+
+<style>
+:not(cursor) {
+  column-count: 1;
+  user-select: none;
+}
+</style>
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+  window.getSelection().modify("move", "backward", "line")
+  const interval = setInterval(() => {
+    const m = new MutationObserver(() => {
+      let x = document.getSelection().getRangeAt(0)
+      a.appendChild(document.createElement("optgroup"))
+      try {
+        x.comparePoint(document.activeElement, 1)
+      } catch (error) {
+        clearInterval(interval)
+        return
+      }
+
+    })
+    m.observe(b, {attributes: true})
+    b.setAttribute("x", "false")
+  }, 100)
+})
+</script>
+<hr contenteditable="true">
+<shadow id="a">
+<select autofocus="autofocus">a</select>
+<div id="b">a</div>
diff --git a/dom/base/crashtests/1712198.html b/dom/base/crashtests/1712198.html
new file mode 100644
index 0000000000..0778f45f26
--- /dev/null
+++ b/dom/base/crashtests/1712198.html
@@ -0,0 +1,9 @@
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  let a = document.documentElement
+  SpecialPowers.wrap(self).printPreview().document.adoptNode(a)
+  let b = document.createElementNS('http://www.w3.org/1999/xhtml', 'optgroup')
+  a.appendChild(b)
+  b.focus({ })
+})
+</script>
diff --git a/dom/base/crashtests/1728670-1-child.html b/dom/base/crashtests/1728670-1-child.html
new file mode 100644
index 0000000000..04dc33c9fa
--- /dev/null
+++ b/dom/base/crashtests/1728670-1-child.html
@@ -0,0 +1,12 @@
+<html>
+<script>
+document.documentElement.clientHeight;
+document.body.clientHeight;
+</script>
+<body>
+<script>
+document.documentElement.clientHeight;
+document.body.clientHeight;
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/1728670-1.html b/dom/base/crashtests/1728670-1.html
new file mode 100644
index 0000000000..71fc842200
--- /dev/null
+++ b/dom/base/crashtests/1728670-1.html
@@ -0,0 +1,3 @@
+<html>
+<iframe src="http://example.org/1728670-1-child.html" style="display: none;">
+</html>
diff --git a/dom/base/crashtests/1757923.html b/dom/base/crashtests/1757923.html
new file mode 100644
index 0000000000..d8e25a3a08
--- /dev/null
+++ b/dom/base/crashtests/1757923.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script>
+      class CustomElement extends HTMLElement {
+        constructor () {
+          super();
+        }
+      }
+
+      let element = document.createElement("custom-element");
+      customElements.define("custom-element", CustomElement);
+      customElements.upgrade(element);
+
+      const internals = element.attachInternals();
+      element = undefined;
+      SpecialPowers.forceGC();
+      SpecialPowers.forceCC();
+      internals.shadowRoot;
+    </script>
+  </head>
+</html>
diff --git a/dom/base/crashtests/1766472.html b/dom/base/crashtests/1766472.html
new file mode 100644
index 0000000000..80462766d1
--- /dev/null
+++ b/dom/base/crashtests/1766472.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script id="worker1" type="javascript/worker">
+        self.onmessage = async function (e) {
+          const abort = new AbortController()
+          self.close()
+          try { await self.scheduler.postTask(async () => abort.abort(undefined), { 'signal': abort.signal }) } catch (e) {}
+          self.queueMicrotask(async () => abort.abort(undefined))
+        }
+    </script>
+    <script>
+      document.addEventListener('DOMContentLoaded', () => {
+        const blob = new Blob([document.querySelector('#worker1').textContent], { type: 'text/javascript' })
+        const worker = new Worker(window.URL.createObjectURL(blob))
+        worker.postMessage([], [])
+      })
+    </script>
+</head>
+</html>
diff --git a/dom/base/crashtests/1780790.html b/dom/base/crashtests/1780790.html
new file mode 100644
index 0000000000..0bc4364763
--- /dev/null
+++ b/dom/base/crashtests/1780790.html
@@ -0,0 +1,15 @@
+<html  class="reftest-wait">
+  <head>
+    <script>
+      function test() {
+        let ac = new AbortController();
+        scheduler.postTask(()=> { ac.abort(); throw "Foobar";  }, { signal: ac.signal });
+        scheduler.postTask(()=> document.documentElement.removeAttribute('class'));
+      }
+    </script>
+    <style>
+    </style>
+  </head>
+  <body onload="test()">
+  </body>
+</html>
diff --git a/dom/base/crashtests/1811939.html b/dom/base/crashtests/1811939.html
new file mode 100644
index 0000000000..73dbbb4ce6
--- /dev/null
+++ b/dom/base/crashtests/1811939.html
@@ -0,0 +1,7 @@
+<html class="reftest-wait">
+<script>
+  import("data:text/javascript,0").catch(x => 0);
+  import("data:text/javascript,0").catch(x => 0);
+  setTimeout('document.documentElement.className = ""', 500);
+  window.stop();
+</script>
diff --git a/dom/base/crashtests/1822717-module.js b/dom/base/crashtests/1822717-module.js
new file mode 100644
index 0000000000..f4180c02c1
--- /dev/null
+++ b/dom/base/crashtests/1822717-module.js
@@ -0,0 +1,56 @@
+// Large (hence OMT compiled) module with a syntax error.
+
+this is a syntax error
+
+/*
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789
+*/
diff --git a/dom/base/crashtests/1822717.html b/dom/base/crashtests/1822717.html
new file mode 100644
index 0000000000..e328b209c7
--- /dev/null
+++ b/dom/base/crashtests/1822717.html
@@ -0,0 +1 @@
+<script type="module" src="1822717-module.js"></script>
diff --git a/dom/base/crashtests/1838484.html b/dom/base/crashtests/1838484.html
new file mode 100644
index 0000000000..c878492c5a
--- /dev/null
+++ b/dom/base/crashtests/1838484.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+  <script>
+    window.requestIdleCallback(() => {
+      window.print();
+      document.documentElement.className = "";
+    });
+  </script>
+  <template></template>
+</html>
diff --git a/dom/base/crashtests/205225-1.html b/dom/base/crashtests/205225-1.html
new file mode 100644
index 0000000000..26576d4d5c
--- /dev/null
+++ b/dom/base/crashtests/205225-1.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<script type="text/javascript">
+document.createTreeWalker(null, NodeFilter.SHOW_ALL, null);
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/231475-1.html b/dom/base/crashtests/231475-1.html
new file mode 100644
index 0000000000..4a0d997daa
--- /dev/null
+++ b/dom/base/crashtests/231475-1.html
@@ -0,0 +1,12 @@
+<html><body>
+<script type="text/javascript">
+//function doBold(){
+range = document.createRange();
+newNode = document.createElement("b");
+range.selectNodeContents(document);
+ 
+range.surroundContents(newNode)
+//}
+</script>
+text
+</body></html>
\ No newline at end of file
diff --git a/dom/base/crashtests/244933-1.html b/dom/base/crashtests/244933-1.html
new file mode 100644
index 0000000000..7eaf96cc31
--- /dev/null
+++ b/dom/base/crashtests/244933-1.html
@@ -0,0 +1,13 @@
+<html>
+<body>
+<pre>
+<script>
+document.write(window.sidebar.something);
+for (i in window.sidebar)
+{
+	break
+}
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/base/crashtests/275912-1.html b/dom/base/crashtests/275912-1.html
new file mode 100644
index 0000000000..08b5bc5fc5
--- /dev/null
+++ b/dom/base/crashtests/275912-1.html
@@ -0,0 +1,2 @@
+<HTML>
+><><BODY onLoad=*><
\ No newline at end of file
diff --git a/dom/base/crashtests/293388-1.html b/dom/base/crashtests/293388-1.html
new file mode 100644
index 0000000000..5c2e5c53c9
--- /dev/null
+++ b/dom/base/crashtests/293388-1.html
@@ -0,0 +1,26 @@
+<html class="reftest-wait"><head><title>Testcase bug 293388 - Overwriting of div innerHTML cause starting of the loading icon(circle) and some times browser can crash [@ nsRange::DeleteContents]</title></head>
+<script>
+function reallyClear()
+{
+  var par = document.getElementById("par");
+  var range = document.createRange();
+  range.selectNodeContents(par);
+  range.deleteContents();
+  document.documentElement.removeAttribute("class");
+}
+
+function clear()
+{
+  document.body.removeEventListener("DOMNodeRemoved", clear);
+  reallyClear();
+}
+
+function init()
+{
+  document.body.addEventListener("DOMNodeRemoved", clear);
+}
+
+</script>
+<body onload="init(); setTimeout(reallyClear, 10);">
+<div id="par"><span>1</span><span>2</span></div>
+</body></html>
\ No newline at end of file
diff --git a/dom/base/crashtests/325730-1.html b/dom/base/crashtests/325730-1.html
new file mode 100644
index 0000000000..113f697abc
--- /dev/null
+++ b/dom/base/crashtests/325730-1.html
@@ -0,0 +1,27 @@
+<html>
+
+<head>
+
+<script>
+
+function init()
+{
+  document.addEventListener("DOMNodeRemoved", meep);
+  document.body.appendChild(document.getElementById("b"));
+
+  function meep()
+  {
+    document.removeEventListener("DOMNodeRemoved", meep);
+    document.body.removeChild(document.getElementById("c"));
+  }
+}
+
+window.addEventListener("load", init);
+
+
+</script>
+
+</head>
+
+<body><div id="b"></div><div id="c"></div></body>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/326618-1.html b/dom/base/crashtests/326618-1.html
new file mode 100644
index 0000000000..926670ab63
--- /dev/null
+++ b/dom/base/crashtests/326618-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+</head>
+<body>
+<script>
+
+try {
+  document.body.removeChild(function(){});
+} catch (e) {
+}
+
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/326646-1.html b/dom/base/crashtests/326646-1.html
new file mode 100644
index 0000000000..5b654dd02c
--- /dev/null
+++ b/dom/base/crashtests/326646-1.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+
+<script>
+
+var dt;
+
+function init() { 
+  dt = document.implementation.createDocumentType("rheet", 0, 2);
+  dt.foopy = "quux";
+}
+
+init();
+
+</script>
+
+</head>
+
+<body>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/326865-1.html b/dom/base/crashtests/326865-1.html
new file mode 100644
index 0000000000..579e95c9ce
--- /dev/null
+++ b/dom/base/crashtests/326865-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<script>
+try {
+  window.getComputedStyle(null);
+} catch (e) {
+}
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/327571-1.html b/dom/base/crashtests/327571-1.html
new file mode 100644
index 0000000000..117f093510
--- /dev/null
+++ b/dom/base/crashtests/327571-1.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function init()
+{
+
+  var x = document.getElementById("d");
+  x.__proto__ = document.getElementById("f");
+  x.inputname;
+}
+
+</script>
+</head>
+
+<body onload="init();">
+
+<div id="d"></div>
+<form id="f"><input name="inputname"></form>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/327694.html b/dom/base/crashtests/327694.html
new file mode 100644
index 0000000000..132c02cf82
--- /dev/null
+++ b/dom/base/crashtests/327694.html
@@ -0,0 +1,17 @@
+<html>
<head>
+
+<script>
+
+function init()
+{
+  var y = document.getElementById("tt");
+  var z = y.firstChild;
+  y.removeChild(z);
+  z.text;
+}
+
+window.addEventListener("load", init);
+
+</script>
+
</head>

<body>

<div id="tt"><a href="http://www.mozilla.org">Foo</a></div>
+
</body>
</html>
diff --git a/dom/base/crashtests/327695-1.html b/dom/base/crashtests/327695-1.html
new file mode 100644
index 0000000000..a3d5562b3a
--- /dev/null
+++ b/dom/base/crashtests/327695-1.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+<script>
+document.createTextNode("").__proto__.__proto__ = null;
+document.createTextNode("");
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/329481-1.xhtml b/dom/base/crashtests/329481-1.xhtml
new file mode 100644
index 0000000000..3ba5477f3d
--- /dev/null
+++ b/dom/base/crashtests/329481-1.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<p>This page made Firefox leak domwindows and documents.</p>
+<span onmouseover="1"></span>
+<script>
+try {
+  window.__proto__ = document.createElement("div");
+} catch(e) {
+}
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/336381-1.xhtml b/dom/base/crashtests/336381-1.xhtml
new file mode 100644
index 0000000000..eac3eeb57a
--- /dev/null
+++ b/dom/base/crashtests/336381-1.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  var zz = document.getElementById("d").childNodes[0];
+
+  zz.parentNode.removeChild(zz);
+
+  var r = document.createRange();
+  r.setStart(zz, 0);
+  r.setEnd(zz, 0);
+
+  try {
+    r.insertNode(document.createTextNode('5'));
+  } catch (e) {
+  }
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<div id="d">3</div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/336715-1.xhtml b/dom/base/crashtests/336715-1.xhtml
new file mode 100644
index 0000000000..ad9d1430ad
--- /dev/null
+++ b/dom/base/crashtests/336715-1.xhtml
@@ -0,0 +1,40 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+<![CDATA[
+
+function funn()
+{
+  var q = document.getElementById("q");
+
+  var start1 = document.getElementById("start1");
+  var end1 = document.getElementById("end1");
+
+  var start2 = q; // div
+  var end2 = q.previousSibling; // text node
+
+  var r = document.createRange();
+  r.setStart(start1, 0);
+  r.setEnd(end1, 0);
+  r.deleteContents();
+  
+  // the offsets for start2 and end2 must be the same to trigger the assertion
+  var s = document.createRange();
+  s.setStart(start2, 0);
+  s.setEnd(end2, 0);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+</head>
+
+<body onload="setTimeout(funn, 30)">
+  <div id="start1"></div>
+  <div id="t">X<div id="q">Y</div></div>
+  <div id="end1"></div>
+</body>
+
+</html>
diff --git a/dom/base/crashtests/338391-1.xhtml b/dom/base/crashtests/338391-1.xhtml
new file mode 100644
index 0000000000..9366e0c0fd
--- /dev/null
+++ b/dom/base/crashtests/338391-1.xhtml
@@ -0,0 +1,33 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<script>
+
+function boom()
+{
+  var n = document.getElementById("n");
+
+  document.addEventListener("DOMNodeRemoved", foozle, false);
+  n.parentNode.removeChild(n);
+  document.removeEventListener("DOMNodeRemoved", foozle, false);
+
+  function foozle()
+  {
+    document.removeEventListener("DOMNodeRemoved", foozle, false); // prevent accidental recursion
+
+    n.parentNode.removeChild(n);
+    
+    document.documentElement.removeAttribute("class");
+  }
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 30)">
+
+<div id="n"></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/338674-1.xhtml b/dom/base/crashtests/338674-1.xhtml
new file mode 100644
index 0000000000..2cba227dcd
--- /dev/null
+++ b/dom/base/crashtests/338674-1.xhtml
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<script>
+
+function boom()
+{
+  var s = document.getElementById("s")
+  var t = s.previousSibling; // a whitespace text node..
+
+  document.addEventListener("DOMAttrModified", bang, false);
+  rM(s);
+  document.removeEventListener("DOMAttrModified", bang, false);
+
+  function bang(ev) {
+    document.removeEventListener("DOMAttrModified", bang, false); // avoid accidental recursion, multiple calls, etc.
+    rM(t);
+  }
+  
+  document.documentElement.removeAttribute("class");
+}
+
+function rM(n) { n.parentNode.removeChild(n); }
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 1);">
+
+<div><select><option>C</option></select></div>
+
+<span id="s">A <div>B</div></span>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/340733-1.html b/dom/base/crashtests/340733-1.html
new file mode 100644
index 0000000000..26d8fb9cdf
--- /dev/null
+++ b/dom/base/crashtests/340733-1.html
@@ -0,0 +1,28 @@
+<html class="reftest-wait">
+
+<head>
+<script type="text/javascript">
+
+
+function boom()
+{
+  var map = document.getElementById("map");
+  var table = document.getElementById("table");
+
+  map.appendChild(table);
+  map.childNodes[0].appendChild(document.createTextNode(' '));
+
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<img src="../../../testing/crashtest/images/tree.gif" usemap="#map">
+<map name="map" id="map"><area></map>
+<table aardvark="aardvark" id="table"><tbody><tr><td>Table</td></tr></tbody></table>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/343730-1.xhtml b/dom/base/crashtests/343730-1.xhtml
new file mode 100644
index 0000000000..82b5a26a8a
--- /dev/null
+++ b/dom/base/crashtests/343730-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<script>
+<![CDATA[
+
+var div;
+
+function boo()
+{  
+  var newSpan = document.createElement('span');
+  div = document.getElementById('div');
+
+  var newScript = document.createElement('script');
+  var nt = document.createTextNode("document.body.removeChild(div);");
+  newScript.appendChild(nt); 
+  newSpan.appendChild(newScript);
+  
+  div.appendChild(newSpan);
+
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+</head>
+
+<body onload="setTimeout(boo, 30);">
+
+<div id="div"></div>
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/343850-1.xhtml b/dom/base/crashtests/343850-1.xhtml
new file mode 100644
index 0000000000..4bf313062d
--- /dev/null
+++ b/dom/base/crashtests/343850-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<script>
+<![CDATA[
+
+function boom()
+{ 
+  var div = document.getElementById("div");
+  var embed = document.getElementById("embed");
+  embed.setAttribute("src", "javascript:'QQQQ'");
+  embed.removeAttribute("src");
+  document.body.appendChild(div);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<div id="div"><embed id="embed"/></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/343889-1.html b/dom/base/crashtests/343889-1.html
new file mode 100644
index 0000000000..8ea8bc28d3
--- /dev/null
+++ b/dom/base/crashtests/343889-1.html
@@ -0,0 +1,18 @@
+<Html class="reftest-wait">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=utf8">
+</head>
+<body onload="boom()">
+<iframe src="#" id="data"></iframe>
+<script>
+function boom() {
+var d=document.getElementById('data').contentDocument;
+d.clear()
+var text='Тест';
+d.write(text);
+d.close();
+document.documentElement.removeAttribute("class");
+}
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/344434-1.xhtml b/dom/base/crashtests/344434-1.xhtml
new file mode 100644
index 0000000000..28c5fc0e49
--- /dev/null
+++ b/dom/base/crashtests/344434-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+
+var XUL_NS = 'http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul';
+
+function foopy()
+{
+  document.getElementsByTagName("div")[0].appendChild(document.createElement("div"));
+  document.body.appendChild(document.createElementNS(XUL_NS, "toolbarpalette"))
+  document.body.appendChild(document.createElementNS(XUL_NS, "toolbar"))
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(foopy, 30);">
+  <div>A</div>
+</body>
+
+</html>
diff --git a/dom/base/crashtests/344882-1.html b/dom/base/crashtests/344882-1.html
new file mode 100644
index 0000000000..6a8dd69d5b
--- /dev/null
+++ b/dom/base/crashtests/344882-1.html
@@ -0,0 +1,33 @@
+<html class="reftest-wait">
+<head>
+<script>
+var obj;
+
+function boo()
+{
+  obj = document.getElementById("obj");
+  setScriptSrc();
+}
+
+function setScriptSrc()
+{
+  obj.data = "javascript:setScriptSrc2();";
+}
+
+function setScriptSrc2() 
+{
+  obj.data = "javascript:void 0";
+
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boo, 30);">
+
+<object data="../../../testing/crashtest/images/tree.gif" id="obj">
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/345837-1.xhtml b/dom/base/crashtests/345837-1.xhtml
new file mode 100644
index 0000000000..a1f010c5e2
--- /dev/null
+++ b/dom/base/crashtests/345837-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+<![CDATA[
+
+function foo()
+{
+  var r = document.createRange(); 
+  r.setStart(document.getElementById("a"), 0); 
+  r.setEnd(document.getElementById("b"), 0); 
+  window.getSelection().addRange(r);
+
+  var everything = document.getElementById("everything");
+  everything.remove();
+  
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(foo, 30);">
+
+<div id="everything">
+
+<div id="a">
+  <span id="b" />
+</div>
+
+</div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/346381-1.html b/dom/base/crashtests/346381-1.html
new file mode 100644
index 0000000000..4d0263d804
--- /dev/null
+++ b/dom/base/crashtests/346381-1.html
@@ -0,0 +1,16 @@
+<html>
+
+<head>
+</head>
+
+<body onload="window.zoop = document.getElementById('paz');">
+
+<p>Loading this page should not make Firefox leak DOMWindows or documents.</p>
+
+<div id="paz">
+<span onmouseover="6"></span>
+</div>
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/349355-1.html b/dom/base/crashtests/349355-1.html
new file mode 100644
index 0000000000..627bdc6d61
--- /dev/null
+++ b/dom/base/crashtests/349355-1.html
@@ -0,0 +1,41 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function zap()
+{
+  var j = document.getElementById("j");
+  j.remove();
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+<body onload="setTimeout(zap, 1);">
+
+
+<div>
+
+  <form>
+    <fieldset>
+      <div id="j">
+        <div>
+          <div>
+            <span>
+             <input type="submit">
+             <label></label>
+            </span>
+          </div>
+        </div>
+
+      </div>
+    </fieldset>
+  </form>
+
+</div>
+
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/359432-1.xhtml b/dom/base/crashtests/359432-1.xhtml
new file mode 100644
index 0000000000..391a4d1622
--- /dev/null
+++ b/dom/base/crashtests/359432-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+      class="reftest-wait">
+
+<head>
+
+<script>
+ 
+function boo()
+{
+  var tabbox = document.getElementById("tabbox");
+  document.body.removeChild(tabbox);
+  tabbox.setAttribute("context", "a");
+  document.documentElement.removeAttribute("class");
+}
+ 
+</script>
+
+</head>
+
+<body onload="setTimeout(boo, 30)">
+
+<xul:tabbox id="tabbox" />
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/360599-1.html b/dom/base/crashtests/360599-1.html
new file mode 100644
index 0000000000..c090088c0f
--- /dev/null
+++ b/dom/base/crashtests/360599-1.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<style>
+#b::first-letter { }
+#c::first-line { }
+</style>
+<title>Testcase bug 360599 - Crash [@ nsFrameList::DestroyFrames] with first-letter/first-line css and position: fixed</title>
+</head>
+<body>
+This page should not crash Mozilla
+<div id="c">
+  <table>
+    <div id="b" style="display:table-header-group;">
+      <q>
+        text
+        <div style="position:fixed;">
+          <q>y</q>
+        </div>
+      </q>  
+    </div>
+    <span style="display: table;"></span>
+</div>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/366200-1.xhtml b/dom/base/crashtests/366200-1.xhtml
new file mode 100644
index 0000000000..a604990cf6
--- /dev/null
+++ b/dom/base/crashtests/366200-1.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<script type="text/javascript">
+
+<![CDATA[
+
+function boom()
+{
+  var dE = document.documentElement;
+  var newSpan = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+  
+  document.addEventListener("DOMNodeRemoved", whee);
+  document.removeChild(dE);
+  document.removeEventListener("DOMNodeRemoved", whee);
+  
+  function whee()
+  {
+    document.removeEventListener("DOMNodeRemoved", whee);
+    document.insertBefore(newSpan, dE);
+  }
+}
+
+window.addEventListener("load", boom);
+
+]]>
+
+</script>
+</head>
+
+<body>
+<p>This text will disappear.  There should be no assertions.</p>
+</body>
+</html>
diff --git a/dom/base/crashtests/369219-1.xhtml b/dom/base/crashtests/369219-1.xhtml
new file mode 100644
index 0000000000..b44242d262
--- /dev/null
+++ b/dom/base/crashtests/369219-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  var select = document.getElementById("sss");
+  select.options.add.call(null, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<select id="sss"><option>foo</option></select>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/369413-1.html b/dom/base/crashtests/369413-1.html
new file mode 100644
index 0000000000..4fc3b7dfcc
--- /dev/null
+++ b/dom/base/crashtests/369413-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<script>
+try { atob(null); } catch(e) { }
+try { atob(""); } catch(e) { }
+try { atob("A="); } catch(e) { }
+try { atob("AA="); } catch(e) { }
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/371124-1-inner.html b/dom/base/crashtests/371124-1-inner.html
new file mode 100644
index 0000000000..d8fb45519d
--- /dev/null
+++ b/dom/base/crashtests/371124-1-inner.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  obj = document.getElementsByTagName("object")[0];
+  obj.__proto__ = null;
+  for (p in obj)
+    dump(p + "\n");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 200);">
+
+<object></object>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/371124-1.html b/dom/base/crashtests/371124-1.html
new file mode 100644
index 0000000000..ccefd3a324
--- /dev/null
+++ b/dom/base/crashtests/371124-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+<body>
+<iframe src="371124-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/371124-2-inner.html b/dom/base/crashtests/371124-2-inner.html
new file mode 100644
index 0000000000..7883093822
--- /dev/null
+++ b/dom/base/crashtests/371124-2-inner.html
@@ -0,0 +1,10 @@
+<html>
+<body>
+
+<script>
+  document.all.tags.__proto__ = null;
+  alert(document.all.tags)
+</script>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/371124-2.html b/dom/base/crashtests/371124-2.html
new file mode 100644
index 0000000000..93897635fa
--- /dev/null
+++ b/dom/base/crashtests/371124-2.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+<body>
+<iframe src="371124-2-inner.html"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/371466-1.xhtml b/dom/base/crashtests/371466-1.xhtml
new file mode 100644
index 0000000000..8da0b22b12
--- /dev/null
+++ b/dom/base/crashtests/371466-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  var marquee = document.getElementById("marquee");
+  var span = document.getElementById("span");
+  marquee.appendChild(span);
+  marquee.removeChild(span);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<marquee id="marquee" />
+
+<span id="span"><div>Foo</div><textarea/></span>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/372554-1.html b/dom/base/crashtests/372554-1.html
new file mode 100644
index 0000000000..a87edcecbf
--- /dev/null
+++ b/dom/base/crashtests/372554-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+  if (location.protocol == "file:") {
+    try {
+      location.hostname = 'foo';
+    } catch(e) {
+    }
+  }
+  
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(boom, 30)">
+
+</body>
+
+</html>
diff --git a/dom/base/crashtests/375399-1-inner.xhtml b/dom/base/crashtests/375399-1-inner.xhtml
new file mode 100644
index 0000000000..46573b49cd
--- /dev/null
+++ b/dom/base/crashtests/375399-1-inner.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:svg="http://www.w3.org/2000/svg">
+<svg:foreignObject x="0" y="0" width="100%" height="100%">
+<xul:tabs onselect="window.frameElement.parentNode.removeChild(window.frameElement)"><xul:tree id="t"/></xul:tabs>
+</svg:foreignObject>
+
+<html:script>
+function doe() {
+document.getElementById('t');
+}
+setTimeout(doe, 200);
+</html:script>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/375399-1.html b/dom/base/crashtests/375399-1.html
new file mode 100644
index 0000000000..8e50c7ef35
--- /dev/null
+++ b/dom/base/crashtests/375399-1.html
@@ -0,0 +1,11 @@
+<html class="reftest-wait">
+<head>
+<title>Testcase bug 375399 - Crash [@ nsElementSH::PostCreate] when removing window when accessing xul:tree in xul:tabs onselect in svg:foreignObject</title>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+</head>
+<body>
+<iframe id="content" src="./375399-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/377360-1.xhtml b/dom/base/crashtests/377360-1.xhtml
new file mode 100644
index 0000000000..77fa300bef
--- /dev/null
+++ b/dom/base/crashtests/377360-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  var div = document.getElementById("div");
+  div.textContent = String.fromCharCode(0xDCBF);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div id="div"></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/377960-1.html b/dom/base/crashtests/377960-1.html
new file mode 100644
index 0000000000..c61002eeea
--- /dev/null
+++ b/dom/base/crashtests/377960-1.html
@@ -0,0 +1,12 @@
+<html><head>
+
+</head>
+<body onblur="document.activeElement.style.display = 'none'" tabindex="4" onfocus="var x=document.getElementsByTagName('*');var i = Math.floor(Math.random()*x.length);x[i].focus()" style="overflow: scroll;">
+
+
+
+<iframe tabindex="2" style="overflow: scroll; display: inline; position: fixed; direction: rtl;"></iframe>
+
+<select onblur="event.target.setAttribute('tabindex', Math.floor(Math.random()*5)-9)" style="overflow: scroll; display: table; position: absolute; float: right; direction: rtl;"></select>
+
+</body></html>
\ No newline at end of file
diff --git a/dom/base/crashtests/377960-2.html b/dom/base/crashtests/377960-2.html
new file mode 100644
index 0000000000..dc42dc00d2
--- /dev/null
+++ b/dom/base/crashtests/377960-2.html
@@ -0,0 +1,7 @@
+<html>
+<head><title>Click the &lt;select&gt; to crash.</title></head>
+<body onfocus="document.documentElement.focus(); document.body.style.display = 'none';">
+<iframe style="position: fixed;"></iframe>
+<select style="position: absolute;"></select>
+</body>
+</html>
diff --git a/dom/base/crashtests/384663-1-inner.xhtml b/dom/base/crashtests/384663-1-inner.xhtml
new file mode 100644
index 0000000000..f2914ce0aa
--- /dev/null
+++ b/dom/base/crashtests/384663-1-inner.xhtml
@@ -0,0 +1,18 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<tree>
+  <splitter style="overflow: scroll;">
+    <treecols style="overflow: scroll; display: block;">
+      <treeitem id="mw_b" style=" display: list-item;"/>
+    </treecols>
+  </splitter>
+</tree>
+
+<script xmlns="http://www.w3.org/1999/xhtml">
+function doe() {
+window.addEventListener('DOMAttrModified', function(e) {document.removeChild(document.documentElement); }, true);
+ var y=document.getElementById('mw_b');
+  y.parentNode.removeChild(y);
+}
+setTimeout(doe, 200);
+</script>
+</window>
\ No newline at end of file
diff --git a/dom/base/crashtests/384663-1.html b/dom/base/crashtests/384663-1.html
new file mode 100644
index 0000000000..d357dfd8ad
--- /dev/null
+++ b/dom/base/crashtests/384663-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 500);
+</script>
+<body>
+<iframe src="384663-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/386000-1.html b/dom/base/crashtests/386000-1.html
new file mode 100644
index 0000000000..0363f0b693
--- /dev/null
+++ b/dom/base/crashtests/386000-1.html
@@ -0,0 +1,36 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<script>
+
+var de;
+
+function boom()
+{
+  de = document.documentElement;
+  document.addEventListener("DOMNodeRemoved", f);
+    
+  function f()
+  {
+    document.removeEventListener("DOMNodeRemoved", f);
+    de.appendChild(document.createElement("body"));
+  }
+    
+  document.removeChild(de);
+  
+  setTimeout(cont, 30);
+}
+
+function cont()
+{
+  document.appendChild(de);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+<body onload="setTimeout(boom, 30);">
+
+</body>
+</html>
diff --git a/dom/base/crashtests/386794-1.html b/dom/base/crashtests/386794-1.html
new file mode 100644
index 0000000000..4b50221688
--- /dev/null
+++ b/dom/base/crashtests/386794-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var weirdScript = document.createElementNS('http://example.com/foo', 'script');
+  document.body.appendChild(weirdScript);
+  document.body.innerHTML;
+}
+
+</script>
+</head>
+<body onload="boom()">
+</body>
+</html>
diff --git a/dom/base/crashtests/387460-1-inner.xhtml b/dom/base/crashtests/387460-1-inner.xhtml
new file mode 100644
index 0000000000..33b1891e7b
--- /dev/null
+++ b/dom/base/crashtests/387460-1-inner.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+<a id="a" href="#"></a>
+
+<table><tbody>
+<tr><td id="d"/></tr>
+<tr id="b"><td id="c"></td></tr>
+</tbody></table>
+
+
+<script>
+function doe() {
+ document.getElementById('b').appendChild(document.getElementById('c')); 
+ window.addEventListener('DOMAttrModified', function(e){document.getElementById('a').focus();}, true); 
+ document.getElementById('d').setAttribute('rowspan', 3); 
+}
+setTimeout(doe, 200);
+</script>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/387460-1.html b/dom/base/crashtests/387460-1.html
new file mode 100644
index 0000000000..bd1fc9353c
--- /dev/null
+++ b/dom/base/crashtests/387460-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="387460-1-inner.xhtml"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/399712-1.html b/dom/base/crashtests/399712-1.html
new file mode 100644
index 0000000000..58e9573090
--- /dev/null
+++ b/dom/base/crashtests/399712-1.html
@@ -0,0 +1,29 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("ta").style.overflow = "scroll";
+  setTimeout(boom2, 12);
+}
+
+function boom2()
+{
+  document.getElementById("ta").style.overflow = "";
+  setTimeout(boom, 12);
+}
+
+function cont()
+{
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="boom(); setTimeout(cont, 800);">
+
+<textarea id="ta">x</textarea>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/400763-1.html b/dom/base/crashtests/400763-1.html
new file mode 100644
index 0000000000..2de6720908
--- /dev/null
+++ b/dom/base/crashtests/400763-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+<script src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12NgYPgPAAEDAQDZqt2zAAAAAElFTkSuQmCC" charset="UTF-8"></script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/407818.html b/dom/base/crashtests/407818.html
new file mode 100644
index 0000000000..eea475be42
--- /dev/null
+++ b/dom/base/crashtests/407818.html
@@ -0,0 +1,5 @@
+<html>
+<head>
+</head>
+<body contenteditable="true" onload="document.execCommand('selectAll', false, null);"><ol> <li></li></ol></body>
+</html>
diff --git a/dom/base/crashtests/410860-1.xml b/dom/base/crashtests/410860-1.xml
new file mode 100644
index 0000000000..4a7414fc9b
--- /dev/null
+++ b/dom/base/crashtests/410860-1.xml
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:xlink="http://www.w3.org/1999/xlink" 
+     onload="document.getElementById('x').getBoundingClientRect();">
+
+<rect id="x"/>
+
+</svg>
+
diff --git a/dom/base/crashtests/411882-1.xhtml b/dom/base/crashtests/411882-1.xhtml
new file mode 100644
index 0000000000..6cd121044f
--- /dev/null
+++ b/dom/base/crashtests/411882-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body></body><textarea></textarea></html>
\ No newline at end of file
diff --git a/dom/base/crashtests/416734-1.html b/dom/base/crashtests/416734-1.html
new file mode 100644
index 0000000000..69350933c1
--- /dev/null
+++ b/dom/base/crashtests/416734-1.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+</head>
+
+<body style="direction: rtl; visibility: collapse; white-space: pre;"><span style="display: -moz-inline-box;"><span><span style="font-size: 0pt; border: 1px dotted red; white-space: -moz-pre-wrap;">
+
+X X }
+
+
+  </span>
+   </span></span></body>
+
+</html>
diff --git a/dom/base/crashtests/417852-1.html b/dom/base/crashtests/417852-1.html
new file mode 100644
index 0000000000..bf8ba34863
--- /dev/null
+++ b/dom/base/crashtests/417852-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+window.__proto__ = null;
+Object.prototype.__proto__ = window;
+
+</script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/base/crashtests/418928-1.html b/dom/base/crashtests/418928-1.html
new file mode 100644
index 0000000000..a3e42fe6f3
--- /dev/null
+++ b/dom/base/crashtests/418928-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.execCommand('selectAll', false, null);">
+
+<select><option contenteditable="true">A</option></select>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/420620-1.html b/dom/base/crashtests/420620-1.html
new file mode 100644
index 0000000000..74ae6dcbe3
--- /dev/null
+++ b/dom/base/crashtests/420620-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var a = document.documentElement;
+  var b = document.body;
+
+  document.removeChild(a);
+  b.contentEditable = "true";
+  document.appendChild(a);
+
+  function t() {
+    document.removeEventListener("DOMAttrModified", t);
+    document.removeChild(a);
+  } 
+
+  document.addEventListener("DOMAttrModified", t);
+  document.execCommand("insertunorderedlist", false, "<h1>");
+  document.removeEventListener("DOMAttrModified", t);
+}
+
+</script>
+</head>
+
+<body onload="boom()"></body>
+</html>
diff --git a/dom/base/crashtests/424276-1.html b/dom/base/crashtests/424276-1.html
new file mode 100644
index 0000000000..feb39bf33d
--- /dev/null
+++ b/dom/base/crashtests/424276-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  window.getSelection().selectAllChildren(document.createTextNode("\n\n"));
+  window.getSelection().addRange(document.createRange());
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
diff --git a/dom/base/crashtests/426987-1.html b/dom/base/crashtests/426987-1.html
new file mode 100644
index 0000000000..7d277156e1
--- /dev/null
+++ b/dom/base/crashtests/426987-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<iframe src="data:text/html,<html><body onunload=&quot;parent.document.body.style.overflow = 'auto';&quot;></body></html>"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/43040-1.html b/dom/base/crashtests/43040-1.html
new file mode 100644
index 0000000000..00165763c4
--- /dev/null
+++ b/dom/base/crashtests/43040-1.html
@@ -0,0 +1,19 @@
+<HTML>
+<HEAD>
+<META NAME="GENERATOR" Content="Microsoft Visual Studio 6.0">
+<script>
+var xmlDoc;
+
+function createDoc()
+{
+	var xmlDoc = document.implementation.createDocument("", "", null);
+	var xmlElem = xmlDoc.firstChild;
+	xmlElem.appendChild(document.createTextNode("blabla"));
+	xmlElem.firstChild.nodeValue;
+}
+</script>
+
+</HEAD>
+<BODY onload="createDoc();">
+</BODY>
+</HTML>
diff --git a/dom/base/crashtests/439206-1.html b/dom/base/crashtests/439206-1.html
new file mode 100644
index 0000000000..688ebe44d5
--- /dev/null
+++ b/dom/base/crashtests/439206-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var s = document.createElement("STYLE");
+  var t = document.createTextNode("\uDB00x"); // a high surrogate followed by 'x'
+  document.documentElement.appendChild(s);
+  s.appendChild(t);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+</body>
+</html>
diff --git a/dom/base/crashtests/443538-1.svg b/dom/base/crashtests/443538-1.svg
new file mode 100644
index 0000000000..cb7388a7cd
--- /dev/null
+++ b/dom/base/crashtests/443538-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     onload="document.getElementById('use').removeChild(document.getElementById('s'));">
+
+  <use id="use" xlink:href="#s"><g id="s"/></use>
+
+</svg>
diff --git a/dom/base/crashtests/448615-1.html b/dom/base/crashtests/448615-1.html
new file mode 100644
index 0000000000..bfb4f365a1
--- /dev/null
+++ b/dom/base/crashtests/448615-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div:first-letter { float: right; }
+
+</style>
+</head>
+
+<body><div>A</div></body>
+
+</html>
diff --git a/dom/base/crashtests/450383-1.html b/dom/base/crashtests/450383-1.html
new file mode 100644
index 0000000000..3c95b966ce
--- /dev/null
+++ b/dom/base/crashtests/450383-1.html
@@ -0,0 +1,9 @@
+<html>
+<BODY></BODY>
+<SCRIPT>
+    document.addEventListener("DOMCharacterDataModified",function(){
+        document.body.innerHTML=""; // change this to see memory corruption
+    },true);
+    document.body.innerHTML="<optGroup</form<textArea";
+</SCRIPT>
+</html>
diff --git a/dom/base/crashtests/450385-1.html b/dom/base/crashtests/450385-1.html
new file mode 100644
index 0000000000..e75159c51d
--- /dev/null
+++ b/dom/base/crashtests/450385-1.html
@@ -0,0 +1,11 @@
+<html>
+<BODY></BODY>
+<SCRIPT>
+document.body.addEventListener("DOMCharacterDataModified", function () {
+    document.body.innerHTML = "";
+    eventChild.appendChild(event.relatedNode);
+}, true);
+document.addEventListener("DOMNodeInserted", function () {}, true);
+document.body.innerHTML="]<kbd><small></kbd><base><optGroup></optGroup>";
+</SCRIPT>
+</html>
diff --git a/dom/base/crashtests/458637-1-inner.xhtml b/dom/base/crashtests/458637-1-inner.xhtml
new file mode 100644
index 0000000000..f91d6e5b4c
--- /dev/null
+++ b/dom/base/crashtests/458637-1-inner.xhtml
@@ -0,0 +1,4 @@
+<?xml-stylesheet type="text/xsl" href="#a"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<xsl:stylesheet version="1.0" id="a" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"/>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/458637-1.html b/dom/base/crashtests/458637-1.html
new file mode 100644
index 0000000000..124846fcbe
--- /dev/null
+++ b/dom/base/crashtests/458637-1.html
@@ -0,0 +1,29 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+var iterations = 0;
+var start = new Date();
+
+function boom()
+{
+  document.getElementById("i").style.overflow = "scroll";
+  document.getElementById("i").src = document.getElementById("i").src;
+  setTimeout(boom2, 10); // must be a short timeout
+}
+
+function boom2()
+{
+  document.getElementById("i").style.overflow = "";
+  var now = new Date();
+  if (++iterations < 20 && now - start < 5000)
+    setTimeout(boom, 10);
+  else
+    document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();"><iframe id="i" src="458637-1-inner.xhtml" style="visibility: collapse;"></iframe></body>
+</html>
diff --git a/dom/base/crashtests/462947.html b/dom/base/crashtests/462947.html
new file mode 100644
index 0000000000..09581b3081
--- /dev/null
+++ b/dom/base/crashtests/462947.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+navigator.mimeTypes.length;
+navigator.mimeTypes.length;
+
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/dom/base/crashtests/467392.html b/dom/base/crashtests/467392.html
new file mode 100644
index 0000000000..a64044c6ea
--- /dev/null
+++ b/dom/base/crashtests/467392.html
@@ -0,0 +1,4 @@
+<script>
+document.write(document.body.innerHTML);
+window.location.reload();
+</script>
diff --git a/dom/base/crashtests/472593-1.html b/dom/base/crashtests/472593-1.html
new file mode 100644
index 0000000000..ad8fe34bfa
--- /dev/null
+++ b/dom/base/crashtests/472593-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<body onload="document.getElementById('t').value = '';">
+<textarea rows="10" cols="1" wrap="hard" id="t">&#9;&#9;</textarea>
+</body>
+</html>
diff --git a/dom/base/crashtests/474041-1.svg b/dom/base/crashtests/474041-1.svg
new file mode 100644
index 0000000000..2b8351472c
--- /dev/null
+++ b/dom/base/crashtests/474041-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="boom();">
+
+<rect id="r"/><use id="u" xlink:href="#r"><rect id="r"/></use>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var r1 = document.getElementsByTagName("rect")[0]; // the first node with id="r" 
+  var use = document.getElementById("u");
+  document.documentElement.insertBefore(use, r1);
+  r1.appendChild(use);
+}
+
+</script>
+
+</svg>
diff --git a/dom/base/crashtests/476526.html b/dom/base/crashtests/476526.html
new file mode 100644
index 0000000000..b3d8f8e1c8
--- /dev/null
+++ b/dom/base/crashtests/476526.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<iframe src="data:text/xml,
+  <html xmlns='http://www.w3.org/1999/xhtml'
+   onDOMAttrModified='window.frameElement.parentNode.removeChild(window.frameElement)'>
+  </html>"
+ onload="event.target.contentDocument.documentElement.setAttribute('x', 'y');"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/483818-1.html b/dom/base/crashtests/483818-1.html
new file mode 100644
index 0000000000..11cc7c4aca
--- /dev/null
+++ b/dom/base/crashtests/483818-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script>
+function appendScript(doc) {
+  var s = doc.createElement("script");
+  s.textContent = "document.write('executed'); document.close()";
+  doc.body.appendChild(s);
+}
+    </script>
+  </head>
+  <body onload="appendScript(window.document)">
+  </body>
+</html>
diff --git a/dom/base/crashtests/490760-1.xhtml b/dom/base/crashtests/490760-1.xhtml
new file mode 100644
index 0000000000..988f7c12ba
--- /dev/null
+++ b/dom/base/crashtests/490760-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  var q = document.getElementsByTagName("style")[0];
+  
+  window.addEventListener("DOMNodeRemoved", f);
+  q.innerHTML = "<span><\/span>";
+  window.removeEventListener("DOMNodeRemoved", f);
+
+  function f()
+  {
+    window.removeEventListener("DOMNodeRemoved", f);
+    q.removeChild(q.childNodes[1]);
+  }
+}
+
+]]>
+</script>
+</head>
+<body onload="boom();"><style><span></span><span></span></style></body>
+</html>
diff --git a/dom/base/crashtests/493281-1.html b/dom/base/crashtests/493281-1.html
new file mode 100644
index 0000000000..6dd3dd4a15
--- /dev/null
+++ b/dom/base/crashtests/493281-1.html
@@ -0,0 +1,7 @@
+<html>
+    <body>
+        <div id="foo">
+            <script>with (document.all) foo</script>
+        </div>
+    </body>
+</html>
diff --git a/dom/base/crashtests/493281-2.html b/dom/base/crashtests/493281-2.html
new file mode 100644
index 0000000000..2369624694
--- /dev/null
+++ b/dom/base/crashtests/493281-2.html
@@ -0,0 +1,12 @@
+<html>
+    <body>
+        <div id="foo">
+            <script>
+                function get(x) { return x }
+                obj = {};
+                obj.__proto__ = get(document.all);
+                obj.foo
+            </script>
+        </div>
+    </body>
+</html>
diff --git a/dom/base/crashtests/494810-1.html b/dom/base/crashtests/494810-1.html
new file mode 100644
index 0000000000..e0036cd836
--- /dev/null
+++ b/dom/base/crashtests/494810-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.domain = "[";
+  window.sessionStorage;
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/499006-1.html b/dom/base/crashtests/499006-1.html
new file mode 100644
index 0000000000..f02720b847
--- /dev/null
+++ b/dom/base/crashtests/499006-1.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function select(start, startOffset, end, endOffset) {
+  var sel = getSelection();
+  sel.removeAllRanges();
+  var range = document.createRange();
+  range.setStart(start, startOffset);
+  range.setEnd(end, endOffset);
+  sel.addRange(range);
+}
+
+function boom() {
+  var p = document.body;
+  select(p.childNodes[0],0,p.childNodes[0],1);
+  sel = getSelection();
+  range = sel.getRangeAt(0);
+  range.detach();
+  range.insertNode(p);
+}
+
+</script>
+</head>
+<body onload="boom()"><span>Hello Kitty</span></body>
+</html>
diff --git a/dom/base/crashtests/499006-2.html b/dom/base/crashtests/499006-2.html
new file mode 100644
index 0000000000..86907c5bb6
--- /dev/null
+++ b/dom/base/crashtests/499006-2.html
@@ -0,0 +1,35 @@
+<html>
+<head>
+<script>
+function extractc(j) {
+var sel = window.getSelection();
+
+
+var b=document.getElementById('b');
+
+var range =document.createRange();
+range.setStart(document.documentElement, 0);
+range.setEnd(document.documentElement, 0);
+sel.addRange(range);
+range.extractContents();
+
+range.setStart(b, 0);
+range.setEnd(b, 0);
+sel.addRange(range);
+range.extractContents();
+
+
+range.setStart(b, 0);
+range.setEnd(b, 0);
+sel.addRange(range);
+range.extractContents();
+
+
+}
+setTimeout(extractc,200,0);
+</script>
+<title id="b"></title>
+</head>
+<body>
+</body>
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/502617.html b/dom/base/crashtests/502617.html
new file mode 100644
index 0000000000..4d4487817f
--- /dev/null
+++ b/dom/base/crashtests/502617.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+var a = {};
+a instanceof HTMLImageElement;
+
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/dom/base/crashtests/504224.html b/dom/base/crashtests/504224.html
new file mode 100644
index 0000000000..713085166b
--- /dev/null
+++ b/dom/base/crashtests/504224.html
@@ -0,0 +1,29 @@
+<html class="reftest-wait">
+<head>
+<title>Crash [@ nsFocusManager::GetClosestCommonInclusiveAncestor], part 2</title>
+</head>
+<body>
+<script>
+function oniframeload() {
+  window.frames[0].location.reload();
+};
+</script>
+<iframe src="file_504224.html" id="content" onload="oniframeload();" ></iframe>
+<script>
+var src='file_504224.html';
+setInterval(function() {
+  var x = document.getElementById('content');
+  if (!x) {
+    x=document.createElement('iframe');
+    x.src=src;
+    x.id = 'content';
+    document.body.appendChild(x);
+    setTimeout(function() {
+      window.focus();
+      document.documentElement.removeAttribute('class');
+    }, 100);
+  }
+}, 500);
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/509536-1.html b/dom/base/crashtests/509536-1.html
new file mode 100644
index 0000000000..9881646013
--- /dev/null
+++ b/dom/base/crashtests/509536-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var frame = document.createElement("iframe");
+  frame.setAttribute("src", "1");
+  document.body.appendChild(frame);
+  frame.setAttribute("src", "2");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/522516-1.html b/dom/base/crashtests/522516-1.html
new file mode 100644
index 0000000000..87891ea198
--- /dev/null
+++ b/dom/base/crashtests/522516-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('a').appendChild(document.getElementById('b'));">
+
+<div id="b"></div>
+<div style="filter: url(#b);"></div>
+<div id="a"></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/529670.html b/dom/base/crashtests/529670.html
new file mode 100644
index 0000000000..52e66ab8c2
--- /dev/null
+++ b/dom/base/crashtests/529670.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html><head>
+    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+    <title>Testcase for bug 529670</title>
+<script>
+function boom() {
+  document.createRange().getClientRects()
+  document.createRange().getBoundingClientRect()
+
+  var range = document.createRange();
+  range.detach();
+  range.getClientRects()
+  range.getBoundingClientRect()
+}
+</script>
+</head>
+<body onload="boom()"></body>
+</html>
diff --git a/dom/base/crashtests/535926-1.html b/dom/base/crashtests/535926-1.html
new file mode 100644
index 0000000000..b59c10cbdd
--- /dev/null
+++ b/dom/base/crashtests/535926-1.html
@@ -0,0 +1,28 @@
+<html class="reftest-wait">
+<head>
+
+<script type="text/javascript">
+
+var i = 0;
+function mmf()
+{
+  if (++i == 2) {
+    document.body.innerHTML = "<marquee>";
+    document.documentElement.removeAttribute("class");
+  }
+}
+
+function init()
+{
+  document.documentElement.offsetHeight;
+  for (var j = 0; j < 2; ++j) {
+    var iframe = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+    iframe.addEventListener("load", mmf);
+    document.body.appendChild(iframe);
+  }
+}
+
+</script>
+</head>
+<body onload="setTimeout(init, 0);"></body>
+</html>
diff --git a/dom/base/crashtests/543645.html b/dom/base/crashtests/543645.html
new file mode 100644
index 0000000000..c9b80f4cdf
--- /dev/null
+++ b/dom/base/crashtests/543645.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<body> <span></span> <script>
+function boom() {
+  var range = document.createRange();
+  range.setEnd(document.body.childNodes[2], 0);
+  window.addEventListener("DOMNodeInserted", f, true);
+  function f() {
+    window.removeEventListener("DOMNodeInserted", f, true);
+    range.deleteContents();
+  }
+  range.deleteContents();
+}
+window.addEventListener("load", boom);
+</script>
diff --git a/dom/base/crashtests/551631-1.html b/dom/base/crashtests/551631-1.html
new file mode 100644
index 0000000000..90a84ce584
--- /dev/null
+++ b/dom/base/crashtests/551631-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<base href="javascript:5">
+<script>
+
+function boom()
+{
+  var head = document.getElementsByTagName("head")[0];
+  var s = document.createElement("script");
+  s.async = "async";
+  s.src = "useBaseHrefAndFail";
+  s.q = "q";
+  head.appendChild(s);
+  head.removeChild(s);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/552651.html b/dom/base/crashtests/552651.html
new file mode 100644
index 0000000000..7db14f52a4
--- /dev/null
+++ b/dom/base/crashtests/552651.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+  <title>Testcase for bug 552651</title>
+  <script class="testbody" type="text/javascript">
+
+function testCancel() {
+  var xhr = new XMLHttpRequest();
+  xhr.addEventListener("readystatechange", function(e) {
+    if (xhr.readyState == 3) // NOTE : only leaks for state == 3
+      xhr.abort();
+    else if (xhr.readyState == 4)
+      document.documentElement.className = "";
+  });
+
+  xhr.open("GET", "552651.xml", true);
+  xhr.send();
+}
+</script>
+</head>
+<body onload="testCancel()">
+This test should not leak...
+</body>
+</html>
+
diff --git a/dom/base/crashtests/552651.xml b/dom/base/crashtests/552651.xml
new file mode 100644
index 0000000000..b04b966cfa
--- /dev/null
+++ b/dom/base/crashtests/552651.xml
@@ -0,0 +1,2 @@
+<foo>test</foo>
+
diff --git a/dom/base/crashtests/554230-1.xhtml b/dom/base/crashtests/554230-1.xhtml
new file mode 100644
index 0000000000..28801ccfa4
--- /dev/null
+++ b/dom/base/crashtests/554230-1.xhtml
@@ -0,0 +1,15 @@
+<html class="reftest-wait" xmlns="http://www.w3.org/1999/xhtml"><iframe contenteditable="true"></iframe><span></span><script style="display: none;" id="fuzz1" type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  document.getElementsByTagName("iframe")[0].focus();
+  document.getElementsByTagName("span")[0].appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "div"));
+  document.execCommand("selectAll", false, null);
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom);
+
+]]>
+</script></html>
diff --git a/dom/base/crashtests/558973.html b/dom/base/crashtests/558973.html
new file mode 100644
index 0000000000..878b8c9259
--- /dev/null
+++ b/dom/base/crashtests/558973.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+var child = document.createTextNode("a");
+
+var attr = document.createAttribute("a");
+try {
+    attr.appendChild(child);
+}
+catch (e) {
+}
+
+</script>
+</head>
+</html>
diff --git a/dom/base/crashtests/564079-1.html b/dom/base/crashtests/564079-1.html
new file mode 100644
index 0000000000..1c97ff9677
--- /dev/null
+++ b/dom/base/crashtests/564079-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+document.createTextNode("x").lookupPrefix("");
+
+</script>
+</head>
+</html>
diff --git a/dom/base/crashtests/564114.html b/dom/base/crashtests/564114.html
new file mode 100644
index 0000000000..93786e2221
--- /dev/null
+++ b/dom/base/crashtests/564114.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+<script type="text/javascript">
+
+document.documentElement.compareDocumentPosition(null);
+
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/dom/base/crashtests/565125-1.html b/dom/base/crashtests/565125-1.html
new file mode 100644
index 0000000000..ceeb923f4c
--- /dev/null
+++ b/dom/base/crashtests/565125-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var a = document.createTextNode(" ");
+  (document.documentElement).appendChild(a);
+  var b = document.createElement("span");
+  (document.documentElement).appendChild(b);
+  var c = document.createTextNode(" ");
+  (document.documentElement).appendChild(c);
+  var r = document.createRange();
+  r.setStart(a, 0); 
+  r.setEnd(c, 0); 
+  try {
+    r.surroundContents(document.documentElement); 
+  } catch(e) {
+  }
+  document.documentElement.appendChild(b);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/575462.svg b/dom/base/crashtests/575462.svg
new file mode 100644
index 0000000000..8131d5f1fd
--- /dev/null
+++ b/dom/base/crashtests/575462.svg
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<g id="a"><g id="b"/></g>
+
+<script type="text/javascript">
+<![CDATA[
+
+function j()
+{
+  var a = document.getElementById("a");
+  var b = document.getElementById("b");
+  window.addEventListener("DOMAttrModified", k, true);
+  function k()
+  {
+    window.removeEventListener("DOMAttrModified", k, true);
+    a.appendChild(b);
+  }
+  b.removeAttribute("id");
+}
+
+window.addEventListener("load", j, false);
+
+]]>
+</script>
+</svg>
diff --git a/dom/base/crashtests/582601.html b/dom/base/crashtests/582601.html
new file mode 100644
index 0000000000..4fb854a42c
--- /dev/null
+++ b/dom/base/crashtests/582601.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+	<title>Crashtest</title>
+<script>
+var attr = document.createAttribute("foo");
+attr.lookupPrefix("");
+</script>
+</head>
+<body>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/590395-1.html b/dom/base/crashtests/590395-1.html
new file mode 100644
index 0000000000..3b653c5e71
--- /dev/null
+++ b/dom/base/crashtests/590395-1.html
@@ -0,0 +1,5 @@
+<html>
+<body onload="document.createElement('div').appendChild(document.getElementById('i').contentDocument.getElementById('j'));">
+<iframe id="i" src="data:text/html,<img id='j' src='about:blank'>">
+</body>
+</html>
diff --git a/dom/base/crashtests/593302-1.html b/dom/base/crashtests/593302-1.html
new file mode 100644
index 0000000000..96d731cfb4
--- /dev/null
+++ b/dom/base/crashtests/593302-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <head>
+    <script type="text/javascript">
+      function boom()
+      {
+        iframe = document.getElementById("iframe");
+        iframeBody = iframe.contentDocument.body;
+        iframeBody.appendChild(makeNamedSpan("w"));
+        remove(iframe);
+        iframeBody.appendChild(makeNamedSpan("w"));
+        remove(iframeBody);
+        document.documentElement.className = "";
+      }
+
+      function makeNamedSpan(i)
+      {
+        var s = document.createElement("span");
+        s.id = i;
+        return s;
+      }
+
+      function remove(n)    { n.remove(); }
+    </script>
+  </head>
+  <body onload="boom();">
+    <iframe id="iframe" srcdoc="<html>S</html>"></iframe>
+  </body>
+</html>
diff --git a/dom/base/crashtests/593302-2.html b/dom/base/crashtests/593302-2.html
new file mode 100644
index 0000000000..60e77d4881
--- /dev/null
+++ b/dom/base/crashtests/593302-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+  <body>
+    <!-- This test should not leak. -->
+    <iframe src="data:text/html,
+      <script>
+        var elem = document.createElement('span');
+        document.mozSetImageElement('foo', elem);
+        elem.foo = document;
+      </script>"></iframe>
+  </body>
+</html>
diff --git a/dom/base/crashtests/595606-1.html b/dom/base/crashtests/595606-1.html
new file mode 100644
index 0000000000..82cae26363
--- /dev/null
+++ b/dom/base/crashtests/595606-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <body onload="
+    document.body.removeChild(document.getElementById('x'));
+    document.documentElement.removeAttribute('class');">
+
+    <div id="x">
+      <div id="a">
+        <form id="a">
+          <select></select>
+        </form>
+      </div>
+    </div>
+
+    <select form="a"></select>
+  </body>
+</html>
diff --git a/dom/base/crashtests/595606-2.html b/dom/base/crashtests/595606-2.html
new file mode 100644
index 0000000000..3cab264c0d
--- /dev/null
+++ b/dom/base/crashtests/595606-2.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+  <body onload="
+    document.body.removeChild(document.getElementById('x'));
+    document.documentElement.removeAttribute('class');">
+
+    <div id="x">
+      <form id="a">
+        <select></select>
+      </form>
+      <form id="a">
+        <select></select>
+      </form>
+    </div>
+
+    <select form="a"></select>
+  </body>
+</html>
diff --git a/dom/base/crashtests/601247.html b/dom/base/crashtests/601247.html
new file mode 100644
index 0000000000..6eb9f46574
--- /dev/null
+++ b/dom/base/crashtests/601247.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var x = document.createTextNode("x");
+x.__proto__ = localStorage;
+for (var p in x) {};
+
+</script>
diff --git a/dom/base/crashtests/603531.html b/dom/base/crashtests/603531.html
new file mode 100644
index 0000000000..8243e462e1
--- /dev/null
+++ b/dom/base/crashtests/603531.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var frame = document.getElementById("f");
+  var frameWindow = frame.contentWindow;
+  document.body.removeChild(frame);
+  document.body.setUserData("x", frameWindow, null);
+  document.body.setUserData("x", "", null);
+}
+
+</script>
+</head>
+<body onload="boom();"><iframe id="f" src="data:text/html,"></iframe></body>
+</html>
diff --git a/dom/base/crashtests/604262-1.html b/dom/base/crashtests/604262-1.html
new file mode 100644
index 0000000000..4ece25e855
--- /dev/null
+++ b/dom/base/crashtests/604262-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var inputElem = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+inputElem.QueryInterface(Ci.imgIDecoderObserver);
+inputElem.onStartDecode(null);
+
+</script>
diff --git a/dom/base/crashtests/605672-1.svg b/dom/base/crashtests/605672-1.svg
new file mode 100644
index 0000000000..b929b26691
--- /dev/null
+++ b/dom/base/crashtests/605672-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<script>
+function boom()
+{
+  var fr = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+  fr.src = "data:text/html,X";
+  document.documentElement.appendChild(fr);
+  var docType = fr.contentDocument.implementation.createDocumentType(undefined, "", "");
+  document.removeChild(document.documentElement);
+  document.appendChild(docType);
+}
+
+window.addEventListener("load", boom, false);
+</script>
+
+</svg>
diff --git a/dom/base/crashtests/606729-1.html b/dom/base/crashtests/606729-1.html
new file mode 100644
index 0000000000..c81479c20b
--- /dev/null
+++ b/dom/base/crashtests/606729-1.html
@@ -0,0 +1 @@
+<script async src="data:">0</script>
diff --git a/dom/base/crashtests/607222.html b/dom/base/crashtests/607222.html
new file mode 100644
index 0000000000..a9491b3429
--- /dev/null
+++ b/dom/base/crashtests/607222.html
@@ -0,0 +1,21 @@
+<html><body>
+<script>
+
+  function G(str){
+    var cobj=document.createElement(str);
+    document.body.appendChild(cobj);
+    cobj.scrollWidth;
+  }
+
+  function crashme() {
+    document.write("fooFOO");
+    G("a");
+    document.write("<a lang></a>a");
+    G("base");
+    document.write("barBAR");
+    G("audio");
+  }
+</script>
+<script>crashme();</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/609560-1.xhtml b/dom/base/crashtests/609560-1.xhtml
new file mode 100644
index 0000000000..7849c8db73
--- /dev/null
+++ b/dom/base/crashtests/609560-1.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+<![CDATA[
+
+function x()
+{
+ var p = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+ frame.onload = y;
+ frame.src = "data:text/html,1";
+ document.body.appendChild(frame);
+ var frameRoot = frame.contentDocument.documentElement;
+
+  function y()
+  {
+    var frameDoc = frameRoot.ownerDocument;
+    frameRoot.appendChild(p);
+    var attr = frameDoc.createAttributeNS("http://www.w3.org/1999/xhtml", "u");
+    attr.w = {};
+    p.setAttributeNode(attr);
+    document.documentElement.removeAttribute("class");
+  }
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(x, 0);"></body>
+</html>
diff --git a/dom/base/crashtests/610571-1.html b/dom/base/crashtests/610571-1.html
new file mode 100644
index 0000000000..96dbc22719
--- /dev/null
+++ b/dom/base/crashtests/610571-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  var frame1 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); frame1.src = "data:text/html,1"; document.body.appendChild(frame1);
+  var frame2 = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe"); frame2.src = "data:text/html,2"; document.body.appendChild(frame2);
+  var frame1doc = frame1.contentDocument;
+  var frame1root = frame1doc.documentElement;
+  frame1root.appendChild(frame2);
+  setTimeout(function() { 
+    try {
+      frame2.contentDocument.q = frame1root.__lookupGetter__("nextSibling");
+    } catch(ex) {}
+    document.documentElement.removeAttribute("class");
+  }, 200);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
+
diff --git a/dom/base/crashtests/612018-1.html b/dom/base/crashtests/612018-1.html
new file mode 100644
index 0000000000..7f81422a71
--- /dev/null
+++ b/dom/base/crashtests/612018-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  var input = document.createElement("input");
+  document.body.appendChild(input);
+  input.focus();
+  document.body.appendChild(input);
+  input.focus();
+
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 0);"></body>
+</html>
diff --git a/dom/base/crashtests/628599-1.html b/dom/base/crashtests/628599-1.html
new file mode 100644
index 0000000000..09be38f1e0
--- /dev/null
+++ b/dom/base/crashtests/628599-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+var w;
+
+function b1()
+{
+  w = window.open("404.gif", "w2", "f");
+  setTimeout(b2, 1200);
+}
+
+function b2()
+{
+  w.close();
+  setTimeout(b3, 500);
+}
+
+function b3()
+{
+  w.location = "data:text/html,2";
+  document.body.appendChild(document.createTextNode("Done"));
+}
+
+</script>
+</head>
+<body>
+<div><button onclick="b1();">Start test</button></div>
+</body>
+</html>
diff --git a/dom/base/crashtests/637116.html b/dom/base/crashtests/637116.html
new file mode 100644
index 0000000000..422cbe7360
--- /dev/null
+++ b/dom/base/crashtests/637116.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<script>
+
+function K(v) { return function() { return v; } }
+
+var errorProxy = new Proxy({}, {get: function() { throw new Error(); }});
+
+function boom()
+{
+  var focused = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+  document.body.appendChild(focused);
+  var otherWin = window.open("data:text/html,1", "_blank", "width=200,height=200");
+  try { otherWin.history.replaceState(errorProxy, "title", "replaceState.html"); } catch(e) {}
+  focused.focus();
+  focused.addEventListener("foo", K(otherWin.applicationCache));
+  otherWin.close();
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<button onclick="boom();">If you have popups blocked, click here to start the leak test</button>
+</body>
+
+</html>
diff --git a/dom/base/crashtests/637214-1.svg b/dom/base/crashtests/637214-1.svg
new file mode 100644
index 0000000000..106428a297
--- /dev/null
+++ b/dom/base/crashtests/637214-1.svg
@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" class="reftest-wait">
+
+<script>
+<![CDATA[
+
+window.addEventListener("load", function () {
+    document.documentElement.appendChild(document.getElementById("a"));
+    setTimeout(function () {
+        document.getElementById("x").setAttribute("id", "m1");
+        document.documentElement.removeAttribute("class");
+    }, 0);
+}, false);
+
+]]>
+</script>
+
+<g id="a">
+  <path id="x"/>
+  <text>
+    <textPath xlink:href="#m1">Text</textPath>
+    <textPath xlink:href="#m1">Text</textPath>
+
+  </text>
+</g>
+
+</svg>
diff --git a/dom/base/crashtests/637214-2.svg b/dom/base/crashtests/637214-2.svg
new file mode 100644
index 0000000000..4f5c929277
--- /dev/null
+++ b/dom/base/crashtests/637214-2.svg
@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" class="reftest-wait">
+
+<script>
+<![CDATA[
+
+window.addEventListener("load", function () {
+    document.documentElement.appendChild(document.getElementById("a"));
+    setTimeout(function () {
+        document.getElementById("x").removeAttribute("id");
+        document.documentElement.removeAttribute("class");
+    }, 0);
+}, false);
+
+]]>
+</script>
+
+<g id="a">
+  <path id="x"/>
+  <text>
+    <textPath xlink:href="#m1">Text</textPath>
+    <textPath xlink:href="#m1">Text</textPath>
+
+  </text>
+</g>
+
+</svg>
diff --git a/dom/base/crashtests/642022-1.html b/dom/base/crashtests/642022-1.html
new file mode 100644
index 0000000000..b2bc59085f
--- /dev/null
+++ b/dom/base/crashtests/642022-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+InstallTrigger.constructor.create(window).setTimeout(Array, 0);
+</script>
diff --git a/dom/base/crashtests/646184.html b/dom/base/crashtests/646184.html
new file mode 100644
index 0000000000..a4a6ac4907
--- /dev/null
+++ b/dom/base/crashtests/646184.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var f = document.getElementById("f");
+  var w = f.contentWindow;
+  f.remove();
+  w.localStorage;
+}
+
+</script>
+</head>
+<body onload="boom();"><iframe id="f" src="data:text/html,1"></iframe></body>
+</html>
diff --git a/dom/base/crashtests/658845-1.svg b/dom/base/crashtests/658845-1.svg
new file mode 100644
index 0000000000..40a6a3167c
--- /dev/null
+++ b/dom/base/crashtests/658845-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <use xlink:href="data:" />
+</svg>
diff --git a/dom/base/crashtests/666869.html b/dom/base/crashtests/666869.html
new file mode 100644
index 0000000000..ac11f64e12
--- /dev/null
+++ b/dom/base/crashtests/666869.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var f = document.getElementById("f");
+  var frameWin = f.contentWindow;
+  document.body.removeChild(f);
+  frameWin.performance;
+}
+
+</script>
+</head>
+<body onload="boom();"><iframe id="f" src="data:text/html,1"></iframe></body>
+</html>
diff --git a/dom/base/crashtests/667336-1.html b/dom/base/crashtests/667336-1.html
new file mode 100644
index 0000000000..499f5a9ef0
--- /dev/null
+++ b/dom/base/crashtests/667336-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+document.createElement("div").children.item(-1);
+</script>
diff --git a/dom/base/crashtests/675516.xhtml b/dom/base/crashtests/675516.xhtml
new file mode 100644
index 0000000000..0daadf136b
--- /dev/null
+++ b/dom/base/crashtests/675516.xhtml
@@ -0,0 +1,31 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<script>
+<![CDATA[
+
+function boom()
+{
+  var p = document.body;
+  var t1 = document.createTextNode("1");
+  p.appendChild(t1);
+  var t2 = document.createTextNode("2");
+  p.appendChild(t2);
+  var t3 = document.createTextNode("3");
+  p.appendChild(t3);
+
+  function f() {
+  };
+  window.addEventListener("DOMSubtreeModified", f, false);
+
+  function g() {
+    window.removeEventListener("DOMNodeRemoved", g, false);
+    p.removeChild(t3);
+  };
+  window.addEventListener("DOMNodeRemoved", g, false);
+
+  document.normalize();
+}
+
+]]>
+</script>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/675621-1.html b/dom/base/crashtests/675621-1.html
new file mode 100644
index 0000000000..8f42bfcb7e
--- /dev/null
+++ b/dom/base/crashtests/675621-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<body>
+<script>
+document.addEventListener("DOMSubtreeModified", function() {});
+
+document.body.insertAdjacentHTML("afterbegin", "<p>foo");
+</script>
diff --git a/dom/base/crashtests/677194.html b/dom/base/crashtests/677194.html
new file mode 100644
index 0000000000..a320219a2f
--- /dev/null
+++ b/dom/base/crashtests/677194.html
@@ -0,0 +1,6 @@
+<script>
+function foo(o) {
+        o instanceof CSS2Properties;
+}
+foo({})
+</script>
diff --git a/dom/base/crashtests/679459.html b/dom/base/crashtests/679459.html
new file mode 100644
index 0000000000..c3cbb0c7c6
--- /dev/null
+++ b/dom/base/crashtests/679459.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var t = document.createTextNode("a");
+  document.body.appendChild(t);
+  var r1 = document.createRange();
+  r1.setEnd(t, 1);
+  var r2 = document.createRange();
+  r2.setEnd(t, 0);
+  r2.deleteContents();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/679689-1.html b/dom/base/crashtests/679689-1.html
new file mode 100644
index 0000000000..aab88bbc36
--- /dev/null
+++ b/dom/base/crashtests/679689-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<img crossorigin>
diff --git a/dom/base/crashtests/682463.html b/dom/base/crashtests/682463.html
new file mode 100644
index 0000000000..735979e9fb
--- /dev/null
+++ b/dom/base/crashtests/682463.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var j = document.createTextNode("j");
+  var r = document.createRange();
+  r.setEnd(j, 1);
+  j.splitText(0);
+  r.setEnd(j, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+
+</html>
\ No newline at end of file
diff --git a/dom/base/crashtests/693212.xhtml b/dom/base/crashtests/693212.xhtml
new file mode 100644
index 0000000000..6cc600d3b4
--- /dev/null
+++ b/dom/base/crashtests/693212.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+  function boom() { 
+    select = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
+    text = document.body.childNodes[0];
+    select.setAttribute("onDOMSubtreeModified", "text.parentNode.removeChild(text);");
+    select.appendChild(text);
+  }
+</script>
+</head>
+
+<body onload="boom()">
+
+</body>
+</html>
diff --git a/dom/base/crashtests/693811-1.html b/dom/base/crashtests/693811-1.html
new file mode 100644
index 0000000000..e3629fbb24
--- /dev/null
+++ b/dom/base/crashtests/693811-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<script>
+
+var collection = document.images;
+var other = document.embeds;
+var options = document.createElement("select").options;
+collection.toString;
+options.selectedIndex;
+Object.getPrototypeOf(collection).item = {};
+other.toString;
+collection.toString;
+options.selectedIndex;
+options.toString;
+</script>
diff --git a/dom/base/crashtests/693811-2.html b/dom/base/crashtests/693811-2.html
new file mode 100644
index 0000000000..858e66f4f3
--- /dev/null
+++ b/dom/base/crashtests/693811-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<script>
+
+var collection = document.images;
+var other = document.embeds;
+var options = document.createElement("select").options;
+collection.toString;
+options.selectedIndex;
+Object.defineProperty(Object.getPrototypeOf(collection),
+                      "item",
+                      { value: {}, enumerable: true, configurable: true });
+other.toString;
+collection.toString;
+options.selectedIndex;
+options.toString;
+</script>
diff --git a/dom/base/crashtests/693811-3.html b/dom/base/crashtests/693811-3.html
new file mode 100644
index 0000000000..6e5855e610
--- /dev/null
+++ b/dom/base/crashtests/693811-3.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+document.createElement("p").constructor = function(){};
+</script>
diff --git a/dom/base/crashtests/693894.html b/dom/base/crashtests/693894.html
new file mode 100644
index 0000000000..23bf4a9c8e
--- /dev/null
+++ b/dom/base/crashtests/693894.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+
+var nodeList = document.getElementsByName("html");
+nodeList.__proto__ = null;
+nodeList.x;
+
+</script>
diff --git a/dom/base/crashtests/695867.html b/dom/base/crashtests/695867.html
new file mode 100644
index 0000000000..4cba753f7b
--- /dev/null
+++ b/dom/base/crashtests/695867.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<script>
+
+var nodeList = document.documentElement.childNodes;
+nodeList.__proto__ = null;
+var p = new Proxy({}, {getOwnPropertyDescriptor: function() {return nodeList}});
+Reflect.getOwnPropertyDescriptor(p, "x");
+
+</script>
diff --git a/dom/base/crashtests/697643.html b/dom/base/crashtests/697643.html
new file mode 100644
index 0000000000..093e02ada7
--- /dev/null
+++ b/dom/base/crashtests/697643.html
@@ -0,0 +1,5 @@
+<script>
+
+document.createElementNS('http://www.w3.org/1999/xhtml', 'select').options[0] = {};
+
+</script>
diff --git a/dom/base/crashtests/698974-1.html b/dom/base/crashtests/698974-1.html
new file mode 100644
index 0000000000..b945c9a29f
--- /dev/null
+++ b/dom/base/crashtests/698974-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+document.createDocumentFragment().querySelector("div");
+</script>
diff --git a/dom/base/crashtests/700090-1.html b/dom/base/crashtests/700090-1.html
new file mode 100644
index 0000000000..30479454f7
--- /dev/null
+++ b/dom/base/crashtests/700090-1.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
+  var t1 = document.createTextNode("123456 ");
+  mo.appendChild(t1);
+  document.body.appendChild(mo);
+  var t2 = document.createTextNode("x");
+  document.body.appendChild(t2);
+
+  var r1 = document.createRange();
+  r1.setEnd(t1, 7);
+  var r3 = document.createRange();
+  r3.setStart(t1, 7);
+
+  document.documentElement.offsetHeight;
+
+  var r2 = document.createRange();
+  r2.setStart(t1, 0);
+  r2.setEnd(t2, 0);
+  r2.deleteContents();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/700090-2.html b/dom/base/crashtests/700090-2.html
new file mode 100644
index 0000000000..c6d5eb2114
--- /dev/null
+++ b/dom/base/crashtests/700090-2.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var mo = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mo");
+  var t1 = document.createTextNode("123456 ");
+  mo.appendChild(t1);
+  document.body.appendChild(mo);
+  var t2 = document.createTextNode("x");
+  document.body.appendChild(t2);
+
+  var r1 = document.createRange();
+  r1.setEnd(t1, 7);
+  var r3 = document.createRange();
+  r3.setStart(t1, 7);
+
+  document.documentElement.offsetHeight;
+
+  t1.splitText(t1.length);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/700512-worker.js b/dom/base/crashtests/700512-worker.js
new file mode 100644
index 0000000000..fcb558fcf4
--- /dev/null
+++ b/dom/base/crashtests/700512-worker.js
@@ -0,0 +1,7 @@
+onmessage = function(event) {
+  var blob = event.data;
+
+  blob.slice(1, 5);
+
+  postMessage("done");
+}
diff --git a/dom/base/crashtests/700512.html b/dom/base/crashtests/700512.html
new file mode 100644
index 0000000000..49764e62b2
--- /dev/null
+++ b/dom/base/crashtests/700512.html
@@ -0,0 +1,11 @@
+<html class="reftest-wait">
+  <script type="text/javascript">
+    var worker = new Worker("700512-worker.js");
+
+    worker.onmessage = function() {
+      document.documentElement.removeAttribute("class");
+    }
+
+    worker.postMessage(new Blob(["foo", "bar"]));
+  </script>
+</html>
diff --git a/dom/base/crashtests/706283-1.html b/dom/base/crashtests/706283-1.html
new file mode 100644
index 0000000000..67b618e7fe
--- /dev/null
+++ b/dom/base/crashtests/706283-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<script>
+
+window.requestAnimationFrame(null);
+
+</script>
diff --git a/dom/base/crashtests/709384.html b/dom/base/crashtests/709384.html
new file mode 100644
index 0000000000..5e99e9c3c6
--- /dev/null
+++ b/dom/base/crashtests/709384.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<script>
+  cancelRequestAnimationFrame(requestAnimationFrame(function() {}));
+  requestAnimationFrame(function() {});
+</script>
diff --git a/dom/base/crashtests/709954.html b/dom/base/crashtests/709954.html
new file mode 100644
index 0000000000..a06b7715ec
--- /dev/null
+++ b/dom/base/crashtests/709954.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<script>
+
+function boom()
+{
+  setTimeout(function(){
+    document.documentElement.removeChild(document.body);
+  }, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<input value="f" pattern="[">
+</body>
+
+</html>
diff --git a/dom/base/crashtests/713417-1.html b/dom/base/crashtests/713417-1.html
new file mode 100644
index 0000000000..a5bfd0f809
--- /dev/null
+++ b/dom/base/crashtests/713417-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var f = document.getElementById("f");
+  var w = f.contentWindow;
+  var d = w.document;
+  d.designMode = 'on';
+  var r = d.documentElement;
+  d.removeChild(r);
+  document.adoptNode(r);
+  f.remove();
+}
+
+</script>
+</head>
+<body onload="boom();">
+<iframe src="data:text/html,1" id="f"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/713417-2.html b/dom/base/crashtests/713417-2.html
new file mode 100644
index 0000000000..8bf33b6b11
--- /dev/null
+++ b/dom/base/crashtests/713417-2.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var f = document.getElementById("f");
+  var w = f.contentWindow;
+  var d = w.document;
+  var range = d.createRange();
+  w.getSelection().removeAllRanges();
+  w.getSelection().addRange(range);
+  var r = d.documentElement;
+  d.removeChild(r);
+  w.getSelection().collapse(r,0);
+  document.adoptNode(r);
+  f.remove();
+}
+
+</script>
+</head>
+<body onload="boom();">
+<iframe src="data:text/html,1" id="f"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/715056.html b/dom/base/crashtests/715056.html
new file mode 100644
index 0000000000..214569b02a
--- /dev/null
+++ b/dom/base/crashtests/715056.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var t1 = document.createTextNode("a");
+  var t2 = document.createTextNode("b");
+  document.appendChild(t1);
+  document.appendChild(t2);
+  var sel = window.getSelection();
+  sel.collapse(t2, 0)
+  document.normalize();
+  sel.removeAllRanges();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/729431-1.xhtml b/dom/base/crashtests/729431-1.xhtml
new file mode 100644
index 0000000000..9ff18fc65a
--- /dev/null
+++ b/dom/base/crashtests/729431-1.xhtml
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<script>
+<![CDATA[
+
+function boom()
+{
+  var d = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  d.setAttributeNS(null, "contenteditable", "true");
+  var s = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+  d.appendChild(s);
+  document.documentElement.appendChild(d);
+
+  var textarea = document.createElementNS("http://www.w3.org/1999/xhtml", "textarea");
+  var t1 = document.createTextNode("A");
+  textarea.appendChild(t1);
+  var t2 = document.createTextNode("B");
+  textarea.appendChild(t2);
+  document.documentElement.appendChild(textarea);
+
+  document.documentElement.offsetHeight;
+
+  d.removeChild(s);
+  textarea.removeChild(t2);
+  document.documentElement.appendChild(document.createTextNode(" C "));
+  document.documentElement.appendChild(t2);
+}
+
+window.addEventListener("load", boom);
+
+]]>
+</script>
+
+<!-- no body -->
+
+</html>
diff --git a/dom/base/crashtests/741163-1.html b/dom/base/crashtests/741163-1.html
new file mode 100644
index 0000000000..62262a9498
--- /dev/null
+++ b/dom/base/crashtests/741163-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<script>
+
+var xhr = new XMLHttpRequest();
+xhr.onreadystatechange;
+
+</script>
diff --git a/dom/base/crashtests/745495.html b/dom/base/crashtests/745495.html
new file mode 100644
index 0000000000..f513a33a8b
--- /dev/null
+++ b/dom/base/crashtests/745495.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+  document.body.appendChild(frame);
+  var frameScreen = frame.contentWindow.screen;
+  document.body.removeChild(frame);
+  frameScreen.top;
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/752226-1.html b/dom/base/crashtests/752226-1.html
new file mode 100644
index 0000000000..9c05388ff2
--- /dev/null
+++ b/dom/base/crashtests/752226-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+var worker = new Worker("data:text/javascript,setTimeout(null)");
+</script>
diff --git a/dom/base/crashtests/752226-2.html b/dom/base/crashtests/752226-2.html
new file mode 100644
index 0000000000..9d0aa1698e
--- /dev/null
+++ b/dom/base/crashtests/752226-2.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+document.createElement("video").src = null
+</script>
diff --git a/dom/base/crashtests/766426.html b/dom/base/crashtests/766426.html
new file mode 100644
index 0000000000..105347b34f
--- /dev/null
+++ b/dom/base/crashtests/766426.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+    var j = 0;
+    var a = document.getElementById("a");
+    var r = document.createRange();
+    r.setStart(a.childNodes[0], 0);
+    r.setEnd(a.childNodes[1], 0);
+
+    function f()
+    {
+        if (++j >= 2) {
+            document.removeEventListener("DOMNodeRemoved", f);
+        }
+        r.extractContents();
+    }
+
+    document.addEventListener("DOMNodeRemoved", f);
+
+    r.extractContents();
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="a"><span><span></span></span>X</div>
+</body>
+</html>
diff --git a/dom/base/crashtests/771639.html b/dom/base/crashtests/771639.html
new file mode 100644
index 0000000000..c6124cac51
--- /dev/null
+++ b/dom/base/crashtests/771639.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<script>
+var root = document.documentElement;
+while(root.firstChild) { root.firstChild.remove(); }
+var div = document.createElement("div");
+root.appendChild(div);
+
+document.addEventListener("DOMNodeRemoved", function() {
+  root.appendChild(document.createTextNode("some mutation"));
+});
+
+var range = document.createRange();
+range.setStart(root, 0);
+range.setEnd(root, root.childNodes.length);
+range.deleteContents();
+</script>
diff --git a/dom/base/crashtests/786854.html b/dom/base/crashtests/786854.html
new file mode 100644
index 0000000000..846741c08c
--- /dev/null
+++ b/dom/base/crashtests/786854.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+<table background=""></table>
+</body>
diff --git a/dom/base/crashtests/815043.html b/dom/base/crashtests/815043.html
new file mode 100644
index 0000000000..d5cdd93598
--- /dev/null
+++ b/dom/base/crashtests/815043.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('x').dir = '';">
+
+<div><bdi><bdi id="x"><span></span></bdi></bdi></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/815276.html b/dom/base/crashtests/815276.html
new file mode 100644
index 0000000000..8a691d6685
--- /dev/null
+++ b/dom/base/crashtests/815276.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="((new DOMParser).parseFromString('<x/>', 'text/xml')).adoptNode(document.getElementById('v'));">
+<div id="v"><bdi>x</bdi></div>
+</body>
+</html>
diff --git a/dom/base/crashtests/815477.html b/dom/base/crashtests/815477.html
new file mode 100644
index 0000000000..d3cceb0f9c
--- /dev/null
+++ b/dom/base/crashtests/815477.html
@@ -0,0 +1,15 @@
+<head dir=auto id=test1><ul id=test2>
+7. If no matching font face is within the "font-family" being processed by steps
+</ul>
+
+<h2 id=test3><p id=test5>* XHB7R%[+z^NvLp5	n$C
+<p id=test4>
+<script>
+var docElement = document.body;
+document.addEventListener("DOMContentLoaded", CFcrash);
+function CFcrash() {
+setTimeout('try { test5.appendChild(test4); } catch(e) {}', 50);
+try { test4.remove(); test4 = test1; } catch(e) {}
+try { test4.insertBefore(test2, test4.firstChils); } catch(e) { }
+try { test2.textContent = test3.textContent; } catch(e) {}
+}</script>>
\ No newline at end of file
diff --git a/dom/base/crashtests/815500.html b/dom/base/crashtests/815500.html
new file mode 100644
index 0000000000..76d3157ee6
--- /dev/null
+++ b/dom/base/crashtests/815500.html
@@ -0,0 +1,14 @@
+>><address id=test1> A,*/^㰞﷑ dq豑><script>
+function initCF() {
+try { test2 = document.createElementNS("http://www.w3.org/1999/xhtml", "tt"); } catch(e) {}
+try { test2.setAttribute("dir", "auto"); } catch(e) {}
+setTimeout("CFcrash()", 253);
+}
+document.addEventListener("DOMContentLoaded", initCF);
+function editFuzz() {
+}
+function CFcrash() {
+try { test2.appendChild(test1); } catch(e) {}
+setTimeout('try { test2.setAttribute("dir", "&locale.dir;"); } catch(e) {}', 462);
+try { test1.innerHTML = "Z3 ᜃ 洿G0겨=#⨝  g B 	md^뛳 j # 	 鮪  8媾䝀 &#x30054;ᖾd煏됚M:㕑,i⼷  Geኔ	≴핛 "; } catch(e) {}
+}</script>>
\ No newline at end of file
diff --git a/dom/base/crashtests/816253.html b/dom/base/crashtests/816253.html
new file mode 100644
index 0000000000..4381700916
--- /dev/null
+++ b/dom/base/crashtests/816253.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <script>
+            window.onload = function() {
+                setInterval(
+                    function next_step() {
+                        var style = document.createElement('style');
+                        style.innerHTML = "{ }";
+                        document.getElementsByTagName("*")[ 7 ].appendChild(style);
+                        window.dump('.');
+                    }, 10);
+            }
+        </script>
+    </head>
+    <body>
+        <div id="console"></div>
+        <div id="parentDiv">
+            <div id="left-to-right" dir="auto" class="testElement">
+                <input type="text" value="מקור השם עברית">Test test test
+            </div>
+        </div>
+        <script id="des">
+            var el = document.getElementById("left-to-right");
+            document.defaultView.getComputedStyle(el).getPropertyValue('border-right-color');
+
+            document.getElementById("parentDiv").style.display = "none";
+        </script>
+
+    </body>
+</html>
diff --git a/dom/base/crashtests/819014.html b/dom/base/crashtests/819014.html
new file mode 100644
index 0000000000..0e7c22c502
--- /dev/null
+++ b/dom/base/crashtests/819014.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+ <head>
+  <meta charset="utf-8">
+ </head>
+ <body>
+  <div>
+   <textarea id="right-to-left1" dir="auto" class="testElement">جناع</textarea>
+   <input type="text" id="right-to-left2" dir="auto" value="שלום">
+  </div>
+  <script type="text/javascript">
+   var test1=document.getElementById("right-to-left1");
+   var test2=document.getElementById("right-to-left2");
+   test2.appendChild(document.createTextNode("hello"));
+   setInterval(function() {
+     test1.appendChild(test2);
+     test2.parentNode.removeChild;
+     test1.innerHTML="goodbye";
+   }, 4);
+  </script>
+ </body>
+</html>
diff --git a/dom/base/crashtests/822723.html b/dom/base/crashtests/822723.html
new file mode 100644
index 0000000000..e057d5b61f
--- /dev/null
+++ b/dom/base/crashtests/822723.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var outer = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  outer.setAttribute("dir", "auto");
+  var inner = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  inner.appendChild(document.createTextNode("A"));
+  inner.appendChild(document.createTextNode("B"));
+  outer.appendChild(inner);
+  inner.setAttribute("dir", "ltr");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/824719.html b/dom/base/crashtests/824719.html
new file mode 100644
index 0000000000..64507ef995
--- /dev/null
+++ b/dom/base/crashtests/824719.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<div id='console'></div>
+<div id='parentDiv'>
+<div id='right-to-left1' dir=auto class=testElement>
+<input type=text value="a">a
+</div>
+<div id='right-to-left2' dir=auto class=testElement>
+</div>
+</div>
+
+<script type="text/javascript"> 
+
+document.getElementById("right-to-left2").appendChild(document.createElement("p"))
+var test5=document.getElementById("right-to-left1")
+var test6=document.getElementById("console").appendChild(document.createElement("dl"))
+
+test6.appendChild(document.createElement("img"))
+
+test5.remove()
+test5.innerHTML=''
+test5.appendChild(test6.cloneNode(true))
+</script>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/827190.html b/dom/base/crashtests/827190.html
new file mode 100644
index 0000000000..e8bce20cb7
--- /dev/null
+++ b/dom/base/crashtests/827190.html
@@ -0,0 +1,13 @@
+<noframes dir=auto id=test4></noframes><vbox id=test5>K<csaction id=test3><script>
+function reference(domNode) { this.domNode = domNode;} function walk(a, currentPrefix, index, domNode) { if(domNode == null) return; newPrefix = currentPrefix + "_" + index; walk(a, domNode.nextSibling); walk(a, domNode.firstChild); a[newPrefix] = new reference(domNode); } function clear() { var a = new Array(); walk(a, "", 0, document.documentElement); for(key in a) {a[key].domNode.remove(); }}
+function crash() {
+try { test1 = document.createElementNS("http://www.w3.org/2000/svg", "text"); } catch(e) {}
+try { test2 = test3.cloneNode(true); } catch(e) {}
+setTimeout("try { clear(); } catch(e) {}", 500);
+try { test1.appendChild(test5); } catch(e) {}
+try { test2.appendChild(test1); } catch(e) {}
+try { test4.appendChild(test2); } catch(e) {}
+try { test5.innerHTML = ""; } catch(e) {}
+}
+document.addEventListener("DOMContentLoaded", crash);
+</script>
\ No newline at end of file
diff --git a/dom/base/crashtests/828054.html b/dom/base/crashtests/828054.html
new file mode 100644
index 0000000000..ae5b8d35a7
--- /dev/null
+++ b/dom/base/crashtests/828054.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var outer = document.createElement("div");
+  outer.setAttribute("dir", "auto");
+  var inner = document.createElement("div");
+  inner.appendChild(document.createTextNode("A"));
+  outer.appendChild(inner);
+  inner.setAttribute("dir", "auto");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/828903-iframe.html b/dom/base/crashtests/828903-iframe.html
new file mode 100644
index 0000000000..dc40c45d66
--- /dev/null
+++ b/dom/base/crashtests/828903-iframe.html
@@ -0,0 +1,46 @@
+<html>
+<script>
+function start() {
+try{o33=document.documentElement;}catch(e){}
+try{o1.appendChild;}catch(e){}
+try{tmp = document.createElement('iframe');}catch(e){}
+try{tmp.id = 'id36'}catch(e){}
+try{o33.ownerDocument.documentElement.appendChild(tmp);}catch(e){}
+try{o51=o33.ownerDocument.getElementById('id36').contentDocument;}catch(e){}
+try{o579=document.documentElement;}catch(e){}
+try{tmp.id = 'id421'}catch(e){}
+try{o619=document.getElementById('id421').contentDocument;}catch(e){}
+try{o622=window.document.getElementById('id421').contentWindow.document;}catch(e){}
+try{o875.setAttributeNS(null,'letter-spacing','normal');}catch(e){}
+try{o884=document.createElementNS('http://www.w3.org/2000/svg','set');;}catch(e){}
+try{o887=document.createElementNS('http://www.w3.org/2000/svg','desc');;}catch(e){}
+try{o884.appendChild(o887);}catch(e){}
+try{o887=document.documentElement;}catch(e){}
+try{o1041=o622.createElement('bdi');;}catch(e){}
+window.setTimeout('start2()',100);
+}
+function start2() {
+try{o1042=document.createElement('input');;}catch(e){}
+try{o1043=o51.createElement('input');;}catch(e){}
+try{o884.appendChild(o1043);}catch(e){}
+try{o1053=o1043.previousElementSibling;}catch(e){}
+try{o1067=o619.createElement('blockquote');;}catch(e){}
+try{o1062.appendChild(o1067);}catch(e){}
+try{o1074=o619.createElement('ruby');;}catch(e){}
+try{o1067.appendChild(o1074);}catch(e){}
+try{document.body.appendChild(o1041);}catch(e){}
+try{o1041.appendChild(o1042);}catch(e){}
+try{o1095=o51.createTextNode(unescape('%uff0f%u017f%u0390%ufffa%u2073%uff4d%uDF53%u0261'));;}catch(e){}
+try{o1053.appendChild(o1095);}catch(e){}
+try{o1041.appendChild(o1043.parentNode);}catch(e){}
+try{o1042.appendChild(o1067);}catch(e){}
+try{o1053=null;}catch(e){}
+try{o1095=null;}catch(e){}
+try{for(var xrn in o884.childNodes) o884.removeChild(o884.childNodes[xrn]);}catch(e){}
+//fuzzer.gc();
+location.reload();
+}
+</script>
+<body onload="start()">
+</body>
+</html>
diff --git a/dom/base/crashtests/828903.html b/dom/base/crashtests/828903.html
new file mode 100644
index 0000000000..1a5a4d31fc
--- /dev/null
+++ b/dom/base/crashtests/828903.html
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+    <meta charset="utf-8">
+    <title>Testcase for bug 828903</title>
+<script>
+function reload() {
+  this.location.reload();
+}
+// Run the test for 2 seconds
+setTimeout(function() {
+    document.documentElement.removeChild(document.body);
+    document.documentElement.className = "";
+  }, 2000);
+</script>
+</head>
+<body onload="document.body.getBoundingClientRect()">
+
+<iframe onload="this.contentWindow.setTimeout(reload,1113)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1233)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1313)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1433)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1113)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1233)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1313)" src="828903-iframe.html"></iframe>
+<iframe onload="this.contentWindow.setTimeout(reload,1433)" src="828903-iframe.html"></iframe>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/829428.html b/dom/base/crashtests/829428.html
new file mode 100644
index 0000000000..4cab24d87d
--- /dev/null
+++ b/dom/base/crashtests/829428.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('inner').dir = 'auto';">
+<div dir="auto"><div id="inner"><svg></svg></div></div>
+</body>
+</html>
diff --git a/dom/base/crashtests/830098.html b/dom/base/crashtests/830098.html
new file mode 100644
index 0000000000..0b563ce956
--- /dev/null
+++ b/dom/base/crashtests/830098.html
@@ -0,0 +1,14 @@
+<canvas dir=auto><p id=test1> 
+
+
+nt/b|+K	 E:</p>
+    <svg>
+        <defs id=test2>~ N LRWue`N6g J`NfT Ai0 BG  q QPX6 ~	 #A?ORD
+            <span><metadata id=test4><use id=test3>>>><script>
+var docElement = document.body ? document.body : document.documentElement;
+document.addEventListener("DOMContentLoaded", CFcrash);
+function CFcrash() {
+try { test1.remove(); } catch(e) {}
+try { test2.innerHTML = ''; } catch(e) {}
+try { test3.outerHTML = test4.outerHTML; } catch(e) {}
+}</script>
\ No newline at end of file
diff --git a/dom/base/crashtests/831287.html b/dom/base/crashtests/831287.html
new file mode 100644
index 0000000000..3fc841cc9b
--- /dev/null
+++ b/dom/base/crashtests/831287.html
@@ -0,0 +1,11 @@
+<head dir=auto id=test1><body id=test2><div" id=test3 itemtype=http://example.com/bar style="speak-numeral:> "><canvas id=c><p id=test4>FAIL (fallback content)</p></canvas>
+
+><script>
+document.addEventListener("DOMContentLoaded", CFcrash);
+function CFcrash() {
+test1.appendChild(test4);
+test1.setAttribute("dir", "foopy");
+test1.appendChild(c);
+test4.textContent = test2.outerHTML;
+c.appendChild(test3);
+}</script>>
\ No newline at end of file
diff --git a/dom/base/crashtests/832644.html b/dom/base/crashtests/832644.html
new file mode 100644
index 0000000000..41ce1b907c
--- /dev/null
+++ b/dom/base/crashtests/832644.html
@@ -0,0 +1,8 @@
+<x6 id=test1>><bdi id=test2><fieldset id=test3>>ohVG	l0ci * |X5SEX :GdK5i2rC#sdnwJv0%O{QF Lh>>><ol id=test4><script>
+var docElement = document.documentElement;
+document.addEventListener("DOMContentLoaded", CFcrash);
+function CFcrash() {
+try { test2.setAttribute("dir", "auto"); } catch(e) {}
+try { test3.innerHTML = test4.innerHTML; } catch(e) {}
+setTimeout('docElement.insertBefore(test1, docElement.firstChild);', 2);
+}</script>>
\ No newline at end of file
diff --git a/dom/base/crashtests/836890.html b/dom/base/crashtests/836890.html
new file mode 100644
index 0000000000..a75fa3c45f
--- /dev/null
+++ b/dom/base/crashtests/836890.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var outer = document.createElement("span");
+  var inner = document.createElement("span");
+  outer.dir = "auto";
+  outer.appendChild(inner);
+  inner.appendChild(document.createTextNode("x"));
+  inner.dir = "auto";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/838489-1.html b/dom/base/crashtests/838489-1.html
new file mode 100644
index 0000000000..c7167c45a8
--- /dev/null
+++ b/dom/base/crashtests/838489-1.html
@@ -0,0 +1,11 @@
+><bdi id=test>
+<xmp></xmp><font>><span><br>><keygen>><script>
+document.addEventListener("DOMContentLoaded", CFcrash);
+function editFuzz() {
+document.designMode = "on";
+try { document.execCommand("indent", false, true) } catch(e) {}
+}
+function CFcrash() {
+setTimeout("try { editFuzz(); } catch(e) {}", 0);
+try { test.setAttribute("dir", "&locale.dir;"); } catch(e) {}
+}</script>>
\ No newline at end of file
diff --git a/dom/base/crashtests/838489-2.html b/dom/base/crashtests/838489-2.html
new file mode 100644
index 0000000000..0f5883436f
--- /dev/null
+++ b/dom/base/crashtests/838489-2.html
@@ -0,0 +1,16 @@
+<foo id=test1>>><body id=test2 '><bdi id=test3><keygen>
+<test><script>
+var docElement = document.body ? document.body : document.documentElement;
+function initCF() {
+try { test4 = document.createElementNS("http://www.w3.org/1999/xhtml", "td"); } catch(e) {}
+try { docElement.appendChild(test4); } catch(e) {}
+try { test5 = test3.cloneNode(true); } catch(e) {}
+try { test5.setAttribute("dir", "invalid"); } catch(e) {}
+try { docElement.appendChild(test5); } catch(e) {}
+setTimeout("CFcrash()", 0);
+}
+document.addEventListener("DOMContentLoaded", initCF);
+function CFcrash() {
+try { test1.appendChild(test4); } catch(e) {}
+try { document.adoptNode(test2); } catch(e) {}
+}</script>>
\ No newline at end of file
diff --git a/dom/base/crashtests/841205.html b/dom/base/crashtests/841205.html
new file mode 100644
index 0000000000..4de533a885
--- /dev/null
+++ b/dom/base/crashtests/841205.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var b = document.createElement('bdi');
+  var c = document.createElement('div');
+  var d = document.createElement('div');
+
+  b.appendChild(c);
+  c.appendChild(d);
+  b.removeChild(c);
+  d.appendChild(b);
+  document.createElement('div').appendChild(c);
+  b.appendChild(document.createElement('div'));
+
+  b.setAttribute('dir', "auto");
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/844404.html b/dom/base/crashtests/844404.html
new file mode 100644
index 0000000000..9022837bf2
--- /dev/null
+++ b/dom/base/crashtests/844404.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  d.setAttribute('dir', "auto");
+  c.setAttribute('dir', "auto");
+  d.removeAttribute('dir');
+  c.removeAttribute('dir');
+  b.setAttribute('dir', "auto");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div id="a" dir="auto"><div id="b"><div id="c"><div id="d"></div></div></div></div>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/845093-1.html b/dom/base/crashtests/845093-1.html
new file mode 100644
index 0000000000..3ed8efca65
--- /dev/null
+++ b/dom/base/crashtests/845093-1.html
@@ -0,0 +1,10 @@
+<body dir=auto> u	
+<script>
+function initCF() {
+setTimeout("CFcrash()", 284);
+}
+document.addEventListener("DOMContentLoaded", initCF);
+function CFcrash() {
+try { document.designMode = 'on'; document.execCommand("InsertHTML", false, "world"); document.designMode = 'off'; } catch(e) {}
+try { document.designMode = 'on'; document.execCommand("inserthtml", false, "<span><div>"); } catch(e) {}
+}</script>>
diff --git a/dom/base/crashtests/845093-2.html b/dom/base/crashtests/845093-2.html
new file mode 100644
index 0000000000..59262ac4c7
--- /dev/null
+++ b/dom/base/crashtests/845093-2.html
@@ -0,0 +1,7 @@
+><bdi id=test1><refa id=test2>&#xf921;>></bdi>><h1 id=test3><script>
+document.addEventListener("DOMContentLoaded", CFcrash);
+function CFcrash() {
+test1.setAttribute("dir", "invalid");
+test2.textContent = "	&#xf851;S	";
+test3.appendChild(test1);
+}</script>
diff --git a/dom/base/crashtests/847127.html b/dom/base/crashtests/847127.html
new file mode 100644
index 0000000000..4d78893d87
--- /dev/null
+++ b/dom/base/crashtests/847127.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var outer = document.createElement("span");
+  outer.dir = "auto";
+  var inner = document.createElement("span");
+  outer.appendChild(inner);
+  inner.appendChild(document.createTextNode("\u202B"));
+  inner.dir = "auto";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/849601.html b/dom/base/crashtests/849601.html
new file mode 100644
index 0000000000..bc6410d4fa
--- /dev/null
+++ b/dom/base/crashtests/849601.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function addEmptyMutationObserver()
+{
+  var m = new MutationObserver(function () {});
+  var e = document.createElement('i');
+  m.observe(e, { childList: true });
+}
+
+function addPointlessMutationListener()
+{
+  var a = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  a.appendChild(document.createTextNode("1"));
+
+  function f() {
+    window.removeEventListener("DOMSubtreeModified", f);
+    a.insertAdjacentHTML("afterBegin", "<span></span>");
+  };
+
+  window.addEventListener("DOMSubtreeModified", f);
+}
+
+function boom()
+{
+  addEmptyMutationObserver();
+  addPointlessMutationListener();
+  document.body.outerHTML = "";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/849727.html b/dom/base/crashtests/849727.html
new file mode 100644
index 0000000000..8f26365356
--- /dev/null
+++ b/dom/base/crashtests/849727.html
@@ -0,0 +1,9 @@
+<fieldset id=test1>>>>><figure>w.)+</figure>>.c34::-moz-page-sequence { outline-color: invert }<script>
+function reference(domNode) { this.domNode = domNode;} function walk(a, currentPrefix, index, domNode) { if(domNode == null) return; newPrefix = currentPrefix + "_" + index; walk(a, domNode.firstChild); a[newPrefix] = new reference(domNode); } function clear() { var a = new Array(); walk(a, "", 0, document.documentElement); for(key in a) {a[key].domNode.remove(); }}
+document.addEventListener("DOMContentLoaded", CFcrash);
+function CFcrash() {
+setTimeout("try { clear(); } catch(e) {}", 1419);
+try { test1.setAttribute("dir", "auto"); } catch(e) {}
+try { test1.setAttribute("dir", "rtl"); } catch(e) {}
+try { test1.innerHTML = "j,	-wv	g	yys~*hFchDO*u!c{	XRe@Ieo%[8		M3DZu	JoymuI^AjosAx#}A6fUb7M^{lNSX		FZSa	15Zr?mAS/	KLc	Ip`yT^ZHw!6T-zbYi)24w/6:a;	[5	l)T^DOw5T{H	O&%	kq	m6	&HlP"; } catch(e) {}
+}</script>>
\ No newline at end of file
diff --git a/dom/base/crashtests/849732.html b/dom/base/crashtests/849732.html
new file mode 100644
index 0000000000..150db1ca12
--- /dev/null
+++ b/dom/base/crashtests/849732.html
@@ -0,0 +1,18 @@
+<url id=test1></url>><listing id=test2>
+A[]@q
+<root id=test3><bdi dir=ltr id=test4><script>
+var docElement = document.body ? document.body : document.documentElement;
+function initCF() {
+try { test5 = document.createElementNS("http://www.w3.org/2000/svg", "symbol"); } catch(e) {}
+setTimeout("CFcrash()", 231);
+}
+document.addEventListener("DOMContentLoaded", initCF);
+function CFcrash() {
+try { if (test1 != docElement) { test1.remove(); test1 = test4; }} catch(e) {}
+try { if (test1 != docElement) { test1.remove(); }} catch(e) {}
+try { test4.appendChild(test3); } catch(e) {}
+try { test3.appendChild(test2); } catch(e) {}
+try { test4.setAttribute("dir", "invalid"); } catch(e) {}
+setTimeout('try { test5.appendChild(test4); } catch(e) {}', 343);
+try { test2.innerHTML = "W?bj; ![#`A`#Mn$1r+cn	OwS56 =@jQZU	Ua.[d	4g07!6pZzjN	~4P	1C0_# E#Ak/OYXQ46F%7)^KI m-9:`u2^yx R	,yv04!`L)x3V A5K*&NK!Z	qnXt!`I	4i|i=eE?VI=^&lx:F hI2=t+AH)A`	| 3wWxDv0eU"; } catch(e) {}
+}</script>>
\ No newline at end of file
diff --git a/dom/base/crashtests/851353-1.html b/dom/base/crashtests/851353-1.html
new file mode 100644
index 0000000000..2af7de97aa
--- /dev/null
+++ b/dom/base/crashtests/851353-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+    <meta charset="UTF-8">
+    <script>
+        function start() {
+            var doc = document.getElementsByTagName("iframe")[0].contentDocument;
+            var vid = doc.getElementsByTagName("video")[0];
+
+            function runnable() {
+                // The doc.write forces us to recreate doc's body.
+                doc.write("Hello, world");
+                doc.body.appendChild(vid);
+                document.documentElement.removeAttribute("class");
+            }
+
+            doc.open();
+            setTimeout(runnable, 0);
+        }
+    </script>
+</head>
+<body onload='start()'>
+    <iframe srcdoc="<body><video src=http://localhost:8080/ controls=true loop=true autoplay=true autobuffer=false></video>"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/852381.html b/dom/base/crashtests/852381.html
new file mode 100644
index 0000000000..7e8dd47f81
--- /dev/null
+++ b/dom/base/crashtests/852381.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  var z = document.createElement("legend");
+  document.documentElement.appendChild(z);
+  z.style.display = "table-column-group";
+  window.find("?");
+  z.focus();
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/863950.html b/dom/base/crashtests/863950.html
new file mode 100644
index 0000000000..42303a5094
--- /dev/null
+++ b/dom/base/crashtests/863950.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html style="position: fixed;">
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  var cp = document.caretPositionFromPoint(0, 1);
+  document.documentElement.removeChild(document.body);
+  cp.getClientRect();
+}
+
+</script>
+</head>
+
+<body style="margin: 0;" onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/864448.html b/dom/base/crashtests/864448.html
new file mode 100644
index 0000000000..fdb1a75ea1
--- /dev/null
+++ b/dom/base/crashtests/864448.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    document.setUserData('key', {}, null);
+
+    // Depending on the pref bidi.direction, one of these will hit the page scrollbar.
+    window.cpRight = document.caretPositionFromPoint(window.innerWidth - 1, 0);
+    window.cpLeft = document.caretPositionFromPoint(0, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<div style="height: 50000px;"></div>
+</body>
+</html>
diff --git a/dom/base/crashtests/886213.html b/dom/base/crashtests/886213.html
new file mode 100644
index 0000000000..9cba893f33
--- /dev/null
+++ b/dom/base/crashtests/886213.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    // This shouldn't leak
+    var frame = document.getElementById("f");
+    var frameWin = frame.contentWindow;
+    document.body.removeChild(frame);
+    frameWin.navigator;
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="f" src="data:text/html;charset=utf-8,1"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/898906.html b/dom/base/crashtests/898906.html
new file mode 100644
index 0000000000..12f744109c
--- /dev/null
+++ b/dom/base/crashtests/898906.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+var plug = navigator.plugins[0];
+var mime = plug[0];
+// This shouldn't leak.
+mime.expando = true;
+
+</script>
+</head>
+</html>
diff --git a/dom/base/crashtests/90613-1.html b/dom/base/crashtests/90613-1.html
new file mode 100644
index 0000000000..de60573cc3
--- /dev/null
+++ b/dom/base/crashtests/90613-1.html
@@ -0,0 +1,7 @@
+<html>
+<body onload="this.focus();" onfocus="document.getElementById('foo').focus();" 
+onblur="/*alert('hello');*/this.focus();">
+<input type="text" id="foo">
+</body>
+</html>
+
diff --git a/dom/base/crashtests/930250.html b/dom/base/crashtests/930250.html
new file mode 100644
index 0000000000..cf2c15e9e5
--- /dev/null
+++ b/dom/base/crashtests/930250.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+<nobr>
+<h4 contenteditable="true">
+<iframe></iframe>
+<applet></applet>
+<nobr>
diff --git a/dom/base/crashtests/942979.html b/dom/base/crashtests/942979.html
new file mode 100644
index 0000000000..7faf0092ed
--- /dev/null
+++ b/dom/base/crashtests/942979.html
@@ -0,0 +1,42 @@
+<html>
+<head></head>
+<body>
+<script>
+var QNBABBAH=document.createElement('ROTFL');
+
+QNBABBAH.addEventListener('DOMNodeRemoved',function EventHandlerEventHandlerIMQFGDGL()
+{
+         QNBABBAH.normalize();
+});
+
+var MBHOMIBK=document.createElement('whatever');
+QNBABBAH.appendChild(MBHOMIBK);
+
+var BKDKEDBI=document.createElement('whatever');
+MBHOMIBK.appendChild(BKDKEDBI);
+
+var QQFOJBAM=document.createElement('whatever');
+BKDKEDBI.appendChild(QQFOJBAM); 
+
+var JNCNIPON=document.createElement('whatever');
+QQFOJBAM.appendChild(JNCNIPON);
+var a=document.createTextNode('AAAA');
+
+JNCNIPON.addEventListener('DOMNodeInserted',function EventHandlerEventHandlerGFNKONKK()
+{
+   JNCNIPON.insertAdjacentHTML('afterbegin','.');
+
+});
+
+JNCNIPON.appendChild(a);
+
+var CACEQGDA=document.createElement('whatever2');
+
+CACEQGDA.addEventListener('DOMSubtreeModified',function EventHandlerEventHandlerMOOLBGNC(){
+
+});
+
+JNCNIPON.innerHTML = 'ALBERTDAJEDUPY';
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/973401.html b/dom/base/crashtests/973401.html
new file mode 100644
index 0000000000..070548edd1
--- /dev/null
+++ b/dom/base/crashtests/973401.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+    var frame = document.createElement("iframe");
+    document.body.appendChild(frame);
+    var frameLoc = frame.contentWindow.location;
+    document.body.removeChild(frame)
+    frameLoc.origin;
+    document.documentElement.removeAttribute('class');
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/978646.html b/dom/base/crashtests/978646.html
new file mode 100644
index 0000000000..09274ed16c
--- /dev/null
+++ b/dom/base/crashtests/978646.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+    document.styleSheetSets.expando = null;
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
new file mode 100644
index 0000000000..db0fa9c296
--- /dev/null
+++ b/dom/base/crashtests/crashtests.list
@@ -0,0 +1,270 @@
+load 43040-1.html
+load 90613-1.html
+load 116848-1.html
+load 149320-1.html
+load 205225-1.html
+load 231475-1.html
+load 244933-1.html
+load 275912-1.html
+load 293388-1.html
+load 325730-1.html
+load 326618-1.html
+load 326646-1.html
+load 326865-1.html
+load 327571-1.html
+load 327694.html
+load 327695-1.html
+load 329481-1.xhtml
+load 336381-1.xhtml
+load 336715-1.xhtml
+load 338391-1.xhtml
+load 338674-1.xhtml
+load 340733-1.html
+load 343730-1.xhtml
+load 343850-1.xhtml
+load 343889-1.html
+load 344434-1.xhtml
+load 344882-1.html
+load 345837-1.xhtml
+load 346381-1.html
+load 349355-1.html
+load 359432-1.xhtml
+load 360599-1.html
+load 366200-1.xhtml
+load 369219-1.xhtml
+load 369413-1.html
+load 371124-1.html
+load 371124-2.html
+load 371466-1.xhtml
+load 372554-1.html
+load 375399-1.html
+load 377360-1.xhtml
+load 377960-1.html
+load 377960-2.html
+load 384663-1.html
+load 386000-1.html
+load 386794-1.html
+load 387460-1.html
+load 399712-1.html
+load 400763-1.html
+load 407818.html
+load 410860-1.xml
+load 411882-1.xhtml
+load 416734-1.html
+load 417852-1.html
+load 418928-1.html
+load 420620-1.html
+load 424276-1.html
+load 426987-1.html
+load 439206-1.html
+load 443538-1.svg
+load 448615-1.html
+load 450383-1.html
+load 450385-1.html
+load 458637-1.html
+load 462947.html
+load 467392.html
+load 472593-1.html
+load 474041-1.svg
+load 476526.html
+load 483818-1.html
+load 490760-1.xhtml
+load 493281-1.html
+load 493281-2.html
+load 494810-1.html
+load 499006-1.html
+load 499006-2.html
+load 502617.html
+load 504224.html
+load 509536-1.html
+load 522516-1.html
+load 529670.html
+load 535926-1.html
+load 543645.html
+load 551631-1.html
+load 552651.html
+load 554230-1.xhtml
+load 558973.html
+load 564079-1.html
+load 564114.html
+load 565125-1.html
+load 575462.svg
+load 582601.html
+load 590395-1.html
+load 593302-1.html
+load 593302-2.html
+load 595606-1.html
+load 595606-2.html
+load 601247.html
+load 603531.html
+load 604262-1.html
+load 605672-1.svg
+load 606729-1.html
+load 607222.html
+load 609560-1.xhtml
+load 610571-1.html
+load 612018-1.html
+load 628599-1.html
+load 637116.html
+load 637214-1.svg
+load 637214-2.svg
+pref(extensions.InstallTrigger.enabled,true) pref(extensions.InstallTriggerImpl.enabled,true) load 642022-1.html
+load 646184.html
+load 658845-1.svg
+load 666869.html
+load 667336-1.html
+load 675516.xhtml
+load 675621-1.html
+load 677194.html
+load 679459.html
+load 679689-1.html
+load 682463.html
+load 693212.xhtml
+load 693811-1.html
+load 693811-2.html
+load 693811-3.html
+load 693894.html
+load 695867.html
+load 697643.html
+load 698974-1.html
+load 700090-1.html
+load 700090-2.html
+load 700512.html
+load 706283-1.html
+load 709384.html
+load 709954.html
+load 713417-1.html
+load 713417-2.html
+load 715056.html
+load 729431-1.xhtml
+load 741163-1.html
+load 745495.html
+load 752226-1.html
+load 752226-2.html
+load 766426.html
+load 771639.html
+load 786854.html
+load 815043.html
+load 815276.html
+load 815477.html
+load 815500.html
+load 816253.html
+load 819014.html
+load 822723.html
+load 824719.html
+load 827190.html
+load 828054.html
+load 828903.html
+load 829428.html
+load 830098.html
+load 831287.html
+load 832644.html
+load 836890.html
+load 838489-1.html
+load 838489-2.html
+load 841205.html
+load 844404.html
+load 845093-1.html
+load 845093-2.html
+load 847127.html
+load 849601.html
+load 849727.html
+load 849732.html
+load 851353-1.html
+load 852381.html
+load 863950.html
+load 864448.html
+load 886213.html
+load 898906.html
+load 930250.html
+load 942979.html
+load 973401.html
+load 978646.html
+load 1024428-1.html
+load 1027461-1.html
+load 1029710.html
+load 1154598.xhtml
+load 1157995.html
+load 1158412.html
+load 1181619.html
+load 1228882.html
+load 1230422.html
+load 1251361.html
+load 1281715.html
+load 1304437.html
+load 1324209.html
+load 1324500.html
+load 1326194-1.html
+load 1326194-2.html
+load 1332939.html
+load 1341693.html
+load 1352453.html
+load chrome://reftest/content/crashtests/dom/base/crashtests/1353529.xhtml
+load 1368327.html
+load chrome://reftest/content/crashtests/dom/base/crashtests/1369363.xhtml
+load 1370072.html
+pref(clipboard.autocopy,true) load 1370737.html
+load 1370968.html
+load 1373750.html
+load 1377826.html
+load 1383478.html
+load 1383780.html
+pref(clipboard.autocopy,true) load 1385272-1.html
+load 1393806.html
+load 1396466.html
+load 1397795.html
+load 1400701.html
+load 1403377.html
+load 1405771.html
+load 1406109-1.html
+load 1411473.html
+load 1413815.html
+load 1419799.html
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) skip-if(!browserIsRemote) skip-if(geckoview) skip-if(geckoview&&isDebugBuild) skip-if(AddressSanitizer) skip-if(ThreadSanitizer) pref(dom.disable_open_during_load,false) load 1419902.html # skip on non e10s loads, Bug 1419902. Bug 1563013 for GV+WR. Bug 1524493 GV+debug. Bug 1573281 asan
+load 1422883.html
+load 1428053.html
+load 1441029.html
+load 1445670.html
+load 1449601.html
+load 1458016.html
+load 1459688.html
+load 1460794.html
+load 1462548.html
+load 1505811.html
+load 1505875.html
+load 1508845.html
+load 1516289.html
+load 1516560.html
+pref(javascript.options.dynamicImport,true) load 1529203-1.html
+skip-if(Android) pref(javascript.options.dynamicImport,true) pref(dom.disable_open_during_load,false) pref(browser.link.open_newwindow,2) load 1529203-2.html
+skip-if(Android) pref(dom.disable_open_during_load,false) pref(browser.link.open_newwindow,2) load 1529203-3.html
+load 1528675.html
+load 1566310.html
+skip-if(Android) skip-if(ThreadSanitizer) pref(dom.disable_open_during_load,false) pref(browser.link.open_newwindow,2) load 1588259.html
+load structured_clone_container_throws.html
+load xhr_empty_datauri.html
+load xhr_html_nullresponse.html
+asserts(0-1) load 1517025.html # see bug 1666910 for assert
+load xhr-with-pagehide-1.html
+load 1555786.html
+load 1577191.html
+load eventSource_invalid_scheme_worker_shutdown.html
+load 1291535.html
+skip-if(!isDebugBuild||xulRuntime.OS!="Linux") load 1611853.html
+load 1619322.html
+asserts(0-2) load 1623918.html # May hit an assertion if the <input> element's anonymous tree hasn't been flushed when IMEContentObserver handles focus
+load 1656925.html
+skip-if(Android) load 1665792.html # Print preview on android doesn't fly
+skip-if(ThreadSanitizer) load 1681729.html
+skip-if(ThreadSanitizer) load 1693049.html
+skip-if(winWidget||Android) pref(print.always_print_silent,true) pref(print.print_to_file,true) pref(print.print_to_filename,"/dev/null") load 1697256.html # Windows seemingly requires pref(print_printer,"Mozilla Save to PDF") but pref() doesn't allow space. Android doesn't support print.
+skip-if(ThreadSanitizer||Android) load 1697525.html
+skip-if(ThreadSanitizer||Android) load 1712198.html # Mysterious failure that should be investigated (bug 1712866).
+skip-if(Android) HTTP load 1728670-1.html
+load 1757923.html
+load 1766472.html
+pref(dom.enable_web_task_scheduling,true) load 1780790.html
+load 1700237.html
+load 1811939.html
+load 1822717.html
+skip-if(Android) load 1838484.html
diff --git a/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown-worker.js b/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown-worker.js
new file mode 100644
index 0000000000..d2e5e9e668
--- /dev/null
+++ b/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown-worker.js
@@ -0,0 +1,4 @@
+onmessage = function(event) {
+  close();
+  let source = new EventSource(`d:`, {});
+}
diff --git a/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown.html b/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown.html
new file mode 100644
index 0000000000..731392d83d
--- /dev/null
+++ b/dom/base/crashtests/eventSource_invalid_scheme_worker_shutdown.html
@@ -0,0 +1,36 @@
+<html class="reftest-wait">
+    <head>
+        <script type="text/javascript">
+            const workerURL = "1614339-worker.js";
+
+            const Cc = SpecialPowers.Cc;
+            const Ci = SpecialPowers.Ci;
+            const wdm = Cc["@mozilla.org/dom/workers/workerdebuggermanager;1"]
+                          .getService(Ci.nsIWorkerDebuggerManager);
+
+            function waitForUnregister() {
+              return new Promise(function(resolve) {
+                wdm.addListener({
+                  onUnregister(dbg) {
+                    if (dbg.url !== workerURL) {
+                      return;
+                    }
+                    wdm.removeListener(this);
+                     resolve();
+                  },
+                });
+              });
+            }
+
+            function boom() {
+              const worker = new Worker(workerURL);
+              waitForUnregister().then(function() {
+                document.documentElement.classList.remove("reftest-wait");
+              });
+              worker.postMessage("Start");
+            }
+         </script>
+     </head>
+     <body onload="boom();"></body>
+</html>
+
diff --git a/dom/base/crashtests/file_504224.html b/dom/base/crashtests/file_504224.html
new file mode 100644
index 0000000000..9031ccbfad
--- /dev/null
+++ b/dom/base/crashtests/file_504224.html
@@ -0,0 +1,7 @@
+<html><head></head>
+  <body onunload="window.frameElement.parentNode.removeChild(window.frameElement)" tabindex="1">
+  <script>
+document.body.focus();
+  </script>
+  </body>
+</html>
diff --git a/dom/base/crashtests/module-with-syntax-error.js b/dom/base/crashtests/module-with-syntax-error.js
new file mode 100644
index 0000000000..7edb2fa5bc
--- /dev/null
+++ b/dom/base/crashtests/module-with-syntax-error.js
@@ -0,0 +1 @@
+,
diff --git a/dom/base/crashtests/structured_clone_container_throws.html b/dom/base/crashtests/structured_clone_container_throws.html
new file mode 100644
index 0000000000..c92c6f4ae1
--- /dev/null
+++ b/dom/base/crashtests/structured_clone_container_throws.html
@@ -0,0 +1,9 @@
+<iframe></iframe>
+<script>
+try { frames[0].history.pushState({ dummy: function() {} }, ''); }
+catch (e) {}
+var doc = frames[0].document;
+var s = doc.createElement("script");
+s.textContent = "1";
+doc.body.appendChild(s);
+</script>
diff --git a/dom/base/crashtests/xhr-with-pagehide-1-helper.html b/dom/base/crashtests/xhr-with-pagehide-1-helper.html
new file mode 100644
index 0000000000..efac291708
--- /dev/null
+++ b/dom/base/crashtests/xhr-with-pagehide-1-helper.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function redirectAndFireXHR() {
+  const XHR = new XMLHttpRequest();
+  document.location.assign('data:text/html,final iframe content');
+  XHR.open('GET', 'data:text/html,1', false);
+  XHR.send();
+}
+
+function handlePageHide() {
+  window.parent.finishTest();
+}
+</script>
+</head>
+<body onload="redirectAndFireXHR()"
+      onpagehide="handlePageHide()">
+initial iframe content
+</body>
+</html>
diff --git a/dom/base/crashtests/xhr-with-pagehide-1.html b/dom/base/crashtests/xhr-with-pagehide-1.html
new file mode 100644
index 0000000000..86f074868f
--- /dev/null
+++ b/dom/base/crashtests/xhr-with-pagehide-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <title>
+    Crashtest to make sure that a sync XHR during pageload doesn't prevent
+    pagehide event from firing.
+  </title>
+  <script>
+    function finishTest() {
+      // Visual indication that we got this far, for humans viewing the test:
+      document.documentElement.style.backgroundColor = "lime";
+
+      // Actually finish the test:
+      document.documentElement.className = "";
+    }
+  </script>
+</head>
+<body>
+  <iframe src="xhr-with-pagehide-1-helper.html"></iframe>
+</body>
+</html>
diff --git a/dom/base/crashtests/xhr_empty_datauri.html b/dom/base/crashtests/xhr_empty_datauri.html
new file mode 100644
index 0000000000..77988cfe24
--- /dev/null
+++ b/dom/base/crashtests/xhr_empty_datauri.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html class="reftest-wait"><meta charset=utf-8>
+<script>
+var xhr=new XMLHttpRequest();xhr.open("GET","data:,");xhr.responseType='blob';xhr.onloadend=function(){document.documentElement.removeAttribute('class');};xhr.send();
+</script>
diff --git a/dom/base/crashtests/xhr_html_nullresponse.html b/dom/base/crashtests/xhr_html_nullresponse.html
new file mode 100644
index 0000000000..47c85db9bf
--- /dev/null
+++ b/dom/base/crashtests/xhr_html_nullresponse.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+var xhr=new XMLHttpRequest();xhr.open("GET",window.location);xhr.overrideMimeType("text/html");xhr.onprogress=function(){if(xhr.readyState!=3)return;xhr.abort();document.documentElement.removeAttribute('class');};xhr.onabort=function(){xhr.responseText;};xhr.send();
+</script>
-- 
cgit v1.2.3