From 36d22d82aa202bb199967e9512281e9a53db42c9 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 7 Apr 2024 21:33:14 +0200
Subject: Adding upstream version 115.7.0esr.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 layout/svg/crashtests/1016145.svg                  |   5 +
 layout/svg/crashtests/1028512.svg                  |  15 ++
 layout/svg/crashtests/1072758.html                 |  35 +++
 layout/svg/crashtests/1140080-1.svg                |  11 +
 layout/svg/crashtests/1149542-1.svg                |   9 +
 layout/svg/crashtests/1156581-1.svg                |  12 +
 layout/svg/crashtests/1182496-1.html               |  21 ++
 layout/svg/crashtests/1209525-1.svg                |   7 +
 layout/svg/crashtests/1223281-1.svg                |  24 ++
 layout/svg/crashtests/1234726-1.svg                |  13 ++
 layout/svg/crashtests/1322537-1.html               |   2 +
 layout/svg/crashtests/1322537-2.html               |  15 ++
 layout/svg/crashtests/1322852.html                 |   2 +
 layout/svg/crashtests/1348564.svg                  |   7 +
 layout/svg/crashtests/1402109.html                 |  11 +
 layout/svg/crashtests/1402124.html                 |  10 +
 layout/svg/crashtests/1402486.html                 |  12 +
 layout/svg/crashtests/1403656-1.html               |  19 ++
 layout/svg/crashtests/1403656-2.html               |  21 ++
 layout/svg/crashtests/1403656-3.html               |   8 +
 layout/svg/crashtests/1403656-4.html               |   9 +
 layout/svg/crashtests/1403656-5.html               |  11 +
 layout/svg/crashtests/1404086.html                 |   2 +
 layout/svg/crashtests/1421807-1.html               |   5 +
 layout/svg/crashtests/1421807-2.html               |  15 ++
 layout/svg/crashtests/1422226.html                 |  39 ++++
 layout/svg/crashtests/1424031.html                 |  16 ++
 layout/svg/crashtests/1425434-1.html               |  59 +++++
 layout/svg/crashtests/1426575.html                 |  16 ++
 layout/svg/crashtests/1443092-helper.svg           |   6 +
 layout/svg/crashtests/1443092.html                 |  34 +++
 layout/svg/crashtests/1454201-1.html               |  52 +++++
 layout/svg/crashtests/1467552-1.html               |  15 ++
 layout/svg/crashtests/1474982.html                 |   2 +
 layout/svg/crashtests/1480224.html                 |   6 +
 layout/svg/crashtests/1480275.html                 |  15 ++
 layout/svg/crashtests/1502936.html                 |  11 +
 layout/svg/crashtests/1504072.html                 |   4 +
 layout/svg/crashtests/1504918.svg                  |   4 +
 layout/svg/crashtests/1535517-1.svg                |  11 +
 layout/svg/crashtests/1536892.html                 |  13 ++
 layout/svg/crashtests/1539318-1.svg                |  10 +
 layout/svg/crashtests/1548985-1.html               |  16 ++
 layout/svg/crashtests/1548985-2.svg                |   4 +
 layout/svg/crashtests/1555851.html                 |   8 +
 layout/svg/crashtests/1563779.html                 |  19 ++
 layout/svg/crashtests/1600855.html                 |   8 +
 layout/svg/crashtests/1601824.html                 |   7 +
 layout/svg/crashtests/1605223-1.html               |   4 +
 layout/svg/crashtests/1609663.html                 |  34 +++
 layout/svg/crashtests/1671950.html                 |  27 +++
 layout/svg/crashtests/1678947.html                 |  21 ++
 layout/svg/crashtests/1693032.html                 |  21 ++
 layout/svg/crashtests/1696505.html                 |   9 +
 layout/svg/crashtests/1755770-1.html               |  18 ++
 layout/svg/crashtests/1755770-2.html               |  19 ++
 layout/svg/crashtests/1758029-1.html               |  40 ++++
 layout/svg/crashtests/1764936-1.html               |  16 ++
 layout/svg/crashtests/1804958.html                 |   4 +
 layout/svg/crashtests/1810260.html                 |  28 +++
 layout/svg/crashtests/1826444-1.html               |   6 +
 layout/svg/crashtests/1831419.html                 |   6 +
 layout/svg/crashtests/220165-1.svg                 |  21 ++
 layout/svg/crashtests/267650-1.svg                 |   4 +
 layout/svg/crashtests/294022-1.svg                 |  17 ++
 layout/svg/crashtests/307314-1.svg                 |   9 +
 layout/svg/crashtests/308615-1.svg                 |  10 +
 layout/svg/crashtests/308917-1.svg                 |  35 +++
 layout/svg/crashtests/310436-1.svg                 |  28 +++
 layout/svg/crashtests/310638.svg                   |  35 +++
 layout/svg/crashtests/313737-1.xml                 |  16 ++
 layout/svg/crashtests/314244-1.xhtml               |  26 +++
 layout/svg/crashtests/322185-1.svg                 |   6 +
 layout/svg/crashtests/322215-1.svg                 |  31 +++
 layout/svg/crashtests/323704-1.svg                 |  12 +
 layout/svg/crashtests/325427-1.svg                 |  20 ++
 layout/svg/crashtests/326495-1.svg                 |  16 ++
 layout/svg/crashtests/326974-1.svg                 |  21 ++
 layout/svg/crashtests/327706-1.svg                 |   9 +
 layout/svg/crashtests/327711-1.svg                 |  19 ++
 layout/svg/crashtests/328137-1.svg                 |  24 ++
 layout/svg/crashtests/329848-1.svg                 |   1 +
 layout/svg/crashtests/337408-1.xhtml               |  21 ++
 layout/svg/crashtests/338301-1.xhtml               |  13 ++
 layout/svg/crashtests/338312-1.xhtml               |  28 +++
 layout/svg/crashtests/340083-1.svg                 |   9 +
 layout/svg/crashtests/340945-1.svg                 |   2 +
 layout/svg/crashtests/342923-1.html                |  23 ++
 layout/svg/crashtests/343221-1.xhtml               |  20 ++
 layout/svg/crashtests/344749-1.svg                 |  11 +
 layout/svg/crashtests/344887-1.svg                 |  18 ++
 layout/svg/crashtests/344892-1.svg                 |   5 +
 layout/svg/crashtests/344898-1.svg                 |  19 ++
 layout/svg/crashtests/344904-1.svg                 |  19 ++
 layout/svg/crashtests/345418-1.svg                 |   4 +
 layout/svg/crashtests/348982-1.xhtml               |  20 ++
 layout/svg/crashtests/354777-1.xhtml               |  28 +++
 layout/svg/crashtests/359516-1.svg                 |  36 +++
 layout/svg/crashtests/361015-1.svg                 |  33 +++
 layout/svg/crashtests/361587-1.svg                 |  31 +++
 layout/svg/crashtests/363611-1.xhtml               |  21 ++
 layout/svg/crashtests/364688-1.svg                 |  34 +++
 layout/svg/crashtests/366956-1.svg                 |  61 +++++
 layout/svg/crashtests/366956-2.svg                 |  61 +++++
 layout/svg/crashtests/367111-1.svg                 |  29 +++
 layout/svg/crashtests/367368-1.xhtml               |  12 +
 layout/svg/crashtests/369233-1.svg                 |  33 +++
 layout/svg/crashtests/369438-1.svg                 |  24 ++
 layout/svg/crashtests/369438-2.svg                 |  27 +++
 layout/svg/crashtests/371463-1.xhtml               |   8 +
 layout/svg/crashtests/371563-1.xhtml               |  32 +++
 layout/svg/crashtests/375775-1.svg                 |  23 ++
 layout/svg/crashtests/378716.svg                   |   4 +
 layout/svg/crashtests/380691-1.svg                 |   4 +
 layout/svg/crashtests/384391-1.xhtml               |  20 ++
 layout/svg/crashtests/384499-1.svg                 |  20 ++
 layout/svg/crashtests/384637-1.svg                 |   9 +
 layout/svg/crashtests/384728-1.svg                 |  21 ++
 layout/svg/crashtests/385246-1.svg                 |   9 +
 layout/svg/crashtests/385246-2.svg                 |  15 ++
 layout/svg/crashtests/385552-1.svg                 |   4 +
 layout/svg/crashtests/385552-2.svg                 |   4 +
 layout/svg/crashtests/385840-1.svg                 |  20 ++
 layout/svg/crashtests/385852-1.svg                 |  34 +++
 layout/svg/crashtests/386475-1.xhtml               |  24 ++
 layout/svg/crashtests/386690-1.svg                 |   3 +
 layout/svg/crashtests/387290-1.svg                 |  26 +++
 layout/svg/crashtests/402408-1.svg                 |  32 +++
 layout/svg/crashtests/404677-1.xhtml               |   9 +
 layout/svg/crashtests/409565-1.xhtml               |   3 +
 layout/svg/crashtests/420697-1.svg                 |   7 +
 layout/svg/crashtests/420697-2.svg                 |   6 +
 layout/svg/crashtests/429774-1.svg                 |  29 +++
 layout/svg/crashtests/441368-1.svg                 |  31 +++
 layout/svg/crashtests/453754-1.svg                 |   7 +
 layout/svg/crashtests/455314-1.xhtml               |  16 ++
 layout/svg/crashtests/458453.html                  |  24 ++
 layout/svg/crashtests/459666-1.html                |   7 +
 layout/svg/crashtests/459883.xhtml                 |  13 ++
 layout/svg/crashtests/461289-1.svg                 |  18 ++
 layout/svg/crashtests/464374-1.svg                 |  15 ++
 layout/svg/crashtests/466585-1.svg                 |  17 ++
 layout/svg/crashtests/467323-1.svg                 |  10 +
 layout/svg/crashtests/467498-1.svg                 |  12 +
 layout/svg/crashtests/470124-1.svg                 |   7 +
 layout/svg/crashtests/472782-1.svg                 |   3 +
 layout/svg/crashtests/474700-1.svg                 |   1 +
 layout/svg/crashtests/475181-1.svg                 |   1 +
 layout/svg/crashtests/475193-1.html                |  21 ++
 layout/svg/crashtests/475302-1.svg                 |  11 +
 layout/svg/crashtests/477935-1.html                |  11 +
 layout/svg/crashtests/478128-1.svg                 |  15 ++
 layout/svg/crashtests/478511-1.svg                 |   9 +
 layout/svg/crashtests/483439-1.svg                 |  17 ++
 layout/svg/crashtests/492186-1.svg                 |   6 +
 layout/svg/crashtests/508247-1.svg                 |  10 +
 layout/svg/crashtests/512890-1.svg                 |   4 +
 layout/svg/crashtests/515288-1.html                |   5 +
 layout/svg/crashtests/522394-1.svg                 |  12 +
 layout/svg/crashtests/522394-2.svg                 |  12 +
 layout/svg/crashtests/522394-3.svg                 |  12 +
 layout/svg/crashtests/566216-1.svg                 |  19 ++
 layout/svg/crashtests/587336-1.html                |   9 +
 layout/svg/crashtests/590291-1.svg                 |   9 +
 layout/svg/crashtests/601999-1.html                |   5 +
 layout/svg/crashtests/605626-1.svg                 |   3 +
 layout/svg/crashtests/606914.xhtml                 |   1 +
 layout/svg/crashtests/610594-1.html                |   6 +
 layout/svg/crashtests/610954-1.html                |   1 +
 layout/svg/crashtests/612662-1.svg                 |   1 +
 layout/svg/crashtests/612662-2.svg                 |   3 +
 layout/svg/crashtests/612736-1.svg                 |  19 ++
 layout/svg/crashtests/612736-2.svg                 |   8 +
 layout/svg/crashtests/614367-1.svg                 |   8 +
 layout/svg/crashtests/620034-1.html                |  15 ++
 layout/svg/crashtests/621598-1.svg                 |  16 ++
 layout/svg/crashtests/648819-1.html                |   6 +
 layout/svg/crashtests/655025-1.svg                 |   6 +
 layout/svg/crashtests/655025-2.svg                 |   6 +
 layout/svg/crashtests/655025-3.svg                 |   9 +
 layout/svg/crashtests/657077-1.svg                 |  19 ++
 layout/svg/crashtests/669025-1.svg                 |   8 +
 layout/svg/crashtests/669025-2.svg                 |   8 +
 layout/svg/crashtests/682411-1.svg                 |   5 +
 layout/svg/crashtests/692203-1.svg                 |   4 +
 layout/svg/crashtests/692203-2.svg                 |   4 +
 layout/svg/crashtests/693424-1.svg                 |   6 +
 layout/svg/crashtests/709920-1.svg                 |  23 ++
 layout/svg/crashtests/709920-2.svg                 |  23 ++
 layout/svg/crashtests/713413-1.svg                 |  12 +
 layout/svg/crashtests/722003-1.svg                 |  13 ++
 layout/svg/crashtests/725918-1.svg                 |   4 +
 layout/svg/crashtests/732836-1.svg                 |  17 ++
 layout/svg/crashtests/740627-1.svg                 |   6 +
 layout/svg/crashtests/740627-2.svg                 |   6 +
 layout/svg/crashtests/743469.svg                   |   5 +
 layout/svg/crashtests/757704-1.svg                 |  17 ++
 layout/svg/crashtests/757718-1.svg                 |  18 ++
 layout/svg/crashtests/757751-1.svg                 |   8 +
 layout/svg/crashtests/767056-1.svg                 |  21 ++
 layout/svg/crashtests/767535-1.xhtml               |  22 ++
 layout/svg/crashtests/768087-1.html                |   4 +
 layout/svg/crashtests/768351.svg                   |   2 +
 layout/svg/crashtests/772313-1.svg                 |   1 +
 layout/svg/crashtests/778492-1.svg                 |   4 +
 layout/svg/crashtests/779971-1.svg                 |  14 ++
 layout/svg/crashtests/780764-1.svg                 |  18 ++
 layout/svg/crashtests/780963-1.html                |  27 +++
 layout/svg/crashtests/782141-1.svg                 |  16 ++
 layout/svg/crashtests/784061-1.svg                 |  16 ++
 layout/svg/crashtests/788831-1.svg                 |   5 +
 layout/svg/crashtests/789390-1.html                |   1 +
 layout/svg/crashtests/790072.svg                   |   1 +
 layout/svg/crashtests/791826-1.svg                 |  14 ++
 layout/svg/crashtests/803562-1.svg                 |  18 ++
 layout/svg/crashtests/808318-1.svg                 |   2 +
 layout/svg/crashtests/813420-1.svg                 |  14 ++
 layout/svg/crashtests/841163-1.svg                 |  29 +++
 layout/svg/crashtests/841812-1.svg                 |  11 +
 layout/svg/crashtests/842009-1.svg                 |   5 +
 layout/svg/crashtests/842630-1.svg                 |   1 +
 layout/svg/crashtests/842909-1.svg                 |  11 +
 layout/svg/crashtests/843072-1.svg                 |  11 +
 layout/svg/crashtests/843917-1.svg                 |  19 ++
 layout/svg/crashtests/847139-1.svg                 |  13 ++
 layout/svg/crashtests/849688-1.svg                 |  11 +
 layout/svg/crashtests/849688-2.svg                 |  11 +
 layout/svg/crashtests/860378-1.svg                 |  24 ++
 layout/svg/crashtests/868904-1.svg                 |  17 ++
 layout/svg/crashtests/873806-1.svg                 |  10 +
 layout/svg/crashtests/876831-1.svg                 |  18 ++
 layout/svg/crashtests/877029-1.svg                 |  10 +
 layout/svg/crashtests/880925-1.svg                 |  26 +++
 layout/svg/crashtests/881031-1.svg                 |  15 ++
 layout/svg/crashtests/885608-1.svg                 |  13 ++
 layout/svg/crashtests/890782-1.svg                 |  16 ++
 layout/svg/crashtests/890783-1.svg                 |  19 ++
 layout/svg/crashtests/893510-1.svg                 |   5 +
 layout/svg/crashtests/895311-1.svg                 |  17 ++
 layout/svg/crashtests/897342-1.svg                 |   1 +
 layout/svg/crashtests/898909-1.svg                 |  11 +
 layout/svg/crashtests/898951-1.svg                 |   3 +
 layout/svg/crashtests/913990.html                  |   5 +
 layout/svg/crashtests/919371-1.xhtml               |   5 +
 layout/svg/crashtests/950324-1.svg                 |   3 +
 layout/svg/crashtests/951904-1.html                |  43 ++++
 layout/svg/crashtests/952270-1.svg                 |   9 +
 layout/svg/crashtests/963086-1.svg                 |  18 ++
 layout/svg/crashtests/974746-1.svg                 |   9 +
 layout/svg/crashtests/975773-1.svg                 |  10 +
 layout/svg/crashtests/979407-1.svg                 |   4 +
 layout/svg/crashtests/979407-2.svg                 |   4 +
 layout/svg/crashtests/993443.svg                   |   4 +
 .../blob-merging-and-retained-display-list.html    |  62 +++++
 ...ditional-outer-svg-nondirty-reflow-assert.xhtml |  28 +++
 layout/svg/crashtests/crashtests.list              | 260 +++++++++++++++++++++
 layout/svg/crashtests/empty-blob-merging.html      |  48 ++++
 layout/svg/crashtests/extref-test-1-resource.xhtml |  24 ++
 layout/svg/crashtests/extref-test-1.xhtml          |  11 +
 layout/svg/crashtests/grouping-empty-bounds.html   |  41 ++++
 layout/svg/crashtests/invalid_url.html             |  11 +
 .../svg/crashtests/invalidation-of-opacity-0.html  |  26 +++
 layout/svg/crashtests/masked-3d-transform.html     |  20 ++
 .../svg/crashtests/perspective-invalidation.html   |   9 +
 264 files changed, 4161 insertions(+)
 create mode 100644 layout/svg/crashtests/1016145.svg
 create mode 100644 layout/svg/crashtests/1028512.svg
 create mode 100644 layout/svg/crashtests/1072758.html
 create mode 100644 layout/svg/crashtests/1140080-1.svg
 create mode 100644 layout/svg/crashtests/1149542-1.svg
 create mode 100644 layout/svg/crashtests/1156581-1.svg
 create mode 100644 layout/svg/crashtests/1182496-1.html
 create mode 100644 layout/svg/crashtests/1209525-1.svg
 create mode 100644 layout/svg/crashtests/1223281-1.svg
 create mode 100644 layout/svg/crashtests/1234726-1.svg
 create mode 100644 layout/svg/crashtests/1322537-1.html
 create mode 100644 layout/svg/crashtests/1322537-2.html
 create mode 100644 layout/svg/crashtests/1322852.html
 create mode 100644 layout/svg/crashtests/1348564.svg
 create mode 100644 layout/svg/crashtests/1402109.html
 create mode 100644 layout/svg/crashtests/1402124.html
 create mode 100644 layout/svg/crashtests/1402486.html
 create mode 100644 layout/svg/crashtests/1403656-1.html
 create mode 100644 layout/svg/crashtests/1403656-2.html
 create mode 100644 layout/svg/crashtests/1403656-3.html
 create mode 100644 layout/svg/crashtests/1403656-4.html
 create mode 100644 layout/svg/crashtests/1403656-5.html
 create mode 100644 layout/svg/crashtests/1404086.html
 create mode 100644 layout/svg/crashtests/1421807-1.html
 create mode 100644 layout/svg/crashtests/1421807-2.html
 create mode 100644 layout/svg/crashtests/1422226.html
 create mode 100644 layout/svg/crashtests/1424031.html
 create mode 100644 layout/svg/crashtests/1425434-1.html
 create mode 100644 layout/svg/crashtests/1426575.html
 create mode 100644 layout/svg/crashtests/1443092-helper.svg
 create mode 100644 layout/svg/crashtests/1443092.html
 create mode 100644 layout/svg/crashtests/1454201-1.html
 create mode 100644 layout/svg/crashtests/1467552-1.html
 create mode 100644 layout/svg/crashtests/1474982.html
 create mode 100644 layout/svg/crashtests/1480224.html
 create mode 100644 layout/svg/crashtests/1480275.html
 create mode 100644 layout/svg/crashtests/1502936.html
 create mode 100644 layout/svg/crashtests/1504072.html
 create mode 100644 layout/svg/crashtests/1504918.svg
 create mode 100644 layout/svg/crashtests/1535517-1.svg
 create mode 100644 layout/svg/crashtests/1536892.html
 create mode 100644 layout/svg/crashtests/1539318-1.svg
 create mode 100644 layout/svg/crashtests/1548985-1.html
 create mode 100644 layout/svg/crashtests/1548985-2.svg
 create mode 100644 layout/svg/crashtests/1555851.html
 create mode 100644 layout/svg/crashtests/1563779.html
 create mode 100644 layout/svg/crashtests/1600855.html
 create mode 100644 layout/svg/crashtests/1601824.html
 create mode 100644 layout/svg/crashtests/1605223-1.html
 create mode 100644 layout/svg/crashtests/1609663.html
 create mode 100644 layout/svg/crashtests/1671950.html
 create mode 100644 layout/svg/crashtests/1678947.html
 create mode 100644 layout/svg/crashtests/1693032.html
 create mode 100644 layout/svg/crashtests/1696505.html
 create mode 100644 layout/svg/crashtests/1755770-1.html
 create mode 100644 layout/svg/crashtests/1755770-2.html
 create mode 100644 layout/svg/crashtests/1758029-1.html
 create mode 100644 layout/svg/crashtests/1764936-1.html
 create mode 100644 layout/svg/crashtests/1804958.html
 create mode 100644 layout/svg/crashtests/1810260.html
 create mode 100644 layout/svg/crashtests/1826444-1.html
 create mode 100644 layout/svg/crashtests/1831419.html
 create mode 100644 layout/svg/crashtests/220165-1.svg
 create mode 100644 layout/svg/crashtests/267650-1.svg
 create mode 100644 layout/svg/crashtests/294022-1.svg
 create mode 100644 layout/svg/crashtests/307314-1.svg
 create mode 100644 layout/svg/crashtests/308615-1.svg
 create mode 100644 layout/svg/crashtests/308917-1.svg
 create mode 100644 layout/svg/crashtests/310436-1.svg
 create mode 100644 layout/svg/crashtests/310638.svg
 create mode 100644 layout/svg/crashtests/313737-1.xml
 create mode 100644 layout/svg/crashtests/314244-1.xhtml
 create mode 100644 layout/svg/crashtests/322185-1.svg
 create mode 100644 layout/svg/crashtests/322215-1.svg
 create mode 100644 layout/svg/crashtests/323704-1.svg
 create mode 100644 layout/svg/crashtests/325427-1.svg
 create mode 100644 layout/svg/crashtests/326495-1.svg
 create mode 100644 layout/svg/crashtests/326974-1.svg
 create mode 100644 layout/svg/crashtests/327706-1.svg
 create mode 100644 layout/svg/crashtests/327711-1.svg
 create mode 100644 layout/svg/crashtests/328137-1.svg
 create mode 100644 layout/svg/crashtests/329848-1.svg
 create mode 100644 layout/svg/crashtests/337408-1.xhtml
 create mode 100644 layout/svg/crashtests/338301-1.xhtml
 create mode 100644 layout/svg/crashtests/338312-1.xhtml
 create mode 100644 layout/svg/crashtests/340083-1.svg
 create mode 100644 layout/svg/crashtests/340945-1.svg
 create mode 100644 layout/svg/crashtests/342923-1.html
 create mode 100644 layout/svg/crashtests/343221-1.xhtml
 create mode 100644 layout/svg/crashtests/344749-1.svg
 create mode 100644 layout/svg/crashtests/344887-1.svg
 create mode 100644 layout/svg/crashtests/344892-1.svg
 create mode 100644 layout/svg/crashtests/344898-1.svg
 create mode 100644 layout/svg/crashtests/344904-1.svg
 create mode 100644 layout/svg/crashtests/345418-1.svg
 create mode 100644 layout/svg/crashtests/348982-1.xhtml
 create mode 100644 layout/svg/crashtests/354777-1.xhtml
 create mode 100644 layout/svg/crashtests/359516-1.svg
 create mode 100644 layout/svg/crashtests/361015-1.svg
 create mode 100644 layout/svg/crashtests/361587-1.svg
 create mode 100644 layout/svg/crashtests/363611-1.xhtml
 create mode 100644 layout/svg/crashtests/364688-1.svg
 create mode 100644 layout/svg/crashtests/366956-1.svg
 create mode 100644 layout/svg/crashtests/366956-2.svg
 create mode 100644 layout/svg/crashtests/367111-1.svg
 create mode 100644 layout/svg/crashtests/367368-1.xhtml
 create mode 100644 layout/svg/crashtests/369233-1.svg
 create mode 100644 layout/svg/crashtests/369438-1.svg
 create mode 100644 layout/svg/crashtests/369438-2.svg
 create mode 100644 layout/svg/crashtests/371463-1.xhtml
 create mode 100644 layout/svg/crashtests/371563-1.xhtml
 create mode 100644 layout/svg/crashtests/375775-1.svg
 create mode 100644 layout/svg/crashtests/378716.svg
 create mode 100644 layout/svg/crashtests/380691-1.svg
 create mode 100644 layout/svg/crashtests/384391-1.xhtml
 create mode 100644 layout/svg/crashtests/384499-1.svg
 create mode 100644 layout/svg/crashtests/384637-1.svg
 create mode 100644 layout/svg/crashtests/384728-1.svg
 create mode 100644 layout/svg/crashtests/385246-1.svg
 create mode 100644 layout/svg/crashtests/385246-2.svg
 create mode 100644 layout/svg/crashtests/385552-1.svg
 create mode 100644 layout/svg/crashtests/385552-2.svg
 create mode 100644 layout/svg/crashtests/385840-1.svg
 create mode 100644 layout/svg/crashtests/385852-1.svg
 create mode 100644 layout/svg/crashtests/386475-1.xhtml
 create mode 100644 layout/svg/crashtests/386690-1.svg
 create mode 100644 layout/svg/crashtests/387290-1.svg
 create mode 100644 layout/svg/crashtests/402408-1.svg
 create mode 100644 layout/svg/crashtests/404677-1.xhtml
 create mode 100644 layout/svg/crashtests/409565-1.xhtml
 create mode 100644 layout/svg/crashtests/420697-1.svg
 create mode 100644 layout/svg/crashtests/420697-2.svg
 create mode 100644 layout/svg/crashtests/429774-1.svg
 create mode 100644 layout/svg/crashtests/441368-1.svg
 create mode 100644 layout/svg/crashtests/453754-1.svg
 create mode 100644 layout/svg/crashtests/455314-1.xhtml
 create mode 100644 layout/svg/crashtests/458453.html
 create mode 100644 layout/svg/crashtests/459666-1.html
 create mode 100644 layout/svg/crashtests/459883.xhtml
 create mode 100644 layout/svg/crashtests/461289-1.svg
 create mode 100644 layout/svg/crashtests/464374-1.svg
 create mode 100644 layout/svg/crashtests/466585-1.svg
 create mode 100644 layout/svg/crashtests/467323-1.svg
 create mode 100644 layout/svg/crashtests/467498-1.svg
 create mode 100644 layout/svg/crashtests/470124-1.svg
 create mode 100644 layout/svg/crashtests/472782-1.svg
 create mode 100644 layout/svg/crashtests/474700-1.svg
 create mode 100644 layout/svg/crashtests/475181-1.svg
 create mode 100644 layout/svg/crashtests/475193-1.html
 create mode 100644 layout/svg/crashtests/475302-1.svg
 create mode 100644 layout/svg/crashtests/477935-1.html
 create mode 100644 layout/svg/crashtests/478128-1.svg
 create mode 100644 layout/svg/crashtests/478511-1.svg
 create mode 100644 layout/svg/crashtests/483439-1.svg
 create mode 100644 layout/svg/crashtests/492186-1.svg
 create mode 100644 layout/svg/crashtests/508247-1.svg
 create mode 100644 layout/svg/crashtests/512890-1.svg
 create mode 100644 layout/svg/crashtests/515288-1.html
 create mode 100644 layout/svg/crashtests/522394-1.svg
 create mode 100644 layout/svg/crashtests/522394-2.svg
 create mode 100644 layout/svg/crashtests/522394-3.svg
 create mode 100644 layout/svg/crashtests/566216-1.svg
 create mode 100644 layout/svg/crashtests/587336-1.html
 create mode 100644 layout/svg/crashtests/590291-1.svg
 create mode 100644 layout/svg/crashtests/601999-1.html
 create mode 100644 layout/svg/crashtests/605626-1.svg
 create mode 100644 layout/svg/crashtests/606914.xhtml
 create mode 100644 layout/svg/crashtests/610594-1.html
 create mode 100644 layout/svg/crashtests/610954-1.html
 create mode 100644 layout/svg/crashtests/612662-1.svg
 create mode 100644 layout/svg/crashtests/612662-2.svg
 create mode 100644 layout/svg/crashtests/612736-1.svg
 create mode 100644 layout/svg/crashtests/612736-2.svg
 create mode 100644 layout/svg/crashtests/614367-1.svg
 create mode 100644 layout/svg/crashtests/620034-1.html
 create mode 100644 layout/svg/crashtests/621598-1.svg
 create mode 100644 layout/svg/crashtests/648819-1.html
 create mode 100644 layout/svg/crashtests/655025-1.svg
 create mode 100644 layout/svg/crashtests/655025-2.svg
 create mode 100644 layout/svg/crashtests/655025-3.svg
 create mode 100644 layout/svg/crashtests/657077-1.svg
 create mode 100644 layout/svg/crashtests/669025-1.svg
 create mode 100644 layout/svg/crashtests/669025-2.svg
 create mode 100644 layout/svg/crashtests/682411-1.svg
 create mode 100644 layout/svg/crashtests/692203-1.svg
 create mode 100644 layout/svg/crashtests/692203-2.svg
 create mode 100644 layout/svg/crashtests/693424-1.svg
 create mode 100644 layout/svg/crashtests/709920-1.svg
 create mode 100644 layout/svg/crashtests/709920-2.svg
 create mode 100644 layout/svg/crashtests/713413-1.svg
 create mode 100644 layout/svg/crashtests/722003-1.svg
 create mode 100644 layout/svg/crashtests/725918-1.svg
 create mode 100644 layout/svg/crashtests/732836-1.svg
 create mode 100644 layout/svg/crashtests/740627-1.svg
 create mode 100644 layout/svg/crashtests/740627-2.svg
 create mode 100644 layout/svg/crashtests/743469.svg
 create mode 100644 layout/svg/crashtests/757704-1.svg
 create mode 100644 layout/svg/crashtests/757718-1.svg
 create mode 100644 layout/svg/crashtests/757751-1.svg
 create mode 100644 layout/svg/crashtests/767056-1.svg
 create mode 100644 layout/svg/crashtests/767535-1.xhtml
 create mode 100644 layout/svg/crashtests/768087-1.html
 create mode 100644 layout/svg/crashtests/768351.svg
 create mode 100644 layout/svg/crashtests/772313-1.svg
 create mode 100644 layout/svg/crashtests/778492-1.svg
 create mode 100644 layout/svg/crashtests/779971-1.svg
 create mode 100644 layout/svg/crashtests/780764-1.svg
 create mode 100644 layout/svg/crashtests/780963-1.html
 create mode 100644 layout/svg/crashtests/782141-1.svg
 create mode 100644 layout/svg/crashtests/784061-1.svg
 create mode 100644 layout/svg/crashtests/788831-1.svg
 create mode 100644 layout/svg/crashtests/789390-1.html
 create mode 100644 layout/svg/crashtests/790072.svg
 create mode 100644 layout/svg/crashtests/791826-1.svg
 create mode 100644 layout/svg/crashtests/803562-1.svg
 create mode 100644 layout/svg/crashtests/808318-1.svg
 create mode 100644 layout/svg/crashtests/813420-1.svg
 create mode 100644 layout/svg/crashtests/841163-1.svg
 create mode 100644 layout/svg/crashtests/841812-1.svg
 create mode 100644 layout/svg/crashtests/842009-1.svg
 create mode 100644 layout/svg/crashtests/842630-1.svg
 create mode 100644 layout/svg/crashtests/842909-1.svg
 create mode 100644 layout/svg/crashtests/843072-1.svg
 create mode 100644 layout/svg/crashtests/843917-1.svg
 create mode 100644 layout/svg/crashtests/847139-1.svg
 create mode 100644 layout/svg/crashtests/849688-1.svg
 create mode 100644 layout/svg/crashtests/849688-2.svg
 create mode 100644 layout/svg/crashtests/860378-1.svg
 create mode 100644 layout/svg/crashtests/868904-1.svg
 create mode 100644 layout/svg/crashtests/873806-1.svg
 create mode 100644 layout/svg/crashtests/876831-1.svg
 create mode 100644 layout/svg/crashtests/877029-1.svg
 create mode 100644 layout/svg/crashtests/880925-1.svg
 create mode 100644 layout/svg/crashtests/881031-1.svg
 create mode 100644 layout/svg/crashtests/885608-1.svg
 create mode 100644 layout/svg/crashtests/890782-1.svg
 create mode 100644 layout/svg/crashtests/890783-1.svg
 create mode 100644 layout/svg/crashtests/893510-1.svg
 create mode 100644 layout/svg/crashtests/895311-1.svg
 create mode 100644 layout/svg/crashtests/897342-1.svg
 create mode 100644 layout/svg/crashtests/898909-1.svg
 create mode 100644 layout/svg/crashtests/898951-1.svg
 create mode 100644 layout/svg/crashtests/913990.html
 create mode 100644 layout/svg/crashtests/919371-1.xhtml
 create mode 100644 layout/svg/crashtests/950324-1.svg
 create mode 100644 layout/svg/crashtests/951904-1.html
 create mode 100644 layout/svg/crashtests/952270-1.svg
 create mode 100644 layout/svg/crashtests/963086-1.svg
 create mode 100644 layout/svg/crashtests/974746-1.svg
 create mode 100644 layout/svg/crashtests/975773-1.svg
 create mode 100644 layout/svg/crashtests/979407-1.svg
 create mode 100644 layout/svg/crashtests/979407-2.svg
 create mode 100644 layout/svg/crashtests/993443.svg
 create mode 100644 layout/svg/crashtests/blob-merging-and-retained-display-list.html
 create mode 100644 layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml
 create mode 100644 layout/svg/crashtests/crashtests.list
 create mode 100644 layout/svg/crashtests/empty-blob-merging.html
 create mode 100644 layout/svg/crashtests/extref-test-1-resource.xhtml
 create mode 100644 layout/svg/crashtests/extref-test-1.xhtml
 create mode 100644 layout/svg/crashtests/grouping-empty-bounds.html
 create mode 100644 layout/svg/crashtests/invalid_url.html
 create mode 100644 layout/svg/crashtests/invalidation-of-opacity-0.html
 create mode 100644 layout/svg/crashtests/masked-3d-transform.html
 create mode 100644 layout/svg/crashtests/perspective-invalidation.html

(limited to 'layout/svg/crashtests')

diff --git a/layout/svg/crashtests/1016145.svg b/layout/svg/crashtests/1016145.svg
new file mode 100644
index 0000000000..5c362a17e1
--- /dev/null
+++ b/layout/svg/crashtests/1016145.svg
@@ -0,0 +1,5 @@
+<!-- svg mime type but html root -->
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <body style="display: table-column-group;" />
+</html>
+
diff --git a/layout/svg/crashtests/1028512.svg b/layout/svg/crashtests/1028512.svg
new file mode 100644
index 0000000000..0c9458b478
--- /dev/null
+++ b/layout/svg/crashtests/1028512.svg
@@ -0,0 +1,15 @@
+<!-- {lower,upper}-{roman,alpha} in svg -->
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+
+function boom()
+{
+    document.documentElement.style.transition = "2s";
+    document.documentElement.style.listStyleType = "lower-roman";
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></svg>
diff --git a/layout/svg/crashtests/1072758.html b/layout/svg/crashtests/1072758.html
new file mode 100644
index 0000000000..1d4c85fb87
--- /dev/null
+++ b/layout/svg/crashtests/1072758.html
@@ -0,0 +1,35 @@
+<style>
+#x9 {
+  display:none;
+}
+</style>
+
+<body onload="go()">
+<svg>
+<path id="a"></path>
+
+<mask id="m">
+  <text id="y">
+    <tspan id="x1"></tspan>
+    <textPath id="x2"></textPath>
+    <a id="x3">Hello</a>
+    <tspan><tspan id="x4"></tspan></tspan>
+    <tspan id="x5"></tspan>
+  </text>
+</mask>
+
+<rect width="600" height="400" mask="url(#m)"/>
+</svg>
+</body>
+
+<script>
+
+function go() {
+  x1.style.display = "none";
+  x2.style.display = "none";
+  x3.style.display = "none";
+  x4.style.display = "none";
+  x5.id = "x9";
+};
+
+</script>
diff --git a/layout/svg/crashtests/1140080-1.svg b/layout/svg/crashtests/1140080-1.svg
new file mode 100644
index 0000000000..d424562468
--- /dev/null
+++ b/layout/svg/crashtests/1140080-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+
+window.addEventListener("load", function() {
+    var stop = document.getElementsByTagName("stop")[0];
+    stop.setAttribute("offset", "0");
+}, false);
+
+</script>
+<stop/>
+</svg>
diff --git a/layout/svg/crashtests/1149542-1.svg b/layout/svg/crashtests/1149542-1.svg
new file mode 100644
index 0000000000..7353f12775
--- /dev/null
+++ b/layout/svg/crashtests/1149542-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <style>
+    text { white-space: pre }
+    text::first-letter { color: red; }
+    tspan { display: none }
+  </style>
+  <text textLength="64">
+<tspan>a</tspan>b</text>
+</svg>
diff --git a/layout/svg/crashtests/1156581-1.svg b/layout/svg/crashtests/1156581-1.svg
new file mode 100644
index 0000000000..97e5fb1ca9
--- /dev/null
+++ b/layout/svg/crashtests/1156581-1.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="filter: url(#a); clip: rect(0px, 4rem, 2px, 2px);">
+    <script>
+        function boom()
+        {
+            document.getElementById("a").style.overflow = "hidden";
+            document.documentElement.style.fontSize = "10px";
+        }
+        window.addEventListener("load", boom, false);
+    </script>
+
+    <set id="a"/>
+</svg>
diff --git a/layout/svg/crashtests/1182496-1.html b/layout/svg/crashtests/1182496-1.html
new file mode 100644
index 0000000000..1d95905a2d
--- /dev/null
+++ b/layout/svg/crashtests/1182496-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    function tweak(){
+      document.body.innerHTML="fuzz"
+    }
+  </script>
+</head>
+<body onload="tweak()">
+  <svg xmlns="http://www.w3.org/2000/svg">
+    <text>
+      <foreignObject requiredFeatures="foo">
+        <svg style="position: absolute;"/>
+      </foreignObject>
+    </text>
+  </svg>
+</body>
+</html>
+
+
diff --git a/layout/svg/crashtests/1209525-1.svg b/layout/svg/crashtests/1209525-1.svg
new file mode 100644
index 0000000000..21134df33b
--- /dev/null
+++ b/layout/svg/crashtests/1209525-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     width="0" height="0">
+
+  <rect width="10" height="10" stroke="black"
+        vector-effect="non-scaling-stroke" />
+
+</svg>
diff --git a/layout/svg/crashtests/1223281-1.svg b/layout/svg/crashtests/1223281-1.svg
new file mode 100644
index 0000000000..b548a9a600
--- /dev/null
+++ b/layout/svg/crashtests/1223281-1.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+
+function forceFrameConstruction()
+{
+    document.documentElement.getBoundingClientRect();
+}
+
+function boom()
+{
+    document.documentElement.style.overflow = "scroll";
+    forceFrameConstruction()
+    document.documentElement.style.visibility = "visible";
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<rect style="perspective: 10em;" />
+</svg>
+
diff --git a/layout/svg/crashtests/1234726-1.svg b/layout/svg/crashtests/1234726-1.svg
new file mode 100644
index 0000000000..ec807e2aba
--- /dev/null
+++ b/layout/svg/crashtests/1234726-1.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+
+window.addEventListener("load", function() {
+    document.documentElement.style.fontSize = "70%";
+    document.documentElement.setAttribute("transform", "scale(2)");
+    var filt = document.createElementNS("http://www.w3.org/2000/svg", "filter");
+    filt.style.borderWidth = "2rem";
+    document.documentElement.appendChild(filt);
+}, false);
+
+</script>
+</svg>
diff --git a/layout/svg/crashtests/1322537-1.html b/layout/svg/crashtests/1322537-1.html
new file mode 100644
index 0000000000..04207db4ad
--- /dev/null
+++ b/layout/svg/crashtests/1322537-1.html
@@ -0,0 +1,2 @@
+<svg>
+<animateMotion path='M8,0l69,97m45,-17592186044414A71,23 46,0,0 16382,98Q50,10 48,72T21,0Z'/>
\ No newline at end of file
diff --git a/layout/svg/crashtests/1322537-2.html b/layout/svg/crashtests/1322537-2.html
new file mode 100644
index 0000000000..d0495d79af
--- /dev/null
+++ b/layout/svg/crashtests/1322537-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<head>
+  <script>
+    function go() {
+      var path = document.getElementById("myPath");
+      var len = path.getTotalLength();
+      console.log(len);
+    }
+  </script>
+</head>
+<body onload="go()">
+  <svg>
+    <path id="myPath" d="M45,-17592186044414A71,23 46,0,0 16382,98"/>
+  </svg>
+</body>
diff --git a/layout/svg/crashtests/1322852.html b/layout/svg/crashtests/1322852.html
new file mode 100644
index 0000000000..728ea5c7a9
--- /dev/null
+++ b/layout/svg/crashtests/1322852.html
@@ -0,0 +1,2 @@
+<svg>
+<ellipse stroke='-moz-mac-menushadow'/>
\ No newline at end of file
diff --git a/layout/svg/crashtests/1348564.svg b/layout/svg/crashtests/1348564.svg
new file mode 100644
index 0000000000..0cb28948e6
--- /dev/null
+++ b/layout/svg/crashtests/1348564.svg
@@ -0,0 +1,7 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+<g style="outline-style:auto;">
+<radialGradient style="transform-box:fill-box;transform:rotatex(15deg);"></radialGradient>
+<rect x="200"></rect>
+</g>
+</svg>
diff --git a/layout/svg/crashtests/1402109.html b/layout/svg/crashtests/1402109.html
new file mode 100644
index 0000000000..81ef78a058
--- /dev/null
+++ b/layout/svg/crashtests/1402109.html
@@ -0,0 +1,11 @@
+<script>
+function jsfuzzer() {
+try { svgvar00012.getStartPositionOfChar(0); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<table>
+<caption>,HM&gt;v((Ndeoi=&amp;</caption>
+<caption>
+<svg>
+<text id="svgvar00012">
diff --git a/layout/svg/crashtests/1402124.html b/layout/svg/crashtests/1402124.html
new file mode 100644
index 0000000000..793b46b9a1
--- /dev/null
+++ b/layout/svg/crashtests/1402124.html
@@ -0,0 +1,10 @@
+<script>
+function jsfuzzer() {
+try { a.getExtentOfChar(0); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<svg>
+<switch>
+<path/>
+<text id="a">
diff --git a/layout/svg/crashtests/1402486.html b/layout/svg/crashtests/1402486.html
new file mode 100644
index 0000000000..af0c72e351
--- /dev/null
+++ b/layout/svg/crashtests/1402486.html
@@ -0,0 +1,12 @@
+<script>
+function jsfuzzer() {
+try { a.getEndPositionOfChar(0); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<svg>
+<switch>
+<text id="a">
+</text>
+<feTurbulence
+<!-- a -->
\ No newline at end of file
diff --git a/layout/svg/crashtests/1403656-1.html b/layout/svg/crashtests/1403656-1.html
new file mode 100644
index 0000000000..996562d150
--- /dev/null
+++ b/layout/svg/crashtests/1403656-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="filtered">
+<style>
+  .filtered {
+    filter: url(#notsvg);
+  }
+  #notsvg {
+    float: left;
+    overflow: auto;
+  }
+</style>
+<script>
+function go() {
+  const div = document.createElement('div')
+  div.setAttribute('id', 'notsvg')
+  document.documentElement.appendChild(div)
+}
+</script>
+<body onload="go();" class="filtered">
diff --git a/layout/svg/crashtests/1403656-2.html b/layout/svg/crashtests/1403656-2.html
new file mode 100644
index 0000000000..e4287e933f
--- /dev/null
+++ b/layout/svg/crashtests/1403656-2.html
@@ -0,0 +1,21 @@
+<!-- MUST BE QUIRKS MODE -->
+<style>
+span { top: 0%; }
+</style>
+<script>
+function jsfuzzer() {
+  try { text.setAttribute("font-size", "10px"); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+  <div style="overflow: scroll">
+    <span></span>
+  </div>
+  <svg>
+    <tref id="marker">
+      <text id="text"/>
+    </tref>
+    <polyline marker-end="url(#marker)">
+    </polyline>
+  </svg>
+</body>
diff --git a/layout/svg/crashtests/1403656-3.html b/layout/svg/crashtests/1403656-3.html
new file mode 100644
index 0000000000..a5a7632665
--- /dev/null
+++ b/layout/svg/crashtests/1403656-3.html
@@ -0,0 +1,8 @@
+<style>
+* { columns: 0px }
+</style>
+A
+<svg id="a">
+<line marker-end="url(#a)">
+</svg>
+<keygen>
diff --git a/layout/svg/crashtests/1403656-4.html b/layout/svg/crashtests/1403656-4.html
new file mode 100644
index 0000000000..1da8979aa7
--- /dev/null
+++ b/layout/svg/crashtests/1403656-4.html
@@ -0,0 +1,9 @@
+<style>
+#a {}
+* {
+  text-align: end;
+  writing-mode: sideways-lr;
+  -webkit-filter: url(#a);
+}
+</style>
+<canvas>AAAAAAAAAAAAAAAA</canvas><ol id="a">@
diff --git a/layout/svg/crashtests/1403656-5.html b/layout/svg/crashtests/1403656-5.html
new file mode 100644
index 0000000000..3d64bc5b50
--- /dev/null
+++ b/layout/svg/crashtests/1403656-5.html
@@ -0,0 +1,11 @@
+<style>
+* {
+  -webkit-filter: url(#a);
+  padding-right: 1vmin;
+  overflow-y: scroll;
+}
+</style>
+<details id="a"></details>
+<image style="bottom: 1em;display:flex"></image>
+<canvas height="1">
+<font>
diff --git a/layout/svg/crashtests/1404086.html b/layout/svg/crashtests/1404086.html
new file mode 100644
index 0000000000..df2ad6a3b3
--- /dev/null
+++ b/layout/svg/crashtests/1404086.html
@@ -0,0 +1,2 @@
+<svg>
+<text textLength="0" lengthAdjust="spacingAndGlyphs">t
diff --git a/layout/svg/crashtests/1421807-1.html b/layout/svg/crashtests/1421807-1.html
new file mode 100644
index 0000000000..fe5a3e8d66
--- /dev/null
+++ b/layout/svg/crashtests/1421807-1.html
@@ -0,0 +1,5 @@
+<body onload=b.appendChild(a)>
+<div id="a" style="display: contents">
+</div>
+<svg>
+<text id="b">
diff --git a/layout/svg/crashtests/1421807-2.html b/layout/svg/crashtests/1421807-2.html
new file mode 100644
index 0000000000..30b100642c
--- /dev/null
+++ b/layout/svg/crashtests/1421807-2.html
@@ -0,0 +1,15 @@
+<style>
+.c1 { display: contents; }
+</style>
+<script>
+function go() {
+  a.attachShadow({mode: "open"}).innerHTML = `<slot> </slot> `;
+  b.appendChild(a);
+}
+</script>
+<body onload=go()>
+<div id="a" class="c1">
+  <span></span>
+</div>
+<svg>
+<text id="b">
diff --git a/layout/svg/crashtests/1422226.html b/layout/svg/crashtests/1422226.html
new file mode 100644
index 0000000000..5826e60b69
--- /dev/null
+++ b/layout/svg/crashtests/1422226.html
@@ -0,0 +1,39 @@
+<style id="htmlvar00001">
+* {
+	filter: saturate(1) hue-rotate(0deg);
+	marker-mid: url()
+}
+</style>
+<script>
+function jsfuzzer() {
+try { var var00078 = window.find("foo",true,true); } catch(e) { }
+try { htmlvar00004.setAttribute("onselect", "eventhandler2()"); } catch(e) { }
+try { htmlvar00004.selectionStart = 1; } catch(e) { }
+try { svgvar00030.addEventListener("DOMSubtreeModified", eventhandler5); } catch(e) { }
+}
+function eventhandler1() {
+try { var var00098 = document.createElement("select"); } catch(e) { }
+try { htmlvar00001.appendChild(var00098); } catch(e) { }
+}
+function eventhandler2() {
+try { htmlvar00015.href = "3" } catch(e) { }
+try { svgvar00008.before(svgvar00013); } catch(e) { }
+try { var var00014 = window.getSelection(); } catch(e) { }
+try { var00014.setBaseAndExtent(htmlvar00011,0,htmlvar00010,0); } catch(e) { }
+try { var00014.collapseToStart(); } catch(e) { }
+}
+function eventhandler5() {
+try { svgvar00001.addEventListener("DOMNodeRemoved", eventhandler1); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<input id="htmlvar00004">
+<svg id="svgvar00001">
+<marker>
+<meshgradient id="svgvar00008">
+<foreignObject id="svgvar00013">
+<discard id="svgvar00030"/>
+<a id="htmlvar00010" contenteditable="true"></a>
+<a id="htmlvar00011">
+<base id="htmlvar00015">
+
diff --git a/layout/svg/crashtests/1424031.html b/layout/svg/crashtests/1424031.html
new file mode 100644
index 0000000000..447e01cb15
--- /dev/null
+++ b/layout/svg/crashtests/1424031.html
@@ -0,0 +1,16 @@
+<script>
+function eh1() {
+  a.setAttribute("points", "1");
+}
+function eh2() {
+  a.addEventListener("DOMSubtreeModified", eh1);
+  a.points.getItem(1).y = 0;
+}
+function go() {
+  window.requestIdleCallback(eh2, {timeout: 62});
+}
+</script>
+<style onload="go()"></style>
+<svg>
+<polygon id="a" points="0 0 58 1 -1 1">
+
diff --git a/layout/svg/crashtests/1425434-1.html b/layout/svg/crashtests/1425434-1.html
new file mode 100644
index 0000000000..cec773ca25
--- /dev/null
+++ b/layout/svg/crashtests/1425434-1.html
@@ -0,0 +1,59 @@
+<html>
+<head>
+<style>
+
+#htmlvar00002,.class4,strong:last-of-type {
+	border-image-repeat: round stretch;
+	counter-increment:c
+}
+.class6,#htmlvar00001,#htmlvar00008 {
+	height:63%;
+	grid-column:span 0 middle / middle
+}
+#htmlvar00002 {
+	overflow-y:hidden;
+	grid-column-end:0 inherit
+}
+
+</style>
+<script>
+
+function eventhandler5() {
+
+	var var00066 = document.createElement("audio");
+	try { var00066.controls = true; } catch(e) { }
+	
+	try { document.all['htmlvar00002'].appendChild(htmlvar00001); } catch(e) { }
+	try { document.all['htmlvar00002'].appendChild(var00066); } catch(e) { }
+}
+
+</script>
+</head>
+<body onload=eventhandler5()>
+
+	<shadow id="htmlvar00001" axis="PDcIvMde3=%- S^@dz" ondblclick="eventhandler1()" item="8z6h" checked="checked" type="text/x-javascript">
+		aaa
+	</shadow>
+	
+	<ul id="htmlvar00002" type="video/mp4; codecs='avc1.4D400C'" type="turbulence" type="javascript_1.0" 
+		role="complementary" dir="ltr" required="required" formnovalidate="formnovalidate" scheme="NIST" expanded="true" slot="slot2">
+		bbb
+	</ul>
+	
+	<svg id="svgvar00001" marker-end="url(#svgvar00005)" transform="translate(0, 0) scale(0.113899652038) rotate(1) translate(0, 1)" 
+		marker-mid="url(#svgvar00009)" xml:id="test-title" viewBox="0 1 78 1" click="none" glyph-orientation-vertical="-1" dominant-baseline="middle" ry="61%" k="1">
+
+		<path id="svgvar00009" d="M 0 0 L 1 0" stroke-dashoffset="inherit" onclick="eventhandler5()" stroke-linejoin="inherit" 
+			fill-rule="evenodd" onmouseover="eventhandler3()" onfocusin="eventhandler4()" pointsAtY="1" target="_self" primitiveUnits="userSpaceOnUse" horiz-adv-x="0" />
+
+		<line id="svgvar00010" x1="0px" y1="55%" x2="76%" y2="62%" transform="translate(0 100) scale(0 -1)" 
+			transform="translate(00.32347924876,0)" visibility="hidden" stroke-width="inherit" pointer-events="painted" 
+			xlink:type="simple" onrepeat="eventhandler4()" clip-path="url(#svgvar00001)" vector-effect="non-scaling-stroke" azimuth="-1">
+			ccc
+		</line>	 
+
+	</svg>
+
+<!--endhtml-->
+</body>
+</html>
diff --git a/layout/svg/crashtests/1426575.html b/layout/svg/crashtests/1426575.html
new file mode 100644
index 0000000000..6ea99585e9
--- /dev/null
+++ b/layout/svg/crashtests/1426575.html
@@ -0,0 +1,16 @@
+<script>
+function go() {
+  var var00046 = svgvar00022.createSVGLength();
+  svgvar00015.y.baseVal.appendItem(var00046);
+  svgvar00015.addEventListener("DOMSubtreeModified", eh);
+  var00046.newValueSpecifiedUnits(7,0);
+}
+function eh() {
+  svgvar00015.setAttribute("y", "2 1 93");
+}
+</script>
+<body onload=go()>
+<svg>
+<tspan id="svgvar00015" y="32 45 1 1"/>
+<svg id="svgvar00022">
+
diff --git a/layout/svg/crashtests/1443092-helper.svg b/layout/svg/crashtests/1443092-helper.svg
new file mode 100644
index 0000000000..134cbefb58
--- /dev/null
+++ b/layout/svg/crashtests/1443092-helper.svg
@@ -0,0 +1,6 @@
+<svg class='class2' xmlns='http://www.w3.org/2000/svg'>
+<clipPath clipPathUnits='userSpaceOnUse' id='id9' lighting-color='pink' class='class0 class1' >
+</clipPath>
+<a id='id0' clip-path='url(#id9)' >
+</a>
+</svg>
diff --git a/layout/svg/crashtests/1443092.html b/layout/svg/crashtests/1443092.html
new file mode 100644
index 0000000000..7be4561e61
--- /dev/null
+++ b/layout/svg/crashtests/1443092.html
@@ -0,0 +1,34 @@
+<script>
+function start() {
+	o7=document.createElement('div');
+	o7.innerHTML='<style>@keyframes key7{ from{ transform: rotate(-536870911deg)}}\n*{ animation-name: key7; animation-duration: 0.001s';
+	o17=document.createElement('div');
+	o17.innerHTML='<svg><style>@font-face{}\n*{ outline-style: dotted</style><style>@font-face{ font-family: font3; src: url(';
+	o18=o17.firstChild.getElementsByTagName('*');
+	o20=o18[0];
+	o23=o18[1];
+	o114=document.createElement('iframe');
+	o114.src='1443092-helper.svg';
+	o114.addEventListener('load', fun0,false);
+	document.body.appendChild(o114);
+}
+function fun0() {
+	o117=o114.contentDocument;
+	document.replaceChild(o117.documentElement,document.documentElement);
+	o124=document.createElement('iframe');
+	document.documentElement.appendChild(o124);
+	o145=document.createElement('div');
+	o145.innerHTML='<svg><set attributeName="text-decoration">';
+	document.documentElement.appendChild(o20);
+	document.documentElement.appendChild(o23);
+	document.documentElement.appendChild(o7);
+	o124.src='x';
+	document.documentElement.appendChild(o145);
+	o264=document.createElement('style');
+	o265=document.createTextNode('*{ float: left');
+	o264.appendChild(o265);
+	o23.appendChild(o264);
+	setTimeout("location.reload()",40);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/svg/crashtests/1454201-1.html b/layout/svg/crashtests/1454201-1.html
new file mode 100644
index 0000000000..b92a7aa595
--- /dev/null
+++ b/layout/svg/crashtests/1454201-1.html
@@ -0,0 +1,52 @@
+<html>
+<head>
+<script>
+function loader() {
+var tbody = document.createElement("tbody");
+try { document.all[90%document.all.length].appendChild(tbody); } catch(e) { }
+}
+</script>
+</head>
+<body onload=loader()>
+<span>
+<a></a>
+</span>
+<a></a>
+<svg marker-end="url(#poly)">
+<a></a>
+<a></a>
+<symbol >
+<a></a>
+</symbol>
+<polyline id="poly">
+<a></a>
+<a></a>
+<a></a>
+<a></a>
+</polyline>
+<line >
+<a></a>
+</line>
+<a></a>
+<span>
+<a></a>
+</span>
+<a></a>
+<a></a>
+<a></a>
+</svg>
+<dialog style="-moz-appearance: checkbox; overflow-x: auto; max-width: 0em;" open="true"></dialog>
+<a></a>
+<a></a>
+<span>
+<a></a>
+<a></a>
+<a></a>
+<a></a>
+</span>
+<a></a>
+<a></a>
+<a></a>
+<a></a>
+</body>
+</html>
diff --git a/layout/svg/crashtests/1467552-1.html b/layout/svg/crashtests/1467552-1.html
new file mode 100644
index 0000000000..df85665c72
--- /dev/null
+++ b/layout/svg/crashtests/1467552-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<html>
+<style>
+fieldset {
+  mask: url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciLz4=),
+        padding-box;
+  margin-right: 75px;
+}
+span {
+  vertical-align: 672in;
+}
+</style>
+<fieldset><span><video></video></span></fieldset>
+</html>
diff --git a/layout/svg/crashtests/1474982.html b/layout/svg/crashtests/1474982.html
new file mode 100644
index 0000000000..c33e2be474
--- /dev/null
+++ b/layout/svg/crashtests/1474982.html
@@ -0,0 +1,2 @@
+<svg>
+<text lengthAdjust="" textLength="0">A</text>
diff --git a/layout/svg/crashtests/1480224.html b/layout/svg/crashtests/1480224.html
new file mode 100644
index 0000000000..0bb0dfa7b5
--- /dev/null
+++ b/layout/svg/crashtests/1480224.html
@@ -0,0 +1,6 @@
+<svg>
+<symbol id="a">
+<foreignObject>
+<input type="file">
+</symbol>
+<use xlink:href="#a">
diff --git a/layout/svg/crashtests/1480275.html b/layout/svg/crashtests/1480275.html
new file mode 100644
index 0000000000..b21ebdd062
--- /dev/null
+++ b/layout/svg/crashtests/1480275.html
@@ -0,0 +1,15 @@
+<script>
+function go() {
+  b.appendChild(a);
+  d.outerHTML = f.outerHTML;
+}
+</script>
+<table>
+<tr id="a">
+<th>
+<svg id="c" onload="go()">
+<use xlink:href="#c"/>
+</tr>
+<code id="d"></code>
+<video id="f">
+<details id="b">
diff --git a/layout/svg/crashtests/1502936.html b/layout/svg/crashtests/1502936.html
new file mode 100644
index 0000000000..87892ab461
--- /dev/null
+++ b/layout/svg/crashtests/1502936.html
@@ -0,0 +1,11 @@
+<script>
+function go() {
+  a.setAttribute("requiredExtensions", "x");
+  b.getBoundingClientRect();
+  a.setAttribute("y", "-1px");
+}
+</script>
+<body onload=go()>
+<svg>
+<use id="a">
+<feGaussianBlur id="b">
diff --git a/layout/svg/crashtests/1504072.html b/layout/svg/crashtests/1504072.html
new file mode 100644
index 0000000000..a44e2f0251
--- /dev/null
+++ b/layout/svg/crashtests/1504072.html
@@ -0,0 +1,4 @@
+<style>
+svg { perspective: 0px }
+</style>
+<svg overflow="scroll" systemLanguage="">
diff --git a/layout/svg/crashtests/1504918.svg b/layout/svg/crashtests/1504918.svg
new file mode 100644
index 0000000000..63cd3a08e0
--- /dev/null
+++ b/layout/svg/crashtests/1504918.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <style>textPath { display: contents; }</style>
+  <text>x<textPath><textPath><tspan>y</tspan></textPath></textPath></text>
+</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/1535517-1.svg b/layout/svg/crashtests/1535517-1.svg
new file mode 100644
index 0000000000..6f3f17eabf
--- /dev/null
+++ b/layout/svg/crashtests/1535517-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<marker><text><tspan id="x"/></text></marker>
+
+<script>
+window.addEventListener("load", function() {
+  document.getElementById("x").appendChild(document.createTextNode("\u062Ax"));
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/1536892.html b/layout/svg/crashtests/1536892.html
new file mode 100644
index 0000000000..8bc237138e
--- /dev/null
+++ b/layout/svg/crashtests/1536892.html
@@ -0,0 +1,13 @@
+<style>
+* { -webkit-filter: blur(5px) }
+</style>
+<script>
+function go() {
+  a.setAttribute("text-decoration", "overline")
+}
+</script>
+<body onload=go()>
+<svg id="a">
+<marker>
+<foreignObject>
+<li style="-webkit-box-shadow:8px 0 1px">
diff --git a/layout/svg/crashtests/1539318-1.svg b/layout/svg/crashtests/1539318-1.svg
new file mode 100644
index 0000000000..d832f448a3
--- /dev/null
+++ b/layout/svg/crashtests/1539318-1.svg
@@ -0,0 +1,10 @@
+<script>
+window.onload = function() {
+  a.getComputedTextLength()
+}
+</script>
+<body>
+<svg>
+<switch>
+<hatch>
+<text id="a">A</text>
diff --git a/layout/svg/crashtests/1548985-1.html b/layout/svg/crashtests/1548985-1.html
new file mode 100644
index 0000000000..7156eaf36b
--- /dev/null
+++ b/layout/svg/crashtests/1548985-1.html
@@ -0,0 +1,16 @@
+<!-- a -->
+<style>
+:root { contain: size }
+</style>
+<script>
+window.requestIdleCallback(window.close)
+function go() {
+  a.appendChild(document.head)
+  let b = d.getRootNode({composed: true})
+  b.replaceChild(c, b.childNodes[1])
+}
+</script>
+<body onload=go()>
+<svg id="c">
+<feTile id="d" />
+<foreignObject id="a">
diff --git a/layout/svg/crashtests/1548985-2.svg b/layout/svg/crashtests/1548985-2.svg
new file mode 100644
index 0000000000..700facb411
--- /dev/null
+++ b/layout/svg/crashtests/1548985-2.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     style="contain:size">
+  <rect width="100px" height="100px" fill="lime"/>
+</svg>
diff --git a/layout/svg/crashtests/1555851.html b/layout/svg/crashtests/1555851.html
new file mode 100644
index 0000000000..2b6f5a596a
--- /dev/null
+++ b/layout/svg/crashtests/1555851.html
@@ -0,0 +1,8 @@
+<body>
+<script>
+  var o0 = document.createElementNS("http://www.w3.org/2000/svg", "svg")
+  document.body.appendChild(o0)
+  var o3 = document.createElementNS("http://www.w3.org/2000/svg", "animateMotion")
+  o0.appendChild(o3)
+  o3.setAttribute("path", "M9,2l2e37,3A40,2 85,102-1")
+</script>
diff --git a/layout/svg/crashtests/1563779.html b/layout/svg/crashtests/1563779.html
new file mode 100644
index 0000000000..4c51d0884d
--- /dev/null
+++ b/layout/svg/crashtests/1563779.html
@@ -0,0 +1,19 @@
+<script id="a">
+let count = 0;
+function go() {
+  if (count++ == 3)
+    return;
+  try { a.appendChild(c) } catch(e) { }
+  try { window.getSelection().getRangeAt(0).insertNode(b) } catch(e) { }
+  try { d.selectSubString(0,-1) } catch(e) { }
+  document.documentElement.style.display = "none"
+  document.documentElement.getBoundingClientRect()
+  document.documentElement.style.display = ""
+}
+</script>
+<pre id="b" style="display:contents">a</pre>
+<span id="c">
+<style onload="go()"></style>
+</span>
+<svg>
+<text id="d"><textPath xml:space="preserve">
diff --git a/layout/svg/crashtests/1600855.html b/layout/svg/crashtests/1600855.html
new file mode 100644
index 0000000000..31c4809ecb
--- /dev/null
+++ b/layout/svg/crashtests/1600855.html
@@ -0,0 +1,8 @@
+<script>
+window.onload = () => {
+  a.append(String.fromCodePoint(71341))
+}
+</script>
+<font style="word-spacing: 31pc">
+<svg>
+<text id="a">Text</text>
diff --git a/layout/svg/crashtests/1601824.html b/layout/svg/crashtests/1601824.html
new file mode 100644
index 0000000000..04d0de825d
--- /dev/null
+++ b/layout/svg/crashtests/1601824.html
@@ -0,0 +1,7 @@
+<svg>
+<polygon id="a" points="0 1">
+</polygon>
+<text>
+<textPath xlink:href="#a">
+<marker />
+<a systemLanguage="">
diff --git a/layout/svg/crashtests/1605223-1.html b/layout/svg/crashtests/1605223-1.html
new file mode 100644
index 0000000000..6b476a7fd0
--- /dev/null
+++ b/layout/svg/crashtests/1605223-1.html
@@ -0,0 +1,4 @@
+<svg filter="url(#a)">
+<filter id="a">
+<feComponentTransfer>
+<feFuncG type="" />
diff --git a/layout/svg/crashtests/1609663.html b/layout/svg/crashtests/1609663.html
new file mode 100644
index 0000000000..c5a5d938e0
--- /dev/null
+++ b/layout/svg/crashtests/1609663.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+</head>
+<body>
+<div id="main">
+	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="mySvg" width="400" height="800">
+		<defs>
+			<pattern id="pattern1" x="30" y="10" width="30" height="30" patternUnits="userSpaceOnUse" >
+					<text id="idText1" x="15" y="15" font-size="20">1</text>
+			</pattern>
+		</defs>
+		<rect id="idRect1" fill="url(#pattern1)" width="300" height="200"/> 
+	</svg>
+</div>
+<script>
+document.body.offsetHeight;
+
+var pattern = document.getElementById('pattern1');
+var text = document.getElementById('idText1');
+pattern.removeChild(text);
+
+var svgNS = "http://www.w3.org/2000/svg";
+var newText = document.createElementNS(svgNS,"text");
+newText.setAttributeNS(null,"id",'idText1');     
+newText.setAttributeNS(null,"x",15);     
+newText.setAttributeNS(null,"y",15); 
+newText.setAttributeNS(null,"font-size","20");
+
+var textNode = document.createTextNode('x');
+newText.appendChild(textNode);
+pattern.appendChild(newText);
+</script>
+</body>
+</html>
diff --git a/layout/svg/crashtests/1671950.html b/layout/svg/crashtests/1671950.html
new file mode 100644
index 0000000000..173ace4ea9
--- /dev/null
+++ b/layout/svg/crashtests/1671950.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+    <style>
+        * {
+            break-before: always ! important;
+        }
+    </style>
+    <script>
+      window.addEventListener('load', () => {
+        const style = document.createElement('style')
+        document.head.appendChild(style)
+        const svg_1 = document.getElementById('id_3')
+        const svg_2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+        const switch_0 = document.createElementNS('http://www.w3.org/2000/svg', 'switch')
+        const c_0 = document.createElementNS('http://www.w3.org/2000/svg', 'c')
+        switch_0.appendChild(c_0)
+        svg_1.appendChild(switch_0)
+        svg_2.appendChild(svg_1)
+        document.documentElement.appendChild(svg_2)
+        style.sheet.insertRule('@-moz-document url-prefix(){*,a{all:inherit', 0)
+        SpecialPowers.wrap(window).printPreview()?.close()
+      })
+    </script>
+    <svg id='id_3'></svg>
+</head>
+</html>
+
diff --git a/layout/svg/crashtests/1678947.html b/layout/svg/crashtests/1678947.html
new file mode 100644
index 0000000000..96a3a37862
--- /dev/null
+++ b/layout/svg/crashtests/1678947.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<style>
+ol { float: right; }
+</style>
+<script>
+function start() {
+	document.elementFromPoint(0,1);
+	document.dir = "rtl";
+}
+</script>
+</head>
+<body>
+<svg onload="start()" requiredExtensions="x">
+  <g id="a"/></g>
+<text>
+<textPath xlink:href="#a">
+</svg>
+<ol></ol>
+</body>
+</html>
diff --git a/layout/svg/crashtests/1693032.html b/layout/svg/crashtests/1693032.html
new file mode 100644
index 0000000000..49a2bf3c17
--- /dev/null
+++ b/layout/svg/crashtests/1693032.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      document.addEventListener('DOMContentLoaded', () => {
+        const svg_1 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+        const svg_2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+        const switch_1 = document.createElementNS('http://www.w3.org/2000/svg', 'switch')
+        const metadata_1 = document.createElementNS('http://www.w3.org/2000/svg', 'metadata')
+        const foreign_1 = document.createElementNS('http://www.w3.org/2000/svg', 'foreignObject')
+        const text_1 = document.createElementNS('http://www.w3.org/2000/svg', 'text')
+        switch_1.appendChild(metadata_1)
+        svg_2.appendChild(text_1)
+        foreign_1.appendChild(svg_2)
+        switch_1.appendChild(foreign_1)
+        svg_1.appendChild(switch_1)
+        document.documentElement.appendChild(svg_1)
+      })
+    </script>
+</head>
+</html>
diff --git a/layout/svg/crashtests/1696505.html b/layout/svg/crashtests/1696505.html
new file mode 100644
index 0000000000..92700496e8
--- /dev/null
+++ b/layout/svg/crashtests/1696505.html
@@ -0,0 +1,9 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+    document.getElementById('a').style.cssText += "grid-row-end:auto"
+})
+</script>
+<svg>
+<polyline marker-mid='url(#a)'/>
+<marker id='a'>
+<text/>
diff --git a/layout/svg/crashtests/1755770-1.html b/layout/svg/crashtests/1755770-1.html
new file mode 100644
index 0000000000..ee9cf6fee7
--- /dev/null
+++ b/layout/svg/crashtests/1755770-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    window.addEventListener("load", () => {
+      const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+      const text = document.createElementNS("http://www.w3.org/2000/svg", "text");
+      text.setAttribute("letter-spacing", "65535pc");
+      const node = document.createTextNode("\rï¿»ð¨\nó = ð£%?;ð©á©¿ð�");
+      text.appendChild(node);
+      svg.appendChild(text);
+      document.documentElement.appendChild(svg);
+      const rect = new DOMRectReadOnly(-128, 256, 0, 1024);
+      node.convertRectFromNode(rect, document, {});
+    })
+  </script>
+</head>
+</html>
diff --git a/layout/svg/crashtests/1755770-2.html b/layout/svg/crashtests/1755770-2.html
new file mode 100644
index 0000000000..31b42ec452
--- /dev/null
+++ b/layout/svg/crashtests/1755770-2.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <script>
+    window.addEventListener("load", () => {
+      const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+      const text = document.createElementNS("http://www.w3.org/2000/svg", "text");
+      text.setAttribute("letter-spacing", "65535pc");
+      text.setAttribute("writing-mode", "vertical-lr");
+      const node = document.createTextNode("\rï¿»ð¨\nó = ð£%?;ð©á©¿ð�");
+      text.appendChild(node);
+      svg.appendChild(text);
+      document.documentElement.appendChild(svg);
+      const rect = new DOMRectReadOnly(-128, 256, 0, 1024);
+      node.convertRectFromNode(rect, document, {});
+    })
+  </script>
+</head>
+</html>
diff --git a/layout/svg/crashtests/1758029-1.html b/layout/svg/crashtests/1758029-1.html
new file mode 100644
index 0000000000..2097e875ee
--- /dev/null
+++ b/layout/svg/crashtests/1758029-1.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<meta charset="utf-8">
+<style>
+  body { background: gray; }
+  canvas { border: 2px solid black;}
+</style>
+
+<img id="img"
+     onload="go()"
+     src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAAAKElEQVR42u3NQQ0AAAgEoNP+nTWFDzcoQE1udQQCgUAgEAgEAsGTYAGjxAE/G/Q2tQAAAABJRU5ErkJggg==">
+<canvas id="canvas"></canvas>
+<script>
+  const ctx = canvas.getContext("2d", { desynchronized: true });
+  const SVG_FILTER = `
+  <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <filter id="posterize">
+      <feComponentTransfer>
+        <feFuncR type="discrete" tableValues="0,1" />
+        <feFuncG type="discrete" tableValues="0,1" />
+        <feFuncB type="discrete" tableValues="0,1" />
+        <feFuncA type="discrete" tableValues="0,1" />
+      </feComponentTransfer>
+    </filter>
+  </svg>`;
+
+  const FILTER1 = `url('data:image/svg+xml;utf8,${SVG_FILTER.replace(/\n/g, "")
+    .replace(/\s+/g, " ")
+    .trim()}#posterize') grayscale(50%) brightness(50%)`;
+  function go() {
+    canvas.width = img.naturalWidth;
+    canvas.height = img.naturalHeight;
+
+    ctx.imageSmoothingEnabled = true;
+    ctx.clearRect(0, 0, canvas.width, canvas.height);
+    ctx.filter = FILTER1;
+    ctx.drawImage(img, 0, 0);
+    setTimeout(() => { document.documentElement.removeAttribute("class")}, 0);
+  }
+</script>
diff --git a/layout/svg/crashtests/1764936-1.html b/layout/svg/crashtests/1764936-1.html
new file mode 100644
index 0000000000..c03789d547
--- /dev/null
+++ b/layout/svg/crashtests/1764936-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+      window.addEventListener("load", () => {
+        const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg")
+        const image = document.createElementNS("http://www.w3.org/2000/svg", "image")
+        image.setAttribute("height", "78.04250580135444ch")
+        image.setAttribute("width", "1024rem")
+        image.setAttribute("clip-path", "path( evenodd, '\\C' )")
+        svg.appendChild(image)
+        document.documentElement.appendChild(svg)
+      })
+    </script>
+</head>
+</html>
diff --git a/layout/svg/crashtests/1804958.html b/layout/svg/crashtests/1804958.html
new file mode 100644
index 0000000000..663f621d4c
--- /dev/null
+++ b/layout/svg/crashtests/1804958.html
@@ -0,0 +1,4 @@
+<svg>
+<polygon points="0,2 2,0" marker-end="url(#a)"></polygon>
+<marker id="a" clip-path="">
+<svg style="mix-blend-mode: lighten">
diff --git a/layout/svg/crashtests/1810260.html b/layout/svg/crashtests/1810260.html
new file mode 100644
index 0000000000..f555581165
--- /dev/null
+++ b/layout/svg/crashtests/1810260.html
@@ -0,0 +1,28 @@
+<style>
+*:only-child {
+  display: contents;
+}
+*:nth-child(1) {
+  mask: url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=) repeat-x view-box;
+}
+</style>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+  document.execCommand("selectAll", false)
+  document.designMode = "on"
+  document.execCommand("backColor", false, "red")
+  document.execCommand("justifyFull", false)
+})
+</script>
+A
+<q contenteditable="true">
+<link>
+<svg>
+<line></line>
+<text white-space="pre-line">
+A
+</text>
+<defs>
+</svg>
+A
+
diff --git a/layout/svg/crashtests/1826444-1.html b/layout/svg/crashtests/1826444-1.html
new file mode 100644
index 0000000000..b41e59928d
--- /dev/null
+++ b/layout/svg/crashtests/1826444-1.html
@@ -0,0 +1,6 @@
+<svg>
+<marker id="a">
+<circle stroke="context-fill" r="1em">
+</marker>
+<polygon points="1,50 1,511 0,1 0,0 30,71 32768,912 1,52 41146,14 0,120 814,7 868,16 973,83 8192,0 121,242 0,16384 0,1 541,44049 0,0 0,12 1,0 16376,0 2,7 0,1 0,0 0,16 953,15758 2048,992 1,8 33,0 58,0 0,6 26,7" fill="url(#b)" marker-mid="url(#a)" fill-opacity="0"></polygon>
+<pattern id="b">
diff --git a/layout/svg/crashtests/1831419.html b/layout/svg/crashtests/1831419.html
new file mode 100644
index 0000000000..32a120907c
--- /dev/null
+++ b/layout/svg/crashtests/1831419.html
@@ -0,0 +1,6 @@
+<style>
+* { font-size: 5% }
+</style>
+<svg>
+<text y="1,172" clip-path="url()" transform="matrix(0,0,4,1,0,0)">
+AA
diff --git a/layout/svg/crashtests/220165-1.svg b/layout/svg/crashtests/220165-1.svg
new file mode 100644
index 0000000000..0335f78d41
--- /dev/null
+++ b/layout/svg/crashtests/220165-1.svg
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:html="http://www.w3.org/1999/xhtml" height="500" 
+     xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+     onload="document.documentElement.getBoundingClientRect();
+	     document.getElementById('x').textContent = 'New text'">
+
+  <foreignObject x="200" y="180" width="100" height="50" >
+    <html:button id="x">Old long long long text</html:button>
+  </foreignObject>
+
+  <g transform="rotate(10) translate(-100) scale(0.8)">
+    <polygon style="fill:red; fill-opacity:0.5;"
+	  points="350, 75 379,161 469,161 397,215
+	  423,301 350,250 277,301 303,215
+                     231,161 321,161" />
+	
+  </g>
+
+</svg>
diff --git a/layout/svg/crashtests/267650-1.svg b/layout/svg/crashtests/267650-1.svg
new file mode 100644
index 0000000000..3e9c7ecc01
--- /dev/null
+++ b/layout/svg/crashtests/267650-1.svg
@@ -0,0 +1,4 @@
+<?xml version='1.0'?>
+<svg xmlns='http://www.w3.org/2000/svg'>
+  <text fill='none' stroke='black'>TESTCASE</text>
+</svg>
diff --git a/layout/svg/crashtests/294022-1.svg b/layout/svg/crashtests/294022-1.svg
new file mode 100644
index 0000000000..f30b484c83
--- /dev/null
+++ b/layout/svg/crashtests/294022-1.svg
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" 
+         "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg"
+        xmlns:xlink="http://www.w3.org/1999/xlink"
+        >
+
+                    <g>
+                       <clipPath id="action_box_cp">
+                            <rect width="100" height="46"/>
+                        </clipPath>
+                        <text style="clip-path:url(#action_box_cp); " y="10" id="action_boxtext" pointer-events="none"  class="TextBoxText">
+                            <tspan x="0" dy="0">Action</tspan>
+                        </text>
+                    </g>
+      
+</svg>
diff --git a/layout/svg/crashtests/307314-1.svg b/layout/svg/crashtests/307314-1.svg
new file mode 100644
index 0000000000..5c538df88d
--- /dev/null
+++ b/layout/svg/crashtests/307314-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait" onload="setTimeout(function() { var g = document.getElementById('N1'), h = document.getElementById('N2'); g.appendChild(h); document.documentElement.removeAttribute("class"); }, 20);">
+
+  <text id="N1"/>
+  <text id="N2">
+    <tspan>
+      <textPath/>
+    </tspan>
+  </text>
+</svg>
diff --git a/layout/svg/crashtests/308615-1.svg b/layout/svg/crashtests/308615-1.svg
new file mode 100644
index 0000000000..fe5391de38
--- /dev/null
+++ b/layout/svg/crashtests/308615-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+    xmlns:xlink="http://www.w3.org/1999/xlink">
+
+ <pattern id="pattern1">  
+   <rect style="fill:url(#pattern1);"/>
+ </pattern> 
+
+ <rect style="fill:url(#pattern1);" />
+
+</svg> 
\ No newline at end of file
diff --git a/layout/svg/crashtests/308917-1.svg b/layout/svg/crashtests/308917-1.svg
new file mode 100644
index 0000000000..7d0ae44f74
--- /dev/null
+++ b/layout/svg/crashtests/308917-1.svg
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" width="100%" height="100%" viewBox="0 0 480 360" class="reftest-wait" onload="first();">
+
+<script><![CDATA[
+
+function first()
+{
+  document.getElementById("z").appendChild(document.getElementById("pat1"));
+  setTimeout(second, 30);
+}
+
+function second()
+{
+  document.getElementById("pat4").appendChild(document.getElementById("z"));
+  document.documentElement.removeAttribute("class");
+}
+
+]]></script>
+
+
+		<pattern patternUnits="userSpaceOnUse" id="pat1" x="10" y="10" width="20" height="20">
+			<rect x="5" y="5" width="10" height="10" fill="red" />
+			<rect x="10" y="10" width="10" height="10" fill="green" />
+		</pattern>
+		<rect x="25" y="10" width="430" height="60" stroke="black" fill="url(#pat1)" />
+
+		<pattern patternUnits="userSpaceOnUse" id="pat4" x="0" y="0" width="20" height="10">
+			<rect x="0" y="0" width="10" height="10" fill="red" />
+			<rect x="10" y="0" width="10" height="10" fill="blue" />
+		</pattern>
+		<text font-family="Arial" font-size="40" fill="none" stroke="url(#pat4)" stroke-width="2"  x="25" y="275" id="z">Pattern on stroke</text>
+
+</svg>
+
diff --git a/layout/svg/crashtests/310436-1.svg b/layout/svg/crashtests/310436-1.svg
new file mode 100644
index 0000000000..e6dd5680ce
--- /dev/null
+++ b/layout/svg/crashtests/310436-1.svg
@@ -0,0 +1,28 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"><script><![CDATA[
+
+function init() { 
+  var docElt = document.documentElement;
+  var div1 = document.getElementById("div1");
+  var div2 = document.getElementById("div2");
+  var textNode = div2.childNodes[0];
+
+  function first()
+  {
+    docElt.appendChild(div2);
+    div2.appendChild(div1);
+  }
+
+  function second() 
+  {
+    div2.appendChild(div1);
+    div1.appendChild(textNode);
+    document.documentElement.removeAttribute("class");
+  }
+
+  first();
+  setTimeout(second, 30);
+}
+
+window.addEventListener("load", init, false);
+
+]]></script><div xmlns="http://www.w3.org/1999/xhtml" id="div1"><div id="div2">A Z</div></div></svg>
diff --git a/layout/svg/crashtests/310638.svg b/layout/svg/crashtests/310638.svg
new file mode 100644
index 0000000000..e5ee30fb2c
--- /dev/null
+++ b/layout/svg/crashtests/310638.svg
@@ -0,0 +1,35 @@
+<svg xmlns="http://www.w3.org/2000/svg"><div xmlns='http://www.w3.org/1999/xhtml' id="div1">
+<div id="div2">bar</div>
+</div>
+<script><![CDATA[
+
+function init()
+{
+  var div2 = document.getElementById("div2");
+  var div1 = document.getElementById("div1");
+  var docElt = document.documentElement;
+  var titleText = document.createTextNode("foo baz");
+
+  docElt.appendChild(div2);
  div2.appendChild(titleText);
+  
+  function second () 
+  {
+    div2.appendChild(div1);
+    removeNode(titleText);
+    removeNode(div2);
+  }
+  
+  setTimeout(second, 0);
+}
+
+
+function removeNode(q1) { q1.parentNode.removeChild(q1); }
+
+
+setTimeout(init, 0);
+
+
+]]></script>
+
+
+</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/313737-1.xml b/layout/svg/crashtests/313737-1.xml
new file mode 100644
index 0000000000..93421f6077
--- /dev/null
+++ b/layout/svg/crashtests/313737-1.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="ISO-8859-1" standalone="no"?>
+<!DOCTYPE xhtml PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd" [ 
+]>
+
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <head>
+  <title>bug 313737</title>
+  </head>
+  <body>
+
+     <svg:svg style="position:fixed;">
+        <input type="text" style="position:absolute;"  />
+     </svg:svg>
+
+  </body>
+</html>
diff --git a/layout/svg/crashtests/314244-1.xhtml b/layout/svg/crashtests/314244-1.xhtml
new file mode 100644
index 0000000000..14717f146d
--- /dev/null
+++ b/layout/svg/crashtests/314244-1.xhtml
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=314244 -->
+<!-- Just checking for lack of crash, nothing more -->
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        title="GMail"
+        width="300" height="300"
+        screenX="10" screenY="10">
+
+  <hbox>
+    <svg version="1.0"
+         xmlns="http://www.w3.org/2000/svg"
+         width="100px" height="100px"
+         id="back-button"
+         class="nav-button"
+         style="display: -moz-box;">
+      <rect x="10" y="10" width="80" height="80" fill="blue" />
+    </svg>
+    <spacer flex="1" />
+  </hbox>
+
+  <spacer flex="1" />
+
+</window>
+
diff --git a/layout/svg/crashtests/322185-1.svg b/layout/svg/crashtests/322185-1.svg
new file mode 100644
index 0000000000..8a10eb34a4
--- /dev/null
+++ b/layout/svg/crashtests/322185-1.svg
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+  <g id="g" style="display: -moz-box; overflow: hidden;">
+    <circle />
+  </g>
+</svg>
diff --git a/layout/svg/crashtests/322215-1.svg b/layout/svg/crashtests/322215-1.svg
new file mode 100644
index 0000000000..f872fbcd8f
--- /dev/null
+++ b/layout/svg/crashtests/322215-1.svg
@@ -0,0 +1,31 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" 
+"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.  -->
+<!--
+Copyright Georgi Guninski
+-->
+
+
+<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg">
+
+<defs>
+<filter id="MyFilter" filterUnits="userSpaceOnUse"
+x="0" y="0" width="32769" height="32769">
+
+<feGaussianBlur in="SourceAlpha" stdDeviation="4" result="blur"/>
+
+</filter>
+</defs>
+
+<rect x="1" y="1" width="198" height="118" fill="#cccccc" />
+
+<g filter="url(#MyFilter)">
+<text fill="#FFFFFF" stroke="black" font-size="45"
+x="42" y="42">Feck b1ll</text>
+</g>
+
+</svg>
diff --git a/layout/svg/crashtests/323704-1.svg b/layout/svg/crashtests/323704-1.svg
new file mode 100644
index 0000000000..13b8d52243
--- /dev/null
+++ b/layout/svg/crashtests/323704-1.svg
@@ -0,0 +1,12 @@
+<svg xmlns='http://www.w3.org/2000/svg'
+xmlns:xlink='http://www.w3.org/1999/xlink'>
+
+   <clipPath id='clipPath_0'>
+      <rect x='10' y='10' width='25' height='25' rx='5' ry='5' fill='none'
+clip-path='url(#clipPath_0)'/>
+   </clipPath>
+
+   <rect x='5' y='5' width='35' height='35' fill='red'
+clip-path='url(#clipPath_0)'/>
+
+</svg>
diff --git a/layout/svg/crashtests/325427-1.svg b/layout/svg/crashtests/325427-1.svg
new file mode 100644
index 0000000000..1f1c645251
--- /dev/null
+++ b/layout/svg/crashtests/325427-1.svg
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <defs>
+    <g id="module">
+      <use xlink:href="#module" />
+      <use xlink:href="#module" />
+      <use xlink:href="#module" />
+      <use xlink:href="#module" />
+      <use xlink:href="#baseModule" />
+      <use xlink:href="#baseModule" />
+      <use xlink:href="#extendsModule" />
+      <use xlink:href="#extendsModule" />
+      <use xlink:href="#extendsModule" />
+      <use xlink:href="#extendsModule" />
+      <use xlink:href="#extendsModule" />
+      <use xlink:href="#extendsModule" />
+    </g>
+    <use id="baseModule" xlink:href="#module" />
+    <use id="extendsModule" xlink:href="#module" />
+  </defs>
+</svg>
diff --git a/layout/svg/crashtests/326495-1.svg b/layout/svg/crashtests/326495-1.svg
new file mode 100644
index 0000000000..a5bf25b62a
--- /dev/null
+++ b/layout/svg/crashtests/326495-1.svg
@@ -0,0 +1,16 @@
+<?xml version="1.0"?>
+<svg width="10cm" height="5cm" viewBox="0 0 1000 500"
+     xmlns="http://www.w3.org/2000/svg"
+	 version="1.1">
+
+  <script>
+  function init()
+  {
+    document.getElementsByTagName("rect")[0].style.display = "-moz-inline-box";
+  }
+  
+  window.addEventListener("load", init, false);
+  </script>
+  
+  <rect requiredFeatures="http://www.w3.org/TR/SVG11/feature#SVG-nonexistent-feature"/>
+</svg>
diff --git a/layout/svg/crashtests/326974-1.svg b/layout/svg/crashtests/326974-1.svg
new file mode 100644
index 0000000000..750165b730
--- /dev/null
+++ b/layout/svg/crashtests/326974-1.svg
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+function init() { 
  var n2 = document.getElementById("n2");
+  var n3 = document.getElementById("n3");
+  
+  n2.appendChild(n3);
+}
+
+window.addEventListener("load", init, false);
+
+</script>
+
+
+<g id="n2">
  <text id="n3" />
+</g>
+
+</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/327706-1.svg b/layout/svg/crashtests/327706-1.svg
new file mode 100644
index 0000000000..9aae909250
--- /dev/null
+++ b/layout/svg/crashtests/327706-1.svg
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+document.documentElement.unsuspendRedraw(6)
+
+</script>
+</svg>
diff --git a/layout/svg/crashtests/327711-1.svg b/layout/svg/crashtests/327711-1.svg
new file mode 100644
index 0000000000..d919b866f6
--- /dev/null
+++ b/layout/svg/crashtests/327711-1.svg
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+function init()
+{
+  document.documentElement.unsuspendRedrawAll();
+  document.getElementsByTagName("text")[0].firstChild.data = "Quux";
+}
+
+window.addEventListener("load", init, false);
+
+</script>
+
+<text x="125" y="30">Foo</text>
+
+</svg>

\ No newline at end of file
diff --git a/layout/svg/crashtests/328137-1.svg b/layout/svg/crashtests/328137-1.svg
new file mode 100644
index 0000000000..26190b1eb0
--- /dev/null
+++ b/layout/svg/crashtests/328137-1.svg
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+
+function init()
+{
+  x = document.getElementsByTagName("stop");
+  x[0].appendChild(x[1]);
+}
+
+
+window.addEventListener("load", init, false);
+
+</script>
+
+<radialGradient>
+  <stop/>
+  <stop/>
+</radialGradient>
+
+</svg>
diff --git a/layout/svg/crashtests/329848-1.svg b/layout/svg/crashtests/329848-1.svg
new file mode 100644
index 0000000000..ac4f0022e1
--- /dev/null
+++ b/layout/svg/crashtests/329848-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg">
          <polygon transform="?" points="100,100 200,100 150,200"/>
</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/337408-1.xhtml b/layout/svg/crashtests/337408-1.xhtml
new file mode 100644
index 0000000000..f56c06ec94
--- /dev/null
+++ b/layout/svg/crashtests/337408-1.xhtml
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=337408 -->
+<!-- Just checking for lack of crash, nothing more -->
+<window id="svg-in-xul-stack"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:svg="http://www.w3.org/2000/svg"
+        style="background-color:white;"
+        screenX="20" 
+        screenY="20"
+        width="600"
+        height="400">
+
+  <stack>
+    <box flex="1">
+      <label value="foo"/>
+    </box>
+    <svg:svg>
+      <svg:rect width="100%" height="100%" fill="red" fill-opacity="0.5"/>
+    </svg:svg>
+  </stack>
+</window>
diff --git a/layout/svg/crashtests/338301-1.xhtml b/layout/svg/crashtests/338301-1.xhtml
new file mode 100644
index 0000000000..3367eedebb
--- /dev/null
+++ b/layout/svg/crashtests/338301-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de">
+<body>
+
+  <svg xmlns="http://www.w3.org/2000/svg">
+    <defs>
+      <linearGradient>
+        <path/>
+      </linearGradient>     
+    </defs>
+  </svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/338312-1.xhtml b/layout/svg/crashtests/338312-1.xhtml
new file mode 100644
index 0000000000..5a751a2ae0
--- /dev/null
+++ b/layout/svg/crashtests/338312-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+
+function boom()
+{
+  document.getElementById("foo").appendChild(document.getElementById("bar"));
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</head>
+
+<body>
+
+  <div id="foo"></div>
+
+  <svg xmlns="http://www.w3.org/2000/svg">
+    <defs>
+      <linearGradient id="grad1"/>
+    </defs>
+    <rect id="bar" style="fill:url(#grad1);" />  
+  </svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/340083-1.svg b/layout/svg/crashtests/340083-1.svg
new file mode 100644
index 0000000000..7f015b6efe
--- /dev/null
+++ b/layout/svg/crashtests/340083-1.svg
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100%" height="100%">
+  <defs>
+    <title>
+      <image x="30" y="0" width="190" height="190" xlink:href="../../../testing/crashtest/images/tree.gif"/>
+    </title>
+  </defs>
+</svg>
diff --git a/layout/svg/crashtests/340945-1.svg b/layout/svg/crashtests/340945-1.svg
new file mode 100644
index 0000000000..01ac66fb33
--- /dev/null
+++ b/layout/svg/crashtests/340945-1.svg
@@ -0,0 +1,2 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="display: table;">
+</svg>
diff --git a/layout/svg/crashtests/342923-1.html b/layout/svg/crashtests/342923-1.html
new file mode 100644
index 0000000000..bed6e89791
--- /dev/null
+++ b/layout/svg/crashtests/342923-1.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+ 
+function boo()
+{
+  var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+  rect.setAttribute("stroke", "blue");
+
+  document.body.appendChild(rect);
+}
+ 
+</script>
+</head>
+
+<body class="bodytext" onload="boo();">
+
+<div id="c1"></div>
+
+<p>In a debug trunk build from 2006-006-27, loading this page triggers an assertion.  (It also triggers a CSS error in the console, but I think that's a known, separate bug.)</p>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/343221-1.xhtml b/layout/svg/crashtests/343221-1.xhtml
new file mode 100644
index 0000000000..890b161dfe
--- /dev/null
+++ b/layout/svg/crashtests/343221-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boo()
+{
+  document.getElementById("c").style.overflow = "hidden";
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="setTimeout(boo, 30);">
+
+<svg xmlns="http://www.w3.org/2000/svg">
+  <circle id="c" cx="50" cy="50" r="20" />
+</svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/344749-1.svg b/layout/svg/crashtests/344749-1.svg
new file mode 100644
index 0000000000..1a02d7c180
--- /dev/null
+++ b/layout/svg/crashtests/344749-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+
+<circle cx="6cm" cy="2cm" r="100" fill="red" transform="translate(0,50)" />
+<circle cx="6cm" cy="2cm" r="100" fill="blue" transform="translate(70,150)" />
+<circle cx="6cm" cy="2cm" r="100" fill="green" transform="translate(-70,150)" />
+
+<rect id="rect1" fill="url(#pat0)"/>
+
+<pattern patternUnits="userSpaceOnUse" id="pat0" x="10" y="10" width="20" height="20">
  <rect x="5" y="5" width="10" height="10" fill="red" />
  <rect x="10" y="10" width="10" height="10" fill="green" />
</pattern>
	
+
</svg>
diff --git a/layout/svg/crashtests/344887-1.svg b/layout/svg/crashtests/344887-1.svg
new file mode 100644
index 0000000000..f0bd21c592
--- /dev/null
+++ b/layout/svg/crashtests/344887-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(foo, 30);" class="reftest-wait">
+
+<script>
+
+var SVG_NS = "http://www.w3.org/2000/svg";
+
+function foo()
+{
+  var rect = document.createElementNS(SVG_NS, 'rect'); 
+  rect.setAttribute('opacity', ".3"); 
+  document.documentElement.appendChild(rect);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+
+</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/344892-1.svg b/layout/svg/crashtests/344892-1.svg
new file mode 100644
index 0000000000..a38d7eb40f
--- /dev/null
+++ b/layout/svg/crashtests/344892-1.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<text stroke-width="50%">foo</text>
+
+</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/344898-1.svg b/layout/svg/crashtests/344898-1.svg
new file mode 100644
index 0000000000..34c3f45a4e
--- /dev/null
+++ b/layout/svg/crashtests/344898-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(removeText, 30);" class="reftest-wait">
+
+
+<script>
+
+function removeText()
+{
+  var x = document.getElementById("textPath");
+  x.removeChild(x.firstChild);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+
+<text x="30" y="30"><textPath id="textPath">Foo</textPath></text>
+
+
+</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/344904-1.svg b/layout/svg/crashtests/344904-1.svg
new file mode 100644
index 0000000000..a2c8d07647
--- /dev/null
+++ b/layout/svg/crashtests/344904-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30);" class="reftest-wait">
+
+<script>
+
+function boom()
+{
+  document.getElementById("m").setAttribute("stroke-miterlimit", 1);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+
+<marker>
+  <path id="m" />
+</marker>
+
+
+</svg>
diff --git a/layout/svg/crashtests/345418-1.svg b/layout/svg/crashtests/345418-1.svg
new file mode 100644
index 0000000000..2cf8b331fa
--- /dev/null
+++ b/layout/svg/crashtests/345418-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<tspan>arg</tspan>
+
</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/348982-1.xhtml b/layout/svg/crashtests/348982-1.xhtml
new file mode 100644
index 0000000000..ad0340689a
--- /dev/null
+++ b/layout/svg/crashtests/348982-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<style>
+#div, #svg { display: table; }
+#g { display: inline; }
+</style>
+</head>
+
+<body>
+  <div id="div">
+    <svg id="svg" xmlns="http://www.w3.org/2000/svg">
+      <g id="g">
+        <circle cx="6.5cm" cy="2cm" r="100" style="fill: blue;" />
+      </g>
+    </svg>
+  </div>
+</body>
+
+</html>
diff --git a/layout/svg/crashtests/354777-1.xhtml b/layout/svg/crashtests/354777-1.xhtml
new file mode 100644
index 0000000000..e82baf34c9
--- /dev/null
+++ b/layout/svg/crashtests/354777-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<script>
+
+var SVG_NS = "http://www.w3.org/2000/svg";
+
+function boom()
+{
+  var svgElem = document.createElementNS(SVG_NS, "svg");
+  var ellipse = document.createElementNS(SVG_NS, "ellipse");
+
+  svgElem.setAttribute("viewBox", "0 0 30 40"); 
+  document.body.appendChild(svgElem);
+  document.body.appendChild(ellipse);
+  ellipse.appendChild(svgElem);
+  svgElem.removeAttribute("viewBox");
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+</body>
+
+</html>
+
diff --git a/layout/svg/crashtests/359516-1.svg b/layout/svg/crashtests/359516-1.svg
new file mode 100644
index 0000000000..c997eb3a85
--- /dev/null
+++ b/layout/svg/crashtests/359516-1.svg
@@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:html="http://www.w3.org/1999/xhtml"
+     class="reftest-wait"
+     onload="setTimeout(doStuff, 30);">
+
+<html:script style="display: none;" type="text/javascript">
+
+function doStuff()
+{
+  var svg = document.documentElement;
+  var ellipse = document.getElementById("ellipse");
+  var filter = document.getElementById("filter");
+
+  document.addEventListener("DOMNodeRemoved", foopy, false);
+  filter.removeChild(filter.firstChild);
+  document.removeEventListener("DOMNodeRemoved", foopy, false);
+  
+  function foopy()
+  {
+    document.removeEventListener("DOMNodeRemoved", foopy, false);
+    svg.appendChild(filter);
+  }
+
+  // Needed for the crash, but not for the assertion.
+  svg.appendChild(ellipse);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<ellipse id="ellipse" cx="200" cy="150" rx="70" ry="40" style="filter: url(#filter);"/>
+
+<filter id="filter"> </filter>
+
+</svg>
diff --git a/layout/svg/crashtests/361015-1.svg b/layout/svg/crashtests/361015-1.svg
new file mode 100644
index 0000000000..8ac4bc56f2
--- /dev/null
+++ b/layout/svg/crashtests/361015-1.svg
@@ -0,0 +1,33 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:html="http://www.w3.org/1999/xhtml" 
+     class="reftest-wait"
+     onload="setTimeout(boom, 30)">
+
+<html:script>
+<![CDATA[
+
+function boom()
+{
+  var grad = document.getElementById("grad");
+  var g = document.getElementById("g");
+  grad.appendChild(g);
+  g.removeAttribute("transform");
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</html:script>
+
+
+  <g id="g" transform="translate(500,0)">
+    <text x="25" y="85">Foo</text>
+  </g>
+
+
+  <linearGradient id="grad" gradientUnits="objectBoundingBox" x1="0" y1="0" x2="1" y2="1">
+    <stop stop-color="blue" offset="0.2"/>
+    <stop stop-color="lime" offset="0.4"/>
+  </linearGradient>
+
+
+</svg>
diff --git a/layout/svg/crashtests/361587-1.svg b/layout/svg/crashtests/361587-1.svg
new file mode 100644
index 0000000000..52bce9eda7
--- /dev/null
+++ b/layout/svg/crashtests/361587-1.svg
@@ -0,0 +1,31 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     onload="setTimeout(boom, 30);"
+     class="reftest-wait">
+     
+<script style="display: none" type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+  var oldGrad = document.getElementById("grad");
+  oldGrad.parentNode.removeChild(oldGrad);
+
+  var newGrad = document.createElementNS("http://www.w3.org/2000/svg", "radialGradient");
+  newGrad.setAttribute("gradientUnits", "userSpaceOnUse");
+  newGrad.setAttribute("id", "grad"); 
+  
+  document.documentElement.appendChild(newGrad);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+		<radialGradient id="grad" gradientUnits="userSpaceOnUse" cx="240" cy="210" r="220" fx="240" fy="210">
+			<stop stop-color="yellow" offset="0"/>
+			<stop stop-color="green"  offset="1"/>
+		</radialGradient>
+		<rect x="20" y="150" width="440" height="80" fill="url(#grad)" stroke-width="40"/>
+
+</svg>
diff --git a/layout/svg/crashtests/363611-1.xhtml b/layout/svg/crashtests/363611-1.xhtml
new file mode 100644
index 0000000000..6bc386bcdf
--- /dev/null
+++ b/layout/svg/crashtests/363611-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script style="display: none" type="text/javascript">
+
+function boom()
+{
+  var fo = document.createElementNS("http://www.w3.org/2000/svg", 'foreignObject');
+  document.getElementById("innerSVG").appendChild(fo);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<svg xmlns="http://www.w3.org/2000/svg" ><linearGradient><svg id="innerSVG"></svg></linearGradient></svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/364688-1.svg b/layout/svg/crashtests/364688-1.svg
new file mode 100644
index 0000000000..045061cd2f
--- /dev/null
+++ b/layout/svg/crashtests/364688-1.svg
@@ -0,0 +1,34 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:html="http://www.w3.org/1999/xhtml"
+     onload="setTimeout(boom, 30);"
+     class="reftest-wait">
+
+<script>
+function boom()
+{
+  document.getElementById("sss").removeAttribute('value');
+
+  document.documentElement.removeAttribute("class");
+}
+</script>
+
+
+<foreignObject width="500" height="500" y="300">
+
+<div xmlns="http://www.w3.org/1999/xhtml">
+
+<table border="1">
+ <tr>
+  <td>Foo</td>
+ </tr>
+ <tr>
+  <td><input type="text" value="Baz" id="sss" /></td>
+ </tr>
+</table>
+
+</div>
+
+</foreignObject>
+
+
+</svg>
diff --git a/layout/svg/crashtests/366956-1.svg b/layout/svg/crashtests/366956-1.svg
new file mode 100644
index 0000000000..9836c7ea3a
--- /dev/null
+++ b/layout/svg/crashtests/366956-1.svg
@@ -0,0 +1,61 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom1, 50);" class="reftest-wait">
+
+<html:script>
+
+function boom1()
+{
+  document.getElementsByTagName("mi")[0].setAttribute('id', "ffff");
+
+  document.getElementById("fo").appendChild(document.createTextNode(" "));
+
+  setTimeout(boom2, 50);
+}
+
+function boom2()
+{
+  var fodiv = document.getElementById("fodiv");
+  fodiv.parentNode.removeChild(fodiv);
+
+  document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+
+  <g>
+    <foreignObject width="500" height="500" transform="scale(.7,.7)" id="fo" y="300">
+  
+<div id="fodiv" xmlns="http://www.w3.org/1999/xhtml">
+
+
+
+<p>0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99</p>
+
+
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+<mrow>
+  <mi>A</mi>
+</mrow>
+</math></div>
+
+
+<svg xmlns="http://www.w3.org/2000/svg" id="svg" viewbox="0 0 250 250" width="100" height="100">
+  <style type="text/css">
+    circle:hover {fill-opacity:0.9;}
+  </style>
+
+  <g style="fill-opacity:0.7;" transform="scale(.2)">
+    <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black; stroke-width:0.1cm" transform="translate(0,50)" />
+    <circle cx="6.5cm" cy="2cm" r="100" style="fill:blue; stroke:black; stroke-width:0.1cm" transform="translate(70,150)" />
+    <circle cx="6.5cm" cy="2cm" r="100" style="fill:green; stroke:black; stroke-width:0.1cm" transform="translate(-70,150)"/>
+  </g>
+</svg>
+
+</div>
+</foreignObject>
+</g>
+
+
+
+</svg>
diff --git a/layout/svg/crashtests/366956-2.svg b/layout/svg/crashtests/366956-2.svg
new file mode 100644
index 0000000000..a2ab21ed55
--- /dev/null
+++ b/layout/svg/crashtests/366956-2.svg
@@ -0,0 +1,61 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom1, 30);" class="reftest-wait">
+
+<html:script>
+
+function boom1()
+{
+  document.getElementsByTagName("mi")[0].setAttribute('id', "ffff");
+
+  document.getElementById("fo").appendChild(document.createTextNode(" "));
+
+  boom2();
+}
+
+function boom2()
+{
+  var fodiv = document.getElementById("fodiv");
+  fodiv.parentNode.removeChild(fodiv);
+
+  document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+
+  <g>
+    <foreignObject width="500" height="500" transform="scale(.7,.7)" id="fo" y="300">
+  
+<div id="fodiv" xmlns="http://www.w3.org/1999/xhtml">
+
+
+
+<p>0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99</p>
+
+
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+<mrow>
+  <mi>A</mi>
+</mrow>
+</math></div>
+
+
+<svg xmlns="http://www.w3.org/2000/svg" id="svg" viewbox="0 0 250 250" width="100" height="100">
+  <style type="text/css">
+    circle:hover {fill-opacity:0.9;}
+  </style>
+
+  <g style="fill-opacity:0.7;" transform="scale(.2)">
+    <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black; stroke-width:0.1cm" transform="translate(0,50)" />
+    <circle cx="6.5cm" cy="2cm" r="100" style="fill:blue; stroke:black; stroke-width:0.1cm" transform="translate(70,150)" />
+    <circle cx="6.5cm" cy="2cm" r="100" style="fill:green; stroke:black; stroke-width:0.1cm" transform="translate(-70,150)"/>
+  </g>
+</svg>
+
+</div>
+</foreignObject>
+</g>
+
+
+
+</svg>
diff --git a/layout/svg/crashtests/367111-1.svg b/layout/svg/crashtests/367111-1.svg
new file mode 100644
index 0000000000..dcf6a39bf7
--- /dev/null
+++ b/layout/svg/crashtests/367111-1.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:html="http://www.w3.org/1999/xhtml"
+     onload="setTimeout(boom, 30);"
+     class="reftest-wait">
+
+<html:script>
+
+function boom()
+{
+  document.getElementById("text").appendChild(document.getElementById("fo"));
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+  
+<defs>
+  <marker>
+    <text id="text">svg:text</text>
+  </marker>
+</defs>
+
+<foreignObject id="fo">
+  <div xmlns="http://www.w3.org/1999/xhtml">
+    <p>HTML in a foreignObject</p>
+  </div>
+</foreignObject>
+
+</svg>
diff --git a/layout/svg/crashtests/367368-1.xhtml b/layout/svg/crashtests/367368-1.xhtml
new file mode 100644
index 0000000000..b9bcd3241b
--- /dev/null
+++ b/layout/svg/crashtests/367368-1.xhtml
@@ -0,0 +1,12 @@
+<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=367368 -->
+<!-- Just checking for crash, nothing more -->
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <body>
+
+    <svg xmlns="http://www.w3.org/2000/svg">
+      <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black;" transform="translate(0,50)" />
+    </svg>
+
+  </body>
+</html>
diff --git a/layout/svg/crashtests/369233-1.svg b/layout/svg/crashtests/369233-1.svg
new file mode 100644
index 0000000000..22f4aacb37
--- /dev/null
+++ b/layout/svg/crashtests/369233-1.svg
@@ -0,0 +1,33 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:html="http://www.w3.org/1999/xhtml" 
+     onload="setTimeout(boom, 200);"
+     class="reftest-wait">
+
+<html:script>
+
+function boom()
+{
+  try {
+    document.getElementById("grad2").gradientUnits.baseVal = "y";
+  } catch (e) {
+  }
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+
+
+<radialGradient id="grad2" gradientUnits="userSpaceOnUse" cx="240" cy="210" r="220" fx="240" fy="210">
+  <stop stop-color="black"  offset="0"/>
+  <stop stop-color="yellow"  offset="0.2"/>
+  <stop stop-color="red"  offset="0.4"/>
+  <stop stop-color="blue"  offset="0.6"/>
+  <stop stop-color="white"  offset="0.8"/>
+  <stop stop-color="green"  offset="1"/>
+</radialGradient>
+
+<rect x="20" y="150" width="440" height="80" fill="url(#grad2)" stroke-width="40"/>
+
+</svg>
diff --git a/layout/svg/crashtests/369438-1.svg b/layout/svg/crashtests/369438-1.svg
new file mode 100644
index 0000000000..78bcb6b54d
--- /dev/null
+++ b/layout/svg/crashtests/369438-1.svg
@@ -0,0 +1,24 @@
+<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom, 30);" class="reftest-wait"><html:script src="data:text/javascript,"></html:script><html:script>
+
+function boom()
+{
+  var defs = document.getElementById("defs");
+  defs.parentNode.removeChild(defs);
+
+  document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<defs id="defs">
+<filter id="Gaussian_Blur">
+<feGaussianBlur in="SourceGraphic" stdDeviation="3"/>
+</filter>
+</defs>
+
+<ellipse cx="200" cy="150" rx="70" ry="40"
+style="fill:#ff0000;stroke:#000000;
+stroke-width:2;filter:url(#Gaussian_Blur)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/369438-2.svg b/layout/svg/crashtests/369438-2.svg
new file mode 100644
index 0000000000..92eea9ee0f
--- /dev/null
+++ b/layout/svg/crashtests/369438-2.svg
@@ -0,0 +1,27 @@
+<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom, 30);" class="reftest-wait"><html:script>
+
+function boom()
+{
+  var defs = document.getElementById("defs");
+  var gb = document.getElementById("Gaussian_Blur");
+
+  defs.parentNode.removeChild(defs);
+  gb.removeChild(gb.firstChild); // remove a whitespace text node (!)
+
+  document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<defs id="defs">
+<filter id="Gaussian_Blur">
+<feGaussianBlur in="SourceGraphic" stdDeviation="3"/>
+</filter>
+</defs>
+
+<ellipse cx="200" cy="150" rx="70" ry="40"
+style="fill:#ff0000;stroke:#000000;
+stroke-width:2;filter:url(#Gaussian_Blur)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/371463-1.xhtml b/layout/svg/crashtests/371463-1.xhtml
new file mode 100644
index 0000000000..461fb27ba3
--- /dev/null
+++ b/layout/svg/crashtests/371463-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:svg="http://www.w3.org/2000/svg">
+<body>
+
+<select><svg:svg><svg:foreignObject/></svg:svg></select>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/371563-1.xhtml b/layout/svg/crashtests/371563-1.xhtml
new file mode 100644
index 0000000000..0ebdc9bfa1
--- /dev/null
+++ b/layout/svg/crashtests/371563-1.xhtml
@@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+  document.getElementById("sdiv").style.overflow = "scroll";
+
+  document.documentElement.removeAttribute("class");
+}
+
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+  <div id="sdiv" style="float: left;">
+  
+  <svg xmlns="http://www.w3.org/2000/svg" height="400px" width="400px"
+     y="0.0000000" x="0.0000000" version="1.0" >
+    <defs>
+      <marker id="Arrow"/>
+    </defs>
+    <path style="marker-end:url(#Arrow)"
+       d="M 12.500000,200.00000 L 387.50000,200.00000" />
+  </svg>
+
+  </div>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/375775-1.svg b/layout/svg/crashtests/375775-1.svg
new file mode 100644
index 0000000000..cd17c85a94
--- /dev/null
+++ b/layout/svg/crashtests/375775-1.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30);" class="reftest-wait">
+     
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("filter").style.display = "none";
+  document.getElementById("path").style.display = "none";
+
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<filter id="filter" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="120" />
+
+<g filter="url(#filter)">
+  <path id="path"
+        fill="black"
+        d="M60,80 C30,80 30,40 60,40 L140,40 C170,40 170,80 140,80 z" />
+</g>
+
+</svg>
diff --git a/layout/svg/crashtests/378716.svg b/layout/svg/crashtests/378716.svg
new file mode 100644
index 0000000000..b6faa00284
--- /dev/null
+++ b/layout/svg/crashtests/378716.svg
@@ -0,0 +1,4 @@
+<svg width="100%" height="100%" x="0" y="0" viewBox="0 0 1 1"
+     xmlns="http://www.w3.org/2000/svg">
+  <text id="text_1" x="0.5" y="0.5" font-size="0.05" fill="green">Okay Text</text>
+</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/380691-1.svg b/layout/svg/crashtests/380691-1.svg
new file mode 100644
index 0000000000..ed28552633
--- /dev/null
+++ b/layout/svg/crashtests/380691-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <mask id="m"/>
+  <foreignObject mask="url(#m)"/>
+</svg>
diff --git a/layout/svg/crashtests/384391-1.xhtml b/layout/svg/crashtests/384391-1.xhtml
new file mode 100644
index 0000000000..12c657a48c
--- /dev/null
+++ b/layout/svg/crashtests/384391-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg" >
+<head>
+<script>
+
+function boom()
+{
+  var circle = document.getElementById("circle");
+  document.removeChild(document.documentElement);
+  document.appendChild(circle);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<svg:circle id="circle" />
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/384499-1.svg b/layout/svg/crashtests/384499-1.svg
new file mode 100644
index 0000000000..f448910008
--- /dev/null
+++ b/layout/svg/crashtests/384499-1.svg
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<html:style>
+  #mathy { display: table}
+</html:style>
+
+<foreignObject width="500" height="500" y="50">
+  <div xmlns="http://www.w3.org/1999/xhtml">
+    <p>Foo</p>
+    <div>
+      <math xmlns="http://www.w3.org/1998/Math/MathML" id="mathy" display="block">
+        <mrow>
+          <mi>x</mi>
+        </mrow>
+      </math>
+    </div>
+  </div>
+</foreignObject>
+
+</svg>
diff --git a/layout/svg/crashtests/384637-1.svg b/layout/svg/crashtests/384637-1.svg
new file mode 100644
index 0000000000..263a2d556a
--- /dev/null
+++ b/layout/svg/crashtests/384637-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" baseProfile="basic" width="100%" height="100%" viewBox="0 0 480 360">
+
+		<mask id="mask1" maskUnits="userSpaceOnUse" x="60" y="50" width="100" height="60">
+  		<rect x="60" y="50" width="100" height="60" fill="yellow" mask="url(#mask1)"/>
+		</mask>
+
+		<rect x="60" y="50" width="100" height="60" fill="lime" mask="url(#mask1)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/384728-1.svg b/layout/svg/crashtests/384728-1.svg
new file mode 100644
index 0000000000..ccafc83706
--- /dev/null
+++ b/layout/svg/crashtests/384728-1.svg
@@ -0,0 +1,21 @@
+<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script>
+
+function boom()
+{
+  document.getElementById("thhh").setAttributeNS("http://www.w3.org/1999/xlink", 'href', '');
+}
+
+</script>
+
+	<defs>
+    <g id="ch" style="counter-reset: c;">
+      <rect x="75" y="0" width="75" height="75" fill="lightgreen" style="counter-increment: c;"/>
+    </g>
+    
+  </defs>
+
+  <use id="thhh" x="0" y="0"><use xlink:href="#ch" x="0" y="0"/></use>
+
+</svg>
diff --git a/layout/svg/crashtests/385246-1.svg b/layout/svg/crashtests/385246-1.svg
new file mode 100644
index 0000000000..cddad0c5e4
--- /dev/null
+++ b/layout/svg/crashtests/385246-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<foreignObject x="100" y="100" width="-2" height="500">
+  <div xmlns="http://www.w3.org/1999/xhtml">
+    <p>Foo</p>
+  </div>
+</foreignObject>
+
+</svg>
diff --git a/layout/svg/crashtests/385246-2.svg b/layout/svg/crashtests/385246-2.svg
new file mode 100644
index 0000000000..c392f2fc8a
--- /dev/null
+++ b/layout/svg/crashtests/385246-2.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<script type="text/javascript" xlink:href="data:text/javascript,"></script>
+
+
+<foreignObject width="-2" height="500" id="fo" x="300">
+  <div xmlns="http://www.w3.org/1999/xhtml">
+    <p>Hi!!!</p>
+  </div>
+</foreignObject>
+
+
+
+
+</svg>
diff --git a/layout/svg/crashtests/385552-1.svg b/layout/svg/crashtests/385552-1.svg
new file mode 100644
index 0000000000..019e249d77
--- /dev/null
+++ b/layout/svg/crashtests/385552-1.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<script>
+document.createElementNS("http://www.w3.org/2000/svg", "svg").unsuspendRedrawAll();
+</script>
diff --git a/layout/svg/crashtests/385552-2.svg b/layout/svg/crashtests/385552-2.svg
new file mode 100644
index 0000000000..9a93d657fb
--- /dev/null
+++ b/layout/svg/crashtests/385552-2.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<script>
+document.createElementNS("http://www.w3.org/2000/svg", "svg").suspendRedraw(3);
+</script>
diff --git a/layout/svg/crashtests/385840-1.svg b/layout/svg/crashtests/385840-1.svg
new file mode 100644
index 0000000000..cf7ff6949c
--- /dev/null
+++ b/layout/svg/crashtests/385840-1.svg
@@ -0,0 +1,20 @@
+<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script>
+
+function boom()
+{
+  var SVG_NS = "http://www.w3.org/2000/svg";
+
+  var svgCircle = document.createElementNS(SVG_NS, 'circle');
+  var svgText = document.createElementNS(SVG_NS, 'text');
+  svgText.appendChild(document.createTextNode("foo"));
+  svgCircle.appendChild(svgText);
+
+  document.removeChild(document.documentElement);
+  document.appendChild(svgCircle);
+}
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/385852-1.svg b/layout/svg/crashtests/385852-1.svg
new file mode 100644
index 0000000000..17ad99ca8f
--- /dev/null
+++ b/layout/svg/crashtests/385852-1.svg
@@ -0,0 +1,34 @@
+<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30)" class="reftest-wait">
+
+<script>
+
+var originalRoot = document.documentElement;
+var svgCircle;
+
+function boom()
+{
+  var SVG_NS = "http://www.w3.org/2000/svg";
+
+  var svgPolyline = document.createElementNS(SVG_NS, 'polyline');
+  svgCircle   = document.createElementNS(SVG_NS, 'circle');
+
+  svgCircle.appendChild(svgPolyline);
+  
+  document.removeChild(originalRoot);
+  document.appendChild(svgCircle);
+
+  setTimeout(restore, 30);
+}
+
+function restore()
+{
+  // We have to put it the root element back in the document so that reftest.js
+  // sees the event for the removal of class="reftest-wait"!
+  document.removeChild(svgCircle);
+  document.appendChild(originalRoot);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/386475-1.xhtml b/layout/svg/crashtests/386475-1.xhtml
new file mode 100644
index 0000000000..4d1b9a2808
--- /dev/null
+++ b/layout/svg/crashtests/386475-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:svg="http://www.w3.org/2000/svg">
+<head>
+<script>
+function boom()
+{
+  document.body.style.display = "table-header-group";
+  document.getElementById("svg").setAttribute('height', 1);
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<svg:svg width="100%" height="100%" id="svg">
+	<svg:g>
+		<svg:foreignObject width="8205em" height="100%">
+			<span>hello</span> <span>world</span>
+		</svg:foreignObject>
+	</svg:g>
+</svg:svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/386690-1.svg b/layout/svg/crashtests/386690-1.svg
new file mode 100644
index 0000000000..e206978134
--- /dev/null
+++ b/layout/svg/crashtests/386690-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 40">
+  <foreignObject width="-2" height="100" />
+</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/387290-1.svg b/layout/svg/crashtests/387290-1.svg
new file mode 100644
index 0000000000..4ac8463204
--- /dev/null
+++ b/layout/svg/crashtests/387290-1.svg
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.  -->
+<!--
+Copyright Georgi Guninski
+-->
+
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" 
+"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+
+<svg version="1.1"
+xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"
+>
+<defs>
+<filter id="dafilter" filterUnits="userSpaceOnUse"
+x="0" y="0"  width="4194305" height="17">
+<feGaussianBlur in="SourceAlpha" stdDeviation="4" result="blur"/>
+</filter>
+</defs>
+<g>
+
+<rect fill="red" width="256" height="256" filter="url(#dafilter)" transform="scale(262145,9)"  />
+</g>
+
+</svg>
diff --git a/layout/svg/crashtests/402408-1.svg b/layout/svg/crashtests/402408-1.svg
new file mode 100644
index 0000000000..f442b2171e
--- /dev/null
+++ b/layout/svg/crashtests/402408-1.svg
@@ -0,0 +1,32 @@
+<svg xmlns="http://www.w3.org/2000/svg" 
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     onload="boom();"
+    class="reftest-wait">
+     
+<script>
+
+function boom()
+{
+  var grad1 = document.getElementById("grad1");
+  var grad2 = document.getElementById("grad2");
+
+  grad1.appendChild(grad2);
+
+  setTimeout(function() { 
+    grad1.removeChild(grad2);
+    document.documentElement.removeAttribute("class");
+  }, 30);  
+}
+
+</script>
+
+<linearGradient id="grad1" gradientUnits="objectBoundingBox" x1="0" y1="0" x2="1" y2="0">
+  <stop id="green"   stop-color="#00dd00"   offset="0"/>
+  <stop id="blue"    stop-color="#0000dd"   offset="1"/>
+</linearGradient>
+
+<linearGradient id="grad2" xlink:href="#grad1"/>
+
+<rect x="20" y="20" width="440" height="80" fill="url(#grad2)" />
+
+</svg>
diff --git a/layout/svg/crashtests/404677-1.xhtml b/layout/svg/crashtests/404677-1.xhtml
new file mode 100644
index 0000000000..c1df3869b9
--- /dev/null
+++ b/layout/svg/crashtests/404677-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg">
+<head>
+</head>
+<body>
+
+<svg:svg height="-2" width="5" />
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/409565-1.xhtml b/layout/svg/crashtests/409565-1.xhtml
new file mode 100644
index 0000000000..2c427ccc8b
--- /dev/null
+++ b/layout/svg/crashtests/409565-1.xhtml
@@ -0,0 +1,3 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="white-space: pre;"><body style="width: 24px; height: 24px; column-width: 200px;">
+
+  <svg xmlns="http://www.w3.org/2000/svg" style="float: left;"></svg></body></html>
diff --git a/layout/svg/crashtests/420697-1.svg b/layout/svg/crashtests/420697-1.svg
new file mode 100644
index 0000000000..d8b7f38340
--- /dev/null
+++ b/layout/svg/crashtests/420697-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text stroke="black" y="1em"
+        stroke-dashoffset="1%"
+        stroke-dasharray="1px">
+    m
+  </text>
+</svg>
diff --git a/layout/svg/crashtests/420697-2.svg b/layout/svg/crashtests/420697-2.svg
new file mode 100644
index 0000000000..8987693e50
--- /dev/null
+++ b/layout/svg/crashtests/420697-2.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text stroke="black" y="1em"
+        stroke-dasharray="1%">
+    m
+  </text>
+</svg>
diff --git a/layout/svg/crashtests/429774-1.svg b/layout/svg/crashtests/429774-1.svg
new file mode 100644
index 0000000000..00b726de6a
--- /dev/null
+++ b/layout/svg/crashtests/429774-1.svg
@@ -0,0 +1,29 @@
+<?xml version="1.0"?>
+
+<svg width="7.5cm" height="5cm" viewBox="0 0 200 120"
+     xmlns="http://www.w3.org/2000/svg">
+
+  <defs>
+    <filter id="MyFilter" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="120">
+
+      <feOffset in="SourceAlpha" result="offset" dx="4" dy="4" y="76"/>
+
+      <feSpecularLighting in="offset" result="specOut"
+                          surfaceScale="5" specularConstant=".75" specularExponent="20">
+        <fePointLight x="-5000" y="-10000" z="20000"/>
+      </feSpecularLighting>
+
+      <feComposite in="SourceAlpha" in2="SourceAlpha" result="litPaint"
+                   operator="arithmetic" k1="0" k2="1" k3="1" k4="0"/>
+
+      <feMerge>
+        <feMergeNode in="offset"/>
+        <feMergeNode in="litPaint"/>
+      </feMerge>
+
+    </filter>
+  </defs>
+
+  <g filter="url(#MyFilter)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/441368-1.svg b/layout/svg/crashtests/441368-1.svg
new file mode 100644
index 0000000000..d0fee7478b
--- /dev/null
+++ b/layout/svg/crashtests/441368-1.svg
@@ -0,0 +1,31 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" 
+"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/.  -->
+<!--
+Copyright Georgi Guninski
+-->
+
+
+<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg">
+
+<defs>
+<filter id="MyFilter" filterUnits="userSpaceOnUse"
+x="0" y="0" width="32769" height="32769">
+
+<feGaussianBlur in="SourceAlpha" stdDeviation="2147483648" result="blur"/>
+
+</filter>
+</defs>
+
+<rect x="1" y="1" width="198" height="118" fill="#cccccc" />
+
+<g filter="url(#MyFilter)">
+<text fill="#FFFFFF" stroke="black" font-size="45"
+x="42" y="42">Feck b1ll</text>
+</g>
+
+</svg>
diff --git a/layout/svg/crashtests/453754-1.svg b/layout/svg/crashtests/453754-1.svg
new file mode 100644
index 0000000000..a32d819281
--- /dev/null
+++ b/layout/svg/crashtests/453754-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+  <filter id="f" height="-1"/>
+
+  <rect filter="url(#f)" />
+
+</svg>
diff --git a/layout/svg/crashtests/455314-1.xhtml b/layout/svg/crashtests/455314-1.xhtml
new file mode 100644
index 0000000000..01bb33d653
--- /dev/null
+++ b/layout/svg/crashtests/455314-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head>
+<script>
+function doe() {
+document.getElementById('a').appendChild(document.body);
+}
+setTimeout(doe, 100);
+</script>
+</head>
+<body>
+<div style="position: absolute;  -moz-appearance: button; filter: url(#b);  "></div>
+<pre style="position: absolute;">
+<table id="b"></table>
+</pre>
+</body>
+<div id="a"/>
+</html>
\ No newline at end of file
diff --git a/layout/svg/crashtests/458453.html b/layout/svg/crashtests/458453.html
new file mode 100644
index 0000000000..ab72d46dee
--- /dev/null
+++ b/layout/svg/crashtests/458453.html
@@ -0,0 +1,24 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+var i = 0;
+
+function bouncy()
+{
+  var body = document.body;
+  document.documentElement.removeChild(body);
+  document.documentElement.appendChild(body);
+
+  if (++i < 30)
+    setTimeout(bouncy, 1);
+  else
+    document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="bouncy();"><span id="a"></span><span style="filter: url(#a);"><span style="filter: url(#a);">B</span></span></body>
+
+</html>
diff --git a/layout/svg/crashtests/459666-1.html b/layout/svg/crashtests/459666-1.html
new file mode 100644
index 0000000000..69074b6028
--- /dev/null
+++ b/layout/svg/crashtests/459666-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html style="filter: url(#e);">
+<head></head>
+<body onload="document.documentElement.style.counterReset = 'a';">
+<div id="e"></div>
+</body>
+</html>
diff --git a/layout/svg/crashtests/459883.xhtml b/layout/svg/crashtests/459883.xhtml
new file mode 100644
index 0000000000..e125e71d8a
--- /dev/null
+++ b/layout/svg/crashtests/459883.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="filter: url(#r);" class="reftest-wait"><head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("s").setAttribute("style", "display: -moz-box;");
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", function() { setTimeout(boom, 0); }, false);
+
+</script>
+</head><body><ms xmlns="http://www.w3.org/1998/Math/MathML" id="s"><maction id="r"/></ms></body></html>
diff --git a/layout/svg/crashtests/461289-1.svg b/layout/svg/crashtests/461289-1.svg
new file mode 100644
index 0000000000..82a57f81b0
--- /dev/null
+++ b/layout/svg/crashtests/461289-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<script type="text/javascript">
+
+function boom()
+{
+  var f = document.getElementById("filter1");
+  f.appendChild(document.createElementNS("http://www.w3.org/2000/svg", "feImage"));
+  f.appendChild(document.getElementById("rect"));
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+<filter id="filter1"/><rect id="rect" filter="url(#filter1)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/464374-1.svg b/layout/svg/crashtests/464374-1.svg
new file mode 100644
index 0000000000..9844e5187f
--- /dev/null
+++ b/layout/svg/crashtests/464374-1.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("b").appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "math"));
+  document.getElementById("defs").setAttribute("filter", "url(#a)");
+}
+
+</script>
+
+<defs id="defs"><filter id="a"/><g id="b"><rect/></g></defs>
+
+</svg>
diff --git a/layout/svg/crashtests/466585-1.svg b/layout/svg/crashtests/466585-1.svg
new file mode 100644
index 0000000000..22ad862e15
--- /dev/null
+++ b/layout/svg/crashtests/466585-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script type="text/javascript">
+
+window.addEventListener("load", boom, false);
+
+function boom()
+{
+  document.getElementById("rect").setAttribute("filter", "url(#filter)");
+  document.getElementById("defs").setAttribute("fill", "red");
+}
+
+</script>
+
+<defs id="defs"><filter id="filter"/><rect id="rect"/></defs>
+
+</svg>
diff --git a/layout/svg/crashtests/467323-1.svg b/layout/svg/crashtests/467323-1.svg
new file mode 100644
index 0000000000..9d757c349d
--- /dev/null
+++ b/layout/svg/crashtests/467323-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="500" height="500">
+
+<filter id="f1" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse">
+  <feFlood flood-color="#ff0000" result="flood" x="0" y="0" width="100" height="100"/>
+  <feDisplacementMap style="color-interpolation-filters:sRGB"
+   in="SourceGraphic" in2="flood" scale="100" xChannelSelector="R" yChannelSelector="G"/>
+</filter>
+<g filter="url(#f1)"></g>
+
+</svg>
diff --git a/layout/svg/crashtests/467498-1.svg b/layout/svg/crashtests/467498-1.svg
new file mode 100644
index 0000000000..9839e6c30d
--- /dev/null
+++ b/layout/svg/crashtests/467498-1.svg
@@ -0,0 +1,12 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+  <use id="a" width="100" height="100" xlink:href="#b"/>
+  <use id="b" x="100" y="100" width="100" height="100" xlink:href="#a"/>
+  <script>
+    document.getElementById("a").setAttribute("width", "200");
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/470124-1.svg b/layout/svg/crashtests/470124-1.svg
new file mode 100644
index 0000000000..ba3b8aff40
--- /dev/null
+++ b/layout/svg/crashtests/470124-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<filter id="f7" filterUnits="userSpaceOnUse" primitiveUnits="objectBoundingBox"><feComposite/></filter>
+
+<g filter="url(#f7)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/472782-1.svg b/layout/svg/crashtests/472782-1.svg
new file mode 100644
index 0000000000..7cfeb11a69
--- /dev/null
+++ b/layout/svg/crashtests/472782-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="r">
+<text><textPath xlink:href="#r">S</textPath> </text>
+</svg>
diff --git a/layout/svg/crashtests/474700-1.svg b/layout/svg/crashtests/474700-1.svg
new file mode 100644
index 0000000000..141a1b3903
--- /dev/null
+++ b/layout/svg/crashtests/474700-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><filter id="f1" height="-2"/><rect width="50" height="100" filter="url(#f1)"/></svg>
diff --git a/layout/svg/crashtests/475181-1.svg b/layout/svg/crashtests/475181-1.svg
new file mode 100644
index 0000000000..ef5a638afb
--- /dev/null
+++ b/layout/svg/crashtests/475181-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><filter id="filter1"><feImage y="4095"/><feTile/></filter><rect width="100%" height="100%" filter="url(#filter1)"/></svg>
diff --git a/layout/svg/crashtests/475193-1.html b/layout/svg/crashtests/475193-1.html
new file mode 100644
index 0000000000..edc08bcee4
--- /dev/null
+++ b/layout/svg/crashtests/475193-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+
+
+<style type="text/css">
+
+.p { marker: url('#c'); }
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("a").setAttribute("class", "p");
+  document.documentElement.offsetHeight;
+  document.getElementById("b").setAttribute("id", "c");
+}
+
+</script>
+</head><body onload="boom();"><div class="p" id="a">C</div><div id="c"></div></body></html>
\ No newline at end of file
diff --git a/layout/svg/crashtests/475302-1.svg b/layout/svg/crashtests/475302-1.svg
new file mode 100644
index 0000000000..4fdaa2213c
--- /dev/null
+++ b/layout/svg/crashtests/475302-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<style type="text/css">
+  tref { filter: url(#filter1); }
+</style>
+
+<filter id="filter1"><feFlood/></filter>
+
+<tref><polyline points="350,75 379,161 469,161 397,215 423,301 350,250 277,301 303,215 231,161 321,161"/></tref>
+
+</svg>
diff --git a/layout/svg/crashtests/477935-1.html b/layout/svg/crashtests/477935-1.html
new file mode 100644
index 0000000000..9c2ac5438a
--- /dev/null
+++ b/layout/svg/crashtests/477935-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css"> :root { filter: url('#g'); } </style>
+<style type="text/css" id="ccs"> .cc { content: 'X'; } </style>
+</head>
+<body onload="document.getElementById('ccs').disabled = true;">
+<div id="g"></div>
+<div class="cc">5</div>
+</body>
+</html>
diff --git a/layout/svg/crashtests/478128-1.svg b/layout/svg/crashtests/478128-1.svg
new file mode 100644
index 0000000000..a34552776a
--- /dev/null
+++ b/layout/svg/crashtests/478128-1.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <script type="text/javascript">
+
+    function boom()
+    {
+      document.documentElement.style.columnCount = '15';
+    }
+    window.onload = function() { setTimeout(boom, 20); };
+    
+  </script>
+
+  <foreignObject width="50" height="50" filter="url(#f1)"/>
+
+  <filter id="f1"/>
+</svg>
diff --git a/layout/svg/crashtests/478511-1.svg b/layout/svg/crashtests/478511-1.svg
new file mode 100644
index 0000000000..75a4aaa9b2
--- /dev/null
+++ b/layout/svg/crashtests/478511-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" version="1.0">
+  <defs>
+    <pattern id="pattern"
+             x="0" y="0" width="200" height="200">
+      <circle fill="lime" r="100" cx="100" cy="100"/>
+    </pattern>
+  </defs>
+  <rect width="200" height="200" fill="url(#pattern)"/>
+</svg>
diff --git a/layout/svg/crashtests/483439-1.svg b/layout/svg/crashtests/483439-1.svg
new file mode 100644
index 0000000000..c9e9ebae1c
--- /dev/null
+++ b/layout/svg/crashtests/483439-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+
+    <defs>
+        <path id="myTextPath"
+              d="M275,20
+                 a1,1 0 0,0 100,0 
+               "
+                />
+    </defs>
+
+    <svg y="15">
+        <text x="10" y="100" style="stroke: #000000;">
+          <textPath xlink:href="#myTextPath" >Text along a curved path...</textPath>
+        </text>
+    </svg>
+</svg>
diff --git a/layout/svg/crashtests/492186-1.svg b/layout/svg/crashtests/492186-1.svg
new file mode 100644
index 0000000000..7f4b6650ab
--- /dev/null
+++ b/layout/svg/crashtests/492186-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<altGlyphDef/>
+<script xmlns="http://www.w3.org/1999/xhtml">
+document.documentElement.getBBox();
+</script>
+</svg>
diff --git a/layout/svg/crashtests/508247-1.svg b/layout/svg/crashtests/508247-1.svg
new file mode 100644
index 0000000000..c8b36b905f
--- /dev/null
+++ b/layout/svg/crashtests/508247-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<definition-src>
+<path id="a"/>
+</definition-src>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">
+setTimeout(function() {document.getElementById('a').getCTM()},10);
+</script>
+</svg>
diff --git a/layout/svg/crashtests/512890-1.svg b/layout/svg/crashtests/512890-1.svg
new file mode 100644
index 0000000000..044f693892
--- /dev/null
+++ b/layout/svg/crashtests/512890-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <filter id="f" height="1em"/>
+  <rect width="50" height="50" filter="url(#f)"/>
+</svg>
diff --git a/layout/svg/crashtests/515288-1.html b/layout/svg/crashtests/515288-1.html
new file mode 100644
index 0000000000..d78cbbfbec
--- /dev/null
+++ b/layout/svg/crashtests/515288-1.html
@@ -0,0 +1,5 @@
+<script>
+var svgElem = document.createElementNS("http://www.w3.org/2000/svg", "svg"); 
+document.createElement("script").appendChild(svgElem); 
+svgElem.getScreenCTM(); 
+</script>
\ No newline at end of file
diff --git a/layout/svg/crashtests/522394-1.svg b/layout/svg/crashtests/522394-1.svg
new file mode 100644
index 0000000000..f745c47dd2
--- /dev/null
+++ b/layout/svg/crashtests/522394-1.svg
@@ -0,0 +1,12 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+<defs>
+  <filter id="f1" x="0" y="0" width="-100" height="-100" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse">
+    <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/>
+  </filter>
+</defs>
+<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/>
+</svg>
diff --git a/layout/svg/crashtests/522394-2.svg b/layout/svg/crashtests/522394-2.svg
new file mode 100644
index 0000000000..1b6f1f0892
--- /dev/null
+++ b/layout/svg/crashtests/522394-2.svg
@@ -0,0 +1,12 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+<defs>
+  <filter id="f1" x="0" y="0" width="100000000" height="100000000" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse">
+    <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/>
+  </filter>
+</defs>
+<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/>
+</svg>
diff --git a/layout/svg/crashtests/522394-3.svg b/layout/svg/crashtests/522394-3.svg
new file mode 100644
index 0000000000..cf3483cfad
--- /dev/null
+++ b/layout/svg/crashtests/522394-3.svg
@@ -0,0 +1,12 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+<defs>
+  <filter id="f1" x="0" y="0" width="4563402752" height="4563402752" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse">
+    <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/>
+  </filter>
+</defs>
+<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/>
+</svg>
diff --git a/layout/svg/crashtests/566216-1.svg b/layout/svg/crashtests/566216-1.svg
new file mode 100644
index 0000000000..999aaf4f08
--- /dev/null
+++ b/layout/svg/crashtests/566216-1.svg
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg"><animate id="y"/><script>
+<![CDATA[
+
+function boom()
+{
+  var r = document.createRange();
+  r.setEnd(document.getElementById('y'), 0);
+  r.extractContents();
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</svg>
+
+
diff --git a/layout/svg/crashtests/587336-1.html b/layout/svg/crashtests/587336-1.html
new file mode 100644
index 0000000000..811f483dd7
--- /dev/null
+++ b/layout/svg/crashtests/587336-1.html
@@ -0,0 +1,9 @@
+<html>
+<head><script>
+function boom()
+{
+  var b = document.getElementById("b");
+  b.setAttributeNS(null, "style", "filter: url(#a);");
+}
+</script></head>
+<body onload="boom();" id="a"><span id="b">B</span></body></html>
diff --git a/layout/svg/crashtests/590291-1.svg b/layout/svg/crashtests/590291-1.svg
new file mode 100644
index 0000000000..db26fac3a8
--- /dev/null
+++ b/layout/svg/crashtests/590291-1.svg
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1" width="0cm" height="0cm">
+
+<text id="a">a</text>
+
+<script><![CDATA[
+var x=document.getElementById('a').getExtentOfChar(0);
+]]></script>
+</svg>
diff --git a/layout/svg/crashtests/601999-1.html b/layout/svg/crashtests/601999-1.html
new file mode 100644
index 0000000000..7e8a3d39de
--- /dev/null
+++ b/layout/svg/crashtests/601999-1.html
@@ -0,0 +1,5 @@
+<html class="reftest-wait">
+  <body onload="document.getElementsByTagName('div')[0].id='b';
+                document.documentElement.removeAttribute('class');"
+    ><div style="overflow-x: scroll; filter: url(#b)">abc</div></body>
+</html>
diff --git a/layout/svg/crashtests/605626-1.svg b/layout/svg/crashtests/605626-1.svg
new file mode 100644
index 0000000000..678b011797
--- /dev/null
+++ b/layout/svg/crashtests/605626-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<image width="10" height="10" xlink:href="data:text/plain,g"/>
+</svg>
diff --git a/layout/svg/crashtests/606914.xhtml b/layout/svg/crashtests/606914.xhtml
new file mode 100644
index 0000000000..fc019af573
--- /dev/null
+++ b/layout/svg/crashtests/606914.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="display: table; position: absolute; left: 2305843009213694000pc; bottom: 2452284pc; padding: 9931442138140%; border-bottom-right-radius: 1152921504606847000pc;">X</html>
diff --git a/layout/svg/crashtests/610594-1.html b/layout/svg/crashtests/610594-1.html
new file mode 100644
index 0000000000..ee48e762cc
--- /dev/null
+++ b/layout/svg/crashtests/610594-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<svg><path d="M 0 5 a 2 5 -30 104 -5" marker-mid="url(#q)"></path></svg>
+</body>
+</html>
diff --git a/layout/svg/crashtests/610954-1.html b/layout/svg/crashtests/610954-1.html
new file mode 100644
index 0000000000..f5080df8b8
--- /dev/null
+++ b/layout/svg/crashtests/610954-1.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html><body dir=rtl onload="document.getElementById('g').style.filter = 'url(#filter1)';"><span id="g">&#x200E;---</span></body></html>
diff --git a/layout/svg/crashtests/612662-1.svg b/layout/svg/crashtests/612662-1.svg
new file mode 100644
index 0000000000..73dc98ed19
--- /dev/null
+++ b/layout/svg/crashtests/612662-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="background: url(#a); direction: rtl; margin: -32944px;"></svg>
diff --git a/layout/svg/crashtests/612662-2.svg b/layout/svg/crashtests/612662-2.svg
new file mode 100644
index 0000000000..b46841132f
--- /dev/null
+++ b/layout/svg/crashtests/612662-2.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     style="direction: rtl; margin: -32944px;
+            background: url(data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3C%2Fsvg%3E)"></svg>
diff --git a/layout/svg/crashtests/612736-1.svg b/layout/svg/crashtests/612736-1.svg
new file mode 100644
index 0000000000..cb3044efd0
--- /dev/null
+++ b/layout/svg/crashtests/612736-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     class="reftest-wait">
+  <path id="path"/>
+  <text>
+    <textPath xlink:href="#path">f</textPath>
+    <textPath xlink:href="#path">f</textPath>
+  </text>
+
+  <script>
+  function boom()
+  {
+    var path = document.getElementById("path");
+    path.parentNode.removeChild(path);
+    document.documentElement.removeAttribute("class");
+  }
+  window.addEventListener("load", boom, false);
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/612736-2.svg b/layout/svg/crashtests/612736-2.svg
new file mode 100644
index 0000000000..30b8245a9f
--- /dev/null
+++ b/layout/svg/crashtests/612736-2.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+  <path id="path" d="M0 100 h50" stroke="black"/>
+  <text>
+    <textPath xlink:href="#path">abc</textPath>
+    <textPath xlink:href="#path">def</textPath>
+  </text>
+</svg>
diff --git a/layout/svg/crashtests/614367-1.svg b/layout/svg/crashtests/614367-1.svg
new file mode 100644
index 0000000000..3af7b491da
--- /dev/null
+++ b/layout/svg/crashtests/614367-1.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+  <polygon id="p" transform="?" />
+  <script>
+    document.getElementById("p").transform.baseVal.removeItem(0);
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/620034-1.html b/layout/svg/crashtests/620034-1.html
new file mode 100644
index 0000000000..bfffd3ffac
--- /dev/null
+++ b/layout/svg/crashtests/620034-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+  var f = document.createElementNS("http://www.w3.org/2000/svg", "feFuncB");
+  var tvb = f.tableValues.baseVal;
+  f.setAttribute("tableValues", "3 7 5");
+  f.setAttribute("tableValues", "i"); 
+  tvb.numberOfItems;
+}
+
+boom();
+
+</script>
diff --git a/layout/svg/crashtests/621598-1.svg b/layout/svg/crashtests/621598-1.svg
new file mode 100644
index 0000000000..dd47967d35
--- /dev/null
+++ b/layout/svg/crashtests/621598-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <marker id="m1">
+    <rect/>
+    <marker>
+      <line id="z" marker-end="url(#m1)"/>
+    </marker>
+  </marker>
+  <script>
+    function boom()
+    {
+      document.getElementById("z").getBoundingClientRect();
+    }
+    window.addEventListener("load", boom, false);
+  </script>
+
+</svg>
diff --git a/layout/svg/crashtests/648819-1.html b/layout/svg/crashtests/648819-1.html
new file mode 100644
index 0000000000..727ca3e55f
--- /dev/null
+++ b/layout/svg/crashtests/648819-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<script>
+var p = document.createElementNS("http://www.w3.org/2000/svg", "pattern");
+p.setAttribute("patternTransform", "i");
+p.patternTransform.baseVal.clear();
+</script>
diff --git a/layout/svg/crashtests/655025-1.svg b/layout/svg/crashtests/655025-1.svg
new file mode 100644
index 0000000000..4501bb57fa
--- /dev/null
+++ b/layout/svg/crashtests/655025-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text id="a">a</text>
+  <script>
+    document.getElementById("a").firstChild.nodeValue = "";
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/655025-2.svg b/layout/svg/crashtests/655025-2.svg
new file mode 100644
index 0000000000..601006e831
--- /dev/null
+++ b/layout/svg/crashtests/655025-2.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text id="a">a</text>
+  <script>
+    document.getElementById("a").appendChild(document.createTextNode(""));
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/655025-3.svg b/layout/svg/crashtests/655025-3.svg
new file mode 100644
index 0000000000..43e06b6fc3
--- /dev/null
+++ b/layout/svg/crashtests/655025-3.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <script>
+    var a = document.createElementNS("http://www.w3.org/2000/svg", "text");
+    a.appendChild(document.createTextNode(""));
+    document.documentElement.appendChild(a);
+    a.getNumberOfChars();
+    document.documentElement.removeChild(a);
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/657077-1.svg b/layout/svg/crashtests/657077-1.svg
new file mode 100644
index 0000000000..b0165bd14a
--- /dev/null
+++ b/layout/svg/crashtests/657077-1.svg
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<svg id="a" requiredExtensions="x"/>
+
+<script>
+<![CDATA[
+
+function boom()
+{
+  document.getElementById("a").unsuspendRedrawAll();
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/669025-1.svg b/layout/svg/crashtests/669025-1.svg
new file mode 100644
index 0000000000..eb529da4e0
--- /dev/null
+++ b/layout/svg/crashtests/669025-1.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+  <script type="text/javascript">
+
+    document.createElementNS("http://www.w3.org/2000/svg", "filter").filterResX;
+
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/669025-2.svg b/layout/svg/crashtests/669025-2.svg
new file mode 100644
index 0000000000..ccecebef3c
--- /dev/null
+++ b/layout/svg/crashtests/669025-2.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+  <script type="text/javascript">
+
+    document.createElementNS("http://www.w3.org/2000/svg", "feGaussianBlur").stdDeviationX;
+
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/682411-1.svg b/layout/svg/crashtests/682411-1.svg
new file mode 100644
index 0000000000..92d0c0a725
--- /dev/null
+++ b/layout/svg/crashtests/682411-1.svg
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg" style="width: 0pt; padding: 100px;">
+  <filter id="s"/>
+  <g filter="url(#s)"><text>z</text></g>
+</svg>
diff --git a/layout/svg/crashtests/692203-1.svg b/layout/svg/crashtests/692203-1.svg
new file mode 100644
index 0000000000..8427b84268
--- /dev/null
+++ b/layout/svg/crashtests/692203-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <marker id="marker" markerWidth="0"/>
+  <path d="M0,0 L100,100 200,200" marker-mid="url(#marker)"/>
+</svg>
diff --git a/layout/svg/crashtests/692203-2.svg b/layout/svg/crashtests/692203-2.svg
new file mode 100644
index 0000000000..b59926dbba
--- /dev/null
+++ b/layout/svg/crashtests/692203-2.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <marker id="marker" markerHeight="0"/>
+  <path d="M0,0 L100,100 200,200" marker-mid="url(#marker)"/>
+</svg>
diff --git a/layout/svg/crashtests/693424-1.svg b/layout/svg/crashtests/693424-1.svg
new file mode 100644
index 0000000000..8485f6b617
--- /dev/null
+++ b/layout/svg/crashtests/693424-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <marker id="m">
+    <foreignObject/>
+  </marker>
+  <line marker-end="url(#m)"/>
+</svg>
diff --git a/layout/svg/crashtests/709920-1.svg b/layout/svg/crashtests/709920-1.svg
new file mode 100644
index 0000000000..5f25155307
--- /dev/null
+++ b/layout/svg/crashtests/709920-1.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait">
+  <!-- Test to be sure that a zero-sized-in-one-dimension viewBox doesn't
+       make us fail assertions. -->
+  <script>
+    document.addEventListener("MozReftestInvalidate", waitAndFinish, false);
+
+    function waitAndFinish() {
+      // Sadly, MozReftestInvalidate fires sooner than PaintPattern here, so
+      // we need to wait a little bit to give PaintPattern a chance to hit
+      // this bug.
+      setTimeout(finish, 100);
+    }
+
+    function finish() {
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+  <pattern id="test" viewBox="0 0 1 0">
+    <rect/>
+  </pattern>
+  <rect width="200" height="200" fill="url(#test)"/>
+</svg>
diff --git a/layout/svg/crashtests/709920-2.svg b/layout/svg/crashtests/709920-2.svg
new file mode 100644
index 0000000000..58c51111eb
--- /dev/null
+++ b/layout/svg/crashtests/709920-2.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait">
+  <!-- Test to be sure that a zero-sized-in-one-dimension viewBox doesn't
+       make us fail assertions. -->
+  <script>
+    document.addEventListener("MozReftestInvalidate", waitAndFinish, false);
+
+    function waitAndFinish() {
+      // Sadly, MozReftestInvalidate fires sooner than PaintPattern here, so
+      // we need to wait a little bit to give PaintPattern a chance to hit
+      // this bug.
+      setTimeout(finish, 100);
+    }
+
+    function finish() {
+      document.documentElement.removeAttribute("class");
+    }
+  </script>
+  <pattern id="test" viewBox="0 0 0 1">
+    <rect/>
+  </pattern>
+  <rect width="200" height="200" fill="url(#test)"/>
+</svg>
diff --git a/layout/svg/crashtests/713413-1.svg b/layout/svg/crashtests/713413-1.svg
new file mode 100644
index 0000000000..7131202335
--- /dev/null
+++ b/layout/svg/crashtests/713413-1.svg
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<marker id="m"></marker>
+
+<script>
+window.addEventListener("load", function() {
+  document.getElementById("m").appendChild(document.createElementNS("http://www.w3.org/2000/svg", "foreignObject"));
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/722003-1.svg b/layout/svg/crashtests/722003-1.svg
new file mode 100644
index 0000000000..58e2d57734
--- /dev/null
+++ b/layout/svg/crashtests/722003-1.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<marker><foreignObject><span id="x" xmlns="http://www.w3.org/1999/xhtml"></span></foreignObject></marker>
+
+<script>
+
+window.addEventListener("load", function() {
+  document.getElementById("x").getClientRects();
+}, false);
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/725918-1.svg b/layout/svg/crashtests/725918-1.svg
new file mode 100644
index 0000000000..5ebdf33f69
--- /dev/null
+++ b/layout/svg/crashtests/725918-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text stroke="url(#p)">t</text>
+  <pattern id="p"/>
+</svg>
diff --git a/layout/svg/crashtests/732836-1.svg b/layout/svg/crashtests/732836-1.svg
new file mode 100644
index 0000000000..a9abb46668
--- /dev/null
+++ b/layout/svg/crashtests/732836-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" >
+
+  <symbol id="z">
+    <use xlink:href="data:image/svg+xml,&lt;svg xmlns='http://www.w3.org/2000/svg' id='root' /&gt;#root" />
+  </symbol>
+
+  <use id="a" xlink:href="#z" width="20"/>
+
+  <script>
+  window.addEventListener("load", function() {
+    window.scrollByPages(0);
+    document.getElementById("a").removeAttribute("width");
+    document.elementFromPoint(0, 0);
+  }, false);
+  </script>
+
+</svg>
diff --git a/layout/svg/crashtests/740627-1.svg b/layout/svg/crashtests/740627-1.svg
new file mode 100644
index 0000000000..b74fcd2ddd
--- /dev/null
+++ b/layout/svg/crashtests/740627-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <pattern id="test" viewBox="0 0 10 10" height="-65%">
+    <rect/>
+  </pattern>
+  <rect width="100" height="100" fill="url(#test)"/>
+</svg>
diff --git a/layout/svg/crashtests/740627-2.svg b/layout/svg/crashtests/740627-2.svg
new file mode 100644
index 0000000000..6241ddaae5
--- /dev/null
+++ b/layout/svg/crashtests/740627-2.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <pattern id="test" viewBox="0 0 10 10" width="-65%">
+    <rect/>
+  </pattern>
+  <rect width="100" height="100" fill="url(#test)"/>
+</svg>
diff --git a/layout/svg/crashtests/743469.svg b/layout/svg/crashtests/743469.svg
new file mode 100644
index 0000000000..6affc6fab8
--- /dev/null
+++ b/layout/svg/crashtests/743469.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="border-width: 51703084143745256mm; border-left-style: dashed; border-top-left-radius: 3%; border-top-style: dashed; border-right-style: solid; border-image-outset: 10;">
+<script>
+document.elementFromPoint(20, 20);
+</script>
+</svg>
diff --git a/layout/svg/crashtests/757704-1.svg b/layout/svg/crashtests/757704-1.svg
new file mode 100644
index 0000000000..b7e610e0e1
--- /dev/null
+++ b/layout/svg/crashtests/757704-1.svg
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg"><script>
+<![CDATA[
+
+function boom()
+{
+  var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+  document.documentElement.appendChild(rect);
+  document.removeChild(document.documentElement);
+  rect.getScreenCTM();
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></svg>
diff --git a/layout/svg/crashtests/757718-1.svg b/layout/svg/crashtests/757718-1.svg
new file mode 100644
index 0000000000..fa948c6677
--- /dev/null
+++ b/layout/svg/crashtests/757718-1.svg
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var svgDoc = (new DOMParser).parseFromString("<svg xmlns='http://www.w3.org/2000/svg'></svg>", "image/svg+xml");
+  var svgRoot = svgDoc.documentElement;
+  var rf = svgRoot.requiredFeatures;
+  document.adoptNode(svgRoot);
+  Object.getOwnPropertyNames(rf);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/svg/crashtests/757751-1.svg b/layout/svg/crashtests/757751-1.svg
new file mode 100644
index 0000000000..7ab51d0d19
--- /dev/null
+++ b/layout/svg/crashtests/757751-1.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <svg id="x" viewBox=" 0 0 10 10"/>
+  </defs>
+  <script>
+    window.addEventListener("load", function() { document.getElementById("x").setAttribute("width", "2"); }, false);
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/767056-1.svg b/layout/svg/crashtests/767056-1.svg
new file mode 100644
index 0000000000..b813d784b3
--- /dev/null
+++ b/layout/svg/crashtests/767056-1.svg
@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     width="100%"
+     class="reftest-wait">
+  <script>
+
+function resize() {
+  // Set the viewBox to the same width as the content area, but slightly
+  // higher. This checks that we don't enter an infinite reflow loop. See
+  // https://bugzilla.mozilla.org/show_bug.cgi?id=767056#c10
+  var viewBox = "0 0 " + window.innerWidth + " " + (window.innerHeight + 1);
+  document.documentElement.setAttribute("viewBox", viewBox);
+  document.documentElement.removeAttribute("class");
+}
+
+document.addEventListener("MozReftestInvalidate", resize, false);
+setTimeout(resize, 3000); // For non-gecko
+
+  </script>
+  <rect width="100%" height="100%"/>
+</svg>
diff --git a/layout/svg/crashtests/767535-1.xhtml b/layout/svg/crashtests/767535-1.xhtml
new file mode 100644
index 0000000000..2a923fcc6d
--- /dev/null
+++ b/layout/svg/crashtests/767535-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="columns: 2 auto;" class="reftest-wait">
+  <head>
+    <script>
+
+function test() { 
+  var r = document.documentElement; 
+  document.removeChild(r); 
+  document.appendChild(r); 
+  document.documentElement.removeAttribute("class");
+}
+
+    </script>
+  </head>
+  <body style="filter:url(#f);" onload="setTimeout(test, 0);">
+    <div>
+    </div>
+    <svg xmlns="http://www.w3.org/2000/svg">
+      <filter id="f"/>
+    </svg>
+  </body>
+</html>
+
diff --git a/layout/svg/crashtests/768087-1.html b/layout/svg/crashtests/768087-1.html
new file mode 100644
index 0000000000..9a7899f9d1
--- /dev/null
+++ b/layout/svg/crashtests/768087-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body onload="setTimeout(function() { document.body.innerHTML = '<span>x<svg viewbox=\'0 0 30 40\' ></svg></span>'; }, 0);"></body>
+</html>
diff --git a/layout/svg/crashtests/768351.svg b/layout/svg/crashtests/768351.svg
new file mode 100644
index 0000000000..50a4b9b9c4
--- /dev/null
+++ b/layout/svg/crashtests/768351.svg
@@ -0,0 +1,2 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="mask: url('data:text/plain,1#f');" />
+
diff --git a/layout/svg/crashtests/772313-1.svg b/layout/svg/crashtests/772313-1.svg
new file mode 100644
index 0000000000..c77af02b6e
--- /dev/null
+++ b/layout/svg/crashtests/772313-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="background: url(#d); width: 0.1px;"></svg>
diff --git a/layout/svg/crashtests/778492-1.svg b/layout/svg/crashtests/778492-1.svg
new file mode 100644
index 0000000000..76deda594e
--- /dev/null
+++ b/layout/svg/crashtests/778492-1.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg width="1cm" viewBox="0 0 1 1" xmlns="http://www.w3.org/2000/svg">
+<line x2="100" y2="100"/>
+</svg>
diff --git a/layout/svg/crashtests/779971-1.svg b/layout/svg/crashtests/779971-1.svg
new file mode 100644
index 0000000000..d57065a0ba
--- /dev/null
+++ b/layout/svg/crashtests/779971-1.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="r" class="reftest-wait">
+<text id="t"><textPath xlink:href="#r">x</textPath>1</text>
+<script>
+
+window.addEventListener("load", function() {
+    setTimeout(function() {
+        document.getElementById("t").lastChild.data = "2";
+
+        document.documentElement.removeAttribute("class");
+    }, 200);
+}, false);
+
+</script>
+</svg>
diff --git a/layout/svg/crashtests/780764-1.svg b/layout/svg/crashtests/780764-1.svg
new file mode 100644
index 0000000000..6f4eb970bb
--- /dev/null
+++ b/layout/svg/crashtests/780764-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+
+<marker id="marker"><path d="M100,0 l100,100 200,200" filter="url(#filter)"/></marker>
+
+<filter id="filter"/>
+
+<path d="M100,0 l100,100 200,200" marker-mid="url(#marker)"/>
+
+<script>
+window.addEventListener("load", function() {
+    setTimeout(function() {
+        document.getElementById("filter").style.fontWeight = "bold";
+        document.documentElement.removeAttribute("class");
+    }, 200);
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/780963-1.html b/layout/svg/crashtests/780963-1.html
new file mode 100644
index 0000000000..8cbeb1a37f
--- /dev/null
+++ b/layout/svg/crashtests/780963-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <script>
+
+function tweak() {
+  document.body.offsetTop;
+
+  var feImage = document.getElementsByTagName("feImage")[0];
+  feImage.setAttribute('filter', 'url(#f1)')
+  document.body.offsetTop;
+
+  var child = document.createElementNS('http://www.w3.org/2000/svg', 'g')
+  feImage.appendChild(child);
+}
+
+    </script>
+  </head>
+  <body onload="tweak()">
+    <svg xmlns="http://www.w3.org/2000/svg">
+      <filter filterUnits="userSpaceOnUse" id="f1">
+        <feImage/>
+      </filter>
+      <rect height="100" width="100"/>
+    </svg>
+  </body>
+</html>
diff --git a/layout/svg/crashtests/782141-1.svg b/layout/svg/crashtests/782141-1.svg
new file mode 100644
index 0000000000..6f0af76ff4
--- /dev/null
+++ b/layout/svg/crashtests/782141-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1"
+     onload="go()">
+  <script>
+
+function go() {
+  var f = document.getElementById('f');
+  var fm = document.getElementById('fm');
+  f.appendChild(fm.cloneNode(1));
+}
+
+  </script>
+  <filter id="f">
+    <feMorphology id="fm" radius="2147483500"/>
+  </filter>
+  <rect height="28" width="256" filter="url(#f)" />
+</svg>
diff --git a/layout/svg/crashtests/784061-1.svg b/layout/svg/crashtests/784061-1.svg
new file mode 100644
index 0000000000..6a9623154d
--- /dev/null
+++ b/layout/svg/crashtests/784061-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     class="reftest-wait">
+
+<defs><path id="x"/></defs>
+
+<script>
+function boom()
+{
+    document.getElementById("x").style.transform = "translate(0px)";
+    document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/788831-1.svg b/layout/svg/crashtests/788831-1.svg
new file mode 100644
index 0000000000..b6202a1324
--- /dev/null
+++ b/layout/svg/crashtests/788831-1.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <pattern id="pattern" width="40" height="40"><stop/></pattern>
+  <rect id="rect" width="200" height="100"/>
+  <use xlink:href="#rect" stroke="url(#pattern)" />
+</svg>
diff --git a/layout/svg/crashtests/789390-1.html b/layout/svg/crashtests/789390-1.html
new file mode 100644
index 0000000000..542037f229
--- /dev/null
+++ b/layout/svg/crashtests/789390-1.html
@@ -0,0 +1 @@
+<html style="transition: 1s;"><body onload="document.documentElement.style.stroke = '-moz-objectStroke';"></body></html>
diff --git a/layout/svg/crashtests/790072.svg b/layout/svg/crashtests/790072.svg
new file mode 100644
index 0000000000..b288251a7e
--- /dev/null
+++ b/layout/svg/crashtests/790072.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><text style="stroke: -moz-objectfill none;">abc</text></svg>
diff --git a/layout/svg/crashtests/791826-1.svg b/layout/svg/crashtests/791826-1.svg
new file mode 100644
index 0000000000..f42261a3ad
--- /dev/null
+++ b/layout/svg/crashtests/791826-1.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="position: fixed;">
+<script>
+<![CDATA[
+
+function boom()
+{
+  document.documentElement.setAttribute("preserveAspectRatio", "_");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</svg>
diff --git a/layout/svg/crashtests/803562-1.svg b/layout/svg/crashtests/803562-1.svg
new file mode 100644
index 0000000000..e6fc91127e
--- /dev/null
+++ b/layout/svg/crashtests/803562-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<foreignObject width="500" height="500" style="-moz-appearance: checkbox;">
+  <option xmlns="http://www.w3.org/1999/xhtml"></option>
+</foreignObject>
+
+<script>
+<![CDATA[
+
+window.addEventListener("load", function() {
+  document.getElementsByTagName("option")[0].appendChild(document.createTextNode("Option 1"));
+}, false);
+
+]]>
+</script>
+
+</svg>
+
diff --git a/layout/svg/crashtests/808318-1.svg b/layout/svg/crashtests/808318-1.svg
new file mode 100644
index 0000000000..48907225cc
--- /dev/null
+++ b/layout/svg/crashtests/808318-1.svg
@@ -0,0 +1,2 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="-moz-transform-style: preserve-3d"></svg>
+
diff --git a/layout/svg/crashtests/813420-1.svg b/layout/svg/crashtests/813420-1.svg
new file mode 100644
index 0000000000..d977c0e982
--- /dev/null
+++ b/layout/svg/crashtests/813420-1.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+  <svg id="i" style="mask: url(&quot;#none&quot;);">
+    <marker id="markerEnd"/><polygon marker-end="url(#markerEnd)" points="250,150 200,150"/>
+  </svg>
+  <script>
+
+window.addEventListener("MozReftestInvalidate", function() {
+  document.getElementById("i").style.mask = "url(#none)";
+  document.documentElement.removeAttribute("class");
+}, false);
+
+  </script>
+</svg>
+
diff --git a/layout/svg/crashtests/841163-1.svg b/layout/svg/crashtests/841163-1.svg
new file mode 100644
index 0000000000..b1bb5198ab
--- /dev/null
+++ b/layout/svg/crashtests/841163-1.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+
+<filter id="f"/>
+
+<g filter="url(#f)">
+  <text>AB</text>
+</g>
+
+<script>
+
+function forceFrameConstruction()
+{
+  document.documentElement.getBoundingClientRect();
+}
+
+function boom()
+{
+  document.getElementsByTagName("text")[0].firstChild.splitText(1);
+  forceFrameConstruction();
+  document.normalize();
+  forceFrameConstruction();
+  document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/841812-1.svg b/layout/svg/crashtests/841812-1.svg
new file mode 100644
index 0000000000..e5bcaa66ee
--- /dev/null
+++ b/layout/svg/crashtests/841812-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <text>
+        <circle>
+            <textPath id="t" xlink:href="data:text/html,1" />
+        </circle>
+    </text>
+
+    <script>
+        window.addEventListener("load", function() { document.getElementById("t").removeAttribute('xlink:href'); }, false);
+    </script>
+</svg>
diff --git a/layout/svg/crashtests/842009-1.svg b/layout/svg/crashtests/842009-1.svg
new file mode 100644
index 0000000000..25656ba530
--- /dev/null
+++ b/layout/svg/crashtests/842009-1.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+  <title id="hello">hello</title>
+  <text x="100" y="100"> <tref xlink:href="#hello"/></text>
+</svg>
diff --git a/layout/svg/crashtests/842630-1.svg b/layout/svg/crashtests/842630-1.svg
new file mode 100644
index 0000000000..8d36998be6
--- /dev/null
+++ b/layout/svg/crashtests/842630-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><text dy="20 20">A<tspan style="display: none;">B</tspan></text></svg>
diff --git a/layout/svg/crashtests/842909-1.svg b/layout/svg/crashtests/842909-1.svg
new file mode 100644
index 0000000000..9a1bc89eb4
--- /dev/null
+++ b/layout/svg/crashtests/842909-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <text id="t">X</text>
+  </defs>
+
+  <script>
+    window.addEventListener("load", function() {
+      document.getElementById("t").getSubStringLength(0, 0);
+    }, false);
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/843072-1.svg b/layout/svg/crashtests/843072-1.svg
new file mode 100644
index 0000000000..590721f058
--- /dev/null
+++ b/layout/svg/crashtests/843072-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <text id="t"></text>
+  </defs>
+
+  <script>
+    window.addEventListener("load", function() {
+      document.getElementById("t").getExtentOfChar(0);
+    }, false);
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/843917-1.svg b/layout/svg/crashtests/843917-1.svg
new file mode 100644
index 0000000000..55cf7ab186
--- /dev/null
+++ b/layout/svg/crashtests/843917-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+  <filter id="f"/>
+
+  <g filter="url(#f)">
+    <text>a&#x1e82f;</text>
+  </g>
+
+  <script>
+
+  window.addEventListener("load", function() {
+    var text = document.getElementsByTagName("text")[0];
+    text.firstChild.data = "d";
+    text.appendChild(document.createElementNS("http://www.w3.org/2000/svg", "g"));
+  }, false);
+
+  </script>
+
+</svg>
diff --git a/layout/svg/crashtests/847139-1.svg b/layout/svg/crashtests/847139-1.svg
new file mode 100644
index 0000000000..81fffa4be8
--- /dev/null
+++ b/layout/svg/crashtests/847139-1.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<marker><text>x</text></marker>
+
+<script>
+
+window.addEventListener("load", function() {
+    document.caretPositionFromPoint(0, 0);
+}, false);
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/849688-1.svg b/layout/svg/crashtests/849688-1.svg
new file mode 100644
index 0000000000..142f04c933
--- /dev/null
+++ b/layout/svg/crashtests/849688-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<text></text>
+
+<script>
+window.addEventListener("load", function() {
+    document.getElementsByTagName('text')[0].getStartPositionOfChar(1);
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/849688-2.svg b/layout/svg/crashtests/849688-2.svg
new file mode 100644
index 0000000000..4b71b20c7c
--- /dev/null
+++ b/layout/svg/crashtests/849688-2.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<text>X</text>
+
+<script>
+window.addEventListener("load", function() {
+    document.getElementsByTagName('text')[0].getStartPositionOfChar(2);
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/860378-1.svg b/layout/svg/crashtests/860378-1.svg
new file mode 100644
index 0000000000..f4ec09bc4c
--- /dev/null
+++ b/layout/svg/crashtests/860378-1.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<filter id="f"/>
+<g filter="url(#f)"><text>ab</text></g>
+
+<script>
+
+function boom()
+{
+    var svgtext = document.getElementsByTagName("text")[0];
+    var text1 = svgtext.firstChild ;
+    var text2 = text1.splitText(1);
+
+    setTimeout(function() {
+        text1.data = "c";
+        svgtext.removeChild(text2);
+    }, 200);
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/868904-1.svg b/layout/svg/crashtests/868904-1.svg
new file mode 100644
index 0000000000..c8d7e9437e
--- /dev/null
+++ b/layout/svg/crashtests/868904-1.svg
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+
+* { animation-name: a; animation-duration: 72ms }
+@keyframes a { 60% { transform: skewx(30deg); } }
+
+</style>
+</head>
+<body>
+
+<svg></svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/873806-1.svg b/layout/svg/crashtests/873806-1.svg
new file mode 100644
index 0000000000..e40aff201b
--- /dev/null
+++ b/layout/svg/crashtests/873806-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <foreignObject requiredFeatures="fail">
+    <svg>
+      <text>a</text>
+    </svg>
+  </foreignObject>
+  <script>
+    document.querySelector("text").getBBox();
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/876831-1.svg b/layout/svg/crashtests/876831-1.svg
new file mode 100644
index 0000000000..6b6c01f9e7
--- /dev/null
+++ b/layout/svg/crashtests/876831-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+function boom()
+{
+    var x = document.getElementById("x").firstChild;
+    x.data = x.data.slice(1);
+    document.caretPositionFromPoint(0, 0);
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+<text><tspan id="x">@&#x062A;</tspan></text>
+
+</svg>
diff --git a/layout/svg/crashtests/877029-1.svg b/layout/svg/crashtests/877029-1.svg
new file mode 100644
index 0000000000..1a7bad0f1b
--- /dev/null
+++ b/layout/svg/crashtests/877029-1.svg
@@ -0,0 +1,10 @@
+<!--
+  Check that we don't crash due to an nsSVGMarkerFrame having a null
+  mMarkedFrame and incorrectly calling GetCanvasTM() on the nsSVGMarkerFrame.
+  -->
+<svg xmlns="http://www.w3.org/2000/svg">
+  <marker><text>a</text></marker>
+  <script>
+    document.querySelector("text").getComputedTextLength();
+  </script>
+</svg>
diff --git a/layout/svg/crashtests/880925-1.svg b/layout/svg/crashtests/880925-1.svg
new file mode 100644
index 0000000000..77efd3c0a5
--- /dev/null
+++ b/layout/svg/crashtests/880925-1.svg
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+
+function boom()
+{
+    var svgText = document.createElementNS("http://www.w3.org/2000/svg", "text");
+    document.documentElement.appendChild(svgText);
+    var text1 = document.createTextNode("A");
+    svgText.appendChild(text1);
+    var text2 = document.createTextNode("");
+    svgText.appendChild(text2);
+    document.caretPositionFromPoint(0, 0);
+    setTimeout(function() {
+        text2.data = "B";
+        document.caretPositionFromPoint(0, 0);
+    }, 0);
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</svg>
diff --git a/layout/svg/crashtests/881031-1.svg b/layout/svg/crashtests/881031-1.svg
new file mode 100644
index 0000000000..0738e1299d
--- /dev/null
+++ b/layout/svg/crashtests/881031-1.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+
+function boom()
+{
+    var svgText = document.getElementById("t");
+    svgText.firstChild.data = "C";
+    svgText.appendChild(document.createTextNode("D"));
+    document.caretPositionFromPoint(0, 0);
+}
+window.addEventListener("load", boom, false);
+
+</script>
+<text id="t">A</text>
+</svg>
diff --git a/layout/svg/crashtests/885608-1.svg b/layout/svg/crashtests/885608-1.svg
new file mode 100644
index 0000000000..0c96777508
--- /dev/null
+++ b/layout/svg/crashtests/885608-1.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<mask id="m"><text id="t">z</text></mask>
+
+<rect width="600" height="400" mask="url(#m)"/>
+
+<script>
+window.addEventListener("load", function() {
+  document.getElementById("t").firstChild.data = "ab";
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/890782-1.svg b/layout/svg/crashtests/890782-1.svg
new file mode 100644
index 0000000000..686bc73a8f
--- /dev/null
+++ b/layout/svg/crashtests/890782-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+    <foreignObject requiredFeatures="foo" id="f">
+        <svg>
+            <text id="t"/>
+        </svg>
+    </foreignObject>
+
+    <script>
+        window.addEventListener("load", function() {
+            document.documentElement.appendChild(document.getElementById("f"))
+            document.getElementById("t").getNumberOfChars();
+        }, false);
+    </script>
+
+</svg>
diff --git a/layout/svg/crashtests/890783-1.svg b/layout/svg/crashtests/890783-1.svg
new file mode 100644
index 0000000000..25f54ba2a3
--- /dev/null
+++ b/layout/svg/crashtests/890783-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+  <mask id="m">
+    <text>
+      <tspan id="tspan" />
+    </text>
+  </mask>
+
+  <rect width="600" height="400" mask="url(#m)"/>
+
+  <script>
+
+    window.addEventListener("load", function() {
+      document.getElementById("tspan").style.dominantBaseline = "alphabetic";
+    }, false);
+
+  </script>
+
+</svg>
diff --git a/layout/svg/crashtests/893510-1.svg b/layout/svg/crashtests/893510-1.svg
new file mode 100644
index 0000000000..bb58be0450
--- /dev/null
+++ b/layout/svg/crashtests/893510-1.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+    <g requiredExtensions="foo">
+        <text>&#x062A;z</text>
+    </g>
+</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/895311-1.svg b/layout/svg/crashtests/895311-1.svg
new file mode 100644
index 0000000000..7b0c728043
--- /dev/null
+++ b/layout/svg/crashtests/895311-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+  <mask id="m">
+    <text>
+      <tspan id="ts" />
+    </text>
+  </mask>
+
+  <rect width="600" height="400" mask="url(#m)"/>
+
+  <script>
+    window.addEventListener("load", function() {
+      document.getElementById("ts").style.overflow = "hidden";
+    }, false);
+  </script>
+
+</svg>
diff --git a/layout/svg/crashtests/897342-1.svg b/layout/svg/crashtests/897342-1.svg
new file mode 100644
index 0000000000..547e919b7d
--- /dev/null
+++ b/layout/svg/crashtests/897342-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><text textLength="50" lengthAdjust="spacingAndGlyphs">&#x200D;</text></svg>
diff --git a/layout/svg/crashtests/898909-1.svg b/layout/svg/crashtests/898909-1.svg
new file mode 100644
index 0000000000..8a70cd7b8d
--- /dev/null
+++ b/layout/svg/crashtests/898909-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" requiredFeatures="foo">
+
+  <text id="t" />
+
+  <script>
+    window.addEventListener("load", function() {
+      document.getElementById("t").getComputedTextLength();
+    }, false);
+  </script>
+
+</svg>
diff --git a/layout/svg/crashtests/898951-1.svg b/layout/svg/crashtests/898951-1.svg
new file mode 100644
index 0000000000..f42dbf69f2
--- /dev/null
+++ b/layout/svg/crashtests/898951-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text>X<tspan style="display: none;">2</tspan>&#x0301;</text>
+</svg>
diff --git a/layout/svg/crashtests/913990.html b/layout/svg/crashtests/913990.html
new file mode 100644
index 0000000000..21d8ef3cc3
--- /dev/null
+++ b/layout/svg/crashtests/913990.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<body style="filter: url('feed:javascript:5');">
+</body>
+</html>
diff --git a/layout/svg/crashtests/919371-1.xhtml b/layout/svg/crashtests/919371-1.xhtml
new file mode 100644
index 0000000000..b27ba3fa66
--- /dev/null
+++ b/layout/svg/crashtests/919371-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <svg xmlns="http://www.w3.org/2000/svg">
+    <marker style="position: absolute;" />
+  </svg>
+</html>
diff --git a/layout/svg/crashtests/950324-1.svg b/layout/svg/crashtests/950324-1.svg
new file mode 100644
index 0000000000..a43d84f4d8
--- /dev/null
+++ b/layout/svg/crashtests/950324-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+    <text style="font-family: sans-serif;"> &#x0301;</text>
+</svg>
diff --git a/layout/svg/crashtests/951904-1.html b/layout/svg/crashtests/951904-1.html
new file mode 100644
index 0000000000..7a1d1d4dd4
--- /dev/null
+++ b/layout/svg/crashtests/951904-1.html
@@ -0,0 +1,43 @@
+<body onload="go()">
+<svg>
+  <switch>
+    <text id="a">Bonjour</text>
+    <text id="b">Hello</text>
+    <a><text id="c">Hello</text></a>
+    <g>
+      <mask>
+        <text>Lundi</text>
+      </mask>
+    </g>
+    <switch>
+      <text id="d">Au revoir</text>
+      <g>
+        <mask>
+          <text>Mercredi</text>
+        </mask>
+      </g>
+      <text id="e">Goodbye</text>
+      <a><text id="f">Goodbye</text></a>
+    </switch>
+  </switch>
+</svg>
+<svg>
+  <switch>
+    <mask>
+      <text id="g">Vendredi</text>
+    </mask>
+    <a></a>
+  </switch>
+</svg>
+</body>
+<script>
+function go() {
+  a.getComputedTextLength();
+  b.getComputedTextLength();
+  c.getComputedTextLength();
+  d.getComputedTextLength();
+  e.getComputedTextLength();
+  f.getComputedTextLength();
+  g.getComputedTextLength();
+}
+</script>
diff --git a/layout/svg/crashtests/952270-1.svg b/layout/svg/crashtests/952270-1.svg
new file mode 100644
index 0000000000..69bac47d42
--- /dev/null
+++ b/layout/svg/crashtests/952270-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+    <path id="path" transform="scale(2,1)" />
+
+    <text>
+        <textPath xlink:href="#path">F</textPath>
+    </text>
+
+</svg>
diff --git a/layout/svg/crashtests/963086-1.svg b/layout/svg/crashtests/963086-1.svg
new file mode 100644
index 0000000000..3805b46d75
--- /dev/null
+++ b/layout/svg/crashtests/963086-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+   viewBox="0 0 64 64">
+  <defs>
+    <filter id="dropShadow">
+      <feGaussianBlur stdDeviation="2" />
+      <feOffset
+         result="offsetBlur"
+         dy="1073741824"/>
+      <feMerge>
+        <feMergeNode
+           in="offsetBlur" />
+        <feMergeNode
+           in="SourceGraphic" />
+      </feMerge>
+    </filter>
+  </defs>
+  <rect height="64" width="64" style="filter:url(#dropShadow)" />
+</svg>
diff --git a/layout/svg/crashtests/974746-1.svg b/layout/svg/crashtests/974746-1.svg
new file mode 100644
index 0000000000..c619c25f79
--- /dev/null
+++ b/layout/svg/crashtests/974746-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+    <pattern id="patternRotated" width="1" patternTransform="rotate(45 50 50)">
+        <rect/>
+    </pattern>
+
+    <rect width="100" height="100" fill="url(#patternRotated)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/975773-1.svg b/layout/svg/crashtests/975773-1.svg
new file mode 100644
index 0000000000..dd225eb2ae
--- /dev/null
+++ b/layout/svg/crashtests/975773-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+    <filter id="f">
+        <feSpecularLighting style="display: none;"/>
+        <feComposite in="SourceGraphic"/>
+    </filter>
+
+    <path d="M0,0 h100 v100 h-100 z M20,20 v60 h60 v-60 z" filter="url(#f)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/979407-1.svg b/layout/svg/crashtests/979407-1.svg
new file mode 100644
index 0000000000..b615f3bec2
--- /dev/null
+++ b/layout/svg/crashtests/979407-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <marker id="marker" viewBox="0 0 10 10" markerHeight="-1px"/>
+  <path d="M0,0 h10" marker-start="url(#marker)"/>
+</svg>
diff --git a/layout/svg/crashtests/979407-2.svg b/layout/svg/crashtests/979407-2.svg
new file mode 100644
index 0000000000..75aee06345
--- /dev/null
+++ b/layout/svg/crashtests/979407-2.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <marker id="marker" viewBox="0 0 10 10" markerWidth="-1px"/>
+  <path d="M0,0 h10" marker-start="url(#marker)"/>
+</svg>
diff --git a/layout/svg/crashtests/993443.svg b/layout/svg/crashtests/993443.svg
new file mode 100644
index 0000000000..30bd18543c
--- /dev/null
+++ b/layout/svg/crashtests/993443.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+<image width="10" height="10" x="17592186044416pt"/>
+</svg>
\ No newline at end of file
diff --git a/layout/svg/crashtests/blob-merging-and-retained-display-list.html b/layout/svg/crashtests/blob-merging-and-retained-display-list.html
new file mode 100644
index 0000000000..56ca743dc9
--- /dev/null
+++ b/layout/svg/crashtests/blob-merging-and-retained-display-list.html
@@ -0,0 +1,62 @@
+<!doctype html>
+<html class="reftest-wait">
+<script>
+        var r = 40;
+        var xmlns = "http://www.w3.org/2000/svg";
+        const raf = f => requestAnimationFrame(f);
+        function rect(x, y) {
+            var r = document.createElementNS (xmlns, "rect");
+            r.setAttribute("x", x);
+            r.setAttribute("y", y);
+            r.setAttribute("width", "100");
+            r.setAttribute("height", "100");
+            r.setAttribute("fill", "blue");
+            return r;
+        }
+        function f1() {
+            svg = document.getElementById("cnvs");
+            svg.appendChild(rect(0, 0));
+            svg.appendChild(rect(600, 0));
+            svg.appendChild(rect(600, 400));
+            svg.appendChild(rect(0, 400));
+            let a = rect(110, 110);
+            let b = rect(120, 120);
+            let c = rect(130, 130);
+            let d = rect(140, 140);
+            let a2 = rect(310, 140);
+            let b2 = rect(320, 130);
+            let c2 = rect(330, 120);
+            let d2 = rect(340, 110);
+            raf(() => {
+                svg.appendChild(a);
+                svg.appendChild(b);
+                svg.appendChild(c);
+                svg.appendChild(d);
+                raf(() => {
+                    // the display list partial update will end up with these items before x,y,w,z
+                    svg.appendChild(d2);
+                    svg.appendChild(c2);
+                    svg.appendChild(b2);
+                    svg.appendChild(a2);
+                    raf(() => {
+                        // this forces all the items to be ordered and makes the new display list
+                        // contain reorded items outside of the invalid area
+                        let mix = rect(220, 220);
+                        svg.insertBefore(mix, d2);
+                        raf(() => { document.documentElement.className = "" });
+                    })
+                })
+            })
+        }
+
+        function f() {
+                requestAnimationFrame(f1);
+        }
+
+        onload = f;
+</script>
+
+<body>
+<svg width="700" height="600" id=cnvs>
+
+</svg>
diff --git a/layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml b/layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml
new file mode 100644
index 0000000000..b23f064a6c
--- /dev/null
+++ b/layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml
@@ -0,0 +1,28 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html xmlns="http://www.w3.org/1999/xhtml"
+      xmlns:svg="http://www.w3.org/2000/svg">
+<head>
+  <title>Test of NS_FRAME_IS_NONDISPLAY / NS_FRAME_IS_DIRTY assertion</title>
+  <!-- reduced from layout/reftests/svg/svg-integration/conditions-outer-svg-01.xhtml
+       and modified to occur without bug 1308876 patches. -->
+  <style>
+    div { position: relative; height: 100px; width: 100px }
+    svg { position: absolute; top: 0; left: 0; height: 100%; width: 100% }
+  </style>
+  <script>
+    function run() {
+      var d = document.getElementById("d");
+      d.offsetHeight;
+      d.style.height = "50px";
+    }
+  </script>
+</head>
+<body onload="run()">
+  <div id="d">
+    <svg:svg systemLanguage="x"></svg:svg>
+  </div>
+</body>
+</html>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
new file mode 100644
index 0000000000..9d38f43f7a
--- /dev/null
+++ b/layout/svg/crashtests/crashtests.list
@@ -0,0 +1,260 @@
+load 220165-1.svg
+load 267650-1.svg
+load 294022-1.svg
+load 307314-1.svg
+load 308615-1.svg
+load 308917-1.svg
+load 310436-1.svg
+load 310638.svg
+load 313737-1.xml
+load chrome://reftest/content/crashtests/layout/svg/crashtests/314244-1.xhtml
+load 322185-1.svg
+load 322215-1.svg
+load 323704-1.svg
+load 325427-1.svg
+load 326495-1.svg
+load 326974-1.svg
+load 327706-1.svg
+load 327711-1.svg
+load 328137-1.svg
+load 329848-1.svg
+load chrome://reftest/content/crashtests/layout/svg/crashtests/337408-1.xhtml
+load 338301-1.xhtml
+load 338312-1.xhtml
+load 340083-1.svg
+load 340945-1.svg
+load 342923-1.html
+load 343221-1.xhtml
+load 344749-1.svg
+load 344887-1.svg
+load 344892-1.svg
+load 344898-1.svg
+load 344904-1.svg
+load 345418-1.svg
+load 348982-1.xhtml
+load 354777-1.xhtml
+load 359516-1.svg
+load 361015-1.svg
+load 361587-1.svg
+load 363611-1.xhtml
+load 364688-1.svg
+load 366956-1.svg
+load 366956-2.svg
+load 367111-1.svg
+load 367368-1.xhtml
+load 369233-1.svg
+load 369438-1.svg
+load 369438-2.svg
+load 371463-1.xhtml
+load 371563-1.xhtml
+load 375775-1.svg
+load 378716.svg
+load 380691-1.svg
+load 384391-1.xhtml
+load 384499-1.svg
+load 384637-1.svg
+load 384728-1.svg
+load 385246-1.svg
+load 385246-2.svg
+load 385552-1.svg
+load 385552-2.svg
+load 385840-1.svg
+load 385852-1.svg
+load 386475-1.xhtml
+load 386690-1.svg
+load 387290-1.svg
+load 402408-1.svg
+load 404677-1.xhtml
+load 409565-1.xhtml
+load 420697-1.svg
+load 420697-2.svg
+load 429774-1.svg
+load 441368-1.svg
+load 453754-1.svg
+load 455314-1.xhtml
+load 458453.html
+load 459666-1.html
+load 459883.xhtml
+load 461289-1.svg
+load 464374-1.svg
+load 466585-1.svg
+load 467323-1.svg
+load 467498-1.svg
+load 470124-1.svg
+load 472782-1.svg
+load 474700-1.svg
+load 475181-1.svg
+load 475193-1.html
+load 475302-1.svg
+load 477935-1.html
+load 478128-1.svg
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) load 478511-1.svg
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) load 483439-1.svg
+load 492186-1.svg
+load 508247-1.svg
+load 512890-1.svg
+load 515288-1.html
+load 522394-1.svg
+load 522394-2.svg
+load 522394-3.svg
+load 566216-1.svg
+load 587336-1.html
+load 590291-1.svg
+load 601999-1.html
+load 605626-1.svg
+asserts(2) load 606914.xhtml # bug 606914, bug 718883
+load 610594-1.html
+load 610954-1.html
+load 612662-1.svg
+load 612662-2.svg
+load 612736-1.svg
+load 612736-2.svg
+load 614367-1.svg
+load 620034-1.html
+load 621598-1.svg
+load 648819-1.html
+load 655025-1.svg
+load 655025-2.svg
+load 655025-3.svg
+load 657077-1.svg
+load 669025-1.svg
+load 669025-2.svg
+load 682411-1.svg
+load 692203-1.svg
+load 692203-2.svg
+load 693424-1.svg
+load 709920-1.svg
+load 709920-2.svg
+load 713413-1.svg
+load 722003-1.svg
+load 725918-1.svg
+load 732836-1.svg
+load 740627-1.svg
+load 740627-2.svg
+load 743469.svg
+load 757704-1.svg
+load 757718-1.svg
+load 757751-1.svg
+load 767056-1.svg
+load 767535-1.xhtml
+load 768087-1.html
+load 768351.svg
+load 772313-1.svg
+load 778492-1.svg
+load 779971-1.svg
+load 780764-1.svg
+load 780963-1.html
+load 782141-1.svg
+load 784061-1.svg
+load 788831-1.svg
+load 789390-1.html
+load 790072.svg
+load 791826-1.svg
+load 808318-1.svg
+load 803562-1.svg
+load 813420-1.svg
+load 841163-1.svg
+load 841812-1.svg
+load 842009-1.svg
+load 842630-1.svg
+load 842909-1.svg
+load 843072-1.svg
+load 843917-1.svg
+load 847139-1.svg
+load 849688-1.svg
+load 849688-2.svg
+load 860378-1.svg
+load 868904-1.svg
+load 873806-1.svg
+load 876831-1.svg
+load 877029-1.svg
+load 880925-1.svg
+load 881031-1.svg
+load 885608-1.svg
+load 890782-1.svg
+load 890783-1.svg
+load 893510-1.svg
+load 895311-1.svg
+load 897342-1.svg
+load 898909-1.svg
+load 898951-1.svg
+load 913990.html
+load 919371-1.xhtml
+load 950324-1.svg
+load 951904-1.html
+load 952270-1.svg
+load 963086-1.svg
+load 974746-1.svg
+load 975773-1.svg
+load 979407-1.svg
+load 979407-2.svg
+load 993443.svg
+load 1016145.svg
+load 1028512.svg
+load 1140080-1.svg
+load 1149542-1.svg
+load 1156581-1.svg
+load 1182496-1.html
+load 1209525-1.svg
+load 1223281-1.svg
+load 1234726-1.svg
+load 1322537-1.html
+load 1322537-2.html
+load 1322852.html
+load 1348564.svg
+load 1402109.html
+load 1402124.html
+load 1402486.html
+load 1403656-1.html
+load 1403656-2.html
+load 1403656-3.html
+load 1403656-4.html
+load 1403656-5.html
+load 1404086.html
+load 1421807-1.html
+load 1421807-2.html
+load 1422226.html
+load 1425434-1.html
+load 1443092.html
+load 1454201-1.html
+load 1467552-1.html
+load 1474982.html
+load conditional-outer-svg-nondirty-reflow-assert.xhtml
+load extref-test-1.xhtml
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) pref(widget.windows.window_occlusion_tracking.enabled,false) load blob-merging-and-retained-display-list.html # Bug 1819154
+load empty-blob-merging.html
+load grouping-empty-bounds.html
+load 1480275.html
+load 1480224.html
+load 1502936.html
+load 1504918.svg
+load perspective-invalidation.html
+load invalid_url.html
+load 1535517-1.svg
+load 1504072.html
+load 1072758.html
+load 1424031.html
+load 1426575.html
+load 1536892.html
+load 1539318-1.svg
+load 1548985-1.html
+load 1548985-2.svg
+load 1555851.html
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) pref(widget.windows.window_occlusion_tracking.enabled,false) load invalidation-of-opacity-0.html # Bug 1819154
+load 1563779.html
+load 1600855.html
+load 1601824.html
+load 1605223-1.html
+load 1609663.html
+skip-if(Android|/^Windows\x20NT\x206\.1/.test(http.oscpu)) load 1671950.html # No print-preview support on android
+load 1678947.html
+load 1693032.html
+load 1696505.html
+load 1758029-1.html
+HTTP load 1755770-1.html
+HTTP load 1755770-2.html
+load 1764936-1.html
+load 1804958.html
+load 1810260.html
+load 1826444-1.html
+load 1831419.html
diff --git a/layout/svg/crashtests/empty-blob-merging.html b/layout/svg/crashtests/empty-blob-merging.html
new file mode 100644
index 0000000000..4b603c19d9
--- /dev/null
+++ b/layout/svg/crashtests/empty-blob-merging.html
@@ -0,0 +1,48 @@
+<html class="reftest-wait">
+<style>
+@keyframes spinnow {
+    100% {
+        transform: rotate(360deg) scale(.2, .2);
+    }
+}
+
+rect {
+    transform: rotate(0deg) scale(0.6, 1);
+    transform-origin: center;
+    animation: 5s spinnow infinite linear;
+}
+
+</style>
+<svg width=400 height=400>
+        <!--
+          onwheel is needed so that we get a hit test info display item
+          before the transform on the rect
+        -->
+	<g onwheel="alert(1)">
+	<g id="gr">
+	<circle r=30 fill=yellow cx=300 cy=100 />
+	<circle r=30 fill=yellow cx=10 cy=100 />
+	<circle r=30 fill=yellow cx=300 cy=300 />
+	<circle r=30 fill=yellow cx=10 cy=300 />
+	</g>
+	<rect width=100 height=100 fill=blue x=100 y=100 />
+	<g opacity=0.5>
+	<circle r=30 fill=pink cx=300 cy=100 />
+	<circle r=30 fill=pink cx=10 cy=100 />
+	<circle r=30 fill=pink cx=300 cy=300 />
+	<circle r=30 fill=pink cx=10 cy=300 />
+	</g>
+	</g>
+</svg>
+<script>
+  function blam() {
+    let gr = document.getElementById("gr");
+    gr.remove();
+    document.documentElement.removeAttribute("class");
+  }
+document.addEventListener("MozReftestInvalidate", function() {
+  requestAnimationFrame(function() {
+    blam();
+  });
+});
+</script>
diff --git a/layout/svg/crashtests/extref-test-1-resource.xhtml b/layout/svg/crashtests/extref-test-1-resource.xhtml
new file mode 100644
index 0000000000..cd47ddc2f5
--- /dev/null
+++ b/layout/svg/crashtests/extref-test-1-resource.xhtml
@@ -0,0 +1,24 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<html xmlns="http://www.w3.org/1999/xhtml"
+     xmlns:svg="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+<body style="margin:0">
+  <embed type="application/x-shockwave-flash" src="data:application/x-shockwave-flash,This is a test"></embed>
+  <iframe src="date:text/plain,aaa"></iframe>
+  <div style="mask: url(#m1); width:500px; height:500px; background:lime;"></div>
+
+  <svg:svg height="0">
+    <svg:mask id="m1" maskUnits="objectBoundingBox" maskContentUnits="objectBoundingBox">
+      <svg:linearGradient id="g" gradientUnits="objectBoundingBox" x2="0" y2="1">
+        <svg:stop stop-color="white" offset="0"/>
+        <svg:stop stop-color="white" stop-opacity="0" offset="1"/>
+      </svg:linearGradient>
+      <svg:circle cx="0.25" cy="0.25" r="0.25" id="circle" fill="white"/>
+      <svg:rect x="0.5" y="0" width="0.5" height="1" fill="url(#g)"/>
+    </svg:mask>
+  </svg:svg>
+</body>
+</html>
diff --git a/layout/svg/crashtests/extref-test-1.xhtml b/layout/svg/crashtests/extref-test-1.xhtml
new file mode 100644
index 0000000000..932b679b1f
--- /dev/null
+++ b/layout/svg/crashtests/extref-test-1.xhtml
@@ -0,0 +1,11 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/licenses/publicdomain/
+-->
+<html xmlns="http://www.w3.org/1999/xhtml"
+     xmlns:svg="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink">
+<body style="margin:0">
+  <div style="mask: url(extref-test-1-resource.xhtml#m1); width:500px; height:500px; background:lime;"></div>
+</body>
+</html>
diff --git a/layout/svg/crashtests/grouping-empty-bounds.html b/layout/svg/crashtests/grouping-empty-bounds.html
new file mode 100644
index 0000000000..c9f688d0f0
--- /dev/null
+++ b/layout/svg/crashtests/grouping-empty-bounds.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html lang="en" class='reftest-wait'>
+<meta charset="utf-8">
+<title>This testcase might create a non-empty display list with an empty set of drawing commands / items in the EventRecorder</title>
+
+<style>
+
+body {
+  margin: 0;
+}
+
+.animated-opacity {
+  animation: opacity-animation 1s linear alternate infinite;
+}
+
+@keyframes opacity-animation {
+  from {
+    opacity: 0;
+  }
+  to {
+    opacity: 1;
+  }
+}
+
+</style>
+
+<svg style="width: 100px; height: 100px;">
+  <rect class="animated-opacity" x="0" y="0" width="100" height="100"/>
+  <rect x="0" y="0" width="10" height="10" id="toremove"/>
+  <g transform="translate(10 10)"><rect x="120" y="0" width="1" height="1"/></g>
+</svg>
+
+<script>
+
+window.addEventListener("MozReftestInvalidate", () => {
+  var elem = document.getElementById("toremove");
+  elem.parentNode.removeChild(elem);
+  document.documentElement.removeAttribute('class');
+});
+
+</script>
diff --git a/layout/svg/crashtests/invalid_url.html b/layout/svg/crashtests/invalid_url.html
new file mode 100644
index 0000000000..ac8671b1ce
--- /dev/null
+++ b/layout/svg/crashtests/invalid_url.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body>
+  <!--
+     If invalid url isn't correctly handled, this test will crash when
+     gfx.webrender.enabled=true and gfx.webrender.all=true
+  -->
+	<div style="padding: 1px; filter:url('data://not-valid-data');"></div>
+</body>
+</html>
diff --git a/layout/svg/crashtests/invalidation-of-opacity-0.html b/layout/svg/crashtests/invalidation-of-opacity-0.html
new file mode 100644
index 0000000000..50700e3908
--- /dev/null
+++ b/layout/svg/crashtests/invalidation-of-opacity-0.html
@@ -0,0 +1,26 @@
+<html class="reftest-wait">
+  <script>
+  var i = 0;
+  var opac = [0.3, 0.2, 0, 0.3];
+
+  function f() {
+    document.getElementById("rim").setAttribute("opacity", opac[i]);
+    document.getElementById("circ").setAttribute("r", i + 10);
+    i++;
+    if (i > opac.length) {
+      document.documentElement.className = ""
+    } else {
+      requestAnimationFrame(f);
+    }
+  }
+  onload = () => requestAnimationFrame(f);
+</script>
+
+<body>
+  <svg height="1000" width="1000">
+    <circle cx="50" cy="50" r="40" fill="red" />
+    <g id=rim clip-path="url(#myClip)" opacity=0>
+      <circle id="circ" cx="150" cy="150" r="40" fill="red" />
+    </g>
+    <circle cx="250" cy="250" r="40" fill="red" />
+  </svg>
diff --git a/layout/svg/crashtests/masked-3d-transform.html b/layout/svg/crashtests/masked-3d-transform.html
new file mode 100644
index 0000000000..6c70aae7fe
--- /dev/null
+++ b/layout/svg/crashtests/masked-3d-transform.html
@@ -0,0 +1,20 @@
+<style>
+  svg,
+svg * {
+  perspective: 1000px;
+}
+</style>
+<svg style="max-width: 176px;" viewBox="0 0 279 169">
+            <g transform="translate(-2.000000, -2.000000)">
+                    <g mask="url(#mask-2)">
+                        <g transform="translate(19.000000, 22.000000)">
+                                <g fill="#FFFFFF">
+                                    <path d="M43,2.3 C41,2.3 39.9,3.3 39.9,5.6 L39.9,12.4 C39.9,14.7 41,15.7 43.1,15.7 C45.7,15.7 45.9,14.1 46.1,13 C46.1,12.7 46.4,12.4 46.8,12.4 C47.3,12.4 47.5,12.6 47.5,13.3 C47.5,15.3 45.8,17 42.9,17 C40.4,17 38.4,15.7 38.4,12.3 L38.4,5.5 C38.4,2.1 40.5,0.9 43,0.9 C45.9,0.9 47.5,2.6 47.5,4.5 C47.5,5.2 47.3,5.4 46.8,5.4 C46.3,5.4 46.1,5.2 46.1,4.9 C46.1,4 45.6,2.3 43,2.3 L43,2.3 Z"></path>
+                                </g>
+                            </g>
+                            <ellipse fill="#000000" cx="157.9" cy="162.1" rx="157.9" ry="4.3"></ellipse>
+                    </g>
+            </g>
+</svg>
+
+
diff --git a/layout/svg/crashtests/perspective-invalidation.html b/layout/svg/crashtests/perspective-invalidation.html
new file mode 100644
index 0000000000..179836d500
--- /dev/null
+++ b/layout/svg/crashtests/perspective-invalidation.html
@@ -0,0 +1,9 @@
+<span>
+<svg id="a" transform="skewX(0)" opacity="0">
+<text>
+</span>
+<marquee>
+A
+</marquee>
+<svg xml:space="preserve">
+<use style="outline: auto; -webkit-perspective: 1px" xlink:href="#a" mask="url(#x)">
-- 
cgit v1.2.3