summaryrefslogtreecommitdiffstats
path: root/layout/svg/crashtests
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 09:22:09 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 09:22:09 +0000
commit43a97878ce14b72f0981164f87f2e35e14151312 (patch)
tree620249daf56c0258faa40cbdcf9cfba06de2a846 /layout/svg/crashtests
parentInitial commit. (diff)
downloadfirefox-upstream.tar.xz
firefox-upstream.zip
Adding upstream version 110.0.1.upstream/110.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r--layout/svg/crashtests/1016145.svg5
-rw-r--r--layout/svg/crashtests/1028512.svg15
-rw-r--r--layout/svg/crashtests/1072758.html35
-rw-r--r--layout/svg/crashtests/1140080-1.svg11
-rw-r--r--layout/svg/crashtests/1149542-1.svg9
-rw-r--r--layout/svg/crashtests/1156581-1.svg12
-rw-r--r--layout/svg/crashtests/1182496-1.html21
-rw-r--r--layout/svg/crashtests/1209525-1.svg7
-rw-r--r--layout/svg/crashtests/1223281-1.svg24
-rw-r--r--layout/svg/crashtests/1234726-1.svg13
-rw-r--r--layout/svg/crashtests/1322537-1.html2
-rw-r--r--layout/svg/crashtests/1322537-2.html15
-rw-r--r--layout/svg/crashtests/1322852.html2
-rw-r--r--layout/svg/crashtests/1348564.svg7
-rw-r--r--layout/svg/crashtests/1402109.html11
-rw-r--r--layout/svg/crashtests/1402124.html10
-rw-r--r--layout/svg/crashtests/1402486.html12
-rw-r--r--layout/svg/crashtests/1403656-1.html19
-rw-r--r--layout/svg/crashtests/1403656-2.html21
-rw-r--r--layout/svg/crashtests/1403656-3.html8
-rw-r--r--layout/svg/crashtests/1403656-4.html9
-rw-r--r--layout/svg/crashtests/1403656-5.html11
-rw-r--r--layout/svg/crashtests/1404086.html2
-rw-r--r--layout/svg/crashtests/1421807-1.html5
-rw-r--r--layout/svg/crashtests/1421807-2.html15
-rw-r--r--layout/svg/crashtests/1422226.html39
-rw-r--r--layout/svg/crashtests/1425434-1.html59
-rw-r--r--layout/svg/crashtests/1443092-helper.svg6
-rw-r--r--layout/svg/crashtests/1443092.html34
-rw-r--r--layout/svg/crashtests/1454201-1.html52
-rw-r--r--layout/svg/crashtests/1467552-1.html15
-rw-r--r--layout/svg/crashtests/1474982.html2
-rw-r--r--layout/svg/crashtests/1480224.html6
-rw-r--r--layout/svg/crashtests/1480275.html15
-rw-r--r--layout/svg/crashtests/1502936.html11
-rw-r--r--layout/svg/crashtests/1504072.html4
-rw-r--r--layout/svg/crashtests/1504918.svg4
-rw-r--r--layout/svg/crashtests/1535517-1.svg11
-rw-r--r--layout/svg/crashtests/1536892.html13
-rw-r--r--layout/svg/crashtests/1539318-1.svg10
-rw-r--r--layout/svg/crashtests/1548985-1.html16
-rw-r--r--layout/svg/crashtests/1548985-2.svg4
-rw-r--r--layout/svg/crashtests/1555851.html8
-rw-r--r--layout/svg/crashtests/1563779.html19
-rw-r--r--layout/svg/crashtests/1600855.html8
-rw-r--r--layout/svg/crashtests/1601824.html7
-rw-r--r--layout/svg/crashtests/1605223-1.html4
-rw-r--r--layout/svg/crashtests/1609663.html34
-rw-r--r--layout/svg/crashtests/1671950.html27
-rw-r--r--layout/svg/crashtests/1678947.html21
-rw-r--r--layout/svg/crashtests/1693032.html21
-rw-r--r--layout/svg/crashtests/1696505.html9
-rw-r--r--layout/svg/crashtests/1755770-1.html18
-rw-r--r--layout/svg/crashtests/1755770-2.html19
-rw-r--r--layout/svg/crashtests/1758029-1.html40
-rw-r--r--layout/svg/crashtests/1764936-1.html16
-rw-r--r--layout/svg/crashtests/1804958.html4
-rw-r--r--layout/svg/crashtests/1810260.html28
-rw-r--r--layout/svg/crashtests/220165-1.svg21
-rw-r--r--layout/svg/crashtests/267650-1.svg4
-rw-r--r--layout/svg/crashtests/294022-1.svg17
-rw-r--r--layout/svg/crashtests/307314-1.svg9
-rw-r--r--layout/svg/crashtests/308615-1.svg10
-rw-r--r--layout/svg/crashtests/308917-1.svg35
-rw-r--r--layout/svg/crashtests/310436-1.svg28
-rw-r--r--layout/svg/crashtests/310638.svg35
-rw-r--r--layout/svg/crashtests/313737-1.xml16
-rw-r--r--layout/svg/crashtests/314244-1.xhtml26
-rw-r--r--layout/svg/crashtests/322185-1.svg6
-rw-r--r--layout/svg/crashtests/322215-1.svg31
-rw-r--r--layout/svg/crashtests/323704-1.svg12
-rw-r--r--layout/svg/crashtests/325427-1.svg20
-rw-r--r--layout/svg/crashtests/326495-1.svg16
-rw-r--r--layout/svg/crashtests/326974-1.svg21
-rw-r--r--layout/svg/crashtests/327706-1.svg9
-rw-r--r--layout/svg/crashtests/327711-1.svg19
-rw-r--r--layout/svg/crashtests/328137-1.svg24
-rw-r--r--layout/svg/crashtests/329848-1.svg1
-rw-r--r--layout/svg/crashtests/337408-1.xhtml21
-rw-r--r--layout/svg/crashtests/338301-1.xhtml13
-rw-r--r--layout/svg/crashtests/338312-1.xhtml28
-rw-r--r--layout/svg/crashtests/340083-1.svg9
-rw-r--r--layout/svg/crashtests/340945-1.svg2
-rw-r--r--layout/svg/crashtests/342923-1.html23
-rw-r--r--layout/svg/crashtests/343221-1.xhtml20
-rw-r--r--layout/svg/crashtests/344749-1.svg11
-rw-r--r--layout/svg/crashtests/344887-1.svg18
-rw-r--r--layout/svg/crashtests/344892-1.svg5
-rw-r--r--layout/svg/crashtests/344898-1.svg19
-rw-r--r--layout/svg/crashtests/344904-1.svg19
-rw-r--r--layout/svg/crashtests/345418-1.svg4
-rw-r--r--layout/svg/crashtests/348982-1.xhtml20
-rw-r--r--layout/svg/crashtests/354777-1.xhtml28
-rw-r--r--layout/svg/crashtests/359516-1.svg36
-rw-r--r--layout/svg/crashtests/361015-1.svg33
-rw-r--r--layout/svg/crashtests/361587-1.svg31
-rw-r--r--layout/svg/crashtests/363611-1.xhtml21
-rw-r--r--layout/svg/crashtests/364688-1.svg34
-rw-r--r--layout/svg/crashtests/366956-1.svg61
-rw-r--r--layout/svg/crashtests/366956-2.svg61
-rw-r--r--layout/svg/crashtests/367111-1.svg29
-rw-r--r--layout/svg/crashtests/367368-1.xhtml12
-rw-r--r--layout/svg/crashtests/369233-1.svg33
-rw-r--r--layout/svg/crashtests/369438-1.svg24
-rw-r--r--layout/svg/crashtests/369438-2.svg27
-rw-r--r--layout/svg/crashtests/371463-1.xhtml8
-rw-r--r--layout/svg/crashtests/371563-1.xhtml32
-rw-r--r--layout/svg/crashtests/375775-1.svg23
-rw-r--r--layout/svg/crashtests/378716.svg4
-rw-r--r--layout/svg/crashtests/380691-1.svg4
-rw-r--r--layout/svg/crashtests/384391-1.xhtml20
-rw-r--r--layout/svg/crashtests/384499-1.svg20
-rw-r--r--layout/svg/crashtests/384637-1.svg9
-rw-r--r--layout/svg/crashtests/384728-1.svg21
-rw-r--r--layout/svg/crashtests/385246-1.svg9
-rw-r--r--layout/svg/crashtests/385246-2.svg15
-rw-r--r--layout/svg/crashtests/385552-1.svg4
-rw-r--r--layout/svg/crashtests/385552-2.svg4
-rw-r--r--layout/svg/crashtests/385840-1.svg20
-rw-r--r--layout/svg/crashtests/385852-1.svg34
-rw-r--r--layout/svg/crashtests/386475-1.xhtml24
-rw-r--r--layout/svg/crashtests/386690-1.svg3
-rw-r--r--layout/svg/crashtests/387290-1.svg26
-rw-r--r--layout/svg/crashtests/402408-1.svg32
-rw-r--r--layout/svg/crashtests/404677-1.xhtml9
-rw-r--r--layout/svg/crashtests/409565-1.xhtml3
-rw-r--r--layout/svg/crashtests/420697-1.svg7
-rw-r--r--layout/svg/crashtests/420697-2.svg6
-rw-r--r--layout/svg/crashtests/429774-1.svg29
-rw-r--r--layout/svg/crashtests/441368-1.svg31
-rw-r--r--layout/svg/crashtests/453754-1.svg7
-rw-r--r--layout/svg/crashtests/455314-1.xhtml16
-rw-r--r--layout/svg/crashtests/458453.html24
-rw-r--r--layout/svg/crashtests/459666-1.html7
-rw-r--r--layout/svg/crashtests/459883.xhtml13
-rw-r--r--layout/svg/crashtests/461289-1.svg18
-rw-r--r--layout/svg/crashtests/464374-1.svg15
-rw-r--r--layout/svg/crashtests/466585-1.svg17
-rw-r--r--layout/svg/crashtests/467323-1.svg10
-rw-r--r--layout/svg/crashtests/467498-1.svg12
-rw-r--r--layout/svg/crashtests/470124-1.svg7
-rw-r--r--layout/svg/crashtests/472782-1.svg3
-rw-r--r--layout/svg/crashtests/474700-1.svg1
-rw-r--r--layout/svg/crashtests/475181-1.svg1
-rw-r--r--layout/svg/crashtests/475193-1.html21
-rw-r--r--layout/svg/crashtests/475302-1.svg11
-rw-r--r--layout/svg/crashtests/477935-1.html11
-rw-r--r--layout/svg/crashtests/478128-1.svg15
-rw-r--r--layout/svg/crashtests/478511-1.svg9
-rw-r--r--layout/svg/crashtests/483439-1.svg17
-rw-r--r--layout/svg/crashtests/492186-1.svg6
-rw-r--r--layout/svg/crashtests/508247-1.svg10
-rw-r--r--layout/svg/crashtests/512890-1.svg4
-rw-r--r--layout/svg/crashtests/515288-1.html5
-rw-r--r--layout/svg/crashtests/522394-1.svg12
-rw-r--r--layout/svg/crashtests/522394-2.svg12
-rw-r--r--layout/svg/crashtests/522394-3.svg12
-rw-r--r--layout/svg/crashtests/566216-1.svg19
-rw-r--r--layout/svg/crashtests/587336-1.html9
-rw-r--r--layout/svg/crashtests/590291-1.svg9
-rw-r--r--layout/svg/crashtests/601999-1.html5
-rw-r--r--layout/svg/crashtests/605626-1.svg3
-rw-r--r--layout/svg/crashtests/606914.xhtml1
-rw-r--r--layout/svg/crashtests/610594-1.html6
-rw-r--r--layout/svg/crashtests/610954-1.html1
-rw-r--r--layout/svg/crashtests/612662-1.svg1
-rw-r--r--layout/svg/crashtests/612662-2.svg3
-rw-r--r--layout/svg/crashtests/612736-1.svg19
-rw-r--r--layout/svg/crashtests/612736-2.svg8
-rw-r--r--layout/svg/crashtests/614367-1.svg8
-rw-r--r--layout/svg/crashtests/620034-1.html15
-rw-r--r--layout/svg/crashtests/621598-1.svg16
-rw-r--r--layout/svg/crashtests/648819-1.html6
-rw-r--r--layout/svg/crashtests/655025-1.svg6
-rw-r--r--layout/svg/crashtests/655025-2.svg6
-rw-r--r--layout/svg/crashtests/655025-3.svg9
-rw-r--r--layout/svg/crashtests/657077-1.svg19
-rw-r--r--layout/svg/crashtests/669025-1.svg8
-rw-r--r--layout/svg/crashtests/669025-2.svg8
-rw-r--r--layout/svg/crashtests/682411-1.svg5
-rw-r--r--layout/svg/crashtests/692203-1.svg4
-rw-r--r--layout/svg/crashtests/692203-2.svg4
-rw-r--r--layout/svg/crashtests/693424-1.svg6
-rw-r--r--layout/svg/crashtests/709920-1.svg23
-rw-r--r--layout/svg/crashtests/709920-2.svg23
-rw-r--r--layout/svg/crashtests/713413-1.svg12
-rw-r--r--layout/svg/crashtests/722003-1.svg13
-rw-r--r--layout/svg/crashtests/725918-1.svg4
-rw-r--r--layout/svg/crashtests/732836-1.svg17
-rw-r--r--layout/svg/crashtests/740627-1.svg6
-rw-r--r--layout/svg/crashtests/740627-2.svg6
-rw-r--r--layout/svg/crashtests/743469.svg5
-rw-r--r--layout/svg/crashtests/757704-1.svg17
-rw-r--r--layout/svg/crashtests/757718-1.svg18
-rw-r--r--layout/svg/crashtests/757751-1.svg8
-rw-r--r--layout/svg/crashtests/767056-1.svg21
-rw-r--r--layout/svg/crashtests/767535-1.xhtml22
-rw-r--r--layout/svg/crashtests/768087-1.html4
-rw-r--r--layout/svg/crashtests/768351.svg2
-rw-r--r--layout/svg/crashtests/772313-1.svg1
-rw-r--r--layout/svg/crashtests/778492-1.svg4
-rw-r--r--layout/svg/crashtests/779971-1.svg14
-rw-r--r--layout/svg/crashtests/780764-1.svg18
-rw-r--r--layout/svg/crashtests/780963-1.html27
-rw-r--r--layout/svg/crashtests/782141-1.svg16
-rw-r--r--layout/svg/crashtests/784061-1.svg16
-rw-r--r--layout/svg/crashtests/788831-1.svg5
-rw-r--r--layout/svg/crashtests/789390-1.html1
-rw-r--r--layout/svg/crashtests/790072.svg1
-rw-r--r--layout/svg/crashtests/791826-1.svg14
-rw-r--r--layout/svg/crashtests/803562-1.svg18
-rw-r--r--layout/svg/crashtests/808318-1.svg2
-rw-r--r--layout/svg/crashtests/813420-1.svg14
-rw-r--r--layout/svg/crashtests/841163-1.svg29
-rw-r--r--layout/svg/crashtests/841812-1.svg11
-rw-r--r--layout/svg/crashtests/842009-1.svg5
-rw-r--r--layout/svg/crashtests/842630-1.svg1
-rw-r--r--layout/svg/crashtests/842909-1.svg11
-rw-r--r--layout/svg/crashtests/843072-1.svg11
-rw-r--r--layout/svg/crashtests/843917-1.svg19
-rw-r--r--layout/svg/crashtests/847139-1.svg13
-rw-r--r--layout/svg/crashtests/849688-1.svg11
-rw-r--r--layout/svg/crashtests/849688-2.svg11
-rw-r--r--layout/svg/crashtests/860378-1.svg24
-rw-r--r--layout/svg/crashtests/868904-1.svg17
-rw-r--r--layout/svg/crashtests/873806-1.svg10
-rw-r--r--layout/svg/crashtests/876831-1.svg18
-rw-r--r--layout/svg/crashtests/877029-1.svg10
-rw-r--r--layout/svg/crashtests/880925-1.svg26
-rw-r--r--layout/svg/crashtests/881031-1.svg15
-rw-r--r--layout/svg/crashtests/885608-1.svg13
-rw-r--r--layout/svg/crashtests/890782-1.svg16
-rw-r--r--layout/svg/crashtests/890783-1.svg19
-rw-r--r--layout/svg/crashtests/893510-1.svg5
-rw-r--r--layout/svg/crashtests/895311-1.svg17
-rw-r--r--layout/svg/crashtests/897342-1.svg1
-rw-r--r--layout/svg/crashtests/898909-1.svg11
-rw-r--r--layout/svg/crashtests/898951-1.svg3
-rw-r--r--layout/svg/crashtests/913990.html5
-rw-r--r--layout/svg/crashtests/919371-1.xhtml5
-rw-r--r--layout/svg/crashtests/950324-1.svg3
-rw-r--r--layout/svg/crashtests/951904-1.html43
-rw-r--r--layout/svg/crashtests/952270-1.svg9
-rw-r--r--layout/svg/crashtests/963086-1.svg18
-rw-r--r--layout/svg/crashtests/974746-1.svg9
-rw-r--r--layout/svg/crashtests/975773-1.svg10
-rw-r--r--layout/svg/crashtests/979407-1.svg4
-rw-r--r--layout/svg/crashtests/979407-2.svg4
-rw-r--r--layout/svg/crashtests/993443.svg4
-rw-r--r--layout/svg/crashtests/blob-merging-and-retained-display-list.html62
-rw-r--r--layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml28
-rw-r--r--layout/svg/crashtests/crashtests.list256
-rw-r--r--layout/svg/crashtests/empty-blob-merging.html48
-rw-r--r--layout/svg/crashtests/extref-test-1-resource.xhtml24
-rw-r--r--layout/svg/crashtests/extref-test-1.xhtml11
-rw-r--r--layout/svg/crashtests/grouping-empty-bounds.html41
-rw-r--r--layout/svg/crashtests/invalid_url.html11
-rw-r--r--layout/svg/crashtests/invalidation-of-opacity-0.html26
-rw-r--r--layout/svg/crashtests/masked-3d-transform.html20
-rw-r--r--layout/svg/crashtests/perspective-invalidation.html9
260 files changed, 4113 insertions, 0 deletions
diff --git a/layout/svg/crashtests/1016145.svg b/layout/svg/crashtests/1016145.svg
new file mode 100644
index 0000000000..5c362a17e1
--- /dev/null
+++ b/layout/svg/crashtests/1016145.svg
@@ -0,0 +1,5 @@
+<!-- svg mime type but html root -->
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body style="display: table-column-group;" />
+</html>
+
diff --git a/layout/svg/crashtests/1028512.svg b/layout/svg/crashtests/1028512.svg
new file mode 100644
index 0000000000..0c9458b478
--- /dev/null
+++ b/layout/svg/crashtests/1028512.svg
@@ -0,0 +1,15 @@
+<!-- {lower,upper}-{roman,alpha} in svg -->
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+
+function boom()
+{
+ document.documentElement.style.transition = "2s";
+ document.documentElement.style.listStyleType = "lower-roman";
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></svg>
diff --git a/layout/svg/crashtests/1072758.html b/layout/svg/crashtests/1072758.html
new file mode 100644
index 0000000000..1d4c85fb87
--- /dev/null
+++ b/layout/svg/crashtests/1072758.html
@@ -0,0 +1,35 @@
+<style>
+#x9 {
+ display:none;
+}
+</style>
+
+<body onload="go()">
+<svg>
+<path id="a"></path>
+
+<mask id="m">
+ <text id="y">
+ <tspan id="x1"></tspan>
+ <textPath id="x2"></textPath>
+ <a id="x3">Hello</a>
+ <tspan><tspan id="x4"></tspan></tspan>
+ <tspan id="x5"></tspan>
+ </text>
+</mask>
+
+<rect width="600" height="400" mask="url(#m)"/>
+</svg>
+</body>
+
+<script>
+
+function go() {
+ x1.style.display = "none";
+ x2.style.display = "none";
+ x3.style.display = "none";
+ x4.style.display = "none";
+ x5.id = "x9";
+};
+
+</script>
diff --git a/layout/svg/crashtests/1140080-1.svg b/layout/svg/crashtests/1140080-1.svg
new file mode 100644
index 0000000000..d424562468
--- /dev/null
+++ b/layout/svg/crashtests/1140080-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+
+window.addEventListener("load", function() {
+ var stop = document.getElementsByTagName("stop")[0];
+ stop.setAttribute("offset", "0");
+}, false);
+
+</script>
+<stop/>
+</svg>
diff --git a/layout/svg/crashtests/1149542-1.svg b/layout/svg/crashtests/1149542-1.svg
new file mode 100644
index 0000000000..7353f12775
--- /dev/null
+++ b/layout/svg/crashtests/1149542-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <style>
+ text { white-space: pre }
+ text::first-letter { color: red; }
+ tspan { display: none }
+ </style>
+ <text textLength="64">
+<tspan>a</tspan>b</text>
+</svg>
diff --git a/layout/svg/crashtests/1156581-1.svg b/layout/svg/crashtests/1156581-1.svg
new file mode 100644
index 0000000000..97e5fb1ca9
--- /dev/null
+++ b/layout/svg/crashtests/1156581-1.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="filter: url(#a); clip: rect(0px, 4rem, 2px, 2px);">
+ <script>
+ function boom()
+ {
+ document.getElementById("a").style.overflow = "hidden";
+ document.documentElement.style.fontSize = "10px";
+ }
+ window.addEventListener("load", boom, false);
+ </script>
+
+ <set id="a"/>
+</svg>
diff --git a/layout/svg/crashtests/1182496-1.html b/layout/svg/crashtests/1182496-1.html
new file mode 100644
index 0000000000..1d95905a2d
--- /dev/null
+++ b/layout/svg/crashtests/1182496-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ function tweak(){
+ document.body.innerHTML="fuzz"
+ }
+ </script>
+</head>
+<body onload="tweak()">
+ <svg xmlns="http://www.w3.org/2000/svg">
+ <text>
+ <foreignObject requiredFeatures="foo">
+ <svg style="position: absolute;"/>
+ </foreignObject>
+ </text>
+ </svg>
+</body>
+</html>
+
+
diff --git a/layout/svg/crashtests/1209525-1.svg b/layout/svg/crashtests/1209525-1.svg
new file mode 100644
index 0000000000..21134df33b
--- /dev/null
+++ b/layout/svg/crashtests/1209525-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ width="0" height="0">
+
+ <rect width="10" height="10" stroke="black"
+ vector-effect="non-scaling-stroke" />
+
+</svg>
diff --git a/layout/svg/crashtests/1223281-1.svg b/layout/svg/crashtests/1223281-1.svg
new file mode 100644
index 0000000000..b548a9a600
--- /dev/null
+++ b/layout/svg/crashtests/1223281-1.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+
+function forceFrameConstruction()
+{
+ document.documentElement.getBoundingClientRect();
+}
+
+function boom()
+{
+ document.documentElement.style.overflow = "scroll";
+ forceFrameConstruction()
+ document.documentElement.style.visibility = "visible";
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+<rect style="perspective: 10em;" />
+</svg>
+
diff --git a/layout/svg/crashtests/1234726-1.svg b/layout/svg/crashtests/1234726-1.svg
new file mode 100644
index 0000000000..ec807e2aba
--- /dev/null
+++ b/layout/svg/crashtests/1234726-1.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+
+window.addEventListener("load", function() {
+ document.documentElement.style.fontSize = "70%";
+ document.documentElement.setAttribute("transform", "scale(2)");
+ var filt = document.createElementNS("http://www.w3.org/2000/svg", "filter");
+ filt.style.borderWidth = "2rem";
+ document.documentElement.appendChild(filt);
+}, false);
+
+</script>
+</svg>
diff --git a/layout/svg/crashtests/1322537-1.html b/layout/svg/crashtests/1322537-1.html
new file mode 100644
index 0000000000..04207db4ad
--- /dev/null
+++ b/layout/svg/crashtests/1322537-1.html
@@ -0,0 +1,2 @@
+<svg>
+<animateMotion path='M8,0l69,97m45,-17592186044414A71,23 46,0,0 16382,98Q50,10 48,72T21,0Z'/> \ No newline at end of file
diff --git a/layout/svg/crashtests/1322537-2.html b/layout/svg/crashtests/1322537-2.html
new file mode 100644
index 0000000000..d0495d79af
--- /dev/null
+++ b/layout/svg/crashtests/1322537-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<head>
+ <script>
+ function go() {
+ var path = document.getElementById("myPath");
+ var len = path.getTotalLength();
+ console.log(len);
+ }
+ </script>
+</head>
+<body onload="go()">
+ <svg>
+ <path id="myPath" d="M45,-17592186044414A71,23 46,0,0 16382,98"/>
+ </svg>
+</body>
diff --git a/layout/svg/crashtests/1322852.html b/layout/svg/crashtests/1322852.html
new file mode 100644
index 0000000000..728ea5c7a9
--- /dev/null
+++ b/layout/svg/crashtests/1322852.html
@@ -0,0 +1,2 @@
+<svg>
+<ellipse stroke='-moz-mac-menushadow'/> \ No newline at end of file
diff --git a/layout/svg/crashtests/1348564.svg b/layout/svg/crashtests/1348564.svg
new file mode 100644
index 0000000000..0cb28948e6
--- /dev/null
+++ b/layout/svg/crashtests/1348564.svg
@@ -0,0 +1,7 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+<g style="outline-style:auto;">
+<radialGradient style="transform-box:fill-box;transform:rotatex(15deg);"></radialGradient>
+<rect x="200"></rect>
+</g>
+</svg>
diff --git a/layout/svg/crashtests/1402109.html b/layout/svg/crashtests/1402109.html
new file mode 100644
index 0000000000..81ef78a058
--- /dev/null
+++ b/layout/svg/crashtests/1402109.html
@@ -0,0 +1,11 @@
+<script>
+function jsfuzzer() {
+try { svgvar00012.getStartPositionOfChar(0); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<table>
+<caption>,HM&gt;v((Ndeoi=&amp;</caption>
+<caption>
+<svg>
+<text id="svgvar00012">
diff --git a/layout/svg/crashtests/1402124.html b/layout/svg/crashtests/1402124.html
new file mode 100644
index 0000000000..793b46b9a1
--- /dev/null
+++ b/layout/svg/crashtests/1402124.html
@@ -0,0 +1,10 @@
+<script>
+function jsfuzzer() {
+try { a.getExtentOfChar(0); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<svg>
+<switch>
+<path/>
+<text id="a">
diff --git a/layout/svg/crashtests/1402486.html b/layout/svg/crashtests/1402486.html
new file mode 100644
index 0000000000..af0c72e351
--- /dev/null
+++ b/layout/svg/crashtests/1402486.html
@@ -0,0 +1,12 @@
+<script>
+function jsfuzzer() {
+try { a.getEndPositionOfChar(0); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<svg>
+<switch>
+<text id="a">
+</text>
+<feTurbulence
+<!-- a --> \ No newline at end of file
diff --git a/layout/svg/crashtests/1403656-1.html b/layout/svg/crashtests/1403656-1.html
new file mode 100644
index 0000000000..996562d150
--- /dev/null
+++ b/layout/svg/crashtests/1403656-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html class="filtered">
+<style>
+ .filtered {
+ filter: url(#notsvg);
+ }
+ #notsvg {
+ float: left;
+ overflow: auto;
+ }
+</style>
+<script>
+function go() {
+ const div = document.createElement('div')
+ div.setAttribute('id', 'notsvg')
+ document.documentElement.appendChild(div)
+}
+</script>
+<body onload="go();" class="filtered">
diff --git a/layout/svg/crashtests/1403656-2.html b/layout/svg/crashtests/1403656-2.html
new file mode 100644
index 0000000000..e4287e933f
--- /dev/null
+++ b/layout/svg/crashtests/1403656-2.html
@@ -0,0 +1,21 @@
+<!-- MUST BE QUIRKS MODE -->
+<style>
+span { top: 0%; }
+</style>
+<script>
+function jsfuzzer() {
+ try { text.setAttribute("font-size", "10px"); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+ <div style="overflow: scroll">
+ <span></span>
+ </div>
+ <svg>
+ <tref id="marker">
+ <text id="text"/>
+ </tref>
+ <polyline marker-end="url(#marker)">
+ </polyline>
+ </svg>
+</body>
diff --git a/layout/svg/crashtests/1403656-3.html b/layout/svg/crashtests/1403656-3.html
new file mode 100644
index 0000000000..a5a7632665
--- /dev/null
+++ b/layout/svg/crashtests/1403656-3.html
@@ -0,0 +1,8 @@
+<style>
+* { columns: 0px }
+</style>
+A
+<svg id="a">
+<line marker-end="url(#a)">
+</svg>
+<keygen>
diff --git a/layout/svg/crashtests/1403656-4.html b/layout/svg/crashtests/1403656-4.html
new file mode 100644
index 0000000000..1da8979aa7
--- /dev/null
+++ b/layout/svg/crashtests/1403656-4.html
@@ -0,0 +1,9 @@
+<style>
+#a {}
+* {
+ text-align: end;
+ writing-mode: sideways-lr;
+ -webkit-filter: url(#a);
+}
+</style>
+<canvas>AAAAAAAAAAAAAAAA</canvas><ol id="a">@
diff --git a/layout/svg/crashtests/1403656-5.html b/layout/svg/crashtests/1403656-5.html
new file mode 100644
index 0000000000..3d64bc5b50
--- /dev/null
+++ b/layout/svg/crashtests/1403656-5.html
@@ -0,0 +1,11 @@
+<style>
+* {
+ -webkit-filter: url(#a);
+ padding-right: 1vmin;
+ overflow-y: scroll;
+}
+</style>
+<details id="a"></details>
+<image style="bottom: 1em;display:flex"></image>
+<canvas height="1">
+<font>
diff --git a/layout/svg/crashtests/1404086.html b/layout/svg/crashtests/1404086.html
new file mode 100644
index 0000000000..df2ad6a3b3
--- /dev/null
+++ b/layout/svg/crashtests/1404086.html
@@ -0,0 +1,2 @@
+<svg>
+<text textLength="0" lengthAdjust="spacingAndGlyphs">t
diff --git a/layout/svg/crashtests/1421807-1.html b/layout/svg/crashtests/1421807-1.html
new file mode 100644
index 0000000000..fe5a3e8d66
--- /dev/null
+++ b/layout/svg/crashtests/1421807-1.html
@@ -0,0 +1,5 @@
+<body onload=b.appendChild(a)>
+<div id="a" style="display: contents">
+</div>
+<svg>
+<text id="b">
diff --git a/layout/svg/crashtests/1421807-2.html b/layout/svg/crashtests/1421807-2.html
new file mode 100644
index 0000000000..30b100642c
--- /dev/null
+++ b/layout/svg/crashtests/1421807-2.html
@@ -0,0 +1,15 @@
+<style>
+.c1 { display: contents; }
+</style>
+<script>
+function go() {
+ a.attachShadow({mode: "open"}).innerHTML = `<slot> </slot> `;
+ b.appendChild(a);
+}
+</script>
+<body onload=go()>
+<div id="a" class="c1">
+ <span></span>
+</div>
+<svg>
+<text id="b">
diff --git a/layout/svg/crashtests/1422226.html b/layout/svg/crashtests/1422226.html
new file mode 100644
index 0000000000..5826e60b69
--- /dev/null
+++ b/layout/svg/crashtests/1422226.html
@@ -0,0 +1,39 @@
+<style id="htmlvar00001">
+* {
+ filter: saturate(1) hue-rotate(0deg);
+ marker-mid: url()
+}
+</style>
+<script>
+function jsfuzzer() {
+try { var var00078 = window.find("foo",true,true); } catch(e) { }
+try { htmlvar00004.setAttribute("onselect", "eventhandler2()"); } catch(e) { }
+try { htmlvar00004.selectionStart = 1; } catch(e) { }
+try { svgvar00030.addEventListener("DOMSubtreeModified", eventhandler5); } catch(e) { }
+}
+function eventhandler1() {
+try { var var00098 = document.createElement("select"); } catch(e) { }
+try { htmlvar00001.appendChild(var00098); } catch(e) { }
+}
+function eventhandler2() {
+try { htmlvar00015.href = "3" } catch(e) { }
+try { svgvar00008.before(svgvar00013); } catch(e) { }
+try { var var00014 = window.getSelection(); } catch(e) { }
+try { var00014.setBaseAndExtent(htmlvar00011,0,htmlvar00010,0); } catch(e) { }
+try { var00014.collapseToStart(); } catch(e) { }
+}
+function eventhandler5() {
+try { svgvar00001.addEventListener("DOMNodeRemoved", eventhandler1); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<input id="htmlvar00004">
+<svg id="svgvar00001">
+<marker>
+<meshgradient id="svgvar00008">
+<foreignObject id="svgvar00013">
+<discard id="svgvar00030"/>
+<a id="htmlvar00010" contenteditable="true"></a>
+<a id="htmlvar00011">
+<base id="htmlvar00015">
+
diff --git a/layout/svg/crashtests/1425434-1.html b/layout/svg/crashtests/1425434-1.html
new file mode 100644
index 0000000000..cec773ca25
--- /dev/null
+++ b/layout/svg/crashtests/1425434-1.html
@@ -0,0 +1,59 @@
+<html>
+<head>
+<style>
+
+#htmlvar00002,.class4,strong:last-of-type {
+ border-image-repeat: round stretch;
+ counter-increment:c
+}
+.class6,#htmlvar00001,#htmlvar00008 {
+ height:63%;
+ grid-column:span 0 middle / middle
+}
+#htmlvar00002 {
+ overflow-y:hidden;
+ grid-column-end:0 inherit
+}
+
+</style>
+<script>
+
+function eventhandler5() {
+
+ var var00066 = document.createElement("audio");
+ try { var00066.controls = true; } catch(e) { }
+
+ try { document.all['htmlvar00002'].appendChild(htmlvar00001); } catch(e) { }
+ try { document.all['htmlvar00002'].appendChild(var00066); } catch(e) { }
+}
+
+</script>
+</head>
+<body onload=eventhandler5()>
+
+ <shadow id="htmlvar00001" axis="PDcIvMde3=%- S^@dz" ondblclick="eventhandler1()" item="8z6h" checked="checked" type="text/x-javascript">
+ aaa
+ </shadow>
+
+ <ul id="htmlvar00002" type="video/mp4; codecs='avc1.4D400C'" type="turbulence" type="javascript_1.0"
+ role="complementary" dir="ltr" required="required" formnovalidate="formnovalidate" scheme="NIST" expanded="true" slot="slot2">
+ bbb
+ </ul>
+
+ <svg id="svgvar00001" marker-end="url(#svgvar00005)" transform="translate(0, 0) scale(0.113899652038) rotate(1) translate(0, 1)"
+ marker-mid="url(#svgvar00009)" xml:id="test-title" viewBox="0 1 78 1" click="none" glyph-orientation-vertical="-1" dominant-baseline="middle" ry="61%" k="1">
+
+ <path id="svgvar00009" d="M 0 0 L 1 0" stroke-dashoffset="inherit" onclick="eventhandler5()" stroke-linejoin="inherit"
+ fill-rule="evenodd" onmouseover="eventhandler3()" onfocusin="eventhandler4()" pointsAtY="1" target="_self" primitiveUnits="userSpaceOnUse" horiz-adv-x="0" />
+
+ <line id="svgvar00010" x1="0px" y1="55%" x2="76%" y2="62%" transform="translate(0 100) scale(0 -1)"
+ transform="translate(00.32347924876,0)" visibility="hidden" stroke-width="inherit" pointer-events="painted"
+ xlink:type="simple" onrepeat="eventhandler4()" clip-path="url(#svgvar00001)" vector-effect="non-scaling-stroke" azimuth="-1">
+ ccc
+ </line>
+
+ </svg>
+
+<!--endhtml-->
+</body>
+</html>
diff --git a/layout/svg/crashtests/1443092-helper.svg b/layout/svg/crashtests/1443092-helper.svg
new file mode 100644
index 0000000000..134cbefb58
--- /dev/null
+++ b/layout/svg/crashtests/1443092-helper.svg
@@ -0,0 +1,6 @@
+<svg class='class2' xmlns='http://www.w3.org/2000/svg'>
+<clipPath clipPathUnits='userSpaceOnUse' id='id9' lighting-color='pink' class='class0 class1' >
+</clipPath>
+<a id='id0' clip-path='url(#id9)' >
+</a>
+</svg>
diff --git a/layout/svg/crashtests/1443092.html b/layout/svg/crashtests/1443092.html
new file mode 100644
index 0000000000..7be4561e61
--- /dev/null
+++ b/layout/svg/crashtests/1443092.html
@@ -0,0 +1,34 @@
+<script>
+function start() {
+ o7=document.createElement('div');
+ o7.innerHTML='<style>@keyframes key7{ from{ transform: rotate(-536870911deg)}}\n*{ animation-name: key7; animation-duration: 0.001s';
+ o17=document.createElement('div');
+ o17.innerHTML='<svg><style>@font-face{}\n*{ outline-style: dotted</style><style>@font-face{ font-family: font3; src: url(';
+ o18=o17.firstChild.getElementsByTagName('*');
+ o20=o18[0];
+ o23=o18[1];
+ o114=document.createElement('iframe');
+ o114.src='1443092-helper.svg';
+ o114.addEventListener('load', fun0,false);
+ document.body.appendChild(o114);
+}
+function fun0() {
+ o117=o114.contentDocument;
+ document.replaceChild(o117.documentElement,document.documentElement);
+ o124=document.createElement('iframe');
+ document.documentElement.appendChild(o124);
+ o145=document.createElement('div');
+ o145.innerHTML='<svg><set attributeName="text-decoration">';
+ document.documentElement.appendChild(o20);
+ document.documentElement.appendChild(o23);
+ document.documentElement.appendChild(o7);
+ o124.src='x';
+ document.documentElement.appendChild(o145);
+ o264=document.createElement('style');
+ o265=document.createTextNode('*{ float: left');
+ o264.appendChild(o265);
+ o23.appendChild(o264);
+ setTimeout("location.reload()",40);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/svg/crashtests/1454201-1.html b/layout/svg/crashtests/1454201-1.html
new file mode 100644
index 0000000000..b92a7aa595
--- /dev/null
+++ b/layout/svg/crashtests/1454201-1.html
@@ -0,0 +1,52 @@
+<html>
+<head>
+<script>
+function loader() {
+var tbody = document.createElement("tbody");
+try { document.all[90%document.all.length].appendChild(tbody); } catch(e) { }
+}
+</script>
+</head>
+<body onload=loader()>
+<span>
+<a></a>
+</span>
+<a></a>
+<svg marker-end="url(#poly)">
+<a></a>
+<a></a>
+<symbol >
+<a></a>
+</symbol>
+<polyline id="poly">
+<a></a>
+<a></a>
+<a></a>
+<a></a>
+</polyline>
+<line >
+<a></a>
+</line>
+<a></a>
+<span>
+<a></a>
+</span>
+<a></a>
+<a></a>
+<a></a>
+</svg>
+<dialog style="-moz-appearance: checkbox; overflow-x: auto; max-width: 0em;" open="true"></dialog>
+<a></a>
+<a></a>
+<span>
+<a></a>
+<a></a>
+<a></a>
+<a></a>
+</span>
+<a></a>
+<a></a>
+<a></a>
+<a></a>
+</body>
+</html>
diff --git a/layout/svg/crashtests/1467552-1.html b/layout/svg/crashtests/1467552-1.html
new file mode 100644
index 0000000000..df85665c72
--- /dev/null
+++ b/layout/svg/crashtests/1467552-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<html>
+<style>
+fieldset {
+ mask: url(data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciLz4=),
+ padding-box;
+ margin-right: 75px;
+}
+span {
+ vertical-align: 672in;
+}
+</style>
+<fieldset><span><video></video></span></fieldset>
+</html>
diff --git a/layout/svg/crashtests/1474982.html b/layout/svg/crashtests/1474982.html
new file mode 100644
index 0000000000..c33e2be474
--- /dev/null
+++ b/layout/svg/crashtests/1474982.html
@@ -0,0 +1,2 @@
+<svg>
+<text lengthAdjust="" textLength="0">A</text>
diff --git a/layout/svg/crashtests/1480224.html b/layout/svg/crashtests/1480224.html
new file mode 100644
index 0000000000..0bb0dfa7b5
--- /dev/null
+++ b/layout/svg/crashtests/1480224.html
@@ -0,0 +1,6 @@
+<svg>
+<symbol id="a">
+<foreignObject>
+<input type="file">
+</symbol>
+<use xlink:href="#a">
diff --git a/layout/svg/crashtests/1480275.html b/layout/svg/crashtests/1480275.html
new file mode 100644
index 0000000000..b21ebdd062
--- /dev/null
+++ b/layout/svg/crashtests/1480275.html
@@ -0,0 +1,15 @@
+<script>
+function go() {
+ b.appendChild(a);
+ d.outerHTML = f.outerHTML;
+}
+</script>
+<table>
+<tr id="a">
+<th>
+<svg id="c" onload="go()">
+<use xlink:href="#c"/>
+</tr>
+<code id="d"></code>
+<video id="f">
+<details id="b">
diff --git a/layout/svg/crashtests/1502936.html b/layout/svg/crashtests/1502936.html
new file mode 100644
index 0000000000..87892ab461
--- /dev/null
+++ b/layout/svg/crashtests/1502936.html
@@ -0,0 +1,11 @@
+<script>
+function go() {
+ a.setAttribute("requiredExtensions", "x");
+ b.getBoundingClientRect();
+ a.setAttribute("y", "-1px");
+}
+</script>
+<body onload=go()>
+<svg>
+<use id="a">
+<feGaussianBlur id="b">
diff --git a/layout/svg/crashtests/1504072.html b/layout/svg/crashtests/1504072.html
new file mode 100644
index 0000000000..a44e2f0251
--- /dev/null
+++ b/layout/svg/crashtests/1504072.html
@@ -0,0 +1,4 @@
+<style>
+svg { perspective: 0px }
+</style>
+<svg overflow="scroll" systemLanguage="">
diff --git a/layout/svg/crashtests/1504918.svg b/layout/svg/crashtests/1504918.svg
new file mode 100644
index 0000000000..63cd3a08e0
--- /dev/null
+++ b/layout/svg/crashtests/1504918.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <style>textPath { display: contents; }</style>
+ <text>x<textPath><textPath><tspan>y</tspan></textPath></textPath></text>
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/1535517-1.svg b/layout/svg/crashtests/1535517-1.svg
new file mode 100644
index 0000000000..6f3f17eabf
--- /dev/null
+++ b/layout/svg/crashtests/1535517-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<marker><text><tspan id="x"/></text></marker>
+
+<script>
+window.addEventListener("load", function() {
+ document.getElementById("x").appendChild(document.createTextNode("\u062Ax"));
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/1536892.html b/layout/svg/crashtests/1536892.html
new file mode 100644
index 0000000000..8bc237138e
--- /dev/null
+++ b/layout/svg/crashtests/1536892.html
@@ -0,0 +1,13 @@
+<style>
+* { -webkit-filter: blur(5px) }
+</style>
+<script>
+function go() {
+ a.setAttribute("text-decoration", "overline")
+}
+</script>
+<body onload=go()>
+<svg id="a">
+<marker>
+<foreignObject>
+<li style="-webkit-box-shadow:8px 0 1px">
diff --git a/layout/svg/crashtests/1539318-1.svg b/layout/svg/crashtests/1539318-1.svg
new file mode 100644
index 0000000000..d832f448a3
--- /dev/null
+++ b/layout/svg/crashtests/1539318-1.svg
@@ -0,0 +1,10 @@
+<script>
+window.onload = function() {
+ a.getComputedTextLength()
+}
+</script>
+<body>
+<svg>
+<switch>
+<hatch>
+<text id="a">A</text>
diff --git a/layout/svg/crashtests/1548985-1.html b/layout/svg/crashtests/1548985-1.html
new file mode 100644
index 0000000000..7156eaf36b
--- /dev/null
+++ b/layout/svg/crashtests/1548985-1.html
@@ -0,0 +1,16 @@
+<!-- a -->
+<style>
+:root { contain: size }
+</style>
+<script>
+window.requestIdleCallback(window.close)
+function go() {
+ a.appendChild(document.head)
+ let b = d.getRootNode({composed: true})
+ b.replaceChild(c, b.childNodes[1])
+}
+</script>
+<body onload=go()>
+<svg id="c">
+<feTile id="d" />
+<foreignObject id="a">
diff --git a/layout/svg/crashtests/1548985-2.svg b/layout/svg/crashtests/1548985-2.svg
new file mode 100644
index 0000000000..700facb411
--- /dev/null
+++ b/layout/svg/crashtests/1548985-2.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ style="contain:size">
+ <rect width="100px" height="100px" fill="lime"/>
+</svg>
diff --git a/layout/svg/crashtests/1555851.html b/layout/svg/crashtests/1555851.html
new file mode 100644
index 0000000000..2b6f5a596a
--- /dev/null
+++ b/layout/svg/crashtests/1555851.html
@@ -0,0 +1,8 @@
+<body>
+<script>
+ var o0 = document.createElementNS("http://www.w3.org/2000/svg", "svg")
+ document.body.appendChild(o0)
+ var o3 = document.createElementNS("http://www.w3.org/2000/svg", "animateMotion")
+ o0.appendChild(o3)
+ o3.setAttribute("path", "M9,2l2e37,3A40,2 85,102-1")
+</script>
diff --git a/layout/svg/crashtests/1563779.html b/layout/svg/crashtests/1563779.html
new file mode 100644
index 0000000000..4c51d0884d
--- /dev/null
+++ b/layout/svg/crashtests/1563779.html
@@ -0,0 +1,19 @@
+<script id="a">
+let count = 0;
+function go() {
+ if (count++ == 3)
+ return;
+ try { a.appendChild(c) } catch(e) { }
+ try { window.getSelection().getRangeAt(0).insertNode(b) } catch(e) { }
+ try { d.selectSubString(0,-1) } catch(e) { }
+ document.documentElement.style.display = "none"
+ document.documentElement.getBoundingClientRect()
+ document.documentElement.style.display = ""
+}
+</script>
+<pre id="b" style="display:contents">a</pre>
+<span id="c">
+<style onload="go()"></style>
+</span>
+<svg>
+<text id="d"><textPath xml:space="preserve">
diff --git a/layout/svg/crashtests/1600855.html b/layout/svg/crashtests/1600855.html
new file mode 100644
index 0000000000..31c4809ecb
--- /dev/null
+++ b/layout/svg/crashtests/1600855.html
@@ -0,0 +1,8 @@
+<script>
+window.onload = () => {
+ a.append(String.fromCodePoint(71341))
+}
+</script>
+<font style="word-spacing: 31pc">
+<svg>
+<text id="a">Text</text>
diff --git a/layout/svg/crashtests/1601824.html b/layout/svg/crashtests/1601824.html
new file mode 100644
index 0000000000..04d0de825d
--- /dev/null
+++ b/layout/svg/crashtests/1601824.html
@@ -0,0 +1,7 @@
+<svg>
+<polygon id="a" points="0 1">
+</polygon>
+<text>
+<textPath xlink:href="#a">
+<marker />
+<a systemLanguage="">
diff --git a/layout/svg/crashtests/1605223-1.html b/layout/svg/crashtests/1605223-1.html
new file mode 100644
index 0000000000..6b476a7fd0
--- /dev/null
+++ b/layout/svg/crashtests/1605223-1.html
@@ -0,0 +1,4 @@
+<svg filter="url(#a)">
+<filter id="a">
+<feComponentTransfer>
+<feFuncG type="" />
diff --git a/layout/svg/crashtests/1609663.html b/layout/svg/crashtests/1609663.html
new file mode 100644
index 0000000000..c5a5d938e0
--- /dev/null
+++ b/layout/svg/crashtests/1609663.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+</head>
+<body>
+<div id="main">
+ <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="mySvg" width="400" height="800">
+ <defs>
+ <pattern id="pattern1" x="30" y="10" width="30" height="30" patternUnits="userSpaceOnUse" >
+ <text id="idText1" x="15" y="15" font-size="20">1</text>
+ </pattern>
+ </defs>
+ <rect id="idRect1" fill="url(#pattern1)" width="300" height="200"/>
+ </svg>
+</div>
+<script>
+document.body.offsetHeight;
+
+var pattern = document.getElementById('pattern1');
+var text = document.getElementById('idText1');
+pattern.removeChild(text);
+
+var svgNS = "http://www.w3.org/2000/svg";
+var newText = document.createElementNS(svgNS,"text");
+newText.setAttributeNS(null,"id",'idText1');
+newText.setAttributeNS(null,"x",15);
+newText.setAttributeNS(null,"y",15);
+newText.setAttributeNS(null,"font-size","20");
+
+var textNode = document.createTextNode('x');
+newText.appendChild(textNode);
+pattern.appendChild(newText);
+</script>
+</body>
+</html>
diff --git a/layout/svg/crashtests/1671950.html b/layout/svg/crashtests/1671950.html
new file mode 100644
index 0000000000..173ace4ea9
--- /dev/null
+++ b/layout/svg/crashtests/1671950.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+ <style>
+ * {
+ break-before: always ! important;
+ }
+ </style>
+ <script>
+ window.addEventListener('load', () => {
+ const style = document.createElement('style')
+ document.head.appendChild(style)
+ const svg_1 = document.getElementById('id_3')
+ const svg_2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+ const switch_0 = document.createElementNS('http://www.w3.org/2000/svg', 'switch')
+ const c_0 = document.createElementNS('http://www.w3.org/2000/svg', 'c')
+ switch_0.appendChild(c_0)
+ svg_1.appendChild(switch_0)
+ svg_2.appendChild(svg_1)
+ document.documentElement.appendChild(svg_2)
+ style.sheet.insertRule('@-moz-document url-prefix(){*,a{all:inherit', 0)
+ SpecialPowers.wrap(window).printPreview()?.close()
+ })
+ </script>
+ <svg id='id_3'></svg>
+</head>
+</html>
+
diff --git a/layout/svg/crashtests/1678947.html b/layout/svg/crashtests/1678947.html
new file mode 100644
index 0000000000..96a3a37862
--- /dev/null
+++ b/layout/svg/crashtests/1678947.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<style>
+ol { float: right; }
+</style>
+<script>
+function start() {
+ document.elementFromPoint(0,1);
+ document.dir = "rtl";
+}
+</script>
+</head>
+<body>
+<svg onload="start()" requiredExtensions="x">
+ <g id="a"/></g>
+<text>
+<textPath xlink:href="#a">
+</svg>
+<ol></ol>
+</body>
+</html>
diff --git a/layout/svg/crashtests/1693032.html b/layout/svg/crashtests/1693032.html
new file mode 100644
index 0000000000..49a2bf3c17
--- /dev/null
+++ b/layout/svg/crashtests/1693032.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const svg_1 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+ const svg_2 = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+ const switch_1 = document.createElementNS('http://www.w3.org/2000/svg', 'switch')
+ const metadata_1 = document.createElementNS('http://www.w3.org/2000/svg', 'metadata')
+ const foreign_1 = document.createElementNS('http://www.w3.org/2000/svg', 'foreignObject')
+ const text_1 = document.createElementNS('http://www.w3.org/2000/svg', 'text')
+ switch_1.appendChild(metadata_1)
+ svg_2.appendChild(text_1)
+ foreign_1.appendChild(svg_2)
+ switch_1.appendChild(foreign_1)
+ svg_1.appendChild(switch_1)
+ document.documentElement.appendChild(svg_1)
+ })
+ </script>
+</head>
+</html>
diff --git a/layout/svg/crashtests/1696505.html b/layout/svg/crashtests/1696505.html
new file mode 100644
index 0000000000..92700496e8
--- /dev/null
+++ b/layout/svg/crashtests/1696505.html
@@ -0,0 +1,9 @@
+<script>
+document.addEventListener("DOMContentLoaded", () => {
+ document.getElementById('a').style.cssText += "grid-row-end:auto"
+})
+</script>
+<svg>
+<polyline marker-mid='url(#a)'/>
+<marker id='a'>
+<text/>
diff --git a/layout/svg/crashtests/1755770-1.html b/layout/svg/crashtests/1755770-1.html
new file mode 100644
index 0000000000..ee9cf6fee7
--- /dev/null
+++ b/layout/svg/crashtests/1755770-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ window.addEventListener("load", () => {
+ const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+ const text = document.createElementNS("http://www.w3.org/2000/svg", "text");
+ text.setAttribute("letter-spacing", "65535pc");
+ const node = document.createTextNode("\rï¿»ð¨\nó = ð£%?;ð©á©¿ð�");
+ text.appendChild(node);
+ svg.appendChild(text);
+ document.documentElement.appendChild(svg);
+ const rect = new DOMRectReadOnly(-128, 256, 0, 1024);
+ node.convertRectFromNode(rect, document, {});
+ })
+ </script>
+</head>
+</html>
diff --git a/layout/svg/crashtests/1755770-2.html b/layout/svg/crashtests/1755770-2.html
new file mode 100644
index 0000000000..31b42ec452
--- /dev/null
+++ b/layout/svg/crashtests/1755770-2.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ window.addEventListener("load", () => {
+ const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+ const text = document.createElementNS("http://www.w3.org/2000/svg", "text");
+ text.setAttribute("letter-spacing", "65535pc");
+ text.setAttribute("writing-mode", "vertical-lr");
+ const node = document.createTextNode("\rï¿»ð¨\nó = ð£%?;ð©á©¿ð�");
+ text.appendChild(node);
+ svg.appendChild(text);
+ document.documentElement.appendChild(svg);
+ const rect = new DOMRectReadOnly(-128, 256, 0, 1024);
+ node.convertRectFromNode(rect, document, {});
+ })
+ </script>
+</head>
+</html>
diff --git a/layout/svg/crashtests/1758029-1.html b/layout/svg/crashtests/1758029-1.html
new file mode 100644
index 0000000000..2097e875ee
--- /dev/null
+++ b/layout/svg/crashtests/1758029-1.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<meta charset="utf-8">
+<style>
+ body { background: gray; }
+ canvas { border: 2px solid black;}
+</style>
+
+<img id="img"
+ onload="go()"
+ src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAAAKElEQVR42u3NQQ0AAAgEoNP+nTWFDzcoQE1udQQCgUAgEAgEAsGTYAGjxAE/G/Q2tQAAAABJRU5ErkJggg==">
+<canvas id="canvas"></canvas>
+<script>
+ const ctx = canvas.getContext("2d", { desynchronized: true });
+ const SVG_FILTER = `
+ <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <filter id="posterize">
+ <feComponentTransfer>
+ <feFuncR type="discrete" tableValues="0,1" />
+ <feFuncG type="discrete" tableValues="0,1" />
+ <feFuncB type="discrete" tableValues="0,1" />
+ <feFuncA type="discrete" tableValues="0,1" />
+ </feComponentTransfer>
+ </filter>
+ </svg>`;
+
+ const FILTER1 = `url('data:image/svg+xml;utf8,${SVG_FILTER.replace(/\n/g, "")
+ .replace(/\s+/g, " ")
+ .trim()}#posterize') grayscale(50%) brightness(50%)`;
+ function go() {
+ canvas.width = img.naturalWidth;
+ canvas.height = img.naturalHeight;
+
+ ctx.imageSmoothingEnabled = true;
+ ctx.clearRect(0, 0, canvas.width, canvas.height);
+ ctx.filter = FILTER1;
+ ctx.drawImage(img, 0, 0);
+ setTimeout(() => { document.documentElement.removeAttribute("class")}, 0);
+ }
+</script>
diff --git a/layout/svg/crashtests/1764936-1.html b/layout/svg/crashtests/1764936-1.html
new file mode 100644
index 0000000000..c03789d547
--- /dev/null
+++ b/layout/svg/crashtests/1764936-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ window.addEventListener("load", () => {
+ const svg = document.createElementNS("http://www.w3.org/2000/svg", "svg")
+ const image = document.createElementNS("http://www.w3.org/2000/svg", "image")
+ image.setAttribute("height", "78.04250580135444ch")
+ image.setAttribute("width", "1024rem")
+ image.setAttribute("clip-path", "path( evenodd, '\\C' )")
+ svg.appendChild(image)
+ document.documentElement.appendChild(svg)
+ })
+ </script>
+</head>
+</html>
diff --git a/layout/svg/crashtests/1804958.html b/layout/svg/crashtests/1804958.html
new file mode 100644
index 0000000000..663f621d4c
--- /dev/null
+++ b/layout/svg/crashtests/1804958.html
@@ -0,0 +1,4 @@
+<svg>
+<polygon points="0,2 2,0" marker-end="url(#a)"></polygon>
+<marker id="a" clip-path="">
+<svg style="mix-blend-mode: lighten">
diff --git a/layout/svg/crashtests/1810260.html b/layout/svg/crashtests/1810260.html
new file mode 100644
index 0000000000..f555581165
--- /dev/null
+++ b/layout/svg/crashtests/1810260.html
@@ -0,0 +1,28 @@
+<style>
+*:only-child {
+ display: contents;
+}
+*:nth-child(1) {
+ mask: url(data:image/gif;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=) repeat-x view-box;
+}
+</style>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+ document.execCommand("selectAll", false)
+ document.designMode = "on"
+ document.execCommand("backColor", false, "red")
+ document.execCommand("justifyFull", false)
+})
+</script>
+A
+<q contenteditable="true">
+<link>
+<svg>
+<line></line>
+<text white-space="pre-line">
+A
+</text>
+<defs>
+</svg>
+A
+
diff --git a/layout/svg/crashtests/220165-1.svg b/layout/svg/crashtests/220165-1.svg
new file mode 100644
index 0000000000..0335f78d41
--- /dev/null
+++ b/layout/svg/crashtests/220165-1.svg
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:html="http://www.w3.org/1999/xhtml" height="500"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="document.documentElement.getBoundingClientRect();
+ document.getElementById('x').textContent = 'New text'">
+
+ <foreignObject x="200" y="180" width="100" height="50" >
+ <html:button id="x">Old long long long text</html:button>
+ </foreignObject>
+
+ <g transform="rotate(10) translate(-100) scale(0.8)">
+ <polygon style="fill:red; fill-opacity:0.5;"
+ points="350, 75 379,161 469,161 397,215
+ 423,301 350,250 277,301 303,215
+ 231,161 321,161" />
+
+ </g>
+
+</svg>
diff --git a/layout/svg/crashtests/267650-1.svg b/layout/svg/crashtests/267650-1.svg
new file mode 100644
index 0000000000..3e9c7ecc01
--- /dev/null
+++ b/layout/svg/crashtests/267650-1.svg
@@ -0,0 +1,4 @@
+<?xml version='1.0'?>
+<svg xmlns='http://www.w3.org/2000/svg'>
+ <text fill='none' stroke='black'>TESTCASE</text>
+</svg>
diff --git a/layout/svg/crashtests/294022-1.svg b/layout/svg/crashtests/294022-1.svg
new file mode 100644
index 0000000000..f30b484c83
--- /dev/null
+++ b/layout/svg/crashtests/294022-1.svg
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+ "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ >
+
+ <g>
+ <clipPath id="action_box_cp">
+ <rect width="100" height="46"/>
+ </clipPath>
+ <text style="clip-path:url(#action_box_cp); " y="10" id="action_boxtext" pointer-events="none" class="TextBoxText">
+ <tspan x="0" dy="0">Action</tspan>
+ </text>
+ </g>
+
+</svg>
diff --git a/layout/svg/crashtests/307314-1.svg b/layout/svg/crashtests/307314-1.svg
new file mode 100644
index 0000000000..5c538df88d
--- /dev/null
+++ b/layout/svg/crashtests/307314-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait" onload="setTimeout(function() { var g = document.getElementById('N1'), h = document.getElementById('N2'); g.appendChild(h); document.documentElement.removeAttribute("class"); }, 20);">
+
+ <text id="N1"/>
+ <text id="N2">
+ <tspan>
+ <textPath/>
+ </tspan>
+ </text>
+</svg>
diff --git a/layout/svg/crashtests/308615-1.svg b/layout/svg/crashtests/308615-1.svg
new file mode 100644
index 0000000000..fe5391de38
--- /dev/null
+++ b/layout/svg/crashtests/308615-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink">
+
+ <pattern id="pattern1">
+ <rect style="fill:url(#pattern1);"/>
+ </pattern>
+
+ <rect style="fill:url(#pattern1);" />
+
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/308917-1.svg b/layout/svg/crashtests/308917-1.svg
new file mode 100644
index 0000000000..7d0ae44f74
--- /dev/null
+++ b/layout/svg/crashtests/308917-1.svg
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<svg version="1.1" baseProfile="basic" xmlns="http://www.w3.org/2000/svg" width="100%" height="100%" viewBox="0 0 480 360" class="reftest-wait" onload="first();">
+
+<script><![CDATA[
+
+function first()
+{
+ document.getElementById("z").appendChild(document.getElementById("pat1"));
+ setTimeout(second, 30);
+}
+
+function second()
+{
+ document.getElementById("pat4").appendChild(document.getElementById("z"));
+ document.documentElement.removeAttribute("class");
+}
+
+]]></script>
+
+
+ <pattern patternUnits="userSpaceOnUse" id="pat1" x="10" y="10" width="20" height="20">
+ <rect x="5" y="5" width="10" height="10" fill="red" />
+ <rect x="10" y="10" width="10" height="10" fill="green" />
+ </pattern>
+ <rect x="25" y="10" width="430" height="60" stroke="black" fill="url(#pat1)" />
+
+ <pattern patternUnits="userSpaceOnUse" id="pat4" x="0" y="0" width="20" height="10">
+ <rect x="0" y="0" width="10" height="10" fill="red" />
+ <rect x="10" y="0" width="10" height="10" fill="blue" />
+ </pattern>
+ <text font-family="Arial" font-size="40" fill="none" stroke="url(#pat4)" stroke-width="2" x="25" y="275" id="z">Pattern on stroke</text>
+
+</svg>
+
diff --git a/layout/svg/crashtests/310436-1.svg b/layout/svg/crashtests/310436-1.svg
new file mode 100644
index 0000000000..e6dd5680ce
--- /dev/null
+++ b/layout/svg/crashtests/310436-1.svg
@@ -0,0 +1,28 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait"><script><![CDATA[
+
+function init() {
+ var docElt = document.documentElement;
+ var div1 = document.getElementById("div1");
+ var div2 = document.getElementById("div2");
+ var textNode = div2.childNodes[0];
+
+ function first()
+ {
+ docElt.appendChild(div2);
+ div2.appendChild(div1);
+ }
+
+ function second()
+ {
+ div2.appendChild(div1);
+ div1.appendChild(textNode);
+ document.documentElement.removeAttribute("class");
+ }
+
+ first();
+ setTimeout(second, 30);
+}
+
+window.addEventListener("load", init, false);
+
+]]></script><div xmlns="http://www.w3.org/1999/xhtml" id="div1"><div id="div2">A Z</div></div></svg>
diff --git a/layout/svg/crashtests/310638.svg b/layout/svg/crashtests/310638.svg
new file mode 100644
index 0000000000..e5ee30fb2c
--- /dev/null
+++ b/layout/svg/crashtests/310638.svg
@@ -0,0 +1,35 @@
+<svg xmlns="http://www.w3.org/2000/svg"><div xmlns='http://www.w3.org/1999/xhtml' id="div1">
+<div id="div2">bar</div>
+</div>
+<script><![CDATA[
+
+function init()
+{
+ var div2 = document.getElementById("div2");
+ var div1 = document.getElementById("div1");
+ var docElt = document.documentElement;
+ var titleText = document.createTextNode("foo baz");
+
+ docElt.appendChild(div2); div2.appendChild(titleText);
+
+ function second ()
+ {
+ div2.appendChild(div1);
+ removeNode(titleText);
+ removeNode(div2);
+ }
+
+ setTimeout(second, 0);
+}
+
+
+function removeNode(q1) { q1.parentNode.removeChild(q1); }
+
+
+setTimeout(init, 0);
+
+
+]]></script>
+
+
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/313737-1.xml b/layout/svg/crashtests/313737-1.xml
new file mode 100644
index 0000000000..93421f6077
--- /dev/null
+++ b/layout/svg/crashtests/313737-1.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="ISO-8859-1" standalone="no"?>
+<!DOCTYPE xhtml PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd" [
+]>
+
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <head>
+ <title>bug 313737</title>
+ </head>
+ <body>
+
+ <svg:svg style="position:fixed;">
+ <input type="text" style="position:absolute;" />
+ </svg:svg>
+
+ </body>
+</html>
diff --git a/layout/svg/crashtests/314244-1.xhtml b/layout/svg/crashtests/314244-1.xhtml
new file mode 100644
index 0000000000..14717f146d
--- /dev/null
+++ b/layout/svg/crashtests/314244-1.xhtml
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=314244 -->
+<!-- Just checking for lack of crash, nothing more -->
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ title="GMail"
+ width="300" height="300"
+ screenX="10" screenY="10">
+
+ <hbox>
+ <svg version="1.0"
+ xmlns="http://www.w3.org/2000/svg"
+ width="100px" height="100px"
+ id="back-button"
+ class="nav-button"
+ style="display: -moz-box;">
+ <rect x="10" y="10" width="80" height="80" fill="blue" />
+ </svg>
+ <spacer flex="1" />
+ </hbox>
+
+ <spacer flex="1" />
+
+</window>
+
diff --git a/layout/svg/crashtests/322185-1.svg b/layout/svg/crashtests/322185-1.svg
new file mode 100644
index 0000000000..8a10eb34a4
--- /dev/null
+++ b/layout/svg/crashtests/322185-1.svg
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+ <g id="g" style="display: -moz-box; overflow: hidden;">
+ <circle />
+ </g>
+</svg>
diff --git a/layout/svg/crashtests/322215-1.svg b/layout/svg/crashtests/322215-1.svg
new file mode 100644
index 0000000000..f872fbcd8f
--- /dev/null
+++ b/layout/svg/crashtests/322215-1.svg
@@ -0,0 +1,31 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+<!--
+Copyright Georgi Guninski
+-->
+
+
+<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg">
+
+<defs>
+<filter id="MyFilter" filterUnits="userSpaceOnUse"
+x="0" y="0" width="32769" height="32769">
+
+<feGaussianBlur in="SourceAlpha" stdDeviation="4" result="blur"/>
+
+</filter>
+</defs>
+
+<rect x="1" y="1" width="198" height="118" fill="#cccccc" />
+
+<g filter="url(#MyFilter)">
+<text fill="#FFFFFF" stroke="black" font-size="45"
+x="42" y="42">Feck b1ll</text>
+</g>
+
+</svg>
diff --git a/layout/svg/crashtests/323704-1.svg b/layout/svg/crashtests/323704-1.svg
new file mode 100644
index 0000000000..13b8d52243
--- /dev/null
+++ b/layout/svg/crashtests/323704-1.svg
@@ -0,0 +1,12 @@
+<svg xmlns='http://www.w3.org/2000/svg'
+xmlns:xlink='http://www.w3.org/1999/xlink'>
+
+ <clipPath id='clipPath_0'>
+ <rect x='10' y='10' width='25' height='25' rx='5' ry='5' fill='none'
+clip-path='url(#clipPath_0)'/>
+ </clipPath>
+
+ <rect x='5' y='5' width='35' height='35' fill='red'
+clip-path='url(#clipPath_0)'/>
+
+</svg>
diff --git a/layout/svg/crashtests/325427-1.svg b/layout/svg/crashtests/325427-1.svg
new file mode 100644
index 0000000000..1f1c645251
--- /dev/null
+++ b/layout/svg/crashtests/325427-1.svg
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <defs>
+ <g id="module">
+ <use xlink:href="#module" />
+ <use xlink:href="#module" />
+ <use xlink:href="#module" />
+ <use xlink:href="#module" />
+ <use xlink:href="#baseModule" />
+ <use xlink:href="#baseModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ <use xlink:href="#extendsModule" />
+ </g>
+ <use id="baseModule" xlink:href="#module" />
+ <use id="extendsModule" xlink:href="#module" />
+ </defs>
+</svg>
diff --git a/layout/svg/crashtests/326495-1.svg b/layout/svg/crashtests/326495-1.svg
new file mode 100644
index 0000000000..a5bf25b62a
--- /dev/null
+++ b/layout/svg/crashtests/326495-1.svg
@@ -0,0 +1,16 @@
+<?xml version="1.0"?>
+<svg width="10cm" height="5cm" viewBox="0 0 1000 500"
+ xmlns="http://www.w3.org/2000/svg"
+ version="1.1">
+
+ <script>
+ function init()
+ {
+ document.getElementsByTagName("rect")[0].style.display = "-moz-inline-box";
+ }
+
+ window.addEventListener("load", init, false);
+ </script>
+
+ <rect requiredFeatures="http://www.w3.org/TR/SVG11/feature#SVG-nonexistent-feature"/>
+</svg>
diff --git a/layout/svg/crashtests/326974-1.svg b/layout/svg/crashtests/326974-1.svg
new file mode 100644
index 0000000000..750165b730
--- /dev/null
+++ b/layout/svg/crashtests/326974-1.svg
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+function init() { var n2 = document.getElementById("n2");
+ var n3 = document.getElementById("n3");
+
+ n2.appendChild(n3);
+}
+
+window.addEventListener("load", init, false);
+
+</script>
+
+
+<g id="n2"> <text id="n3" />
+</g>
+
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/327706-1.svg b/layout/svg/crashtests/327706-1.svg
new file mode 100644
index 0000000000..9aae909250
--- /dev/null
+++ b/layout/svg/crashtests/327706-1.svg
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+document.documentElement.unsuspendRedraw(6)
+
+</script>
+</svg>
diff --git a/layout/svg/crashtests/327711-1.svg b/layout/svg/crashtests/327711-1.svg
new file mode 100644
index 0000000000..d919b866f6
--- /dev/null
+++ b/layout/svg/crashtests/327711-1.svg
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+function init()
+{
+ document.documentElement.unsuspendRedrawAll();
+ document.getElementsByTagName("text")[0].firstChild.data = "Quux";
+}
+
+window.addEventListener("load", init, false);
+
+</script>
+
+<text x="125" y="30">Foo</text>
+
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/328137-1.svg b/layout/svg/crashtests/328137-1.svg
new file mode 100644
index 0000000000..26190b1eb0
--- /dev/null
+++ b/layout/svg/crashtests/328137-1.svg
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+
+function init()
+{
+ x = document.getElementsByTagName("stop");
+ x[0].appendChild(x[1]);
+}
+
+
+window.addEventListener("load", init, false);
+
+</script>
+
+<radialGradient>
+ <stop/>
+ <stop/>
+</radialGradient>
+
+</svg>
diff --git a/layout/svg/crashtests/329848-1.svg b/layout/svg/crashtests/329848-1.svg
new file mode 100644
index 0000000000..ac4f0022e1
--- /dev/null
+++ b/layout/svg/crashtests/329848-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"> <polygon transform="?" points="100,100 200,100 150,200"/> </svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/337408-1.xhtml b/layout/svg/crashtests/337408-1.xhtml
new file mode 100644
index 0000000000..f56c06ec94
--- /dev/null
+++ b/layout/svg/crashtests/337408-1.xhtml
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=337408 -->
+<!-- Just checking for lack of crash, nothing more -->
+<window id="svg-in-xul-stack"
+ xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ xmlns:svg="http://www.w3.org/2000/svg"
+ style="background-color:white;"
+ screenX="20"
+ screenY="20"
+ width="600"
+ height="400">
+
+ <stack>
+ <box flex="1">
+ <label value="foo"/>
+ </box>
+ <svg:svg>
+ <svg:rect width="100%" height="100%" fill="red" fill-opacity="0.5"/>
+ </svg:svg>
+ </stack>
+</window>
diff --git a/layout/svg/crashtests/338301-1.xhtml b/layout/svg/crashtests/338301-1.xhtml
new file mode 100644
index 0000000000..3367eedebb
--- /dev/null
+++ b/layout/svg/crashtests/338301-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de">
+<body>
+
+ <svg xmlns="http://www.w3.org/2000/svg">
+ <defs>
+ <linearGradient>
+ <path/>
+ </linearGradient>
+ </defs>
+ </svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/338312-1.xhtml b/layout/svg/crashtests/338312-1.xhtml
new file mode 100644
index 0000000000..5a751a2ae0
--- /dev/null
+++ b/layout/svg/crashtests/338312-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+
+function boom()
+{
+ document.getElementById("foo").appendChild(document.getElementById("bar"));
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</head>
+
+<body>
+
+ <div id="foo"></div>
+
+ <svg xmlns="http://www.w3.org/2000/svg">
+ <defs>
+ <linearGradient id="grad1"/>
+ </defs>
+ <rect id="bar" style="fill:url(#grad1);" />
+ </svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/340083-1.svg b/layout/svg/crashtests/340083-1.svg
new file mode 100644
index 0000000000..7f015b6efe
--- /dev/null
+++ b/layout/svg/crashtests/340083-1.svg
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100%" height="100%">
+ <defs>
+ <title>
+ <image x="30" y="0" width="190" height="190" xlink:href="../../../testing/crashtest/images/tree.gif"/>
+ </title>
+ </defs>
+</svg>
diff --git a/layout/svg/crashtests/340945-1.svg b/layout/svg/crashtests/340945-1.svg
new file mode 100644
index 0000000000..01ac66fb33
--- /dev/null
+++ b/layout/svg/crashtests/340945-1.svg
@@ -0,0 +1,2 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="display: table;">
+</svg>
diff --git a/layout/svg/crashtests/342923-1.html b/layout/svg/crashtests/342923-1.html
new file mode 100644
index 0000000000..bed6e89791
--- /dev/null
+++ b/layout/svg/crashtests/342923-1.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+
+function boo()
+{
+ var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+ rect.setAttribute("stroke", "blue");
+
+ document.body.appendChild(rect);
+}
+
+</script>
+</head>
+
+<body class="bodytext" onload="boo();">
+
+<div id="c1"></div>
+
+<p>In a debug trunk build from 2006-006-27, loading this page triggers an assertion. (It also triggers a CSS error in the console, but I think that's a known, separate bug.)</p>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/343221-1.xhtml b/layout/svg/crashtests/343221-1.xhtml
new file mode 100644
index 0000000000..890b161dfe
--- /dev/null
+++ b/layout/svg/crashtests/343221-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boo()
+{
+ document.getElementById("c").style.overflow = "hidden";
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+<body onload="setTimeout(boo, 30);">
+
+<svg xmlns="http://www.w3.org/2000/svg">
+ <circle id="c" cx="50" cy="50" r="20" />
+</svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/344749-1.svg b/layout/svg/crashtests/344749-1.svg
new file mode 100644
index 0000000000..1a02d7c180
--- /dev/null
+++ b/layout/svg/crashtests/344749-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+
+<circle cx="6cm" cy="2cm" r="100" fill="red" transform="translate(0,50)" />
+<circle cx="6cm" cy="2cm" r="100" fill="blue" transform="translate(70,150)" />
+<circle cx="6cm" cy="2cm" r="100" fill="green" transform="translate(-70,150)" />
+
+<rect id="rect1" fill="url(#pat0)"/>
+
+<pattern patternUnits="userSpaceOnUse" id="pat0" x="10" y="10" width="20" height="20"> <rect x="5" y="5" width="10" height="10" fill="red" /> <rect x="10" y="10" width="10" height="10" fill="green" /> </pattern>
+ </svg>
diff --git a/layout/svg/crashtests/344887-1.svg b/layout/svg/crashtests/344887-1.svg
new file mode 100644
index 0000000000..f0bd21c592
--- /dev/null
+++ b/layout/svg/crashtests/344887-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(foo, 30);" class="reftest-wait">
+
+<script>
+
+var SVG_NS = "http://www.w3.org/2000/svg";
+
+function foo()
+{
+ var rect = document.createElementNS(SVG_NS, 'rect');
+ rect.setAttribute('opacity', ".3");
+ document.documentElement.appendChild(rect);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/344892-1.svg b/layout/svg/crashtests/344892-1.svg
new file mode 100644
index 0000000000..a38d7eb40f
--- /dev/null
+++ b/layout/svg/crashtests/344892-1.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<text stroke-width="50%">foo</text>
+
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/344898-1.svg b/layout/svg/crashtests/344898-1.svg
new file mode 100644
index 0000000000..34c3f45a4e
--- /dev/null
+++ b/layout/svg/crashtests/344898-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(removeText, 30);" class="reftest-wait">
+
+
+<script>
+
+function removeText()
+{
+ var x = document.getElementById("textPath");
+ x.removeChild(x.firstChild);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+
+<text x="30" y="30"><textPath id="textPath">Foo</textPath></text>
+
+
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/344904-1.svg b/layout/svg/crashtests/344904-1.svg
new file mode 100644
index 0000000000..a2c8d07647
--- /dev/null
+++ b/layout/svg/crashtests/344904-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30);" class="reftest-wait">
+
+<script>
+
+function boom()
+{
+ document.getElementById("m").setAttribute("stroke-miterlimit", 1);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+
+<marker>
+ <path id="m" />
+</marker>
+
+
+</svg>
diff --git a/layout/svg/crashtests/345418-1.svg b/layout/svg/crashtests/345418-1.svg
new file mode 100644
index 0000000000..2cf8b331fa
--- /dev/null
+++ b/layout/svg/crashtests/345418-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<tspan>arg</tspan>
+ </svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/348982-1.xhtml b/layout/svg/crashtests/348982-1.xhtml
new file mode 100644
index 0000000000..ad0340689a
--- /dev/null
+++ b/layout/svg/crashtests/348982-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<style>
+#div, #svg { display: table; }
+#g { display: inline; }
+</style>
+</head>
+
+<body>
+ <div id="div">
+ <svg id="svg" xmlns="http://www.w3.org/2000/svg">
+ <g id="g">
+ <circle cx="6.5cm" cy="2cm" r="100" style="fill: blue;" />
+ </g>
+ </svg>
+ </div>
+</body>
+
+</html>
diff --git a/layout/svg/crashtests/354777-1.xhtml b/layout/svg/crashtests/354777-1.xhtml
new file mode 100644
index 0000000000..e82baf34c9
--- /dev/null
+++ b/layout/svg/crashtests/354777-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<script>
+
+var SVG_NS = "http://www.w3.org/2000/svg";
+
+function boom()
+{
+ var svgElem = document.createElementNS(SVG_NS, "svg");
+ var ellipse = document.createElementNS(SVG_NS, "ellipse");
+
+ svgElem.setAttribute("viewBox", "0 0 30 40");
+ document.body.appendChild(svgElem);
+ document.body.appendChild(ellipse);
+ ellipse.appendChild(svgElem);
+ svgElem.removeAttribute("viewBox");
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+</body>
+
+</html>
+
diff --git a/layout/svg/crashtests/359516-1.svg b/layout/svg/crashtests/359516-1.svg
new file mode 100644
index 0000000000..c997eb3a85
--- /dev/null
+++ b/layout/svg/crashtests/359516-1.svg
@@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ class="reftest-wait"
+ onload="setTimeout(doStuff, 30);">
+
+<html:script style="display: none;" type="text/javascript">
+
+function doStuff()
+{
+ var svg = document.documentElement;
+ var ellipse = document.getElementById("ellipse");
+ var filter = document.getElementById("filter");
+
+ document.addEventListener("DOMNodeRemoved", foopy, false);
+ filter.removeChild(filter.firstChild);
+ document.removeEventListener("DOMNodeRemoved", foopy, false);
+
+ function foopy()
+ {
+ document.removeEventListener("DOMNodeRemoved", foopy, false);
+ svg.appendChild(filter);
+ }
+
+ // Needed for the crash, but not for the assertion.
+ svg.appendChild(ellipse);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<ellipse id="ellipse" cx="200" cy="150" rx="70" ry="40" style="filter: url(#filter);"/>
+
+<filter id="filter"> </filter>
+
+</svg>
diff --git a/layout/svg/crashtests/361015-1.svg b/layout/svg/crashtests/361015-1.svg
new file mode 100644
index 0000000000..8ac4bc56f2
--- /dev/null
+++ b/layout/svg/crashtests/361015-1.svg
@@ -0,0 +1,33 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ class="reftest-wait"
+ onload="setTimeout(boom, 30)">
+
+<html:script>
+<![CDATA[
+
+function boom()
+{
+ var grad = document.getElementById("grad");
+ var g = document.getElementById("g");
+ grad.appendChild(g);
+ g.removeAttribute("transform");
+ document.documentElement.removeAttribute("class");
+}
+
+]]>
+</html:script>
+
+
+ <g id="g" transform="translate(500,0)">
+ <text x="25" y="85">Foo</text>
+ </g>
+
+
+ <linearGradient id="grad" gradientUnits="objectBoundingBox" x1="0" y1="0" x2="1" y2="1">
+ <stop stop-color="blue" offset="0.2"/>
+ <stop stop-color="lime" offset="0.4"/>
+ </linearGradient>
+
+
+</svg>
diff --git a/layout/svg/crashtests/361587-1.svg b/layout/svg/crashtests/361587-1.svg
new file mode 100644
index 0000000000..52bce9eda7
--- /dev/null
+++ b/layout/svg/crashtests/361587-1.svg
@@ -0,0 +1,31 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ onload="setTimeout(boom, 30);"
+ class="reftest-wait">
+
+<script style="display: none" type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+ var oldGrad = document.getElementById("grad");
+ oldGrad.parentNode.removeChild(oldGrad);
+
+ var newGrad = document.createElementNS("http://www.w3.org/2000/svg", "radialGradient");
+ newGrad.setAttribute("gradientUnits", "userSpaceOnUse");
+ newGrad.setAttribute("id", "grad");
+
+ document.documentElement.appendChild(newGrad);
+
+ document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+
+ <radialGradient id="grad" gradientUnits="userSpaceOnUse" cx="240" cy="210" r="220" fx="240" fy="210">
+ <stop stop-color="yellow" offset="0"/>
+ <stop stop-color="green" offset="1"/>
+ </radialGradient>
+ <rect x="20" y="150" width="440" height="80" fill="url(#grad)" stroke-width="40"/>
+
+</svg>
diff --git a/layout/svg/crashtests/363611-1.xhtml b/layout/svg/crashtests/363611-1.xhtml
new file mode 100644
index 0000000000..6bc386bcdf
--- /dev/null
+++ b/layout/svg/crashtests/363611-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script style="display: none" type="text/javascript">
+
+function boom()
+{
+ var fo = document.createElementNS("http://www.w3.org/2000/svg", 'foreignObject');
+ document.getElementById("innerSVG").appendChild(fo);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<svg xmlns="http://www.w3.org/2000/svg" ><linearGradient><svg id="innerSVG"></svg></linearGradient></svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/364688-1.svg b/layout/svg/crashtests/364688-1.svg
new file mode 100644
index 0000000000..045061cd2f
--- /dev/null
+++ b/layout/svg/crashtests/364688-1.svg
@@ -0,0 +1,34 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ onload="setTimeout(boom, 30);"
+ class="reftest-wait">
+
+<script>
+function boom()
+{
+ document.getElementById("sss").removeAttribute('value');
+
+ document.documentElement.removeAttribute("class");
+}
+</script>
+
+
+<foreignObject width="500" height="500" y="300">
+
+<div xmlns="http://www.w3.org/1999/xhtml">
+
+<table border="1">
+ <tr>
+ <td>Foo</td>
+ </tr>
+ <tr>
+ <td><input type="text" value="Baz" id="sss" /></td>
+ </tr>
+</table>
+
+</div>
+
+</foreignObject>
+
+
+</svg>
diff --git a/layout/svg/crashtests/366956-1.svg b/layout/svg/crashtests/366956-1.svg
new file mode 100644
index 0000000000..9836c7ea3a
--- /dev/null
+++ b/layout/svg/crashtests/366956-1.svg
@@ -0,0 +1,61 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom1, 50);" class="reftest-wait">
+
+<html:script>
+
+function boom1()
+{
+ document.getElementsByTagName("mi")[0].setAttribute('id', "ffff");
+
+ document.getElementById("fo").appendChild(document.createTextNode(" "));
+
+ setTimeout(boom2, 50);
+}
+
+function boom2()
+{
+ var fodiv = document.getElementById("fodiv");
+ fodiv.parentNode.removeChild(fodiv);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+
+ <g>
+ <foreignObject width="500" height="500" transform="scale(.7,.7)" id="fo" y="300">
+
+<div id="fodiv" xmlns="http://www.w3.org/1999/xhtml">
+
+
+
+<p>0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99</p>
+
+
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+<mrow>
+ <mi>A</mi>
+</mrow>
+</math></div>
+
+
+<svg xmlns="http://www.w3.org/2000/svg" id="svg" viewbox="0 0 250 250" width="100" height="100">
+ <style type="text/css">
+ circle:hover {fill-opacity:0.9;}
+ </style>
+
+ <g style="fill-opacity:0.7;" transform="scale(.2)">
+ <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black; stroke-width:0.1cm" transform="translate(0,50)" />
+ <circle cx="6.5cm" cy="2cm" r="100" style="fill:blue; stroke:black; stroke-width:0.1cm" transform="translate(70,150)" />
+ <circle cx="6.5cm" cy="2cm" r="100" style="fill:green; stroke:black; stroke-width:0.1cm" transform="translate(-70,150)"/>
+ </g>
+</svg>
+
+</div>
+</foreignObject>
+</g>
+
+
+
+</svg>
diff --git a/layout/svg/crashtests/366956-2.svg b/layout/svg/crashtests/366956-2.svg
new file mode 100644
index 0000000000..a2ab21ed55
--- /dev/null
+++ b/layout/svg/crashtests/366956-2.svg
@@ -0,0 +1,61 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom1, 30);" class="reftest-wait">
+
+<html:script>
+
+function boom1()
+{
+ document.getElementsByTagName("mi")[0].setAttribute('id', "ffff");
+
+ document.getElementById("fo").appendChild(document.createTextNode(" "));
+
+ boom2();
+}
+
+function boom2()
+{
+ var fodiv = document.getElementById("fodiv");
+ fodiv.parentNode.removeChild(fodiv);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+
+ <g>
+ <foreignObject width="500" height="500" transform="scale(.7,.7)" id="fo" y="300">
+
+<div id="fodiv" xmlns="http://www.w3.org/1999/xhtml">
+
+
+
+<p>0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 990 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99</p>
+
+
+
+<div><math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+<mrow>
+ <mi>A</mi>
+</mrow>
+</math></div>
+
+
+<svg xmlns="http://www.w3.org/2000/svg" id="svg" viewbox="0 0 250 250" width="100" height="100">
+ <style type="text/css">
+ circle:hover {fill-opacity:0.9;}
+ </style>
+
+ <g style="fill-opacity:0.7;" transform="scale(.2)">
+ <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black; stroke-width:0.1cm" transform="translate(0,50)" />
+ <circle cx="6.5cm" cy="2cm" r="100" style="fill:blue; stroke:black; stroke-width:0.1cm" transform="translate(70,150)" />
+ <circle cx="6.5cm" cy="2cm" r="100" style="fill:green; stroke:black; stroke-width:0.1cm" transform="translate(-70,150)"/>
+ </g>
+</svg>
+
+</div>
+</foreignObject>
+</g>
+
+
+
+</svg>
diff --git a/layout/svg/crashtests/367111-1.svg b/layout/svg/crashtests/367111-1.svg
new file mode 100644
index 0000000000..dcf6a39bf7
--- /dev/null
+++ b/layout/svg/crashtests/367111-1.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ onload="setTimeout(boom, 30);"
+ class="reftest-wait">
+
+<html:script>
+
+function boom()
+{
+ document.getElementById("text").appendChild(document.getElementById("fo"));
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<defs>
+ <marker>
+ <text id="text">svg:text</text>
+ </marker>
+</defs>
+
+<foreignObject id="fo">
+ <div xmlns="http://www.w3.org/1999/xhtml">
+ <p>HTML in a foreignObject</p>
+ </div>
+</foreignObject>
+
+</svg>
diff --git a/layout/svg/crashtests/367368-1.xhtml b/layout/svg/crashtests/367368-1.xhtml
new file mode 100644
index 0000000000..b9bcd3241b
--- /dev/null
+++ b/layout/svg/crashtests/367368-1.xhtml
@@ -0,0 +1,12 @@
+<!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=367368 -->
+<!-- Just checking for crash, nothing more -->
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body>
+
+ <svg xmlns="http://www.w3.org/2000/svg">
+ <circle cx="6.5cm" cy="2cm" r="100" style="fill:red; stroke:black;" transform="translate(0,50)" />
+ </svg>
+
+ </body>
+</html>
diff --git a/layout/svg/crashtests/369233-1.svg b/layout/svg/crashtests/369233-1.svg
new file mode 100644
index 0000000000..22f4aacb37
--- /dev/null
+++ b/layout/svg/crashtests/369233-1.svg
@@ -0,0 +1,33 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:html="http://www.w3.org/1999/xhtml"
+ onload="setTimeout(boom, 200);"
+ class="reftest-wait">
+
+<html:script>
+
+function boom()
+{
+ try {
+ document.getElementById("grad2").gradientUnits.baseVal = "y";
+ } catch (e) {
+ }
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+
+
+<radialGradient id="grad2" gradientUnits="userSpaceOnUse" cx="240" cy="210" r="220" fx="240" fy="210">
+ <stop stop-color="black" offset="0"/>
+ <stop stop-color="yellow" offset="0.2"/>
+ <stop stop-color="red" offset="0.4"/>
+ <stop stop-color="blue" offset="0.6"/>
+ <stop stop-color="white" offset="0.8"/>
+ <stop stop-color="green" offset="1"/>
+</radialGradient>
+
+<rect x="20" y="150" width="440" height="80" fill="url(#grad2)" stroke-width="40"/>
+
+</svg>
diff --git a/layout/svg/crashtests/369438-1.svg b/layout/svg/crashtests/369438-1.svg
new file mode 100644
index 0000000000..78bcb6b54d
--- /dev/null
+++ b/layout/svg/crashtests/369438-1.svg
@@ -0,0 +1,24 @@
+<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom, 30);" class="reftest-wait"><html:script src="data:text/javascript,"></html:script><html:script>
+
+function boom()
+{
+ var defs = document.getElementById("defs");
+ defs.parentNode.removeChild(defs);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<defs id="defs">
+<filter id="Gaussian_Blur">
+<feGaussianBlur in="SourceGraphic" stdDeviation="3"/>
+</filter>
+</defs>
+
+<ellipse cx="200" cy="150" rx="70" ry="40"
+style="fill:#ff0000;stroke:#000000;
+stroke-width:2;filter:url(#Gaussian_Blur)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/369438-2.svg b/layout/svg/crashtests/369438-2.svg
new file mode 100644
index 0000000000..92eea9ee0f
--- /dev/null
+++ b/layout/svg/crashtests/369438-2.svg
@@ -0,0 +1,27 @@
+<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml" onload="setTimeout(boom, 30);" class="reftest-wait"><html:script>
+
+function boom()
+{
+ var defs = document.getElementById("defs");
+ var gb = document.getElementById("Gaussian_Blur");
+
+ defs.parentNode.removeChild(defs);
+ gb.removeChild(gb.firstChild); // remove a whitespace text node (!)
+
+ document.documentElement.removeAttribute("class");
+}
+
+</html:script>
+
+<defs id="defs">
+<filter id="Gaussian_Blur">
+<feGaussianBlur in="SourceGraphic" stdDeviation="3"/>
+</filter>
+</defs>
+
+<ellipse cx="200" cy="150" rx="70" ry="40"
+style="fill:#ff0000;stroke:#000000;
+stroke-width:2;filter:url(#Gaussian_Blur)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/371463-1.xhtml b/layout/svg/crashtests/371463-1.xhtml
new file mode 100644
index 0000000000..461fb27ba3
--- /dev/null
+++ b/layout/svg/crashtests/371463-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:svg="http://www.w3.org/2000/svg">
+<body>
+
+<select><svg:svg><svg:foreignObject/></svg:svg></select>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/371563-1.xhtml b/layout/svg/crashtests/371563-1.xhtml
new file mode 100644
index 0000000000..0ebdc9bfa1
--- /dev/null
+++ b/layout/svg/crashtests/371563-1.xhtml
@@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("sdiv").style.overflow = "scroll";
+
+ document.documentElement.removeAttribute("class");
+}
+
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+ <div id="sdiv" style="float: left;">
+
+ <svg xmlns="http://www.w3.org/2000/svg" height="400px" width="400px"
+ y="0.0000000" x="0.0000000" version="1.0" >
+ <defs>
+ <marker id="Arrow"/>
+ </defs>
+ <path style="marker-end:url(#Arrow)"
+ d="M 12.500000,200.00000 L 387.50000,200.00000" />
+ </svg>
+
+ </div>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/375775-1.svg b/layout/svg/crashtests/375775-1.svg
new file mode 100644
index 0000000000..cd17c85a94
--- /dev/null
+++ b/layout/svg/crashtests/375775-1.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30);" class="reftest-wait">
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("filter").style.display = "none";
+ document.getElementById("path").style.display = "none";
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<filter id="filter" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="120" />
+
+<g filter="url(#filter)">
+ <path id="path"
+ fill="black"
+ d="M60,80 C30,80 30,40 60,40 L140,40 C170,40 170,80 140,80 z" />
+</g>
+
+</svg>
diff --git a/layout/svg/crashtests/378716.svg b/layout/svg/crashtests/378716.svg
new file mode 100644
index 0000000000..b6faa00284
--- /dev/null
+++ b/layout/svg/crashtests/378716.svg
@@ -0,0 +1,4 @@
+<svg width="100%" height="100%" x="0" y="0" viewBox="0 0 1 1"
+ xmlns="http://www.w3.org/2000/svg">
+ <text id="text_1" x="0.5" y="0.5" font-size="0.05" fill="green">Okay Text</text>
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/380691-1.svg b/layout/svg/crashtests/380691-1.svg
new file mode 100644
index 0000000000..ed28552633
--- /dev/null
+++ b/layout/svg/crashtests/380691-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <mask id="m"/>
+ <foreignObject mask="url(#m)"/>
+</svg>
diff --git a/layout/svg/crashtests/384391-1.xhtml b/layout/svg/crashtests/384391-1.xhtml
new file mode 100644
index 0000000000..12c657a48c
--- /dev/null
+++ b/layout/svg/crashtests/384391-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg" >
+<head>
+<script>
+
+function boom()
+{
+ var circle = document.getElementById("circle");
+ document.removeChild(document.documentElement);
+ document.appendChild(circle);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<svg:circle id="circle" />
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/384499-1.svg b/layout/svg/crashtests/384499-1.svg
new file mode 100644
index 0000000000..f448910008
--- /dev/null
+++ b/layout/svg/crashtests/384499-1.svg
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<html:style>
+ #mathy { display: table}
+</html:style>
+
+<foreignObject width="500" height="500" y="50">
+ <div xmlns="http://www.w3.org/1999/xhtml">
+ <p>Foo</p>
+ <div>
+ <math xmlns="http://www.w3.org/1998/Math/MathML" id="mathy" display="block">
+ <mrow>
+ <mi>x</mi>
+ </mrow>
+ </math>
+ </div>
+ </div>
+</foreignObject>
+
+</svg>
diff --git a/layout/svg/crashtests/384637-1.svg b/layout/svg/crashtests/384637-1.svg
new file mode 100644
index 0000000000..263a2d556a
--- /dev/null
+++ b/layout/svg/crashtests/384637-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" baseProfile="basic" width="100%" height="100%" viewBox="0 0 480 360">
+
+ <mask id="mask1" maskUnits="userSpaceOnUse" x="60" y="50" width="100" height="60">
+ <rect x="60" y="50" width="100" height="60" fill="yellow" mask="url(#mask1)"/>
+ </mask>
+
+ <rect x="60" y="50" width="100" height="60" fill="lime" mask="url(#mask1)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/384728-1.svg b/layout/svg/crashtests/384728-1.svg
new file mode 100644
index 0000000000..ccafc83706
--- /dev/null
+++ b/layout/svg/crashtests/384728-1.svg
@@ -0,0 +1,21 @@
+<svg xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script>
+
+function boom()
+{
+ document.getElementById("thhh").setAttributeNS("http://www.w3.org/1999/xlink", 'href', '');
+}
+
+</script>
+
+ <defs>
+ <g id="ch" style="counter-reset: c;">
+ <rect x="75" y="0" width="75" height="75" fill="lightgreen" style="counter-increment: c;"/>
+ </g>
+
+ </defs>
+
+ <use id="thhh" x="0" y="0"><use xlink:href="#ch" x="0" y="0"/></use>
+
+</svg>
diff --git a/layout/svg/crashtests/385246-1.svg b/layout/svg/crashtests/385246-1.svg
new file mode 100644
index 0000000000..cddad0c5e4
--- /dev/null
+++ b/layout/svg/crashtests/385246-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<foreignObject x="100" y="100" width="-2" height="500">
+ <div xmlns="http://www.w3.org/1999/xhtml">
+ <p>Foo</p>
+ </div>
+</foreignObject>
+
+</svg>
diff --git a/layout/svg/crashtests/385246-2.svg b/layout/svg/crashtests/385246-2.svg
new file mode 100644
index 0000000000..c392f2fc8a
--- /dev/null
+++ b/layout/svg/crashtests/385246-2.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<script type="text/javascript" xlink:href="data:text/javascript,"></script>
+
+
+<foreignObject width="-2" height="500" id="fo" x="300">
+ <div xmlns="http://www.w3.org/1999/xhtml">
+ <p>Hi!!!</p>
+ </div>
+</foreignObject>
+
+
+
+
+</svg>
diff --git a/layout/svg/crashtests/385552-1.svg b/layout/svg/crashtests/385552-1.svg
new file mode 100644
index 0000000000..019e249d77
--- /dev/null
+++ b/layout/svg/crashtests/385552-1.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<script>
+document.createElementNS("http://www.w3.org/2000/svg", "svg").unsuspendRedrawAll();
+</script>
diff --git a/layout/svg/crashtests/385552-2.svg b/layout/svg/crashtests/385552-2.svg
new file mode 100644
index 0000000000..9a93d657fb
--- /dev/null
+++ b/layout/svg/crashtests/385552-2.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<script>
+document.createElementNS("http://www.w3.org/2000/svg", "svg").suspendRedraw(3);
+</script>
diff --git a/layout/svg/crashtests/385840-1.svg b/layout/svg/crashtests/385840-1.svg
new file mode 100644
index 0000000000..cf7ff6949c
--- /dev/null
+++ b/layout/svg/crashtests/385840-1.svg
@@ -0,0 +1,20 @@
+<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script>
+
+function boom()
+{
+ var SVG_NS = "http://www.w3.org/2000/svg";
+
+ var svgCircle = document.createElementNS(SVG_NS, 'circle');
+ var svgText = document.createElementNS(SVG_NS, 'text');
+ svgText.appendChild(document.createTextNode("foo"));
+ svgCircle.appendChild(svgText);
+
+ document.removeChild(document.documentElement);
+ document.appendChild(svgCircle);
+}
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/385852-1.svg b/layout/svg/crashtests/385852-1.svg
new file mode 100644
index 0000000000..17ad99ca8f
--- /dev/null
+++ b/layout/svg/crashtests/385852-1.svg
@@ -0,0 +1,34 @@
+<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg" onload="setTimeout(boom, 30)" class="reftest-wait">
+
+<script>
+
+var originalRoot = document.documentElement;
+var svgCircle;
+
+function boom()
+{
+ var SVG_NS = "http://www.w3.org/2000/svg";
+
+ var svgPolyline = document.createElementNS(SVG_NS, 'polyline');
+ svgCircle = document.createElementNS(SVG_NS, 'circle');
+
+ svgCircle.appendChild(svgPolyline);
+
+ document.removeChild(originalRoot);
+ document.appendChild(svgCircle);
+
+ setTimeout(restore, 30);
+}
+
+function restore()
+{
+ // We have to put it the root element back in the document so that reftest.js
+ // sees the event for the removal of class="reftest-wait"!
+ document.removeChild(svgCircle);
+ document.appendChild(originalRoot);
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/386475-1.xhtml b/layout/svg/crashtests/386475-1.xhtml
new file mode 100644
index 0000000000..4d1b9a2808
--- /dev/null
+++ b/layout/svg/crashtests/386475-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:svg="http://www.w3.org/2000/svg">
+<head>
+<script>
+function boom()
+{
+ document.body.style.display = "table-header-group";
+ document.getElementById("svg").setAttribute('height', 1);
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+<svg:svg width="100%" height="100%" id="svg">
+ <svg:g>
+ <svg:foreignObject width="8205em" height="100%">
+ <span>hello</span> <span>world</span>
+ </svg:foreignObject>
+ </svg:g>
+</svg:svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/386690-1.svg b/layout/svg/crashtests/386690-1.svg
new file mode 100644
index 0000000000..e206978134
--- /dev/null
+++ b/layout/svg/crashtests/386690-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 40">
+ <foreignObject width="-2" height="100" />
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/387290-1.svg b/layout/svg/crashtests/387290-1.svg
new file mode 100644
index 0000000000..4ac8463204
--- /dev/null
+++ b/layout/svg/crashtests/387290-1.svg
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+<!--
+Copyright Georgi Guninski
+-->
+
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+
+<svg version="1.1"
+xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"
+>
+<defs>
+<filter id="dafilter" filterUnits="userSpaceOnUse"
+x="0" y="0" width="4194305" height="17">
+<feGaussianBlur in="SourceAlpha" stdDeviation="4" result="blur"/>
+</filter>
+</defs>
+<g>
+
+<rect fill="red" width="256" height="256" filter="url(#dafilter)" transform="scale(262145,9)" />
+</g>
+
+</svg>
diff --git a/layout/svg/crashtests/402408-1.svg b/layout/svg/crashtests/402408-1.svg
new file mode 100644
index 0000000000..f442b2171e
--- /dev/null
+++ b/layout/svg/crashtests/402408-1.svg
@@ -0,0 +1,32 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ onload="boom();"
+ class="reftest-wait">
+
+<script>
+
+function boom()
+{
+ var grad1 = document.getElementById("grad1");
+ var grad2 = document.getElementById("grad2");
+
+ grad1.appendChild(grad2);
+
+ setTimeout(function() {
+ grad1.removeChild(grad2);
+ document.documentElement.removeAttribute("class");
+ }, 30);
+}
+
+</script>
+
+<linearGradient id="grad1" gradientUnits="objectBoundingBox" x1="0" y1="0" x2="1" y2="0">
+ <stop id="green" stop-color="#00dd00" offset="0"/>
+ <stop id="blue" stop-color="#0000dd" offset="1"/>
+</linearGradient>
+
+<linearGradient id="grad2" xlink:href="#grad1"/>
+
+<rect x="20" y="20" width="440" height="80" fill="url(#grad2)" />
+
+</svg>
diff --git a/layout/svg/crashtests/404677-1.xhtml b/layout/svg/crashtests/404677-1.xhtml
new file mode 100644
index 0000000000..c1df3869b9
--- /dev/null
+++ b/layout/svg/crashtests/404677-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg">
+<head>
+</head>
+<body>
+
+<svg:svg height="-2" width="5" />
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/409565-1.xhtml b/layout/svg/crashtests/409565-1.xhtml
new file mode 100644
index 0000000000..2c427ccc8b
--- /dev/null
+++ b/layout/svg/crashtests/409565-1.xhtml
@@ -0,0 +1,3 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="white-space: pre;"><body style="width: 24px; height: 24px; column-width: 200px;">
+
+ <svg xmlns="http://www.w3.org/2000/svg" style="float: left;"></svg></body></html>
diff --git a/layout/svg/crashtests/420697-1.svg b/layout/svg/crashtests/420697-1.svg
new file mode 100644
index 0000000000..d8b7f38340
--- /dev/null
+++ b/layout/svg/crashtests/420697-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <text stroke="black" y="1em"
+ stroke-dashoffset="1%"
+ stroke-dasharray="1px">
+ m
+ </text>
+</svg>
diff --git a/layout/svg/crashtests/420697-2.svg b/layout/svg/crashtests/420697-2.svg
new file mode 100644
index 0000000000..8987693e50
--- /dev/null
+++ b/layout/svg/crashtests/420697-2.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <text stroke="black" y="1em"
+ stroke-dasharray="1%">
+ m
+ </text>
+</svg>
diff --git a/layout/svg/crashtests/429774-1.svg b/layout/svg/crashtests/429774-1.svg
new file mode 100644
index 0000000000..00b726de6a
--- /dev/null
+++ b/layout/svg/crashtests/429774-1.svg
@@ -0,0 +1,29 @@
+<?xml version="1.0"?>
+
+<svg width="7.5cm" height="5cm" viewBox="0 0 200 120"
+ xmlns="http://www.w3.org/2000/svg">
+
+ <defs>
+ <filter id="MyFilter" filterUnits="userSpaceOnUse" x="0" y="0" width="200" height="120">
+
+ <feOffset in="SourceAlpha" result="offset" dx="4" dy="4" y="76"/>
+
+ <feSpecularLighting in="offset" result="specOut"
+ surfaceScale="5" specularConstant=".75" specularExponent="20">
+ <fePointLight x="-5000" y="-10000" z="20000"/>
+ </feSpecularLighting>
+
+ <feComposite in="SourceAlpha" in2="SourceAlpha" result="litPaint"
+ operator="arithmetic" k1="0" k2="1" k3="1" k4="0"/>
+
+ <feMerge>
+ <feMergeNode in="offset"/>
+ <feMergeNode in="litPaint"/>
+ </feMerge>
+
+ </filter>
+ </defs>
+
+ <g filter="url(#MyFilter)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/441368-1.svg b/layout/svg/crashtests/441368-1.svg
new file mode 100644
index 0000000000..d0fee7478b
--- /dev/null
+++ b/layout/svg/crashtests/441368-1.svg
@@ -0,0 +1,31 @@
+<?xml version="1.0" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+ - License, v. 2.0. If a copy of the MPL was not distributed with this
+ - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+<!--
+Copyright Georgi Guninski
+-->
+
+
+<svg width="100%" height="100%" version="1.1"
+xmlns="http://www.w3.org/2000/svg">
+
+<defs>
+<filter id="MyFilter" filterUnits="userSpaceOnUse"
+x="0" y="0" width="32769" height="32769">
+
+<feGaussianBlur in="SourceAlpha" stdDeviation="2147483648" result="blur"/>
+
+</filter>
+</defs>
+
+<rect x="1" y="1" width="198" height="118" fill="#cccccc" />
+
+<g filter="url(#MyFilter)">
+<text fill="#FFFFFF" stroke="black" font-size="45"
+x="42" y="42">Feck b1ll</text>
+</g>
+
+</svg>
diff --git a/layout/svg/crashtests/453754-1.svg b/layout/svg/crashtests/453754-1.svg
new file mode 100644
index 0000000000..a32d819281
--- /dev/null
+++ b/layout/svg/crashtests/453754-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+ <filter id="f" height="-1"/>
+
+ <rect filter="url(#f)" />
+
+</svg>
diff --git a/layout/svg/crashtests/455314-1.xhtml b/layout/svg/crashtests/455314-1.xhtml
new file mode 100644
index 0000000000..01bb33d653
--- /dev/null
+++ b/layout/svg/crashtests/455314-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head>
+<script>
+function doe() {
+document.getElementById('a').appendChild(document.body);
+}
+setTimeout(doe, 100);
+</script>
+</head>
+<body>
+<div style="position: absolute; -moz-appearance: button; filter: url(#b); "></div>
+<pre style="position: absolute;">
+<table id="b"></table>
+</pre>
+</body>
+<div id="a"/>
+</html> \ No newline at end of file
diff --git a/layout/svg/crashtests/458453.html b/layout/svg/crashtests/458453.html
new file mode 100644
index 0000000000..ab72d46dee
--- /dev/null
+++ b/layout/svg/crashtests/458453.html
@@ -0,0 +1,24 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+var i = 0;
+
+function bouncy()
+{
+ var body = document.body;
+ document.documentElement.removeChild(body);
+ document.documentElement.appendChild(body);
+
+ if (++i < 30)
+ setTimeout(bouncy, 1);
+ else
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="bouncy();"><span id="a"></span><span style="filter: url(#a);"><span style="filter: url(#a);">B</span></span></body>
+
+</html>
diff --git a/layout/svg/crashtests/459666-1.html b/layout/svg/crashtests/459666-1.html
new file mode 100644
index 0000000000..69074b6028
--- /dev/null
+++ b/layout/svg/crashtests/459666-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html style="filter: url(#e);">
+<head></head>
+<body onload="document.documentElement.style.counterReset = 'a';">
+<div id="e"></div>
+</body>
+</html>
diff --git a/layout/svg/crashtests/459883.xhtml b/layout/svg/crashtests/459883.xhtml
new file mode 100644
index 0000000000..e125e71d8a
--- /dev/null
+++ b/layout/svg/crashtests/459883.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="filter: url(#r);" class="reftest-wait"><head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("s").setAttribute("style", "display: -moz-box;");
+ document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", function() { setTimeout(boom, 0); }, false);
+
+</script>
+</head><body><ms xmlns="http://www.w3.org/1998/Math/MathML" id="s"><maction id="r"/></ms></body></html>
diff --git a/layout/svg/crashtests/461289-1.svg b/layout/svg/crashtests/461289-1.svg
new file mode 100644
index 0000000000..82a57f81b0
--- /dev/null
+++ b/layout/svg/crashtests/461289-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<script type="text/javascript">
+
+function boom()
+{
+ var f = document.getElementById("filter1");
+ f.appendChild(document.createElementNS("http://www.w3.org/2000/svg", "feImage"));
+ f.appendChild(document.getElementById("rect"));
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+<filter id="filter1"/><rect id="rect" filter="url(#filter1)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/464374-1.svg b/layout/svg/crashtests/464374-1.svg
new file mode 100644
index 0000000000..9844e5187f
--- /dev/null
+++ b/layout/svg/crashtests/464374-1.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="boom();">
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("b").appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "math"));
+ document.getElementById("defs").setAttribute("filter", "url(#a)");
+}
+
+</script>
+
+<defs id="defs"><filter id="a"/><g id="b"><rect/></g></defs>
+
+</svg>
diff --git a/layout/svg/crashtests/466585-1.svg b/layout/svg/crashtests/466585-1.svg
new file mode 100644
index 0000000000..22ad862e15
--- /dev/null
+++ b/layout/svg/crashtests/466585-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script type="text/javascript">
+
+window.addEventListener("load", boom, false);
+
+function boom()
+{
+ document.getElementById("rect").setAttribute("filter", "url(#filter)");
+ document.getElementById("defs").setAttribute("fill", "red");
+}
+
+</script>
+
+<defs id="defs"><filter id="filter"/><rect id="rect"/></defs>
+
+</svg>
diff --git a/layout/svg/crashtests/467323-1.svg b/layout/svg/crashtests/467323-1.svg
new file mode 100644
index 0000000000..9d757c349d
--- /dev/null
+++ b/layout/svg/crashtests/467323-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="500" height="500">
+
+<filter id="f1" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse">
+ <feFlood flood-color="#ff0000" result="flood" x="0" y="0" width="100" height="100"/>
+ <feDisplacementMap style="color-interpolation-filters:sRGB"
+ in="SourceGraphic" in2="flood" scale="100" xChannelSelector="R" yChannelSelector="G"/>
+</filter>
+<g filter="url(#f1)"></g>
+
+</svg>
diff --git a/layout/svg/crashtests/467498-1.svg b/layout/svg/crashtests/467498-1.svg
new file mode 100644
index 0000000000..9839e6c30d
--- /dev/null
+++ b/layout/svg/crashtests/467498-1.svg
@@ -0,0 +1,12 @@
+<!--
+ Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/licenses/publicdomain/
+-->
+<svg width="100%" height="100%" xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink">
+ <use id="a" width="100" height="100" xlink:href="#b"/>
+ <use id="b" x="100" y="100" width="100" height="100" xlink:href="#a"/>
+ <script>
+ document.getElementById("a").setAttribute("width", "200");
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/470124-1.svg b/layout/svg/crashtests/470124-1.svg
new file mode 100644
index 0000000000..ba3b8aff40
--- /dev/null
+++ b/layout/svg/crashtests/470124-1.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<filter id="f7" filterUnits="userSpaceOnUse" primitiveUnits="objectBoundingBox"><feComposite/></filter>
+
+<g filter="url(#f7)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/472782-1.svg b/layout/svg/crashtests/472782-1.svg
new file mode 100644
index 0000000000..7cfeb11a69
--- /dev/null
+++ b/layout/svg/crashtests/472782-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="r">
+<text><textPath xlink:href="#r">S</textPath> </text>
+</svg>
diff --git a/layout/svg/crashtests/474700-1.svg b/layout/svg/crashtests/474700-1.svg
new file mode 100644
index 0000000000..141a1b3903
--- /dev/null
+++ b/layout/svg/crashtests/474700-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><filter id="f1" height="-2"/><rect width="50" height="100" filter="url(#f1)"/></svg>
diff --git a/layout/svg/crashtests/475181-1.svg b/layout/svg/crashtests/475181-1.svg
new file mode 100644
index 0000000000..ef5a638afb
--- /dev/null
+++ b/layout/svg/crashtests/475181-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><filter id="filter1"><feImage y="4095"/><feTile/></filter><rect width="100%" height="100%" filter="url(#filter1)"/></svg>
diff --git a/layout/svg/crashtests/475193-1.html b/layout/svg/crashtests/475193-1.html
new file mode 100644
index 0000000000..edc08bcee4
--- /dev/null
+++ b/layout/svg/crashtests/475193-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+
+
+<style type="text/css">
+
+.p { marker: url('#c'); }
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("a").setAttribute("class", "p");
+ document.documentElement.offsetHeight;
+ document.getElementById("b").setAttribute("id", "c");
+}
+
+</script>
+</head><body onload="boom();"><div class="p" id="a">C</div><div id="c"></div></body></html> \ No newline at end of file
diff --git a/layout/svg/crashtests/475302-1.svg b/layout/svg/crashtests/475302-1.svg
new file mode 100644
index 0000000000..4fdaa2213c
--- /dev/null
+++ b/layout/svg/crashtests/475302-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<style type="text/css">
+ tref { filter: url(#filter1); }
+</style>
+
+<filter id="filter1"><feFlood/></filter>
+
+<tref><polyline points="350,75 379,161 469,161 397,215 423,301 350,250 277,301 303,215 231,161 321,161"/></tref>
+
+</svg>
diff --git a/layout/svg/crashtests/477935-1.html b/layout/svg/crashtests/477935-1.html
new file mode 100644
index 0000000000..9c2ac5438a
--- /dev/null
+++ b/layout/svg/crashtests/477935-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css"> :root { filter: url('#g'); } </style>
+<style type="text/css" id="ccs"> .cc { content: 'X'; } </style>
+</head>
+<body onload="document.getElementById('ccs').disabled = true;">
+<div id="g"></div>
+<div class="cc">5</div>
+</body>
+</html>
diff --git a/layout/svg/crashtests/478128-1.svg b/layout/svg/crashtests/478128-1.svg
new file mode 100644
index 0000000000..a34552776a
--- /dev/null
+++ b/layout/svg/crashtests/478128-1.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <script type="text/javascript">
+
+ function boom()
+ {
+ document.documentElement.style.columnCount = '15';
+ }
+ window.onload = function() { setTimeout(boom, 20); };
+
+ </script>
+
+ <foreignObject width="50" height="50" filter="url(#f1)"/>
+
+ <filter id="f1"/>
+</svg>
diff --git a/layout/svg/crashtests/478511-1.svg b/layout/svg/crashtests/478511-1.svg
new file mode 100644
index 0000000000..75a4aaa9b2
--- /dev/null
+++ b/layout/svg/crashtests/478511-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" version="1.0">
+ <defs>
+ <pattern id="pattern"
+ x="0" y="0" width="200" height="200">
+ <circle fill="lime" r="100" cx="100" cy="100"/>
+ </pattern>
+ </defs>
+ <rect width="200" height="200" fill="url(#pattern)"/>
+</svg>
diff --git a/layout/svg/crashtests/483439-1.svg b/layout/svg/crashtests/483439-1.svg
new file mode 100644
index 0000000000..c9e9ebae1c
--- /dev/null
+++ b/layout/svg/crashtests/483439-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink">
+
+ <defs>
+ <path id="myTextPath"
+ d="M275,20
+ a1,1 0 0,0 100,0
+ "
+ />
+ </defs>
+
+ <svg y="15">
+ <text x="10" y="100" style="stroke: #000000;">
+ <textPath xlink:href="#myTextPath" >Text along a curved path...</textPath>
+ </text>
+ </svg>
+</svg>
diff --git a/layout/svg/crashtests/492186-1.svg b/layout/svg/crashtests/492186-1.svg
new file mode 100644
index 0000000000..7f4b6650ab
--- /dev/null
+++ b/layout/svg/crashtests/492186-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<altGlyphDef/>
+<script xmlns="http://www.w3.org/1999/xhtml">
+document.documentElement.getBBox();
+</script>
+</svg>
diff --git a/layout/svg/crashtests/508247-1.svg b/layout/svg/crashtests/508247-1.svg
new file mode 100644
index 0000000000..c8b36b905f
--- /dev/null
+++ b/layout/svg/crashtests/508247-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<definition-src>
+<path id="a"/>
+</definition-src>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">
+setTimeout(function() {document.getElementById('a').getCTM()},10);
+</script>
+</svg>
diff --git a/layout/svg/crashtests/512890-1.svg b/layout/svg/crashtests/512890-1.svg
new file mode 100644
index 0000000000..044f693892
--- /dev/null
+++ b/layout/svg/crashtests/512890-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <filter id="f" height="1em"/>
+ <rect width="50" height="50" filter="url(#f)"/>
+</svg>
diff --git a/layout/svg/crashtests/515288-1.html b/layout/svg/crashtests/515288-1.html
new file mode 100644
index 0000000000..d78cbbfbec
--- /dev/null
+++ b/layout/svg/crashtests/515288-1.html
@@ -0,0 +1,5 @@
+<script>
+var svgElem = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+document.createElement("script").appendChild(svgElem);
+svgElem.getScreenCTM();
+</script> \ No newline at end of file
diff --git a/layout/svg/crashtests/522394-1.svg b/layout/svg/crashtests/522394-1.svg
new file mode 100644
index 0000000000..f745c47dd2
--- /dev/null
+++ b/layout/svg/crashtests/522394-1.svg
@@ -0,0 +1,12 @@
+<!--
+ Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+<defs>
+ <filter id="f1" x="0" y="0" width="-100" height="-100" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse">
+ <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/>
+ </filter>
+</defs>
+<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/>
+</svg>
diff --git a/layout/svg/crashtests/522394-2.svg b/layout/svg/crashtests/522394-2.svg
new file mode 100644
index 0000000000..1b6f1f0892
--- /dev/null
+++ b/layout/svg/crashtests/522394-2.svg
@@ -0,0 +1,12 @@
+<!--
+ Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+<defs>
+ <filter id="f1" x="0" y="0" width="100000000" height="100000000" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse">
+ <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/>
+ </filter>
+</defs>
+<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/>
+</svg>
diff --git a/layout/svg/crashtests/522394-3.svg b/layout/svg/crashtests/522394-3.svg
new file mode 100644
index 0000000000..cf3483cfad
--- /dev/null
+++ b/layout/svg/crashtests/522394-3.svg
@@ -0,0 +1,12 @@
+<!--
+ Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/licenses/publicdomain/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+<defs>
+ <filter id="f1" x="0" y="0" width="4563402752" height="4563402752" filterUnits="userSpaceOnUse" primitiveUnits="userSpaceOnUse">
+ <feFlood flood-color="lime" x="0" y="0" width="100%" height="100%"/>
+ </filter>
+</defs>
+<rect x="10" y="10" width="10" height="10" filter="url(#f1)"/>
+</svg>
diff --git a/layout/svg/crashtests/566216-1.svg b/layout/svg/crashtests/566216-1.svg
new file mode 100644
index 0000000000..999aaf4f08
--- /dev/null
+++ b/layout/svg/crashtests/566216-1.svg
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg"><animate id="y"/><script>
+<![CDATA[
+
+function boom()
+{
+ var r = document.createRange();
+ r.setEnd(document.getElementById('y'), 0);
+ r.extractContents();
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</svg>
+
+
diff --git a/layout/svg/crashtests/587336-1.html b/layout/svg/crashtests/587336-1.html
new file mode 100644
index 0000000000..811f483dd7
--- /dev/null
+++ b/layout/svg/crashtests/587336-1.html
@@ -0,0 +1,9 @@
+<html>
+<head><script>
+function boom()
+{
+ var b = document.getElementById("b");
+ b.setAttributeNS(null, "style", "filter: url(#a);");
+}
+</script></head>
+<body onload="boom();" id="a"><span id="b">B</span></body></html>
diff --git a/layout/svg/crashtests/590291-1.svg b/layout/svg/crashtests/590291-1.svg
new file mode 100644
index 0000000000..db26fac3a8
--- /dev/null
+++ b/layout/svg/crashtests/590291-1.svg
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1" width="0cm" height="0cm">
+
+<text id="a">a</text>
+
+<script><![CDATA[
+var x=document.getElementById('a').getExtentOfChar(0);
+]]></script>
+</svg>
diff --git a/layout/svg/crashtests/601999-1.html b/layout/svg/crashtests/601999-1.html
new file mode 100644
index 0000000000..7e8a3d39de
--- /dev/null
+++ b/layout/svg/crashtests/601999-1.html
@@ -0,0 +1,5 @@
+<html class="reftest-wait">
+ <body onload="document.getElementsByTagName('div')[0].id='b';
+ document.documentElement.removeAttribute('class');"
+ ><div style="overflow-x: scroll; filter: url(#b)">abc</div></body>
+</html>
diff --git a/layout/svg/crashtests/605626-1.svg b/layout/svg/crashtests/605626-1.svg
new file mode 100644
index 0000000000..678b011797
--- /dev/null
+++ b/layout/svg/crashtests/605626-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<image width="10" height="10" xlink:href="data:text/plain,g"/>
+</svg>
diff --git a/layout/svg/crashtests/606914.xhtml b/layout/svg/crashtests/606914.xhtml
new file mode 100644
index 0000000000..fc019af573
--- /dev/null
+++ b/layout/svg/crashtests/606914.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="display: table; position: absolute; left: 2305843009213694000pc; bottom: 2452284pc; padding: 9931442138140%; border-bottom-right-radius: 1152921504606847000pc;">X</html>
diff --git a/layout/svg/crashtests/610594-1.html b/layout/svg/crashtests/610594-1.html
new file mode 100644
index 0000000000..ee48e762cc
--- /dev/null
+++ b/layout/svg/crashtests/610594-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<svg><path d="M 0 5 a 2 5 -30 104 -5" marker-mid="url(#q)"></path></svg>
+</body>
+</html>
diff --git a/layout/svg/crashtests/610954-1.html b/layout/svg/crashtests/610954-1.html
new file mode 100644
index 0000000000..f5080df8b8
--- /dev/null
+++ b/layout/svg/crashtests/610954-1.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html><body dir=rtl onload="document.getElementById('g').style.filter = 'url(#filter1)';"><span id="g">&#x200E;---</span></body></html>
diff --git a/layout/svg/crashtests/612662-1.svg b/layout/svg/crashtests/612662-1.svg
new file mode 100644
index 0000000000..73dc98ed19
--- /dev/null
+++ b/layout/svg/crashtests/612662-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="background: url(#a); direction: rtl; margin: -32944px;"></svg>
diff --git a/layout/svg/crashtests/612662-2.svg b/layout/svg/crashtests/612662-2.svg
new file mode 100644
index 0000000000..b46841132f
--- /dev/null
+++ b/layout/svg/crashtests/612662-2.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ style="direction: rtl; margin: -32944px;
+ background: url(data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%3E%3C%2Fsvg%3E)"></svg>
diff --git a/layout/svg/crashtests/612736-1.svg b/layout/svg/crashtests/612736-1.svg
new file mode 100644
index 0000000000..cb3044efd0
--- /dev/null
+++ b/layout/svg/crashtests/612736-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ class="reftest-wait">
+ <path id="path"/>
+ <text>
+ <textPath xlink:href="#path">f</textPath>
+ <textPath xlink:href="#path">f</textPath>
+ </text>
+
+ <script>
+ function boom()
+ {
+ var path = document.getElementById("path");
+ path.parentNode.removeChild(path);
+ document.documentElement.removeAttribute("class");
+ }
+ window.addEventListener("load", boom, false);
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/612736-2.svg b/layout/svg/crashtests/612736-2.svg
new file mode 100644
index 0000000000..30b8245a9f
--- /dev/null
+++ b/layout/svg/crashtests/612736-2.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink">
+ <path id="path" d="M0 100 h50" stroke="black"/>
+ <text>
+ <textPath xlink:href="#path">abc</textPath>
+ <textPath xlink:href="#path">def</textPath>
+ </text>
+</svg>
diff --git a/layout/svg/crashtests/614367-1.svg b/layout/svg/crashtests/614367-1.svg
new file mode 100644
index 0000000000..3af7b491da
--- /dev/null
+++ b/layout/svg/crashtests/614367-1.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+ <polygon id="p" transform="?" />
+ <script>
+ document.getElementById("p").transform.baseVal.removeItem(0);
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/620034-1.html b/layout/svg/crashtests/620034-1.html
new file mode 100644
index 0000000000..bfffd3ffac
--- /dev/null
+++ b/layout/svg/crashtests/620034-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+ var f = document.createElementNS("http://www.w3.org/2000/svg", "feFuncB");
+ var tvb = f.tableValues.baseVal;
+ f.setAttribute("tableValues", "3 7 5");
+ f.setAttribute("tableValues", "i");
+ tvb.numberOfItems;
+}
+
+boom();
+
+</script>
diff --git a/layout/svg/crashtests/621598-1.svg b/layout/svg/crashtests/621598-1.svg
new file mode 100644
index 0000000000..dd47967d35
--- /dev/null
+++ b/layout/svg/crashtests/621598-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <marker id="m1">
+ <rect/>
+ <marker>
+ <line id="z" marker-end="url(#m1)"/>
+ </marker>
+ </marker>
+ <script>
+ function boom()
+ {
+ document.getElementById("z").getBoundingClientRect();
+ }
+ window.addEventListener("load", boom, false);
+ </script>
+
+</svg>
diff --git a/layout/svg/crashtests/648819-1.html b/layout/svg/crashtests/648819-1.html
new file mode 100644
index 0000000000..727ca3e55f
--- /dev/null
+++ b/layout/svg/crashtests/648819-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<script>
+var p = document.createElementNS("http://www.w3.org/2000/svg", "pattern");
+p.setAttribute("patternTransform", "i");
+p.patternTransform.baseVal.clear();
+</script>
diff --git a/layout/svg/crashtests/655025-1.svg b/layout/svg/crashtests/655025-1.svg
new file mode 100644
index 0000000000..4501bb57fa
--- /dev/null
+++ b/layout/svg/crashtests/655025-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <text id="a">a</text>
+ <script>
+ document.getElementById("a").firstChild.nodeValue = "";
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/655025-2.svg b/layout/svg/crashtests/655025-2.svg
new file mode 100644
index 0000000000..601006e831
--- /dev/null
+++ b/layout/svg/crashtests/655025-2.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <text id="a">a</text>
+ <script>
+ document.getElementById("a").appendChild(document.createTextNode(""));
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/655025-3.svg b/layout/svg/crashtests/655025-3.svg
new file mode 100644
index 0000000000..43e06b6fc3
--- /dev/null
+++ b/layout/svg/crashtests/655025-3.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <script>
+ var a = document.createElementNS("http://www.w3.org/2000/svg", "text");
+ a.appendChild(document.createTextNode(""));
+ document.documentElement.appendChild(a);
+ a.getNumberOfChars();
+ document.documentElement.removeChild(a);
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/657077-1.svg b/layout/svg/crashtests/657077-1.svg
new file mode 100644
index 0000000000..b0165bd14a
--- /dev/null
+++ b/layout/svg/crashtests/657077-1.svg
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<svg id="a" requiredExtensions="x"/>
+
+<script>
+<![CDATA[
+
+function boom()
+{
+ document.getElementById("a").unsuspendRedrawAll();
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/669025-1.svg b/layout/svg/crashtests/669025-1.svg
new file mode 100644
index 0000000000..eb529da4e0
--- /dev/null
+++ b/layout/svg/crashtests/669025-1.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+ <script type="text/javascript">
+
+ document.createElementNS("http://www.w3.org/2000/svg", "filter").filterResX;
+
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/669025-2.svg b/layout/svg/crashtests/669025-2.svg
new file mode 100644
index 0000000000..ccecebef3c
--- /dev/null
+++ b/layout/svg/crashtests/669025-2.svg
@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+ <script type="text/javascript">
+
+ document.createElementNS("http://www.w3.org/2000/svg", "feGaussianBlur").stdDeviationX;
+
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/682411-1.svg b/layout/svg/crashtests/682411-1.svg
new file mode 100644
index 0000000000..92d0c0a725
--- /dev/null
+++ b/layout/svg/crashtests/682411-1.svg
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg" style="width: 0pt; padding: 100px;">
+ <filter id="s"/>
+ <g filter="url(#s)"><text>z</text></g>
+</svg>
diff --git a/layout/svg/crashtests/692203-1.svg b/layout/svg/crashtests/692203-1.svg
new file mode 100644
index 0000000000..8427b84268
--- /dev/null
+++ b/layout/svg/crashtests/692203-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <marker id="marker" markerWidth="0"/>
+ <path d="M0,0 L100,100 200,200" marker-mid="url(#marker)"/>
+</svg>
diff --git a/layout/svg/crashtests/692203-2.svg b/layout/svg/crashtests/692203-2.svg
new file mode 100644
index 0000000000..b59926dbba
--- /dev/null
+++ b/layout/svg/crashtests/692203-2.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <marker id="marker" markerHeight="0"/>
+ <path d="M0,0 L100,100 200,200" marker-mid="url(#marker)"/>
+</svg>
diff --git a/layout/svg/crashtests/693424-1.svg b/layout/svg/crashtests/693424-1.svg
new file mode 100644
index 0000000000..8485f6b617
--- /dev/null
+++ b/layout/svg/crashtests/693424-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <marker id="m">
+ <foreignObject/>
+ </marker>
+ <line marker-end="url(#m)"/>
+</svg>
diff --git a/layout/svg/crashtests/709920-1.svg b/layout/svg/crashtests/709920-1.svg
new file mode 100644
index 0000000000..5f25155307
--- /dev/null
+++ b/layout/svg/crashtests/709920-1.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ class="reftest-wait">
+ <!-- Test to be sure that a zero-sized-in-one-dimension viewBox doesn't
+ make us fail assertions. -->
+ <script>
+ document.addEventListener("MozReftestInvalidate", waitAndFinish, false);
+
+ function waitAndFinish() {
+ // Sadly, MozReftestInvalidate fires sooner than PaintPattern here, so
+ // we need to wait a little bit to give PaintPattern a chance to hit
+ // this bug.
+ setTimeout(finish, 100);
+ }
+
+ function finish() {
+ document.documentElement.removeAttribute("class");
+ }
+ </script>
+ <pattern id="test" viewBox="0 0 1 0">
+ <rect/>
+ </pattern>
+ <rect width="200" height="200" fill="url(#test)"/>
+</svg>
diff --git a/layout/svg/crashtests/709920-2.svg b/layout/svg/crashtests/709920-2.svg
new file mode 100644
index 0000000000..58c51111eb
--- /dev/null
+++ b/layout/svg/crashtests/709920-2.svg
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ class="reftest-wait">
+ <!-- Test to be sure that a zero-sized-in-one-dimension viewBox doesn't
+ make us fail assertions. -->
+ <script>
+ document.addEventListener("MozReftestInvalidate", waitAndFinish, false);
+
+ function waitAndFinish() {
+ // Sadly, MozReftestInvalidate fires sooner than PaintPattern here, so
+ // we need to wait a little bit to give PaintPattern a chance to hit
+ // this bug.
+ setTimeout(finish, 100);
+ }
+
+ function finish() {
+ document.documentElement.removeAttribute("class");
+ }
+ </script>
+ <pattern id="test" viewBox="0 0 0 1">
+ <rect/>
+ </pattern>
+ <rect width="200" height="200" fill="url(#test)"/>
+</svg>
diff --git a/layout/svg/crashtests/713413-1.svg b/layout/svg/crashtests/713413-1.svg
new file mode 100644
index 0000000000..7131202335
--- /dev/null
+++ b/layout/svg/crashtests/713413-1.svg
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<marker id="m"></marker>
+
+<script>
+window.addEventListener("load", function() {
+ document.getElementById("m").appendChild(document.createElementNS("http://www.w3.org/2000/svg", "foreignObject"));
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/722003-1.svg b/layout/svg/crashtests/722003-1.svg
new file mode 100644
index 0000000000..58e2d57734
--- /dev/null
+++ b/layout/svg/crashtests/722003-1.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<marker><foreignObject><span id="x" xmlns="http://www.w3.org/1999/xhtml"></span></foreignObject></marker>
+
+<script>
+
+window.addEventListener("load", function() {
+ document.getElementById("x").getClientRects();
+}, false);
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/725918-1.svg b/layout/svg/crashtests/725918-1.svg
new file mode 100644
index 0000000000..5ebdf33f69
--- /dev/null
+++ b/layout/svg/crashtests/725918-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <text stroke="url(#p)">t</text>
+ <pattern id="p"/>
+</svg>
diff --git a/layout/svg/crashtests/732836-1.svg b/layout/svg/crashtests/732836-1.svg
new file mode 100644
index 0000000000..a9abb46668
--- /dev/null
+++ b/layout/svg/crashtests/732836-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" >
+
+ <symbol id="z">
+ <use xlink:href="data:image/svg+xml,&lt;svg xmlns='http://www.w3.org/2000/svg' id='root' /&gt;#root" />
+ </symbol>
+
+ <use id="a" xlink:href="#z" width="20"/>
+
+ <script>
+ window.addEventListener("load", function() {
+ window.scrollByPages(0);
+ document.getElementById("a").removeAttribute("width");
+ document.elementFromPoint(0, 0);
+ }, false);
+ </script>
+
+</svg>
diff --git a/layout/svg/crashtests/740627-1.svg b/layout/svg/crashtests/740627-1.svg
new file mode 100644
index 0000000000..b74fcd2ddd
--- /dev/null
+++ b/layout/svg/crashtests/740627-1.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <pattern id="test" viewBox="0 0 10 10" height="-65%">
+ <rect/>
+ </pattern>
+ <rect width="100" height="100" fill="url(#test)"/>
+</svg>
diff --git a/layout/svg/crashtests/740627-2.svg b/layout/svg/crashtests/740627-2.svg
new file mode 100644
index 0000000000..6241ddaae5
--- /dev/null
+++ b/layout/svg/crashtests/740627-2.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <pattern id="test" viewBox="0 0 10 10" width="-65%">
+ <rect/>
+ </pattern>
+ <rect width="100" height="100" fill="url(#test)"/>
+</svg>
diff --git a/layout/svg/crashtests/743469.svg b/layout/svg/crashtests/743469.svg
new file mode 100644
index 0000000000..6affc6fab8
--- /dev/null
+++ b/layout/svg/crashtests/743469.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="border-width: 51703084143745256mm; border-left-style: dashed; border-top-left-radius: 3%; border-top-style: dashed; border-right-style: solid; border-image-outset: 10;">
+<script>
+document.elementFromPoint(20, 20);
+</script>
+</svg>
diff --git a/layout/svg/crashtests/757704-1.svg b/layout/svg/crashtests/757704-1.svg
new file mode 100644
index 0000000000..b7e610e0e1
--- /dev/null
+++ b/layout/svg/crashtests/757704-1.svg
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg"><script>
+<![CDATA[
+
+function boom()
+{
+ var rect = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+ document.documentElement.appendChild(rect);
+ document.removeChild(document.documentElement);
+ rect.getScreenCTM();
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script></svg>
diff --git a/layout/svg/crashtests/757718-1.svg b/layout/svg/crashtests/757718-1.svg
new file mode 100644
index 0000000000..fa948c6677
--- /dev/null
+++ b/layout/svg/crashtests/757718-1.svg
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var svgDoc = (new DOMParser).parseFromString("<svg xmlns='http://www.w3.org/2000/svg'></svg>", "image/svg+xml");
+ var svgRoot = svgDoc.documentElement;
+ var rf = svgRoot.requiredFeatures;
+ document.adoptNode(svgRoot);
+ Object.getOwnPropertyNames(rf);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/svg/crashtests/757751-1.svg b/layout/svg/crashtests/757751-1.svg
new file mode 100644
index 0000000000..7ab51d0d19
--- /dev/null
+++ b/layout/svg/crashtests/757751-1.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <defs>
+ <svg id="x" viewBox=" 0 0 10 10"/>
+ </defs>
+ <script>
+ window.addEventListener("load", function() { document.getElementById("x").setAttribute("width", "2"); }, false);
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/767056-1.svg b/layout/svg/crashtests/767056-1.svg
new file mode 100644
index 0000000000..b813d784b3
--- /dev/null
+++ b/layout/svg/crashtests/767056-1.svg
@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ width="100%"
+ class="reftest-wait">
+ <script>
+
+function resize() {
+ // Set the viewBox to the same width as the content area, but slightly
+ // higher. This checks that we don't enter an infinite reflow loop. See
+ // https://bugzilla.mozilla.org/show_bug.cgi?id=767056#c10
+ var viewBox = "0 0 " + window.innerWidth + " " + (window.innerHeight + 1);
+ document.documentElement.setAttribute("viewBox", viewBox);
+ document.documentElement.removeAttribute("class");
+}
+
+document.addEventListener("MozReftestInvalidate", resize, false);
+setTimeout(resize, 3000); // For non-gecko
+
+ </script>
+ <rect width="100%" height="100%"/>
+</svg>
diff --git a/layout/svg/crashtests/767535-1.xhtml b/layout/svg/crashtests/767535-1.xhtml
new file mode 100644
index 0000000000..2a923fcc6d
--- /dev/null
+++ b/layout/svg/crashtests/767535-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="columns: 2 auto;" class="reftest-wait">
+ <head>
+ <script>
+
+function test() {
+ var r = document.documentElement;
+ document.removeChild(r);
+ document.appendChild(r);
+ document.documentElement.removeAttribute("class");
+}
+
+ </script>
+ </head>
+ <body style="filter:url(#f);" onload="setTimeout(test, 0);">
+ <div>
+ </div>
+ <svg xmlns="http://www.w3.org/2000/svg">
+ <filter id="f"/>
+ </svg>
+ </body>
+</html>
+
diff --git a/layout/svg/crashtests/768087-1.html b/layout/svg/crashtests/768087-1.html
new file mode 100644
index 0000000000..9a7899f9d1
--- /dev/null
+++ b/layout/svg/crashtests/768087-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body onload="setTimeout(function() { document.body.innerHTML = '<span>x<svg viewbox=\'0 0 30 40\' ></svg></span>'; }, 0);"></body>
+</html>
diff --git a/layout/svg/crashtests/768351.svg b/layout/svg/crashtests/768351.svg
new file mode 100644
index 0000000000..50a4b9b9c4
--- /dev/null
+++ b/layout/svg/crashtests/768351.svg
@@ -0,0 +1,2 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="mask: url('data:text/plain,1#f');" />
+
diff --git a/layout/svg/crashtests/772313-1.svg b/layout/svg/crashtests/772313-1.svg
new file mode 100644
index 0000000000..c77af02b6e
--- /dev/null
+++ b/layout/svg/crashtests/772313-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="background: url(#d); width: 0.1px;"></svg>
diff --git a/layout/svg/crashtests/778492-1.svg b/layout/svg/crashtests/778492-1.svg
new file mode 100644
index 0000000000..76deda594e
--- /dev/null
+++ b/layout/svg/crashtests/778492-1.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<svg width="1cm" viewBox="0 0 1 1" xmlns="http://www.w3.org/2000/svg">
+<line x2="100" y2="100"/>
+</svg>
diff --git a/layout/svg/crashtests/779971-1.svg b/layout/svg/crashtests/779971-1.svg
new file mode 100644
index 0000000000..d57065a0ba
--- /dev/null
+++ b/layout/svg/crashtests/779971-1.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="r" class="reftest-wait">
+<text id="t"><textPath xlink:href="#r">x</textPath>1</text>
+<script>
+
+window.addEventListener("load", function() {
+ setTimeout(function() {
+ document.getElementById("t").lastChild.data = "2";
+
+ document.documentElement.removeAttribute("class");
+ }, 200);
+}, false);
+
+</script>
+</svg>
diff --git a/layout/svg/crashtests/780764-1.svg b/layout/svg/crashtests/780764-1.svg
new file mode 100644
index 0000000000..6f4eb970bb
--- /dev/null
+++ b/layout/svg/crashtests/780764-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+
+<marker id="marker"><path d="M100,0 l100,100 200,200" filter="url(#filter)"/></marker>
+
+<filter id="filter"/>
+
+<path d="M100,0 l100,100 200,200" marker-mid="url(#marker)"/>
+
+<script>
+window.addEventListener("load", function() {
+ setTimeout(function() {
+ document.getElementById("filter").style.fontWeight = "bold";
+ document.documentElement.removeAttribute("class");
+ }, 200);
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/780963-1.html b/layout/svg/crashtests/780963-1.html
new file mode 100644
index 0000000000..8cbeb1a37f
--- /dev/null
+++ b/layout/svg/crashtests/780963-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script>
+
+function tweak() {
+ document.body.offsetTop;
+
+ var feImage = document.getElementsByTagName("feImage")[0];
+ feImage.setAttribute('filter', 'url(#f1)')
+ document.body.offsetTop;
+
+ var child = document.createElementNS('http://www.w3.org/2000/svg', 'g')
+ feImage.appendChild(child);
+}
+
+ </script>
+ </head>
+ <body onload="tweak()">
+ <svg xmlns="http://www.w3.org/2000/svg">
+ <filter filterUnits="userSpaceOnUse" id="f1">
+ <feImage/>
+ </filter>
+ <rect height="100" width="100"/>
+ </svg>
+ </body>
+</html>
diff --git a/layout/svg/crashtests/782141-1.svg b/layout/svg/crashtests/782141-1.svg
new file mode 100644
index 0000000000..6f0af76ff4
--- /dev/null
+++ b/layout/svg/crashtests/782141-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" version="1.1"
+ onload="go()">
+ <script>
+
+function go() {
+ var f = document.getElementById('f');
+ var fm = document.getElementById('fm');
+ f.appendChild(fm.cloneNode(1));
+}
+
+ </script>
+ <filter id="f">
+ <feMorphology id="fm" radius="2147483500"/>
+ </filter>
+ <rect height="28" width="256" filter="url(#f)" />
+</svg>
diff --git a/layout/svg/crashtests/784061-1.svg b/layout/svg/crashtests/784061-1.svg
new file mode 100644
index 0000000000..6a9623154d
--- /dev/null
+++ b/layout/svg/crashtests/784061-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ class="reftest-wait">
+
+<defs><path id="x"/></defs>
+
+<script>
+function boom()
+{
+ document.getElementById("x").style.transform = "translate(0px)";
+ document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/788831-1.svg b/layout/svg/crashtests/788831-1.svg
new file mode 100644
index 0000000000..b6202a1324
--- /dev/null
+++ b/layout/svg/crashtests/788831-1.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <pattern id="pattern" width="40" height="40"><stop/></pattern>
+ <rect id="rect" width="200" height="100"/>
+ <use xlink:href="#rect" stroke="url(#pattern)" />
+</svg>
diff --git a/layout/svg/crashtests/789390-1.html b/layout/svg/crashtests/789390-1.html
new file mode 100644
index 0000000000..542037f229
--- /dev/null
+++ b/layout/svg/crashtests/789390-1.html
@@ -0,0 +1 @@
+<html style="transition: 1s;"><body onload="document.documentElement.style.stroke = '-moz-objectStroke';"></body></html>
diff --git a/layout/svg/crashtests/790072.svg b/layout/svg/crashtests/790072.svg
new file mode 100644
index 0000000000..b288251a7e
--- /dev/null
+++ b/layout/svg/crashtests/790072.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><text style="stroke: -moz-objectfill none;">abc</text></svg>
diff --git a/layout/svg/crashtests/791826-1.svg b/layout/svg/crashtests/791826-1.svg
new file mode 100644
index 0000000000..f42261a3ad
--- /dev/null
+++ b/layout/svg/crashtests/791826-1.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="position: fixed;">
+<script>
+<![CDATA[
+
+function boom()
+{
+ document.documentElement.setAttribute("preserveAspectRatio", "_");
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</svg>
diff --git a/layout/svg/crashtests/803562-1.svg b/layout/svg/crashtests/803562-1.svg
new file mode 100644
index 0000000000..e6fc91127e
--- /dev/null
+++ b/layout/svg/crashtests/803562-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<foreignObject width="500" height="500" style="-moz-appearance: checkbox;">
+ <option xmlns="http://www.w3.org/1999/xhtml"></option>
+</foreignObject>
+
+<script>
+<![CDATA[
+
+window.addEventListener("load", function() {
+ document.getElementsByTagName("option")[0].appendChild(document.createTextNode("Option 1"));
+}, false);
+
+]]>
+</script>
+
+</svg>
+
diff --git a/layout/svg/crashtests/808318-1.svg b/layout/svg/crashtests/808318-1.svg
new file mode 100644
index 0000000000..48907225cc
--- /dev/null
+++ b/layout/svg/crashtests/808318-1.svg
@@ -0,0 +1,2 @@
+<svg xmlns="http://www.w3.org/2000/svg" style="-moz-transform-style: preserve-3d"></svg>
+
diff --git a/layout/svg/crashtests/813420-1.svg b/layout/svg/crashtests/813420-1.svg
new file mode 100644
index 0000000000..d977c0e982
--- /dev/null
+++ b/layout/svg/crashtests/813420-1.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+ <svg id="i" style="mask: url(&quot;#none&quot;);">
+ <marker id="markerEnd"/><polygon marker-end="url(#markerEnd)" points="250,150 200,150"/>
+ </svg>
+ <script>
+
+window.addEventListener("MozReftestInvalidate", function() {
+ document.getElementById("i").style.mask = "url(#none)";
+ document.documentElement.removeAttribute("class");
+}, false);
+
+ </script>
+</svg>
+
diff --git a/layout/svg/crashtests/841163-1.svg b/layout/svg/crashtests/841163-1.svg
new file mode 100644
index 0000000000..b1bb5198ab
--- /dev/null
+++ b/layout/svg/crashtests/841163-1.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg" class="reftest-wait">
+
+<filter id="f"/>
+
+<g filter="url(#f)">
+ <text>AB</text>
+</g>
+
+<script>
+
+function forceFrameConstruction()
+{
+ document.documentElement.getBoundingClientRect();
+}
+
+function boom()
+{
+ document.getElementsByTagName("text")[0].firstChild.splitText(1);
+ forceFrameConstruction();
+ document.normalize();
+ forceFrameConstruction();
+ document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/841812-1.svg b/layout/svg/crashtests/841812-1.svg
new file mode 100644
index 0000000000..e5bcaa66ee
--- /dev/null
+++ b/layout/svg/crashtests/841812-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+ <text>
+ <circle>
+ <textPath id="t" xlink:href="data:text/html,1" />
+ </circle>
+ </text>
+
+ <script>
+ window.addEventListener("load", function() { document.getElementById("t").removeAttribute('xlink:href'); }, false);
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/842009-1.svg b/layout/svg/crashtests/842009-1.svg
new file mode 100644
index 0000000000..25656ba530
--- /dev/null
+++ b/layout/svg/crashtests/842009-1.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink">
+ <title id="hello">hello</title>
+ <text x="100" y="100"> <tref xlink:href="#hello"/></text>
+</svg>
diff --git a/layout/svg/crashtests/842630-1.svg b/layout/svg/crashtests/842630-1.svg
new file mode 100644
index 0000000000..8d36998be6
--- /dev/null
+++ b/layout/svg/crashtests/842630-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><text dy="20 20">A<tspan style="display: none;">B</tspan></text></svg>
diff --git a/layout/svg/crashtests/842909-1.svg b/layout/svg/crashtests/842909-1.svg
new file mode 100644
index 0000000000..9a1bc89eb4
--- /dev/null
+++ b/layout/svg/crashtests/842909-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <defs>
+ <text id="t">X</text>
+ </defs>
+
+ <script>
+ window.addEventListener("load", function() {
+ document.getElementById("t").getSubStringLength(0, 0);
+ }, false);
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/843072-1.svg b/layout/svg/crashtests/843072-1.svg
new file mode 100644
index 0000000000..590721f058
--- /dev/null
+++ b/layout/svg/crashtests/843072-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <defs>
+ <text id="t"></text>
+ </defs>
+
+ <script>
+ window.addEventListener("load", function() {
+ document.getElementById("t").getExtentOfChar(0);
+ }, false);
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/843917-1.svg b/layout/svg/crashtests/843917-1.svg
new file mode 100644
index 0000000000..55cf7ab186
--- /dev/null
+++ b/layout/svg/crashtests/843917-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+ <filter id="f"/>
+
+ <g filter="url(#f)">
+ <text>a&#x1e82f;</text>
+ </g>
+
+ <script>
+
+ window.addEventListener("load", function() {
+ var text = document.getElementsByTagName("text")[0];
+ text.firstChild.data = "d";
+ text.appendChild(document.createElementNS("http://www.w3.org/2000/svg", "g"));
+ }, false);
+
+ </script>
+
+</svg>
diff --git a/layout/svg/crashtests/847139-1.svg b/layout/svg/crashtests/847139-1.svg
new file mode 100644
index 0000000000..81fffa4be8
--- /dev/null
+++ b/layout/svg/crashtests/847139-1.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<marker><text>x</text></marker>
+
+<script>
+
+window.addEventListener("load", function() {
+ document.caretPositionFromPoint(0, 0);
+}, false);
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/849688-1.svg b/layout/svg/crashtests/849688-1.svg
new file mode 100644
index 0000000000..142f04c933
--- /dev/null
+++ b/layout/svg/crashtests/849688-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<text></text>
+
+<script>
+window.addEventListener("load", function() {
+ document.getElementsByTagName('text')[0].getStartPositionOfChar(1);
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/849688-2.svg b/layout/svg/crashtests/849688-2.svg
new file mode 100644
index 0000000000..4b71b20c7c
--- /dev/null
+++ b/layout/svg/crashtests/849688-2.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<text>X</text>
+
+<script>
+window.addEventListener("load", function() {
+ document.getElementsByTagName('text')[0].getStartPositionOfChar(2);
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/860378-1.svg b/layout/svg/crashtests/860378-1.svg
new file mode 100644
index 0000000000..f4ec09bc4c
--- /dev/null
+++ b/layout/svg/crashtests/860378-1.svg
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<filter id="f"/>
+<g filter="url(#f)"><text>ab</text></g>
+
+<script>
+
+function boom()
+{
+ var svgtext = document.getElementsByTagName("text")[0];
+ var text1 = svgtext.firstChild ;
+ var text2 = text1.splitText(1);
+
+ setTimeout(function() {
+ text1.data = "c";
+ svgtext.removeChild(text2);
+ }, 200);
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/868904-1.svg b/layout/svg/crashtests/868904-1.svg
new file mode 100644
index 0000000000..c8d7e9437e
--- /dev/null
+++ b/layout/svg/crashtests/868904-1.svg
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+
+* { animation-name: a; animation-duration: 72ms }
+@keyframes a { 60% { transform: skewx(30deg); } }
+
+</style>
+</head>
+<body>
+
+<svg></svg>
+
+</body>
+</html>
diff --git a/layout/svg/crashtests/873806-1.svg b/layout/svg/crashtests/873806-1.svg
new file mode 100644
index 0000000000..e40aff201b
--- /dev/null
+++ b/layout/svg/crashtests/873806-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <foreignObject requiredFeatures="fail">
+ <svg>
+ <text>a</text>
+ </svg>
+ </foreignObject>
+ <script>
+ document.querySelector("text").getBBox();
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/876831-1.svg b/layout/svg/crashtests/876831-1.svg
new file mode 100644
index 0000000000..6b6c01f9e7
--- /dev/null
+++ b/layout/svg/crashtests/876831-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<script>
+
+function boom()
+{
+ var x = document.getElementById("x").firstChild;
+ x.data = x.data.slice(1);
+ document.caretPositionFromPoint(0, 0);
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+<text><tspan id="x">@&#x062A;</tspan></text>
+
+</svg>
diff --git a/layout/svg/crashtests/877029-1.svg b/layout/svg/crashtests/877029-1.svg
new file mode 100644
index 0000000000..1a7bad0f1b
--- /dev/null
+++ b/layout/svg/crashtests/877029-1.svg
@@ -0,0 +1,10 @@
+<!--
+ Check that we don't crash due to an nsSVGMarkerFrame having a null
+ mMarkedFrame and incorrectly calling GetCanvasTM() on the nsSVGMarkerFrame.
+ -->
+<svg xmlns="http://www.w3.org/2000/svg">
+ <marker><text>a</text></marker>
+ <script>
+ document.querySelector("text").getComputedTextLength();
+ </script>
+</svg>
diff --git a/layout/svg/crashtests/880925-1.svg b/layout/svg/crashtests/880925-1.svg
new file mode 100644
index 0000000000..77efd3c0a5
--- /dev/null
+++ b/layout/svg/crashtests/880925-1.svg
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+<![CDATA[
+
+function boom()
+{
+ var svgText = document.createElementNS("http://www.w3.org/2000/svg", "text");
+ document.documentElement.appendChild(svgText);
+ var text1 = document.createTextNode("A");
+ svgText.appendChild(text1);
+ var text2 = document.createTextNode("");
+ svgText.appendChild(text2);
+ document.caretPositionFromPoint(0, 0);
+ setTimeout(function() {
+ text2.data = "B";
+ document.caretPositionFromPoint(0, 0);
+ }, 0);
+}
+
+window.addEventListener("load", boom, false);
+
+]]>
+</script>
+</svg>
diff --git a/layout/svg/crashtests/881031-1.svg b/layout/svg/crashtests/881031-1.svg
new file mode 100644
index 0000000000..0738e1299d
--- /dev/null
+++ b/layout/svg/crashtests/881031-1.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+
+function boom()
+{
+ var svgText = document.getElementById("t");
+ svgText.firstChild.data = "C";
+ svgText.appendChild(document.createTextNode("D"));
+ document.caretPositionFromPoint(0, 0);
+}
+window.addEventListener("load", boom, false);
+
+</script>
+<text id="t">A</text>
+</svg>
diff --git a/layout/svg/crashtests/885608-1.svg b/layout/svg/crashtests/885608-1.svg
new file mode 100644
index 0000000000..0c96777508
--- /dev/null
+++ b/layout/svg/crashtests/885608-1.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<mask id="m"><text id="t">z</text></mask>
+
+<rect width="600" height="400" mask="url(#m)"/>
+
+<script>
+window.addEventListener("load", function() {
+ document.getElementById("t").firstChild.data = "ab";
+}, false);
+</script>
+
+</svg>
diff --git a/layout/svg/crashtests/890782-1.svg b/layout/svg/crashtests/890782-1.svg
new file mode 100644
index 0000000000..686bc73a8f
--- /dev/null
+++ b/layout/svg/crashtests/890782-1.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+ <foreignObject requiredFeatures="foo" id="f">
+ <svg>
+ <text id="t"/>
+ </svg>
+ </foreignObject>
+
+ <script>
+ window.addEventListener("load", function() {
+ document.documentElement.appendChild(document.getElementById("f"))
+ document.getElementById("t").getNumberOfChars();
+ }, false);
+ </script>
+
+</svg>
diff --git a/layout/svg/crashtests/890783-1.svg b/layout/svg/crashtests/890783-1.svg
new file mode 100644
index 0000000000..25f54ba2a3
--- /dev/null
+++ b/layout/svg/crashtests/890783-1.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+ <mask id="m">
+ <text>
+ <tspan id="tspan" />
+ </text>
+ </mask>
+
+ <rect width="600" height="400" mask="url(#m)"/>
+
+ <script>
+
+ window.addEventListener("load", function() {
+ document.getElementById("tspan").style.dominantBaseline = "alphabetic";
+ }, false);
+
+ </script>
+
+</svg>
diff --git a/layout/svg/crashtests/893510-1.svg b/layout/svg/crashtests/893510-1.svg
new file mode 100644
index 0000000000..bb58be0450
--- /dev/null
+++ b/layout/svg/crashtests/893510-1.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <g requiredExtensions="foo">
+ <text>&#x062A;z</text>
+ </g>
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/895311-1.svg b/layout/svg/crashtests/895311-1.svg
new file mode 100644
index 0000000000..7b0c728043
--- /dev/null
+++ b/layout/svg/crashtests/895311-1.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+ <mask id="m">
+ <text>
+ <tspan id="ts" />
+ </text>
+ </mask>
+
+ <rect width="600" height="400" mask="url(#m)"/>
+
+ <script>
+ window.addEventListener("load", function() {
+ document.getElementById("ts").style.overflow = "hidden";
+ }, false);
+ </script>
+
+</svg>
diff --git a/layout/svg/crashtests/897342-1.svg b/layout/svg/crashtests/897342-1.svg
new file mode 100644
index 0000000000..547e919b7d
--- /dev/null
+++ b/layout/svg/crashtests/897342-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><text textLength="50" lengthAdjust="spacingAndGlyphs">&#x200D;</text></svg>
diff --git a/layout/svg/crashtests/898909-1.svg b/layout/svg/crashtests/898909-1.svg
new file mode 100644
index 0000000000..8a70cd7b8d
--- /dev/null
+++ b/layout/svg/crashtests/898909-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" requiredFeatures="foo">
+
+ <text id="t" />
+
+ <script>
+ window.addEventListener("load", function() {
+ document.getElementById("t").getComputedTextLength();
+ }, false);
+ </script>
+
+</svg>
diff --git a/layout/svg/crashtests/898951-1.svg b/layout/svg/crashtests/898951-1.svg
new file mode 100644
index 0000000000..f42dbf69f2
--- /dev/null
+++ b/layout/svg/crashtests/898951-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <text>X<tspan style="display: none;">2</tspan>&#x0301;</text>
+</svg>
diff --git a/layout/svg/crashtests/913990.html b/layout/svg/crashtests/913990.html
new file mode 100644
index 0000000000..21d8ef3cc3
--- /dev/null
+++ b/layout/svg/crashtests/913990.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<body style="filter: url('feed:javascript:5');">
+</body>
+</html>
diff --git a/layout/svg/crashtests/919371-1.xhtml b/layout/svg/crashtests/919371-1.xhtml
new file mode 100644
index 0000000000..b27ba3fa66
--- /dev/null
+++ b/layout/svg/crashtests/919371-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <svg xmlns="http://www.w3.org/2000/svg">
+ <marker style="position: absolute;" />
+ </svg>
+</html>
diff --git a/layout/svg/crashtests/950324-1.svg b/layout/svg/crashtests/950324-1.svg
new file mode 100644
index 0000000000..a43d84f4d8
--- /dev/null
+++ b/layout/svg/crashtests/950324-1.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <text style="font-family: sans-serif;"> &#x0301;</text>
+</svg>
diff --git a/layout/svg/crashtests/951904-1.html b/layout/svg/crashtests/951904-1.html
new file mode 100644
index 0000000000..7a1d1d4dd4
--- /dev/null
+++ b/layout/svg/crashtests/951904-1.html
@@ -0,0 +1,43 @@
+<body onload="go()">
+<svg>
+ <switch>
+ <text id="a">Bonjour</text>
+ <text id="b">Hello</text>
+ <a><text id="c">Hello</text></a>
+ <g>
+ <mask>
+ <text>Lundi</text>
+ </mask>
+ </g>
+ <switch>
+ <text id="d">Au revoir</text>
+ <g>
+ <mask>
+ <text>Mercredi</text>
+ </mask>
+ </g>
+ <text id="e">Goodbye</text>
+ <a><text id="f">Goodbye</text></a>
+ </switch>
+ </switch>
+</svg>
+<svg>
+ <switch>
+ <mask>
+ <text id="g">Vendredi</text>
+ </mask>
+ <a></a>
+ </switch>
+</svg>
+</body>
+<script>
+function go() {
+ a.getComputedTextLength();
+ b.getComputedTextLength();
+ c.getComputedTextLength();
+ d.getComputedTextLength();
+ e.getComputedTextLength();
+ f.getComputedTextLength();
+ g.getComputedTextLength();
+}
+</script>
diff --git a/layout/svg/crashtests/952270-1.svg b/layout/svg/crashtests/952270-1.svg
new file mode 100644
index 0000000000..69bac47d42
--- /dev/null
+++ b/layout/svg/crashtests/952270-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+ <path id="path" transform="scale(2,1)" />
+
+ <text>
+ <textPath xlink:href="#path">F</textPath>
+ </text>
+
+</svg>
diff --git a/layout/svg/crashtests/963086-1.svg b/layout/svg/crashtests/963086-1.svg
new file mode 100644
index 0000000000..3805b46d75
--- /dev/null
+++ b/layout/svg/crashtests/963086-1.svg
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ viewBox="0 0 64 64">
+ <defs>
+ <filter id="dropShadow">
+ <feGaussianBlur stdDeviation="2" />
+ <feOffset
+ result="offsetBlur"
+ dy="1073741824"/>
+ <feMerge>
+ <feMergeNode
+ in="offsetBlur" />
+ <feMergeNode
+ in="SourceGraphic" />
+ </feMerge>
+ </filter>
+ </defs>
+ <rect height="64" width="64" style="filter:url(#dropShadow)" />
+</svg>
diff --git a/layout/svg/crashtests/974746-1.svg b/layout/svg/crashtests/974746-1.svg
new file mode 100644
index 0000000000..c619c25f79
--- /dev/null
+++ b/layout/svg/crashtests/974746-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+ <pattern id="patternRotated" width="1" patternTransform="rotate(45 50 50)">
+ <rect/>
+ </pattern>
+
+ <rect width="100" height="100" fill="url(#patternRotated)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/975773-1.svg b/layout/svg/crashtests/975773-1.svg
new file mode 100644
index 0000000000..dd225eb2ae
--- /dev/null
+++ b/layout/svg/crashtests/975773-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+ <filter id="f">
+ <feSpecularLighting style="display: none;"/>
+ <feComposite in="SourceGraphic"/>
+ </filter>
+
+ <path d="M0,0 h100 v100 h-100 z M20,20 v60 h60 v-60 z" filter="url(#f)"/>
+
+</svg>
diff --git a/layout/svg/crashtests/979407-1.svg b/layout/svg/crashtests/979407-1.svg
new file mode 100644
index 0000000000..b615f3bec2
--- /dev/null
+++ b/layout/svg/crashtests/979407-1.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <marker id="marker" viewBox="0 0 10 10" markerHeight="-1px"/>
+ <path d="M0,0 h10" marker-start="url(#marker)"/>
+</svg>
diff --git a/layout/svg/crashtests/979407-2.svg b/layout/svg/crashtests/979407-2.svg
new file mode 100644
index 0000000000..75aee06345
--- /dev/null
+++ b/layout/svg/crashtests/979407-2.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+ <marker id="marker" viewBox="0 0 10 10" markerWidth="-1px"/>
+ <path d="M0,0 h10" marker-start="url(#marker)"/>
+</svg>
diff --git a/layout/svg/crashtests/993443.svg b/layout/svg/crashtests/993443.svg
new file mode 100644
index 0000000000..30bd18543c
--- /dev/null
+++ b/layout/svg/crashtests/993443.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg">
+<image width="10" height="10" x="17592186044416pt"/>
+</svg> \ No newline at end of file
diff --git a/layout/svg/crashtests/blob-merging-and-retained-display-list.html b/layout/svg/crashtests/blob-merging-and-retained-display-list.html
new file mode 100644
index 0000000000..56ca743dc9
--- /dev/null
+++ b/layout/svg/crashtests/blob-merging-and-retained-display-list.html
@@ -0,0 +1,62 @@
+<!doctype html>
+<html class="reftest-wait">
+<script>
+ var r = 40;
+ var xmlns = "http://www.w3.org/2000/svg";
+ const raf = f => requestAnimationFrame(f);
+ function rect(x, y) {
+ var r = document.createElementNS (xmlns, "rect");
+ r.setAttribute("x", x);
+ r.setAttribute("y", y);
+ r.setAttribute("width", "100");
+ r.setAttribute("height", "100");
+ r.setAttribute("fill", "blue");
+ return r;
+ }
+ function f1() {
+ svg = document.getElementById("cnvs");
+ svg.appendChild(rect(0, 0));
+ svg.appendChild(rect(600, 0));
+ svg.appendChild(rect(600, 400));
+ svg.appendChild(rect(0, 400));
+ let a = rect(110, 110);
+ let b = rect(120, 120);
+ let c = rect(130, 130);
+ let d = rect(140, 140);
+ let a2 = rect(310, 140);
+ let b2 = rect(320, 130);
+ let c2 = rect(330, 120);
+ let d2 = rect(340, 110);
+ raf(() => {
+ svg.appendChild(a);
+ svg.appendChild(b);
+ svg.appendChild(c);
+ svg.appendChild(d);
+ raf(() => {
+ // the display list partial update will end up with these items before x,y,w,z
+ svg.appendChild(d2);
+ svg.appendChild(c2);
+ svg.appendChild(b2);
+ svg.appendChild(a2);
+ raf(() => {
+ // this forces all the items to be ordered and makes the new display list
+ // contain reorded items outside of the invalid area
+ let mix = rect(220, 220);
+ svg.insertBefore(mix, d2);
+ raf(() => { document.documentElement.className = "" });
+ })
+ })
+ })
+ }
+
+ function f() {
+ requestAnimationFrame(f1);
+ }
+
+ onload = f;
+</script>
+
+<body>
+<svg width="700" height="600" id=cnvs>
+
+</svg>
diff --git a/layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml b/layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml
new file mode 100644
index 0000000000..b23f064a6c
--- /dev/null
+++ b/layout/svg/crashtests/conditional-outer-svg-nondirty-reflow-assert.xhtml
@@ -0,0 +1,28 @@
+<!--
+ Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:svg="http://www.w3.org/2000/svg">
+<head>
+ <title>Test of NS_FRAME_IS_NONDISPLAY / NS_FRAME_IS_DIRTY assertion</title>
+ <!-- reduced from layout/reftests/svg/svg-integration/conditions-outer-svg-01.xhtml
+ and modified to occur without bug 1308876 patches. -->
+ <style>
+ div { position: relative; height: 100px; width: 100px }
+ svg { position: absolute; top: 0; left: 0; height: 100%; width: 100% }
+ </style>
+ <script>
+ function run() {
+ var d = document.getElementById("d");
+ d.offsetHeight;
+ d.style.height = "50px";
+ }
+ </script>
+</head>
+<body onload="run()">
+ <div id="d">
+ <svg:svg systemLanguage="x"></svg:svg>
+ </div>
+</body>
+</html>
diff --git a/layout/svg/crashtests/crashtests.list b/layout/svg/crashtests/crashtests.list
new file mode 100644
index 0000000000..4b898383cf
--- /dev/null
+++ b/layout/svg/crashtests/crashtests.list
@@ -0,0 +1,256 @@
+load 220165-1.svg
+load 267650-1.svg
+load 294022-1.svg
+load 307314-1.svg
+load 308615-1.svg
+load 308917-1.svg
+load 310436-1.svg
+load 310638.svg
+load 313737-1.xml
+load chrome://reftest/content/crashtests/layout/svg/crashtests/314244-1.xhtml
+load 322185-1.svg
+load 322215-1.svg
+load 323704-1.svg
+load 325427-1.svg
+load 326495-1.svg
+load 326974-1.svg
+load 327706-1.svg
+load 327711-1.svg
+load 328137-1.svg
+load 329848-1.svg
+load chrome://reftest/content/crashtests/layout/svg/crashtests/337408-1.xhtml
+load 338301-1.xhtml
+load 338312-1.xhtml
+load 340083-1.svg
+load 340945-1.svg
+load 342923-1.html
+load 343221-1.xhtml
+load 344749-1.svg
+load 344887-1.svg
+load 344892-1.svg
+load 344898-1.svg
+load 344904-1.svg
+load 345418-1.svg
+load 348982-1.xhtml
+load 354777-1.xhtml
+load 359516-1.svg
+load 361015-1.svg
+load 361587-1.svg
+load 363611-1.xhtml
+load 364688-1.svg
+load 366956-1.svg
+load 366956-2.svg
+load 367111-1.svg
+load 367368-1.xhtml
+load 369233-1.svg
+load 369438-1.svg
+load 369438-2.svg
+load 371463-1.xhtml
+load 371563-1.xhtml
+load 375775-1.svg
+load 378716.svg
+load 380691-1.svg
+load 384391-1.xhtml
+load 384499-1.svg
+load 384637-1.svg
+load 384728-1.svg
+load 385246-1.svg
+load 385246-2.svg
+load 385552-1.svg
+load 385552-2.svg
+load 385840-1.svg
+load 385852-1.svg
+load 386475-1.xhtml
+load 386690-1.svg
+load 387290-1.svg
+load 402408-1.svg
+load 404677-1.xhtml
+load 409565-1.xhtml
+load 420697-1.svg
+load 420697-2.svg
+load 429774-1.svg
+load 441368-1.svg
+load 453754-1.svg
+load 455314-1.xhtml
+load 458453.html
+load 459666-1.html
+load 459883.xhtml
+load 461289-1.svg
+load 464374-1.svg
+load 466585-1.svg
+load 467323-1.svg
+load 467498-1.svg
+load 470124-1.svg
+load 472782-1.svg
+load 474700-1.svg
+load 475181-1.svg
+load 475193-1.html
+load 475302-1.svg
+load 477935-1.html
+load 478128-1.svg
+load 478511-1.svg
+load 483439-1.svg
+load 492186-1.svg
+load 508247-1.svg
+load 512890-1.svg
+load 515288-1.html
+load 522394-1.svg
+load 522394-2.svg
+load 522394-3.svg
+load 566216-1.svg
+load 587336-1.html
+load 590291-1.svg
+load 601999-1.html
+load 605626-1.svg
+asserts(2) load 606914.xhtml # bug 606914, bug 718883
+load 610594-1.html
+load 610954-1.html
+load 612662-1.svg
+load 612662-2.svg
+load 612736-1.svg
+load 612736-2.svg
+load 614367-1.svg
+load 620034-1.html
+load 621598-1.svg
+load 648819-1.html
+load 655025-1.svg
+load 655025-2.svg
+load 655025-3.svg
+load 657077-1.svg
+load 669025-1.svg
+load 669025-2.svg
+load 682411-1.svg
+load 692203-1.svg
+load 692203-2.svg
+load 693424-1.svg
+load 709920-1.svg
+load 709920-2.svg
+load 713413-1.svg
+load 722003-1.svg
+load 725918-1.svg
+load 732836-1.svg
+load 740627-1.svg
+load 740627-2.svg
+load 743469.svg
+load 757704-1.svg
+load 757718-1.svg
+load 757751-1.svg
+load 767056-1.svg
+load 767535-1.xhtml
+load 768087-1.html
+load 768351.svg
+load 772313-1.svg
+load 778492-1.svg
+load 779971-1.svg
+load 780764-1.svg
+load 780963-1.html
+load 782141-1.svg
+load 784061-1.svg
+load 788831-1.svg
+load 789390-1.html
+load 790072.svg
+load 791826-1.svg
+load 808318-1.svg
+load 803562-1.svg
+load 813420-1.svg
+load 841163-1.svg
+load 841812-1.svg
+load 842009-1.svg
+load 842630-1.svg
+load 842909-1.svg
+load 843072-1.svg
+load 843917-1.svg
+load 847139-1.svg
+load 849688-1.svg
+load 849688-2.svg
+load 860378-1.svg
+load 868904-1.svg
+load 873806-1.svg
+load 876831-1.svg
+load 877029-1.svg
+load 880925-1.svg
+load 881031-1.svg
+load 885608-1.svg
+load 890782-1.svg
+load 890783-1.svg
+load 893510-1.svg
+load 895311-1.svg
+load 897342-1.svg
+load 898909-1.svg
+load 898951-1.svg
+load 913990.html
+load 919371-1.xhtml
+load 950324-1.svg
+load 951904-1.html
+load 952270-1.svg
+load 963086-1.svg
+load 974746-1.svg
+load 975773-1.svg
+load 979407-1.svg
+load 979407-2.svg
+load 993443.svg
+load 1016145.svg
+load 1028512.svg
+load 1140080-1.svg
+load 1149542-1.svg
+load 1156581-1.svg
+load 1182496-1.html
+load 1209525-1.svg
+load 1223281-1.svg
+load 1234726-1.svg
+load 1322537-1.html
+load 1322537-2.html
+load 1322852.html
+load 1348564.svg
+load 1402109.html
+load 1402124.html
+load 1402486.html
+load 1403656-1.html
+load 1403656-2.html
+load 1403656-3.html
+load 1403656-4.html
+load 1403656-5.html
+load 1404086.html
+load 1421807-1.html
+load 1421807-2.html
+load 1422226.html
+load 1425434-1.html
+load 1443092.html
+load 1454201-1.html
+load 1467552-1.html
+load 1474982.html
+load conditional-outer-svg-nondirty-reflow-assert.xhtml
+load extref-test-1.xhtml
+load blob-merging-and-retained-display-list.html
+load empty-blob-merging.html
+load grouping-empty-bounds.html
+load 1480275.html
+load 1480224.html
+load 1502936.html
+load 1504918.svg
+load perspective-invalidation.html
+load invalid_url.html
+load 1535517-1.svg
+load 1504072.html
+load 1072758.html
+load 1536892.html
+load 1539318-1.svg
+load 1548985-1.html
+load 1548985-2.svg
+load 1555851.html
+load invalidation-of-opacity-0.html
+load 1563779.html
+load 1600855.html
+load 1601824.html
+load 1605223-1.html
+load 1609663.html
+skip-if(Android) load 1671950.html # No print-preview support on android
+load 1678947.html
+load 1693032.html
+load 1696505.html
+load 1758029-1.html
+HTTP load 1755770-1.html
+HTTP load 1755770-2.html
+load 1764936-1.html
+load 1804958.html
+load 1810260.html
diff --git a/layout/svg/crashtests/empty-blob-merging.html b/layout/svg/crashtests/empty-blob-merging.html
new file mode 100644
index 0000000000..4b603c19d9
--- /dev/null
+++ b/layout/svg/crashtests/empty-blob-merging.html
@@ -0,0 +1,48 @@
+<html class="reftest-wait">
+<style>
+@keyframes spinnow {
+ 100% {
+ transform: rotate(360deg) scale(.2, .2);
+ }
+}
+
+rect {
+ transform: rotate(0deg) scale(0.6, 1);
+ transform-origin: center;
+ animation: 5s spinnow infinite linear;
+}
+
+</style>
+<svg width=400 height=400>
+ <!--
+ onwheel is needed so that we get a hit test info display item
+ before the transform on the rect
+ -->
+ <g onwheel="alert(1)">
+ <g id="gr">
+ <circle r=30 fill=yellow cx=300 cy=100 />
+ <circle r=30 fill=yellow cx=10 cy=100 />
+ <circle r=30 fill=yellow cx=300 cy=300 />
+ <circle r=30 fill=yellow cx=10 cy=300 />
+ </g>
+ <rect width=100 height=100 fill=blue x=100 y=100 />
+ <g opacity=0.5>
+ <circle r=30 fill=pink cx=300 cy=100 />
+ <circle r=30 fill=pink cx=10 cy=100 />
+ <circle r=30 fill=pink cx=300 cy=300 />
+ <circle r=30 fill=pink cx=10 cy=300 />
+ </g>
+ </g>
+</svg>
+<script>
+ function blam() {
+ let gr = document.getElementById("gr");
+ gr.remove();
+ document.documentElement.removeAttribute("class");
+ }
+document.addEventListener("MozReftestInvalidate", function() {
+ requestAnimationFrame(function() {
+ blam();
+ });
+});
+</script>
diff --git a/layout/svg/crashtests/extref-test-1-resource.xhtml b/layout/svg/crashtests/extref-test-1-resource.xhtml
new file mode 100644
index 0000000000..cd47ddc2f5
--- /dev/null
+++ b/layout/svg/crashtests/extref-test-1-resource.xhtml
@@ -0,0 +1,24 @@
+<!--
+ Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/licenses/publicdomain/
+-->
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:svg="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink">
+<body style="margin:0">
+ <embed type="application/x-shockwave-flash" src="data:application/x-shockwave-flash,This is a test"></embed>
+ <iframe src="date:text/plain,aaa"></iframe>
+ <div style="mask: url(#m1); width:500px; height:500px; background:lime;"></div>
+
+ <svg:svg height="0">
+ <svg:mask id="m1" maskUnits="objectBoundingBox" maskContentUnits="objectBoundingBox">
+ <svg:linearGradient id="g" gradientUnits="objectBoundingBox" x2="0" y2="1">
+ <svg:stop stop-color="white" offset="0"/>
+ <svg:stop stop-color="white" stop-opacity="0" offset="1"/>
+ </svg:linearGradient>
+ <svg:circle cx="0.25" cy="0.25" r="0.25" id="circle" fill="white"/>
+ <svg:rect x="0.5" y="0" width="0.5" height="1" fill="url(#g)"/>
+ </svg:mask>
+ </svg:svg>
+</body>
+</html>
diff --git a/layout/svg/crashtests/extref-test-1.xhtml b/layout/svg/crashtests/extref-test-1.xhtml
new file mode 100644
index 0000000000..932b679b1f
--- /dev/null
+++ b/layout/svg/crashtests/extref-test-1.xhtml
@@ -0,0 +1,11 @@
+<!--
+ Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/licenses/publicdomain/
+-->
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:svg="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink">
+<body style="margin:0">
+ <div style="mask: url(extref-test-1-resource.xhtml#m1); width:500px; height:500px; background:lime;"></div>
+</body>
+</html>
diff --git a/layout/svg/crashtests/grouping-empty-bounds.html b/layout/svg/crashtests/grouping-empty-bounds.html
new file mode 100644
index 0000000000..c9f688d0f0
--- /dev/null
+++ b/layout/svg/crashtests/grouping-empty-bounds.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html lang="en" class='reftest-wait'>
+<meta charset="utf-8">
+<title>This testcase might create a non-empty display list with an empty set of drawing commands / items in the EventRecorder</title>
+
+<style>
+
+body {
+ margin: 0;
+}
+
+.animated-opacity {
+ animation: opacity-animation 1s linear alternate infinite;
+}
+
+@keyframes opacity-animation {
+ from {
+ opacity: 0;
+ }
+ to {
+ opacity: 1;
+ }
+}
+
+</style>
+
+<svg style="width: 100px; height: 100px;">
+ <rect class="animated-opacity" x="0" y="0" width="100" height="100"/>
+ <rect x="0" y="0" width="10" height="10" id="toremove"/>
+ <g transform="translate(10 10)"><rect x="120" y="0" width="1" height="1"/></g>
+</svg>
+
+<script>
+
+window.addEventListener("MozReftestInvalidate", () => {
+ var elem = document.getElementById("toremove");
+ elem.parentNode.removeChild(elem);
+ document.documentElement.removeAttribute('class');
+});
+
+</script>
diff --git a/layout/svg/crashtests/invalid_url.html b/layout/svg/crashtests/invalid_url.html
new file mode 100644
index 0000000000..ac8671b1ce
--- /dev/null
+++ b/layout/svg/crashtests/invalid_url.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body>
+ <!--
+ If invalid url isn't correctly handled, this test will crash when
+ gfx.webrender.enabled=true and gfx.webrender.all=true
+ -->
+ <div style="padding: 1px; filter:url('data://not-valid-data');"></div>
+</body>
+</html>
diff --git a/layout/svg/crashtests/invalidation-of-opacity-0.html b/layout/svg/crashtests/invalidation-of-opacity-0.html
new file mode 100644
index 0000000000..50700e3908
--- /dev/null
+++ b/layout/svg/crashtests/invalidation-of-opacity-0.html
@@ -0,0 +1,26 @@
+<html class="reftest-wait">
+ <script>
+ var i = 0;
+ var opac = [0.3, 0.2, 0, 0.3];
+
+ function f() {
+ document.getElementById("rim").setAttribute("opacity", opac[i]);
+ document.getElementById("circ").setAttribute("r", i + 10);
+ i++;
+ if (i > opac.length) {
+ document.documentElement.className = ""
+ } else {
+ requestAnimationFrame(f);
+ }
+ }
+ onload = () => requestAnimationFrame(f);
+</script>
+
+<body>
+ <svg height="1000" width="1000">
+ <circle cx="50" cy="50" r="40" fill="red" />
+ <g id=rim clip-path="url(#myClip)" opacity=0>
+ <circle id="circ" cx="150" cy="150" r="40" fill="red" />
+ </g>
+ <circle cx="250" cy="250" r="40" fill="red" />
+ </svg>
diff --git a/layout/svg/crashtests/masked-3d-transform.html b/layout/svg/crashtests/masked-3d-transform.html
new file mode 100644
index 0000000000..6c70aae7fe
--- /dev/null
+++ b/layout/svg/crashtests/masked-3d-transform.html
@@ -0,0 +1,20 @@
+<style>
+ svg,
+svg * {
+ perspective: 1000px;
+}
+</style>
+<svg style="max-width: 176px;" viewBox="0 0 279 169">
+ <g transform="translate(-2.000000, -2.000000)">
+ <g mask="url(#mask-2)">
+ <g transform="translate(19.000000, 22.000000)">
+ <g fill="#FFFFFF">
+ <path d="M43,2.3 C41,2.3 39.9,3.3 39.9,5.6 L39.9,12.4 C39.9,14.7 41,15.7 43.1,15.7 C45.7,15.7 45.9,14.1 46.1,13 C46.1,12.7 46.4,12.4 46.8,12.4 C47.3,12.4 47.5,12.6 47.5,13.3 C47.5,15.3 45.8,17 42.9,17 C40.4,17 38.4,15.7 38.4,12.3 L38.4,5.5 C38.4,2.1 40.5,0.9 43,0.9 C45.9,0.9 47.5,2.6 47.5,4.5 C47.5,5.2 47.3,5.4 46.8,5.4 C46.3,5.4 46.1,5.2 46.1,4.9 C46.1,4 45.6,2.3 43,2.3 L43,2.3 Z"></path>
+ </g>
+ </g>
+ <ellipse fill="#000000" cx="157.9" cy="162.1" rx="157.9" ry="4.3"></ellipse>
+ </g>
+ </g>
+</svg>
+
+
diff --git a/layout/svg/crashtests/perspective-invalidation.html b/layout/svg/crashtests/perspective-invalidation.html
new file mode 100644
index 0000000000..179836d500
--- /dev/null
+++ b/layout/svg/crashtests/perspective-invalidation.html
@@ -0,0 +1,9 @@
+<span>
+<svg id="a" transform="skewX(0)" opacity="0">
+<text>
+</span>
+<marquee>
+A
+</marquee>
+<svg xml:space="preserve">
+<use style="outline: auto; -webkit-perspective: 1px" xlink:href="#a" mask="url(#x)">