14 files changed, 192 insertions, 0 deletions
diff --git a/dom/bindings/crashtests/1010658-1.html b/dom/bindings/crashtests/1010658-1.html
new file mode 100644
index 0000000000..6b341f4ed9
--- /dev/null
+++ b/dom/bindings/crashtests/1010658-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+    window.__proto__ = null;
+    for (var i = 0; i < 10000; ++i) {
+        self.document;
+    }
+}
+
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/1010658-2.html b/dom/bindings/crashtests/1010658-2.html
new file mode 100644
index 0000000000..cf473c3dd9
--- /dev/null
+++ b/dom/bindings/crashtests/1010658-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+    window.__proto__ = function(){};
+    for (var i = 0; i < 10000; ++i) {
+        self.document;
+    }
+}
+
+</script></head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/769464.html b/dom/bindings/crashtests/769464.html
new file mode 100644
index 0000000000..d075ee66a0
--- /dev/null
+++ b/dom/bindings/crashtests/769464.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+    window.getComputedStyle(new Worker("404.js"));
+}
+
+window.addEventListener("load", boom);
+
+</script>
diff --git a/dom/bindings/crashtests/822340-1.html b/dom/bindings/crashtests/822340-1.html
new file mode 100644
index 0000000000..4c8f6ae460
--- /dev/null
+++ b/dom/bindings/crashtests/822340-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<script>
+  var xhr = new XMLHttpRequest;
+  function f() {
+    var x = xhr.getResponseHeader;
+    x("abc");
+  }
+  for (var i = 0; i < 20000; ++i) {
+    try { f(); } catch (e) {}
+  }
+</script>
diff --git a/dom/bindings/crashtests/822340-2.html b/dom/bindings/crashtests/822340-2.html
new file mode 100644
index 0000000000..e938c91aac
--- /dev/null
+++ b/dom/bindings/crashtests/822340-2.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<script>
+  var l = document.getElementsByTagName("*");
+  var count = 20000;
+  for (var i = 0; i < count; ++i) {
+    l.item(0);
+  }
+</script>
diff --git a/dom/bindings/crashtests/832899.html b/dom/bindings/crashtests/832899.html
new file mode 100644
index 0000000000..c565ad00f4
--- /dev/null
+++ b/dom/bindings/crashtests/832899.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<script>
+  var ev = document.createEvent("Events");
+  EventTarget.prototype.dispatchEvent.call(navigator.connection, ev);
+</script>
diff --git a/dom/bindings/crashtests/860551.html b/dom/bindings/crashtests/860551.html
new file mode 100644
index 0000000000..5008e57396
--- /dev/null
+++ b/dom/bindings/crashtests/860551.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<script>
+SVGZoomAndPan instanceof SVGZoomAndPan
+</script>
diff --git a/dom/bindings/crashtests/860591.html b/dom/bindings/crashtests/860591.html
new file mode 100644
index 0000000000..565a729c4d
--- /dev/null
+++ b/dom/bindings/crashtests/860591.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+    var timeEvent = document.createEvent('TimeEvent');
+    var mutationEvent = document.createEvent('MutationEvents');
+    mutationEvent.__proto__ = timeEvent;
+    mutationEvent.target;
+
+    var mouseScrollEvent = document.createEvent("MouseScrollEvents");
+    var mouseEvent = document.createEvent("MouseEvents");
+    mouseEvent.__proto__ = mouseScrollEvent;
+    mouseEvent.relatedTarget;
+
+    var uiEvent = document.createEvent("UIEvents");
+    uiEvent.__proto__ = mouseScrollEvent;
+    uiEvent.rangeParent;
+</script>
+</head>
+</html>
diff --git a/dom/bindings/crashtests/862092.html b/dom/bindings/crashtests/862092.html
new file mode 100644
index 0000000000..1b31775a97
--- /dev/null
+++ b/dom/bindings/crashtests/862092.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  var frameDoc = document.getElementById("f").contentDocument;
+  frameDoc.adoptNode(document.createElement("select"));
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="f"></iframe>
+</body>
+</html>
diff --git a/dom/bindings/crashtests/862610.html b/dom/bindings/crashtests/862610.html
new file mode 100644
index 0000000000..768871ad96
--- /dev/null
+++ b/dom/bindings/crashtests/862610.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+  HTMLElement.prototype.__proto__ = new Proxy({}, {});
+  try {
+    window.Image;
+  } finally {
+    // Restore our prototype so the test harnesses can deal with us
+    // We can't just assign to __proto__ because it lives on our proto chain
+    // and we messed that up.
+    var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+    desc.set.call(HTMLElement.prototype, Element.prototype);
+  }
+</script>
+</head>
+
+<body></body>
+</html>
diff --git a/dom/bindings/crashtests/869038.html b/dom/bindings/crashtests/869038.html
new file mode 100644
index 0000000000..dedb4dd4d7
--- /dev/null
+++ b/dom/bindings/crashtests/869038.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+  var frame = document.createElementNS("http://www.w3.org/1999/xhtml", "iframe");
+  document.body.appendChild(frame);
+  var frameDoc = frame.contentDocument;
+  frameDoc.contentEditable = "true";
+  document.body.removeChild(frame);
+  SpecialPowers.gc();
+  frameDoc.focus();
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/dom/bindings/crashtests/949940.html b/dom/bindings/crashtests/949940.html
new file mode 100644
index 0000000000..7f20085fea
--- /dev/null
+++ b/dom/bindings/crashtests/949940.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom()
+{
+  var frameWin =  document.getElementById("f").contentWindow;
+  Object.create(frameWin).self;
+}
+</script>
+</head>
+<body onload="boom()">
+<iframe id="f" src="data:text/html,3"></iframe>
+</body>
+</html>
diff --git a/dom/bindings/crashtests/crashtests.list b/dom/bindings/crashtests/crashtests.list
new file mode 100644
index 0000000000..50126788cd
--- /dev/null
+++ b/dom/bindings/crashtests/crashtests.list
@@ -0,0 +1,13 @@
+skip load 769464.html # bug 823822 - assert often leaks into other tests
+load 822340-1.html
+load 822340-2.html
+load 832899.html
+load 860551.html
+load 860591.html
+load 862092.html
+load 862610.html
+load 869038.html
+load 949940.html
+load 1010658-1.html
+load 1010658-2.html
+load stringbuffer-USVString.html
diff --git a/dom/bindings/crashtests/stringbuffer-USVString.html b/dom/bindings/crashtests/stringbuffer-USVString.html
new file mode 100644
index 0000000000..a193e732b9
--- /dev/null
+++ b/dom/bindings/crashtests/stringbuffer-USVString.html
@@ -0,0 +1,11 @@
+<!doctype html>
+<script>
+  var div = document.createElement("div");
+  // Need a long-enough string that when we get it from the DOM it will not get
+  // inlined and will be an external stringbuffer string.
+  var str = "http://" + (new Array(200).join("a"));
+  div.setAttribute("x", str);
+  str = div.getAttribute("x");
+  // Now pass it as a USVString
+  new URL(str);
+</script>