1 files changed, 566 insertions, 0 deletions
diff --git a/layout/generic/crashtests/370174-1.html b/layout/generic/crashtests/370174-1.html
new file mode 100644
index 0000000000..57493a7d3d
--- /dev/null
+++ b/layout/generic/crashtests/370174-1.html
@@ -0,0 +1,566 @@
+<html>
+<head>
+<style style="display: none; direction: ltr;">
+<label style="display: table-column-group;direction: rtl;">
+</big>
+</textarea>
+</q>
+<q style="display: table-row;direction: ltr;">
+</span>
+</ol>
+</dir>
+<html style="display: table-row;direction: rtl;">
+</strong>
+<basefont style="display: inline-table;direction: auto;">
+<map style="display: table-footer-group;direction: ltr;">
+<dir="rtl" style="display: inline-block;direction: ltr;">
+<center style="display: none;direction: ltr;">
+<style style="display: block;direction: auto;">
+<samp style="display: -moz-inline-box;direction: rtl;">
+<noframes style="display: inline;direction: rtl;">
+<code style="display: table-header-group;direction: ltr;">
+</li>
+</body>
+</div>
+<embed style="display: table-header-group;direction: auto;">
+</table>
+</fieldset>
+<legend style="display: table-row;direction: auto;">
+</ul>
+<canvas style="display: table;direction: ltr;">
+<font style="display: inline-table;direction: auto;">
+</option>
+</code>
+</menu>
+<thead style="display: inline-table;direction: rtl;">
+</button>
+</div>
+</ol>
+</isindex>
+<code style="display: table-row-group;direction: rtl;">
+<dl style="display: table-row;direction: ltr;">
+<style style="display: table-footer-group;direction: ltr;">
+<marquee style="display: table-row;direction: auto;">
+</object>
+</hx>
+<nobr style="display: table-cell;direction: rtl;">
+<a style="display: table-header-group;direction: ltr;">
+</thead>
+<tr style="display: table-caption;direction: ltr;">
+<tr style="display: table-row;direction: rtl;">
+<base style="display: inline;direction: auto;">
+</input>
+<hx style="display: inline-block;direction: auto;">
+<link style="display: table-column;direction: rtl;">
+<code style="display: inline;direction: ltr;">
+<li style="display: table-column-group;direction: ltr;">
+</dd>
+</spacer>
+<address style="display: table-header-group;direction: auto;">
+</object>
+</hx>
+</th>
+</sup>
+<u style="display: -moz-inline-box;direction: auto;">
+</del>
+<bdo style="display: table-column-group;direction: ltr;">
+<param style="display: block;direction: auto;">
+<td rowspan="5" style="display: inline-table;direction: rtl;">
+<head style="display: none;direction: ltr;">
+</abbr>
+<address style="display: table-row;direction: rtl;">
+</input type="password">
+</li>
+<area style="display: -moz-inline-box;direction: ltr;">
+</noframes>
+</b>
+</input type="image">
+<title style="display: -moz-inline-box;direction: ltr;">
+</font>
+<blockquote style="display: table-column-group;direction: auto;">
+<area style="display: none;direction: auto;">
+</script>
+<colgroup style="display: -moz-inline-box;direction: auto;">
+<font style="display: list-item;direction: auto;">
+<isindex style="display: table-cell;direction: ltr;">
+<sup style="display: table-footer-group;direction: ltr;">
+<abbr style="display: block;direction: auto;">
+<address style="display: table-caption;direction: rtl;">
+</span>
+</code>
+</strong>
+<select style="display: table-cell;direction: auto;">
+<dl style="display: inline-table;direction: rtl;">
+</small>
+</listing>
+<colgroup style="display: table-header-group;direction: rtl;">
+<title style="display: none;direction: auto;">
+</input type="submit">
+<tbody style="display: table-column-group;direction: rtl;">
+</blink>
+<i style="display: table;direction: ltr;">
+</td>
+</dir>
+</tt>
+</a<bgsound style="display: inline;direction: auto;">
+<multicol style="display: -moz-inline-box;direction: auto;">
+</th>
+</font>
+</base>
+<textarea style="display: inline-block;direction: ltr;">
+<frameset style="display: list-item;direction: rtl;">
+</span>
+<blockquote style="display: table-caption;direction: auto;">
+</code>
+<dir style="display: inline-table;direction: rtl;">
+<fieldset style="display: table-column;direction: ltr;">
+</kbd>
+<noframes style="display: none;direction: rtl;">
+</spacer type="block">
+</i>
+<area style="display: table-column-group;direction: ltr;">
+<form style="display: none;direction: rtl;">
+<tt style="display: table-row;direction: auto;">
+</bdo>
+</th>
+<cite style="display: none;direction: auto;">
+</td colspan="5">
+</dir>
+</noscript>
+<spacer style="display: table-caption;direction: rtl;">
+</legend>
+<ins style="display: table-row-group;direction: rtl;">
+</multicol>
+</base>
+</img>
+<nobr style="display: table-header-group;direction: auto;">
+</map>
+<br style="display: none;direction: rtl;">
+</spacer type="block">
+<table style="display: table-row-group;direction: ltr;">
+</td rowspan="5">
+</caption>
+<embed style="display: inline-table;direction: auto;">
+</script>
+<style style="display: list-item;direction: rtl;">
+</nobr>
+<button style="display: table-column;direction: auto;">
+</select>
+</strike>
+<hx style="display: table-header-group;direction: ltr;">
+</bdo>
+<td rowspan="5" style="display: none;direction: ltr;">
+</code>
+<input type="hidden" style="display: table;direction: auto;">
+<spacer type="block" style="display: inline-block;direction: ltr;">
+</marquee>
+</dir="rtl">
+</html>
+<le</i>gend style="display: table-caption;direction: ltr;">
+<sup style="display: table-column-group;direction: ltr;">
+</address>
+<title style="display: none;direction: rtl;">
+<font style="display: table-row;direction: ltr;">
+<ol style="display: inline-table;direction: rtl;">
+</th>
+</link>
+</isindex>
+</iframe>
+<th style="display: table;direction: rtl;">
+</hx>
+<object style="display: table-caption;direction: auto;">
+</embed>
+<small style="display: block;direction: auto;">
+</abbr>
+<object style="display: inline-table;direction: ltr;">
+<div style="display: table-column-group;direction: auto;">
+</i>
+</u>
+</wbr>
+<abbr style="display: inline;direction: ltr;">
+</sub>
+<dir style="display: block;direction: auto;">
+</small>
+</code>
+<style style="display: table-column;direction: ltr;">
+<fieldset style="display: table-cell;direction: rtl;">
+</b>
+<blockquote style="display: table-header-group;direction: rtl;">
+<q style="display: inline;direction: auto;">
+<iframe style="display: block;direction: rtl;">
+<button style="display: table-footer-group;direction: auto;">
+</s>
+</caption>
+<input type="submit" style="display: inline-block;direction: auto;">
+</wbr>
+</link>
+</sub>
+<dt style="display: table-column-group;direction: auto;">
+<noscript style="display: table-cell;direction: ltr;">
+<spacer type="block" style="display: inline-table;direction: rtl;">
+<dl style="display: inline;direction: auto;">
+<thead style="display: table-row;direction: auto;">
+</td>
+</strike>
+<body style="display: inline;direction: auto;">
+<img style="display: table-column;direction: rtl;">
+</input type="hidden">
+</label>
+<img src="fish.gif" style="display: inline-table;direction: auto;">
+</ins>
+<img src="fish.gif" style="display: block;direction: rtl;">
+</caption>
+<abbr style="display: table-header-group;direction: auto;">
+</meta>
+<area style="display: list-item;direction: auto;">
+<ul style="display: table-row-group;direction: rtl;">
+<img style="display: table-cell;direction: rtl;">
+</nobr>
+<blockquote style="display: table;direction: ltr;">
+<a style="display: table-header-group;direction: auto;">
+</basefont>
+</tbody>
+<dt style="display: table-footer-group;direction: auto;">
+</address>
+<strong style="display: table-header-group;direction: auto;">
+<strong style="display: table-row;direction: rtl;">
+<u style="display: table;direction: rtl;">
+</font>
+</dir>gend style="display: ta<samp style="display: table-row-group;direction: rt<kbd style="display: table-column;direction: auto;">
+<acronym style="display: table-footer-group;direction: auto;">
+</html>
+</cite>
+</keygen>
+<kbd style="display: none;direction: ltr;">
+</spacer>
+<div style="display: inline;direction: rtl;">
+</marquee>
+</code>
+<select style="display: table-cell;direction: rtl;">
+<i style="display: none;direction: rtl;">
+<bgsound style="display: table-header-group;direction: ltr;">
+</isindex>
+<table style="display: none;direction: rtl;">
+</td>
+<bgsound style="display: inline-table;direction: rtl;">
+<canvas style="display: inline-table;direction: ltr;">
+<textarea style="display: table-header-group;direction: auto;">
+</tbody>
+</li>
+</th>
+</body>
+<th style="display: inline;direction: ltr;">
+</sub>
+</sup>
+<li style="display: table;direction: ltr;">
+<l<sup style="display: none;direction: ltr;">
+</bgsound>
+<select style="display: table-row;direction: auto;">
+</del>
+</cite>
+</img>
+<abbr style="display: table-row;direction: ltr;">
+<multicol style="display: table;direction: ltr;">
+<style style="display: inline-table;direction: ltr;">
+<code style="display: table-caption;direction: ltr;">
+</tbody>
+<button style="display: -moz-inline-box;direction: rtl;">
+<basefont style="display: table-column-group;direction: auto;">
+<img style="display: inline;direction: auto;">
+<wbr style="display: table-row;direction: rtl;">
+</isindex>
+<html style="display: table-footer-group;direction: rtl;">
+</nobr>
+<col style="display: table-column;direction: ltr;">
+</li>
+<fieldset style="display: table-row-group;direction: auto;">
+<a style="display: inline;direction: rtl;">
+</textarea>
+<input type="hidden" style="display: table;direction: auto;">
+</td rowspan="5">
+</wbr>
+</script>
+</optgroup>
+</noframes>
+<le</i>
+</label>
+</li>
+<frame style="display: table-footer-group;direction: ltr;">
+<noscript style="display: table-column;direction: ltr;">
+<thead style="display: none;direction: rtl;">
+</blink>
+<style style="display: -moz-inline-box;direction: ltr;">
+</strike>
+<noframes style="display: -moz-inline-box;direction: auto;">
+</u>
+</frame>
+</big>
+</strike>
+<label style="display: table-cell;direction: rtl;">
+</p>
+</optgroup>
+<kbd style="display: table-row-group;direction: rtl;">
+<hx style="display: block;direction: ltr;">
+</spacer type="block">
+<strike style="display: -moz-inline-box;direction: rtl;">
+</td>
+<input type="submit" style="display: inline-block;direction: auto;">
+</fieldset>
+</dir="rtl">
+<label style="display: list-item;direction: rtl;">
+<base style="display: -moz-inline-box;direction: ltr;">
+<iframe style="display: table-footer-group;direction: ltr;">
+</link>
+</s>
+<sup style="display: table-row;direction: rtl;">
+</colgroup>
+<map style="display: inline;direction: rtl;">
+<script style="display: -moz-inline-box;direction: auto;">
+<spacer style="display: list-item;direction: auto;">
+</acronym>
+<spacer style="display: none;direction: rtl;">
+</spacer>
+</menu>
+</blockquote>
+<a style="display: table;direction: ltr;">
+</big>
+<script style="display: table-column;direction: auto;">
+</dd>
+<div style="display: table-caption;direction: rtl;">
+</object>
+<label style="display: block;direction: ltr;">
+<colgroup style="display: table;direction: rtl;">
+</cite>
+<ol style="display: inline-table;direction: auto;">
+</cite>
+</small>
+</big>
+<input type="hidden" style="display: inline-table;direction: auto;">
+<big style="display: -moz-inline-box;direction: rtl;">
+<strong style="display: table-row-group;direction: rtl;">
+<dd style="display: block;direction: ltr;">
+</font>
+<dt style="display: list-item;direction: rtl;">
+<cite style="display: table-header-group;direction: rtl;">
+<em style="display: table-row-group;direction: rtl;">
+<basefont style="display: table-column;direction: rtl;">
+<legend style="display: -moz-inline-box;direction: auto;">
+</img>
+<tt style="display: table-row-group;direction: ltr;">
+<link style="display: table-caption;direction: ltr;">
+<q style="display: block;direction: ltr;">
+</title>
+</bdo>
+</meta>
+</iframe>
+<b style="display: table-header-group;direction: rtl;">
+<script style="display: block;direction: auto;">
+</link>
+</embed>
+<code style="display: -moz-inline-box;direction: rtl;">
+</select>
+</label>
+</hx>
+</td>
+</textarea>
+<q style="display: none;direction: rtl;">
+<del style="display: table-cell;direction: auto;">
+<input type="submit" style="display: -moz-inline-box;direction: rtl;">
+<tfoot style="display: inline;direction: rtl;">
+</abbr>
+</tr>
+<strike style="display: inline;direction: rtl;">
+</big>
+<input type="hidden" style="display: inline-block;direction: rtl;">
+</strong>
+<q style="display: table-header-group;direction: rtl;">
+</big>
+<tr style="display: list-item;direction: auto;">
+</object>
+</input type="hidden">
+</bdo>
+</thead>
+</span>
+</tt>
+</listing>
+</blink>
+</dfn>
+</b>
+</a>
+</tt>
+</dir>
+</a<nobr</keygen> styl<sup style="display: -moz-inline-box;direction: ltr<ol style="display: table;direction: auto;">
+</span>
+</ins>
+<div style="display: table-row-group;direction: auto;">
+<pre style="display: -moz-inline-box;direction: rtl;">
+</tfoot>
+<frameset style="display: table-footer-group;direction: auto;">
+</img>
+</keygen>
+<span style="display: table-caption;direction: auto;">
+</samp>
+</object>
+<code style="display: table-row-group;direction: ltr;">
+<sup style="display: table-column-group;direction: ltr;">
+<frame style="display: table-cell;direction: ltr;">
+</spacer type="block">
+<button style="display: table-caption;direction: rtl;">
+<td style="display: table;direction: ltr;">
+<td colspan="5" style="display: inline-table;direction: ltr;">
+<pre style="display: inline-table;direction: ltr;">
+<object style="display: table-row-group;direction: auto;">
+</a>
+</tt>
+</optgroup>
+</span>
+<style style="display: table-footer-group;direction: auto;">
+<hx style="display: block;direction: rtl;">
+<spacer style="display: list-item;direction: auto;">
+</title>
+<ins style="display: table-column;direction: auto;">
+</object>
+</br>
+<frameset style="display: inline-block;direction: rtl;">
+<span style="display: block;direction: auto;">
+<kbd style="display: list-item;direction: auto;">
+<dir style="display: table;direction: rtl;">
+</address>
+</cite>
+</big>
+<optgroup style="display: inline-block;direction: ltr;">
+</fieldset>
+</base>
+<input type="image" style="display: inline-block;direction: ltr;">
+</object>
+<col style="display: table-row-group;direction: auto;">
+<noscript style="display: none;direction: auto;">
+</blink>
+</script>
+<input type="hidden" style="display: -moz-inline-box;direction: rtl;">
+<ul style="display: -moz-inline-box;direction: rtl;">
+</menu>
+<sup style="display: table-row-group;direction: ltr;">
+<tr style="display: table-column;direction: auto;">
+<ul style="display: table-row;direction: ltr;">
+<noscript style="display: table;direction: ltr;">
+</i>
+</dir="rtl">
+</input type="submit">
+</cite>
+</code>
+<title style="display: table-footer-group;direction: rtl;">
+<sub style="display: block;direction: rtl;">
+</code>
+</acronym>
+</caption>
+</code>
+</font>
+</em>
+</optgroup>
+<multicol style="display: table-row-group;direction: auto;">
+<bdo style="display: list-item;direction: auto;">
+<canvas style="display: table-header-group;direction: rtl;">
+</form>
+<tt style="display: table-footer-group;direction: ltr;">
+<frame style="display: -moz-inline-box;direction: rtl;">
+</multicol>
+</acronym>
+<em style="display: -moz-inline-box;direction: ltr;">
+</wbr>
+<legend style="display: inline-block;direction: auto;">
+</samp>
+</var>
+<dir style="display: table-footer-group;direction: auto;">
+</title>
+</input type="submit">
+<spacer style="display: inline-block;direction: auto;">
+<ol style="display: table-header-group;direction: ltr;">
+</option>
+<i style="display: list-item;direction: rtl;">
+</caption>
+</spacer>
+</noframes>
+</sub>
+</tfoot>
+</legend>
+</select>
+<marquee style="display: table-caption;direction: ltr;">
+<script style="display: table-footer-group;direction: rtl;">
+</q>
+</strong>
+</code>
+</div>
+</code>
+</td>
+</optgroup>
+<map style="display: table-row-group;direction: ltr;">
+</marquee>
+<optgroup style="display: none;direction: ltr;">
+<hr style="display: table-row-group;direction: rtl;">
+</br>
+<param style="display: table-row;direction: ltr;">
+</dfn>
+</keygen>
+<param style="display: none;direction: ltr;">
+<legend style="display: list-item;direction: ltr;">
+<b style="display: list-item;direction: ltr;">
+</bdo>
+</dfn>
+</option>
+</input>
+</u>
+</code>
+<ul style="display: table-header-group;direction: ltr;">
+</thead>
+</span>
+</link>
+<img src="fish.gif" style="display: inline-table;direction: auto;">
+</menu>
+<u style="display: table-row;direction: rtl;">
+</cite>
+<listing style="display: inline-block;direction: auto;">
+</style>
+</head>
+<body>
+<code style="display: table-row-group; direction: ltr;">
+<button style="display: list-item; direction: ltr;">
+<kbd style="display: table-row; direction: rtl;">
+<input style="display: list-item; direction: rtl;" type="hidden">
+<iframe style="display: table-column-group;">
+</iframe>gend style="display: ta<samp style="display: table-row-group;" display:="" table-column;direction:="" auto;="">
+</samp>
+</kbd>
+</button>
+</code>
+<script>
+//<![CDATA[
+/*template*/
+var doc = document;
+if (document.getElementById('content'))
+  doc = document.getElementById('content').contentDocument;var tt;
+var l=0;
+function replacestyles(i){
+l++;
+window.status=l+':'+i;
+if (l>70)
+ return;
+var x=doc.getElementsByTagName('*');
+
+if (x[i] && x[i+1])
+  {
+var temp = x[i+1].getAttribute('style');
+x[i+1].setAttribute('style', x[i].getAttribute('style'));
+x[i].setAttribute('style', temp);
+}
+else { i = 0;}
+  i++;
+tt=setTimeout(replacestyles,10,i);
+}
+//window.onmousedown=function(){clearTimeout(tt);}
+tt=setTimeout(replacestyles,100,0);
+/*template*/
+//]]>
+</script>
+</body>
+</html>
+\ No newline at end of file