summaryrefslogtreecommitdiffstats
path: root/layout/generic/crashtests
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--layout/generic/crashtests/1001233.html18
-rw-r--r--layout/generic/crashtests/1001258-1.html26
-rw-r--r--layout/generic/crashtests/1001994.html14
-rw-r--r--layout/generic/crashtests/1003441.xhtml37
-rw-r--r--layout/generic/crashtests/1015562.html15
-rw-r--r--layout/generic/crashtests/1015563-1.html4
-rw-r--r--layout/generic/crashtests/1015563-2.html7
-rw-r--r--layout/generic/crashtests/1015844.html25
-rw-r--r--layout/generic/crashtests/1032450.html12
-rw-r--r--layout/generic/crashtests/1032613-1.svg10
-rw-r--r--layout/generic/crashtests/1032613-2.html17
-rw-r--r--layout/generic/crashtests/1037903.html6
-rw-r--r--layout/generic/crashtests/1039454-1.html12
-rw-r--r--layout/generic/crashtests/1042489.html6
-rw-r--r--layout/generic/crashtests/1054010-1.html97
-rw-r--r--layout/generic/crashtests/1058954-1.html13
-rw-r--r--layout/generic/crashtests/1059138-1.html38
-rw-r--r--layout/generic/crashtests/1102175-2.html47
-rw-r--r--layout/generic/crashtests/1134531.html4
-rw-r--r--layout/generic/crashtests/1134667.html2
-rw-r--r--layout/generic/crashtests/1137723-1.html29
-rw-r--r--layout/generic/crashtests/1137723-2.html29
-rw-r--r--layout/generic/crashtests/1140043-1.html7
-rw-r--r--layout/generic/crashtests/1140043-2.html7
-rw-r--r--layout/generic/crashtests/1140043-3.html7
-rw-r--r--layout/generic/crashtests/1140268-1.html18
-rw-r--r--layout/generic/crashtests/1145768.html21
-rw-r--r--layout/generic/crashtests/1145931.html16
-rw-r--r--layout/generic/crashtests/1146103.html6
-rw-r--r--layout/generic/crashtests/1146107.html6
-rw-r--r--layout/generic/crashtests/1146114.html6
-rw-r--r--layout/generic/crashtests/1153478-iframe.html18
-rw-r--r--layout/generic/crashtests/1153478.html11
-rw-r--r--layout/generic/crashtests/1153695.html25
-rw-r--r--layout/generic/crashtests/1156222.html6
-rw-r--r--layout/generic/crashtests/1156257.html16
-rw-r--r--layout/generic/crashtests/1157011.html4
-rw-r--r--layout/generic/crashtests/1169420-1.html8
-rw-r--r--layout/generic/crashtests/1169420-2.html8
-rw-r--r--layout/generic/crashtests/1178783-1.html157
-rw-r--r--layout/generic/crashtests/1183431.html6
-rw-r--r--layout/generic/crashtests/1186147-1.html6
-rw-r--r--layout/generic/crashtests/1209952.html38
-rw-r--r--layout/generic/crashtests/1221112-1.html32
-rw-r--r--layout/generic/crashtests/1221112-2.html27
-rw-r--r--layout/generic/crashtests/1221874-1.html16
-rw-r--r--layout/generic/crashtests/1221904.html24
-rw-r--r--layout/generic/crashtests/1222783.xhtml19
-rw-r--r--layout/generic/crashtests/1223522.xhtml5
-rw-r--r--layout/generic/crashtests/1223568-1.html2
-rw-r--r--layout/generic/crashtests/1223568-2.html6
-rw-r--r--layout/generic/crashtests/1224230-1.html22
-rw-r--r--layout/generic/crashtests/1225005.html4
-rw-r--r--layout/generic/crashtests/1225118.html4
-rw-r--r--layout/generic/crashtests/1225376.html10
-rw-r--r--layout/generic/crashtests/1225592.html13
-rw-r--r--layout/generic/crashtests/1229437-1.html8
-rw-r--r--layout/generic/crashtests/1229437-2.html5
-rw-r--r--layout/generic/crashtests/1230378.xhtml16
-rw-r--r--layout/generic/crashtests/1233191.html9
-rw-r--r--layout/generic/crashtests/1233607.html9
-rw-r--r--layout/generic/crashtests/1234701-1.html19
-rw-r--r--layout/generic/crashtests/1234701-2.html18
-rw-r--r--layout/generic/crashtests/1248227.html13
-rw-r--r--layout/generic/crashtests/1271765.html8
-rw-r--r--layout/generic/crashtests/1272983-1.html15
-rw-r--r--layout/generic/crashtests/1272983-2.html15
-rw-r--r--layout/generic/crashtests/1275059.html3
-rw-r--r--layout/generic/crashtests/1278007.html26
-rw-r--r--layout/generic/crashtests/1278080.html29
-rw-r--r--layout/generic/crashtests/1278461-1.html23
-rw-r--r--layout/generic/crashtests/1278461-2.html22
-rw-r--r--layout/generic/crashtests/1279814.html35
-rw-r--r--layout/generic/crashtests/1281102.html30
-rw-r--r--layout/generic/crashtests/1297427-non-equal-centers.html14
-rw-r--r--layout/generic/crashtests/1304441.html9
-rw-r--r--layout/generic/crashtests/1308876-1.html38
-rw-r--r--layout/generic/crashtests/1316649.html54
-rw-r--r--layout/generic/crashtests/1316884-1.html21
-rw-r--r--layout/generic/crashtests/1343552-1.html32
-rw-r--r--layout/generic/crashtests/1343552-2.html31
-rw-r--r--layout/generic/crashtests/1346454-1.html34
-rw-r--r--layout/generic/crashtests/1346454-2.html12
-rw-r--r--layout/generic/crashtests/1349650.html11
-rw-r--r--layout/generic/crashtests/1349816-1.html6
-rw-r--r--layout/generic/crashtests/1350372.html31
-rw-r--r--layout/generic/crashtests/1364361-1.html45
-rw-r--r--layout/generic/crashtests/1367413-1.html54
-rw-r--r--layout/generic/crashtests/1368617-1.html9
-rw-r--r--layout/generic/crashtests/1373586.html19
-rw-r--r--layout/generic/crashtests/1375858.html12
-rw-r--r--layout/generic/crashtests/1381134-2.html45
-rw-r--r--layout/generic/crashtests/1381134.html45
-rw-r--r--layout/generic/crashtests/1401420-1.html5
-rw-r--r--layout/generic/crashtests/1401709.html10
-rw-r--r--layout/generic/crashtests/1401807.html15
-rw-r--r--layout/generic/crashtests/1404222-empty-shape.html2
-rw-r--r--layout/generic/crashtests/1405443.html19
-rw-r--r--layout/generic/crashtests/1405813.html10
-rw-r--r--layout/generic/crashtests/1405896.html31
-rw-r--r--layout/generic/crashtests/1406252-1.html13
-rw-r--r--layout/generic/crashtests/1415185.html18
-rw-r--r--layout/generic/crashtests/1416544.html32
-rw-r--r--layout/generic/crashtests/1427824.html10
-rw-r--r--layout/generic/crashtests/1431781-2.html26
-rw-r--r--layout/generic/crashtests/1431781.html22
-rw-r--r--layout/generic/crashtests/1458028.html13
-rw-r--r--layout/generic/crashtests/1459697.html13
-rw-r--r--layout/generic/crashtests/1460158-1.html15
-rw-r--r--layout/generic/crashtests/1460158-2.html17
-rw-r--r--layout/generic/crashtests/1460158-3.html14
-rw-r--r--layout/generic/crashtests/1461039.html15
-rw-r--r--layout/generic/crashtests/1461979-1.html13
-rw-r--r--layout/generic/crashtests/1463977.html5
-rw-r--r--layout/generic/crashtests/1466224.html27
-rw-r--r--layout/generic/crashtests/1467239.html14
-rw-r--r--layout/generic/crashtests/1472403.html6
-rw-r--r--layout/generic/crashtests/1474768.html22
-rw-r--r--layout/generic/crashtests/1478178.html6
-rw-r--r--layout/generic/crashtests/1483972.html10
-rw-r--r--layout/generic/crashtests/1486457.html19
-rw-r--r--layout/generic/crashtests/1488762-1.html16
-rw-r--r--layout/generic/crashtests/1488910-1.html19
-rw-r--r--layout/generic/crashtests/1488910-2.html19
-rw-r--r--layout/generic/crashtests/1489287.html17
-rw-r--r--layout/generic/crashtests/1489770.html23
-rw-r--r--layout/generic/crashtests/1489863.html15
-rw-r--r--layout/generic/crashtests/1490032.html20
-rw-r--r--layout/generic/crashtests/1490685.html1
-rw-r--r--layout/generic/crashtests/1493708.html15
-rw-r--r--layout/generic/crashtests/1493710.html26
-rw-r--r--layout/generic/crashtests/1493741.html6
-rw-r--r--layout/generic/crashtests/1494380.html10
-rw-r--r--layout/generic/crashtests/1505817.html27
-rw-r--r--layout/generic/crashtests/1506216.html4
-rw-r--r--layout/generic/crashtests/1506306.html8
-rw-r--r--layout/generic/crashtests/1507196.html30
-rw-r--r--layout/generic/crashtests/1513275.html9
-rw-r--r--layout/generic/crashtests/1513282.html16
-rw-r--r--layout/generic/crashtests/1515124.html26
-rw-r--r--layout/generic/crashtests/1517033.html24
-rw-r--r--layout/generic/crashtests/1517297.html22
-rw-r--r--layout/generic/crashtests/1520798-1.xhtml10
-rw-r--r--layout/generic/crashtests/1520798-2.html13
-rw-r--r--layout/generic/crashtests/1528771.html10
-rw-r--r--layout/generic/crashtests/1539656.html14
-rw-r--r--layout/generic/crashtests/1542441.html37
-rw-r--r--layout/generic/crashtests/1543140-1.html24
-rw-r--r--layout/generic/crashtests/1544060-1.html3
-rw-r--r--layout/generic/crashtests/1544060-2.html1
-rw-r--r--layout/generic/crashtests/1553824.html86
-rw-r--r--layout/generic/crashtests/1554824.html25
-rw-r--r--layout/generic/crashtests/1555142.html15
-rw-r--r--layout/generic/crashtests/1560349.html12
-rw-r--r--layout/generic/crashtests/1560397-2.html25
-rw-r--r--layout/generic/crashtests/1560397.html21
-rw-r--r--layout/generic/crashtests/1562105.html6
-rw-r--r--layout/generic/crashtests/1563131.html17
-rw-r--r--layout/generic/crashtests/1568001-1.html19
-rw-r--r--layout/generic/crashtests/1568001-2.html13
-rw-r--r--layout/generic/crashtests/1569639.html13
-rw-r--r--layout/generic/crashtests/1571239.html22
-rw-r--r--layout/generic/crashtests/1571460.html29
-rw-r--r--layout/generic/crashtests/1571598.html14
-rw-r--r--layout/generic/crashtests/1571897.html15
-rw-r--r--layout/generic/crashtests/1572901.html19
-rw-r--r--layout/generic/crashtests/1573216.html20
-rw-r--r--layout/generic/crashtests/1574552.html6
-rw-r--r--layout/generic/crashtests/1574993.html21
-rw-r--r--layout/generic/crashtests/1582019.html22
-rw-r--r--layout/generic/crashtests/1586470.html9
-rw-r--r--layout/generic/crashtests/1588955-very-large-frameset.html9
-rw-r--r--layout/generic/crashtests/1590569.html24
-rw-r--r--layout/generic/crashtests/1596310.html17
-rw-r--r--layout/generic/crashtests/1601819-1.html11
-rw-r--r--layout/generic/crashtests/1608851-1.html12
-rw-r--r--layout/generic/crashtests/1608851-2.html12
-rw-r--r--layout/generic/crashtests/1613210.html31
-rw-r--r--layout/generic/crashtests/1614101.html44
-rw-r--r--layout/generic/crashtests/1618312.html19
-rw-r--r--layout/generic/crashtests/1618564.html12
-rw-r--r--layout/generic/crashtests/1625051-1.html13
-rw-r--r--layout/generic/crashtests/1625051-2.html13
-rw-r--r--layout/generic/crashtests/1626970.html14
-rw-r--r--layout/generic/crashtests/1628804.html21
-rw-r--r--layout/generic/crashtests/1629575-1.html21
-rw-r--r--layout/generic/crashtests/1629575-2.html69
-rw-r--r--layout/generic/crashtests/1630385.html26
-rw-r--r--layout/generic/crashtests/1633434.html15
-rw-r--r--layout/generic/crashtests/1633737-1.html8
-rw-r--r--layout/generic/crashtests/1633737-2.html8
-rw-r--r--layout/generic/crashtests/1633737-3.html34
-rw-r--r--layout/generic/crashtests/1633737-4.html53
-rw-r--r--layout/generic/crashtests/1633737-5.html39
-rw-r--r--layout/generic/crashtests/1633828.html36
-rw-r--r--layout/generic/crashtests/1638860-1.html24
-rw-r--r--layout/generic/crashtests/1638860-2.html26
-rw-r--r--layout/generic/crashtests/1638906.html25
-rw-r--r--layout/generic/crashtests/1640028.html31
-rw-r--r--layout/generic/crashtests/1640051.html20
-rw-r--r--layout/generic/crashtests/1640275.html14
-rw-r--r--layout/generic/crashtests/1644819.html20
-rw-r--r--layout/generic/crashtests/1645549-1.html19
-rw-r--r--layout/generic/crashtests/1648577.html18
-rw-r--r--layout/generic/crashtests/1652618.html15
-rw-r--r--layout/generic/crashtests/1652897.html13
-rw-r--r--layout/generic/crashtests/1654925.html16
-rw-r--r--layout/generic/crashtests/1663222.html19
-rw-r--r--layout/generic/crashtests/1666592.html2
-rw-r--r--layout/generic/crashtests/1670336.html33
-rw-r--r--layout/generic/crashtests/1676970.html20
-rw-r--r--layout/generic/crashtests/1677518-1.html15
-rw-r--r--layout/generic/crashtests/1677518-1.jpgbin0 -> 1295 bytes
-rw-r--r--layout/generic/crashtests/1677518-1.svg29
-rw-r--r--layout/generic/crashtests/1679794.html27
-rw-r--r--layout/generic/crashtests/1680406.html16
-rw-r--r--layout/generic/crashtests/1681788.html13
-rw-r--r--layout/generic/crashtests/1682032.html17
-rw-r--r--layout/generic/crashtests/1682686-1.html60
-rw-r--r--layout/generic/crashtests/1682686-2.html35
-rw-r--r--layout/generic/crashtests/1682882.html27
-rw-r--r--layout/generic/crashtests/1683126.html15
-rw-r--r--layout/generic/crashtests/1697262-1.html17
-rw-r--r--layout/generic/crashtests/1699263.html18
-rw-r--r--layout/generic/crashtests/1699468.html30
-rw-r--r--layout/generic/crashtests/1728319.html11
-rw-r--r--layout/generic/crashtests/1730506.html21
-rw-r--r--layout/generic/crashtests/1730570.html33
-rw-r--r--layout/generic/crashtests/1734015.html21
-rw-r--r--layout/generic/crashtests/1776079.html19
-rw-r--r--layout/generic/crashtests/1791606.html29
-rw-r--r--layout/generic/crashtests/1799749.html5
-rw-r--r--layout/generic/crashtests/1807958.html33
-rw-r--r--layout/generic/crashtests/1816574.html39
-rw-r--r--layout/generic/crashtests/1821603.html4
-rw-r--r--layout/generic/crashtests/1822118.html11
-rw-r--r--layout/generic/crashtests/1825434.html16
-rw-r--r--layout/generic/crashtests/225868-1-inner.html14
-rw-r--r--layout/generic/crashtests/225868-1.html7
-rw-r--r--layout/generic/crashtests/255468.xhtml24
-rw-r--r--layout/generic/crashtests/255982-1.html13
-rw-r--r--layout/generic/crashtests/255982-2.html10
-rw-r--r--layout/generic/crashtests/255982-3.html10
-rw-r--r--layout/generic/crashtests/255982-4.html13
-rw-r--r--layout/generic/crashtests/25888-1.html6
-rw-r--r--layout/generic/crashtests/25888-2.html8
-rw-r--r--layout/generic/crashtests/264937-1.html18
-rw-r--r--layout/generic/crashtests/265867-1.html11
-rw-r--r--layout/generic/crashtests/265867-2.html3
-rw-r--r--layout/generic/crashtests/286491.html26
-rw-r--r--layout/generic/crashtests/289864-1.html5
-rw-r--r--layout/generic/crashtests/289864-1.jpgbin0 -> 42186 bytes
-rw-r--r--layout/generic/crashtests/295292-1.html13
-rw-r--r--layout/generic/crashtests/295292-2.html23
-rw-r--r--layout/generic/crashtests/302260-1.html21
-rw-r--r--layout/generic/crashtests/307979-1.html27
-rw-r--r--layout/generic/crashtests/309322-1.html56
-rw-r--r--layout/generic/crashtests/309322-2.html56
-rw-r--r--layout/generic/crashtests/309322-3.html48
-rw-r--r--layout/generic/crashtests/309322-4.html48
-rw-r--r--layout/generic/crashtests/310556-1.xhtml21
-rw-r--r--layout/generic/crashtests/321224.xhtml6
-rw-r--r--layout/generic/crashtests/322780-1.xhtml6
-rw-r--r--layout/generic/crashtests/323381-1.html1
-rw-r--r--layout/generic/crashtests/323381-2.html1
-rw-r--r--layout/generic/crashtests/323386-1.html1
-rw-r--r--layout/generic/crashtests/323389-1.html7
-rw-r--r--layout/generic/crashtests/323389-2.html8
-rw-r--r--layout/generic/crashtests/323493-1.html16
-rw-r--r--layout/generic/crashtests/323495-1.html14
-rw-r--r--layout/generic/crashtests/324318-1.html29
-rw-r--r--layout/generic/crashtests/328946-1.html1
-rw-r--r--layout/generic/crashtests/331284-1.xhtml13
-rw-r--r--layout/generic/crashtests/331292.html258
-rw-r--r--layout/generic/crashtests/334105-1.xhtml35
-rw-r--r--layout/generic/crashtests/334107-1.xhtml9
-rw-r--r--layout/generic/crashtests/334147-1.xhtml16
-rw-r--r--layout/generic/crashtests/334148-1.xhtml14
-rw-r--r--layout/generic/crashtests/334602-1.html12
-rw-r--r--layout/generic/crashtests/337412-1.html29
-rw-r--r--layout/generic/crashtests/337883-1.html20
-rw-r--r--layout/generic/crashtests/337883-2.html21
-rw-r--r--layout/generic/crashtests/339769-1.html22
-rw-r--r--layout/generic/crashtests/342322-1.html28
-rw-r--r--layout/generic/crashtests/343206-1.xhtml21
-rw-r--r--layout/generic/crashtests/344557-1.html32
-rw-r--r--layout/generic/crashtests/345139-1.xhtml53
-rw-r--r--layout/generic/crashtests/345617-1.html8
-rw-r--r--layout/generic/crashtests/348510-1.html7
-rw-r--r--layout/generic/crashtests/348510-2.html7
-rw-r--r--layout/generic/crashtests/348887-1-inner.html21
-rw-r--r--layout/generic/crashtests/348887-1.html9
-rw-r--r--layout/generic/crashtests/350370.html42
-rw-r--r--layout/generic/crashtests/354458-1.html10
-rw-r--r--layout/generic/crashtests/354458-2.html26
-rw-r--r--layout/generic/crashtests/355426-1.html27
-rw-r--r--layout/generic/crashtests/359371-1.html66
-rw-r--r--layout/generic/crashtests/359371-2.html64
-rw-r--r--layout/generic/crashtests/360599.html25
-rw-r--r--layout/generic/crashtests/361109.html9
-rw-r--r--layout/generic/crashtests/363448.html23
-rw-r--r--layout/generic/crashtests/363722-1.html9
-rw-r--r--layout/generic/crashtests/363722-2.html10
-rw-r--r--layout/generic/crashtests/364220.html17
-rw-r--r--layout/generic/crashtests/364407-1.html44
-rw-r--r--layout/generic/crashtests/364686-1.xhtml12
-rw-r--r--layout/generic/crashtests/366021-1.xhtml24
-rw-r--r--layout/generic/crashtests/366667-1.html6
-rw-r--r--layout/generic/crashtests/366952-1.html17
-rw-r--r--layout/generic/crashtests/367246-1.html9
-rw-r--r--layout/generic/crashtests/367360.html30
-rw-r--r--layout/generic/crashtests/368330-1.html15
-rw-r--r--layout/generic/crashtests/368461-1.xhtml11
-rw-r--r--layout/generic/crashtests/368568.html14
-rw-r--r--layout/generic/crashtests/368752.html20
-rw-r--r--layout/generic/crashtests/368860-1.html12
-rw-r--r--layout/generic/crashtests/368863-1.html5
-rw-r--r--layout/generic/crashtests/369150-1.html22
-rw-r--r--layout/generic/crashtests/369150-2.html22
-rw-r--r--layout/generic/crashtests/369227-1.xhtml19
-rw-r--r--layout/generic/crashtests/369542-1.html7
-rw-r--r--layout/generic/crashtests/369542-2.html15
-rw-r--r--layout/generic/crashtests/369547-1.html16
-rw-r--r--layout/generic/crashtests/370174-1.html566
-rw-r--r--layout/generic/crashtests/370174-2.html13
-rw-r--r--layout/generic/crashtests/370174-3.html25
-rw-r--r--layout/generic/crashtests/370699-1.html14
-rw-r--r--layout/generic/crashtests/370794-1.html12
-rw-r--r--layout/generic/crashtests/370884-1.xhtml14
-rw-r--r--layout/generic/crashtests/371348-1.xhtml41
-rw-r--r--layout/generic/crashtests/371561-1.html8
-rw-r--r--layout/generic/crashtests/371566-1.xhtml13
-rw-r--r--layout/generic/crashtests/372376-1.xhtml39
-rw-r--r--layout/generic/crashtests/373859-1.html16
-rw-r--r--layout/generic/crashtests/373868-1.xhtml19
-rw-r--r--layout/generic/crashtests/375462-1.html781
-rw-r--r--layout/generic/crashtests/375831.html11
-rw-r--r--layout/generic/crashtests/376419.html28
-rw-r--r--layout/generic/crashtests/377522.html18
-rw-r--r--layout/generic/crashtests/37757-1.html1
-rw-r--r--layout/generic/crashtests/379217-1.xhtml7
-rw-r--r--layout/generic/crashtests/379217-2.xhtml10
-rw-r--r--layout/generic/crashtests/379917-1.xhtml35
-rw-r--r--layout/generic/crashtests/380012-1.html42
-rw-r--r--layout/generic/crashtests/381152-1.html11
-rw-r--r--layout/generic/crashtests/382129-1.xhtml7
-rw-r--r--layout/generic/crashtests/382131-1.html25
-rw-r--r--layout/generic/crashtests/382199-1.html8
-rw-r--r--layout/generic/crashtests/382208-1.xhtml7
-rw-r--r--layout/generic/crashtests/382262-1.html10
-rw-r--r--layout/generic/crashtests/382396-1.xhtml7
-rw-r--r--layout/generic/crashtests/383089-1.html85
-rw-r--r--layout/generic/crashtests/385265-1.xhtml13
-rw-r--r--layout/generic/crashtests/385295-1.xhtml5
-rw-r--r--layout/generic/crashtests/385344-1.html12
-rw-r--r--layout/generic/crashtests/385344-2.html10
-rw-r--r--layout/generic/crashtests/385414-1.html5
-rw-r--r--layout/generic/crashtests/385414-2.html5
-rw-r--r--layout/generic/crashtests/385426-1.html5
-rw-r--r--layout/generic/crashtests/385526.html116
-rw-r--r--layout/generic/crashtests/385681.html34
-rw-r--r--layout/generic/crashtests/386799-1.html7
-rw-r--r--layout/generic/crashtests/386807-1.html19
-rw-r--r--layout/generic/crashtests/386812-1.html23
-rw-r--r--layout/generic/crashtests/386827-1.html16
-rw-r--r--layout/generic/crashtests/387058-1.html16
-rw-r--r--layout/generic/crashtests/387058-2.html17
-rw-r--r--layout/generic/crashtests/387088-1.html5
-rw-r--r--layout/generic/crashtests/387209-1.html6
-rw-r--r--layout/generic/crashtests/387213-1.html10
-rw-r--r--layout/generic/crashtests/387215-1.xhtml15
-rw-r--r--layout/generic/crashtests/387219-1.xhtml8
-rw-r--r--layout/generic/crashtests/387233-1.html21
-rw-r--r--layout/generic/crashtests/387233-2.html18
-rw-r--r--layout/generic/crashtests/387282-1.html7
-rw-r--r--layout/generic/crashtests/388049.html43
-rw-r--r--layout/generic/crashtests/388175-1.html24
-rw-r--r--layout/generic/crashtests/388367-1.html7
-rw-r--r--layout/generic/crashtests/388709-1.html15
-rw-r--r--layout/generic/crashtests/389635-1.html14
-rw-r--r--layout/generic/crashtests/390050-1.html48
-rw-r--r--layout/generic/crashtests/390050-2.html22
-rw-r--r--layout/generic/crashtests/390050-3.html4
-rw-r--r--layout/generic/crashtests/390052.html13
-rw-r--r--layout/generic/crashtests/390417.html17
-rw-r--r--layout/generic/crashtests/390762-1.html30
-rw-r--r--layout/generic/crashtests/391053-1.xhtml16
-rw-r--r--layout/generic/crashtests/391894-1.html17
-rw-r--r--layout/generic/crashtests/392698-1.html16
-rw-r--r--layout/generic/crashtests/393758-1.xhtml10
-rw-r--r--layout/generic/crashtests/393906-1.html12
-rw-r--r--layout/generic/crashtests/393923-1.html15
-rw-r--r--layout/generic/crashtests/393956-1.html25
-rw-r--r--layout/generic/crashtests/393956-2.html26
-rw-r--r--layout/generic/crashtests/393956-3.html11
-rw-r--r--layout/generic/crashtests/393956-4.html11
-rw-r--r--layout/generic/crashtests/394237-1.html38
-rw-r--r--layout/generic/crashtests/394818-1.html13
-rw-r--r--layout/generic/crashtests/394818-2.html16
-rw-r--r--layout/generic/crashtests/394820-1.html19
-rw-r--r--layout/generic/crashtests/395316-1.html13
-rw-r--r--layout/generic/crashtests/395450-1.xhtml28
-rw-r--r--layout/generic/crashtests/397007-1.html37
-rw-r--r--layout/generic/crashtests/397187-1.html32
-rw-r--r--layout/generic/crashtests/397844-1.xhtml55
-rw-r--r--layout/generic/crashtests/397844-2.xhtml55
-rw-r--r--layout/generic/crashtests/397852-1.xhtml7
-rw-r--r--layout/generic/crashtests/398181-1.html10
-rw-r--r--layout/generic/crashtests/398181-2.html11
-rw-r--r--layout/generic/crashtests/398322-1.html17
-rw-r--r--layout/generic/crashtests/398322-2.html12
-rw-r--r--layout/generic/crashtests/398332-1.html19
-rw-r--r--layout/generic/crashtests/398332-2.html27
-rw-r--r--layout/generic/crashtests/398332-3.html4
-rw-r--r--layout/generic/crashtests/399407-1.xhtml25
-rw-r--r--layout/generic/crashtests/399412-1.html32
-rw-r--r--layout/generic/crashtests/399843-1.html64
-rw-r--r--layout/generic/crashtests/400078-1.html20
-rw-r--r--layout/generic/crashtests/400190.html63
-rw-r--r--layout/generic/crashtests/400223-1.html24
-rw-r--r--layout/generic/crashtests/400232-1.html11
-rw-r--r--layout/generic/crashtests/400244-1.html31
-rw-r--r--layout/generic/crashtests/400768-1.xhtml9
-rw-r--r--layout/generic/crashtests/400768-2.xhtml7
-rw-r--r--layout/generic/crashtests/401042-2.html5
-rw-r--r--layout/generic/crashtests/402380-1.html13
-rw-r--r--layout/generic/crashtests/402380-2.html18
-rw-r--r--layout/generic/crashtests/402872-1.html3
-rw-r--r--layout/generic/crashtests/402872-2.html2
-rw-r--r--layout/generic/crashtests/403004.html3
-rw-r--r--layout/generic/crashtests/403143-1.html19
-rw-r--r--layout/generic/crashtests/403576-1.html5
-rw-r--r--layout/generic/crashtests/404140-1.html7
-rw-r--r--layout/generic/crashtests/404146-1.html28
-rw-r--r--layout/generic/crashtests/404204-1.html7
-rw-r--r--layout/generic/crashtests/404215-1.html29
-rw-r--r--layout/generic/crashtests/404215-2.html37
-rw-r--r--layout/generic/crashtests/404215-3.html32
-rw-r--r--layout/generic/crashtests/404219-1.html30
-rw-r--r--layout/generic/crashtests/404219-2.html31
-rw-r--r--layout/generic/crashtests/404624.html7
-rw-r--r--layout/generic/crashtests/406137.html16
-rw-r--r--layout/generic/crashtests/406380.html12
-rw-r--r--layout/generic/crashtests/406902-1.html47
-rw-r--r--layout/generic/crashtests/407009-1.xhtml7
-rw-r--r--layout/generic/crashtests/408304-1.xhtml5
-rw-r--r--layout/generic/crashtests/408602-1.html12
-rw-r--r--layout/generic/crashtests/408737-1.html14
-rw-r--r--layout/generic/crashtests/408737-2.html14
-rw-r--r--layout/generic/crashtests/408749-1.xhtml1
-rw-r--r--layout/generic/crashtests/408883-1.html39
-rw-r--r--layout/generic/crashtests/410198.html8
-rw-r--r--layout/generic/crashtests/410228-1.html7
-rw-r--r--layout/generic/crashtests/410232-1.html14
-rw-r--r--layout/generic/crashtests/410595-1.html7
-rw-r--r--layout/generic/crashtests/411213-1.html9
-rw-r--r--layout/generic/crashtests/411213-2.xml8
-rw-r--r--layout/generic/crashtests/411835.html19
-rw-r--r--layout/generic/crashtests/411851-1.html8
-rw-r--r--layout/generic/crashtests/412014-1.html17
-rw-r--r--layout/generic/crashtests/412201-1.xhtml1
-rw-r--r--layout/generic/crashtests/412543-1.html17
-rw-r--r--layout/generic/crashtests/413048-1.html9
-rw-r--r--layout/generic/crashtests/413079-1.xhtml10
-rw-r--r--layout/generic/crashtests/413079-2.xhtml12
-rw-r--r--layout/generic/crashtests/413079-3.xhtml12
-rw-r--r--layout/generic/crashtests/413085-1.html23
-rw-r--r--layout/generic/crashtests/413085-2.html14
-rw-r--r--layout/generic/crashtests/413582-1.xhtml9
-rw-r--r--layout/generic/crashtests/413582-2.html9
-rw-r--r--layout/generic/crashtests/413712-1.xhtml18
-rw-r--r--layout/generic/crashtests/414061-1.html12
-rw-r--r--layout/generic/crashtests/414180-1.xhtml7
-rw-r--r--layout/generic/crashtests/414719-1.html25
-rw-r--r--layout/generic/crashtests/415685-1.html14
-rw-r--r--layout/generic/crashtests/415818.xhtml9
-rw-r--r--layout/generic/crashtests/416165.html23
-rw-r--r--layout/generic/crashtests/416264-1.html8
-rw-r--r--layout/generic/crashtests/416476-1.html2
-rw-r--r--layout/generic/crashtests/417848-1.xhtml6
-rw-r--r--layout/generic/crashtests/417902-1.html23
-rw-r--r--layout/generic/crashtests/417902-2.html28
-rw-r--r--layout/generic/crashtests/418532-1.html9
-rw-r--r--layout/generic/crashtests/418932-1.html2
-rw-r--r--layout/generic/crashtests/419352.html3
-rw-r--r--layout/generic/crashtests/420000-1.html10
-rw-r--r--layout/generic/crashtests/420718.html1
-rw-r--r--layout/generic/crashtests/421404-1.html20
-rw-r--r--layout/generic/crashtests/421671.html202
-rw-r--r--layout/generic/crashtests/422283-1.html10
-rw-r--r--layout/generic/crashtests/422301-1.html24
-rw-r--r--layout/generic/crashtests/423055-1.html10
-rw-r--r--layout/generic/crashtests/423098.html22
-rw-r--r--layout/generic/crashtests/423264-1.html19
-rw-r--r--layout/generic/crashtests/424629.html21
-rw-r--r--layout/generic/crashtests/425253-1.html5
-rw-r--r--layout/generic/crashtests/426040-1.html28
-rw-r--r--layout/generic/crashtests/426272-1.html18
-rw-r--r--layout/generic/crashtests/428263-1.html18
-rw-r--r--layout/generic/crashtests/429960-1.html17
-rw-r--r--layout/generic/crashtests/429960-2.html18
-rw-r--r--layout/generic/crashtests/429969-1.html24
-rw-r--r--layout/generic/crashtests/429981-1.html27
-rw-r--r--layout/generic/crashtests/430332-1.html17
-rw-r--r--layout/generic/crashtests/430344-1.html5
-rw-r--r--layout/generic/crashtests/430352-1.html5
-rw-r--r--layout/generic/crashtests/430744-1.html10
-rw-r--r--layout/generic/crashtests/430991.html24
-rw-r--r--layout/generic/crashtests/431260-1.html34
-rw-r--r--layout/generic/crashtests/431260-2.html26
-rw-r--r--layout/generic/crashtests/435529.html20
-rw-r--r--layout/generic/crashtests/436194-1.html18
-rw-r--r--layout/generic/crashtests/436602-1.html8
-rw-r--r--layout/generic/crashtests/436822-1.html22
-rw-r--r--layout/generic/crashtests/436823.html10
-rw-r--r--layout/generic/crashtests/436969-1.html10
-rw-r--r--layout/generic/crashtests/437156-1.html10
-rw-r--r--layout/generic/crashtests/437565-1.xhtml7
-rw-r--r--layout/generic/crashtests/437565-2.xhtml24
-rw-r--r--layout/generic/crashtests/437565-3.xhtml23
-rw-r--r--layout/generic/crashtests/438259-1.html13
-rw-r--r--layout/generic/crashtests/438266-1.html33
-rw-r--r--layout/generic/crashtests/438509-1.html80
-rw-r--r--layout/generic/crashtests/443528-1.html19
-rw-r--r--layout/generic/crashtests/444230-1.html1
-rw-r--r--layout/generic/crashtests/444484-1.html27
-rw-r--r--layout/generic/crashtests/444726-1.xhtml10
-rw-r--r--layout/generic/crashtests/444861-1.html18
-rw-r--r--layout/generic/crashtests/445288.html15
-rw-r--r--layout/generic/crashtests/448903-1.html5
-rw-r--r--layout/generic/crashtests/448996-1.html26
-rw-r--r--layout/generic/crashtests/451315-1.html5
-rw-r--r--layout/generic/crashtests/451317-1.html24
-rw-r--r--layout/generic/crashtests/451334-1.html10
-rw-r--r--layout/generic/crashtests/452157-1.html8
-rw-r--r--layout/generic/crashtests/452157-2.html39
-rw-r--r--layout/generic/crashtests/452157-3.html39
-rw-r--r--layout/generic/crashtests/453762-1.html4
-rw-r--r--layout/generic/crashtests/455171-1.html5
-rw-r--r--layout/generic/crashtests/455171-2.html7
-rw-r--r--layout/generic/crashtests/455171-3.html2
-rw-r--r--layout/generic/crashtests/455643-1.xhtml19
-rw-r--r--layout/generic/crashtests/457375.html5
-rw-r--r--layout/generic/crashtests/457380-1.html26
-rw-r--r--layout/generic/crashtests/459968.html33
-rw-r--r--layout/generic/crashtests/460910-1.xml14
-rw-r--r--layout/generic/crashtests/461294-1.html1
-rw-r--r--layout/generic/crashtests/462968.xhtml5
-rw-r--r--layout/generic/crashtests/463350-1.html17
-rw-r--r--layout/generic/crashtests/463350-2.html17
-rw-r--r--layout/generic/crashtests/463350-3.html15
-rw-r--r--layout/generic/crashtests/463741-1.html20
-rw-r--r--layout/generic/crashtests/465651-1.html45
-rw-r--r--layout/generic/crashtests/467137-1.html24
-rw-r--r--layout/generic/crashtests/467213-1.html9
-rw-r--r--layout/generic/crashtests/467487-1.html11
-rw-r--r--layout/generic/crashtests/467493-1.html7
-rw-r--r--layout/generic/crashtests/467493-2.html25
-rw-r--r--layout/generic/crashtests/467875-1.xhtml10
-rw-r--r--layout/generic/crashtests/467914-1.html3
-rw-r--r--layout/generic/crashtests/468207-1.html5
-rw-r--r--layout/generic/crashtests/468771-1.xhtml27
-rw-r--r--layout/generic/crashtests/468771-2.xhtml22
-rw-r--r--layout/generic/crashtests/469859-1.xhtml32
-rw-r--r--layout/generic/crashtests/471360.html61
-rw-r--r--layout/generic/crashtests/472587-1.xhtml28
-rw-r--r--layout/generic/crashtests/472617-1.xhtml4
-rw-r--r--layout/generic/crashtests/472774-1.html25
-rw-r--r--layout/generic/crashtests/472776-1.html20
-rw-r--r--layout/generic/crashtests/472950-1.html21
-rw-r--r--layout/generic/crashtests/473278-1.xhtml1
-rw-r--r--layout/generic/crashtests/473894-1.html6
-rw-r--r--layout/generic/crashtests/476241-1.html2
-rw-r--r--layout/generic/crashtests/477731-1.html6
-rw-r--r--layout/generic/crashtests/477928.html18
-rw-r--r--layout/generic/crashtests/478131-1.html7
-rw-r--r--layout/generic/crashtests/478170-1.html17
-rw-r--r--layout/generic/crashtests/478185-1.html61
-rw-r--r--layout/generic/crashtests/478504.html33
-rw-r--r--layout/generic/crashtests/479938-1.html23
-rw-r--r--layout/generic/crashtests/480345-1.html5
-rw-r--r--layout/generic/crashtests/481921-iframe.html12
-rw-r--r--layout/generic/crashtests/481921.html20
-rw-r--r--layout/generic/crashtests/481921.oggbin0 -> 42852 bytes
-rw-r--r--layout/generic/crashtests/489462-1.html21
-rw-r--r--layout/generic/crashtests/489477.html21
-rw-r--r--layout/generic/crashtests/489480-1.xhtml1
-rw-r--r--layout/generic/crashtests/489647-1.html13
-rw-r--r--layout/generic/crashtests/493111-1.html22
-rw-r--r--layout/generic/crashtests/493118-1.html6
-rw-r--r--layout/generic/crashtests/493649.html5
-rw-r--r--layout/generic/crashtests/494283-1.xhtml4
-rw-r--r--layout/generic/crashtests/494283-2.html6
-rw-r--r--layout/generic/crashtests/494332-1.html7
-rw-r--r--layout/generic/crashtests/495875-1.html7
-rw-r--r--layout/generic/crashtests/495875-2.html7
-rw-r--r--layout/generic/crashtests/496742.html11
-rw-r--r--layout/generic/crashtests/499138-iframe.html17
-rw-r--r--layout/generic/crashtests/499138.html18
-rw-r--r--layout/generic/crashtests/499857-1.html33
-rw-r--r--layout/generic/crashtests/499862-1.html9
-rw-r--r--layout/generic/crashtests/501535-1.html6
-rw-r--r--layout/generic/crashtests/503961-1.xhtml25
-rw-r--r--layout/generic/crashtests/503961-2.html32
-rw-r--r--layout/generic/crashtests/507566.html33
-rw-r--r--layout/generic/crashtests/508154-1.xhtml1
-rw-r--r--layout/generic/crashtests/508168-1.html6
-rw-r--r--layout/generic/crashtests/508816-1.xhtml9
-rw-r--r--layout/generic/crashtests/509749-1.html5
-rw-r--r--layout/generic/crashtests/511482.html42
-rw-r--r--layout/generic/crashtests/512724-1.html1
-rw-r--r--layout/generic/crashtests/512725-1.html6
-rw-r--r--layout/generic/crashtests/512749-1.html1
-rw-r--r--layout/generic/crashtests/513110-1.html23
-rw-r--r--layout/generic/crashtests/513110-2.xhtml5
-rw-r--r--layout/generic/crashtests/513394-1.html16
-rw-r--r--layout/generic/crashtests/514098-1.xhtml16
-rw-r--r--layout/generic/crashtests/514800-1.html4
-rw-r--r--layout/generic/crashtests/515811-1.html5
-rw-r--r--layout/generic/crashtests/517968.html6
-rw-r--r--layout/generic/crashtests/519031.xhtml6
-rw-r--r--layout/generic/crashtests/520340.html2
-rw-r--r--layout/generic/crashtests/522170-1.html1
-rw-r--r--layout/generic/crashtests/526217.html16
-rw-r--r--layout/generic/crashtests/533379-1.html16
-rw-r--r--layout/generic/crashtests/533379-2.html16
-rw-r--r--layout/generic/crashtests/534082-1.html7
-rw-r--r--layout/generic/crashtests/534366-1.html38
-rw-r--r--layout/generic/crashtests/534366-2.html42
-rw-r--r--layout/generic/crashtests/536692-1.xhtml5
-rw-r--r--layout/generic/crashtests/537645.xhtml11
-rw-r--r--layout/generic/crashtests/541277-1.html5
-rw-r--r--layout/generic/crashtests/541277-2.html5
-rw-r--r--layout/generic/crashtests/541714-1.html3
-rw-r--r--layout/generic/crashtests/541714-2.html3
-rw-r--r--layout/generic/crashtests/542136-1.html23
-rw-r--r--layout/generic/crashtests/545571-1.html8
-rw-r--r--layout/generic/crashtests/547843-1.xhtml1
-rw-r--r--layout/generic/crashtests/551635-1.html16
-rw-r--r--layout/generic/crashtests/553504-1.xhtml4
-rw-r--r--layout/generic/crashtests/564368-1.xhtml27
-rw-r--r--layout/generic/crashtests/564968.xhtml30
-rw-r--r--layout/generic/crashtests/569193-1.html6
-rw-r--r--layout/generic/crashtests/570160.html53
-rw-r--r--layout/generic/crashtests/570289-1.html1
-rw-r--r--layout/generic/crashtests/571618-1.svg1
-rw-r--r--layout/generic/crashtests/571975-1.html5
-rw-r--r--layout/generic/crashtests/571995.xhtml8
-rw-r--r--layout/generic/crashtests/574958.xhtml16
-rw-r--r--layout/generic/crashtests/578977.html11
-rw-r--r--layout/generic/crashtests/578977.xhtml10
-rw-r--r--layout/generic/crashtests/580504-1.xhtml22
-rw-r--r--layout/generic/crashtests/582793-1.html850
-rw-r--r--layout/generic/crashtests/585598-1.xhtml7
-rw-r--r--layout/generic/crashtests/586806-1.html27
-rw-r--r--layout/generic/crashtests/586806-2.html1
-rw-r--r--layout/generic/crashtests/586806-3.html9
-rw-r--r--layout/generic/crashtests/586973-1.html9
-rw-r--r--layout/generic/crashtests/589002-1.html4
-rw-r--r--layout/generic/crashtests/590404.html1
-rw-r--r--layout/generic/crashtests/591141.html7
-rw-r--r--layout/generic/crashtests/592118.html4
-rw-r--r--layout/generic/crashtests/594808-1.html7
-rw-r--r--layout/generic/crashtests/595435-1.xhtml8
-rw-r--r--layout/generic/crashtests/595740-1.html8
-rw-r--r--layout/generic/crashtests/597240-1.xhtml20
-rw-r--r--layout/generic/crashtests/600100.xhtml1
-rw-r--r--layout/generic/crashtests/603490-1.html16
-rw-r--r--layout/generic/crashtests/603510-1.html23
-rw-r--r--layout/generic/crashtests/604314-1.html16
-rw-r--r--layout/generic/crashtests/604843.html28
-rw-r--r--layout/generic/crashtests/605340.html12
-rw-r--r--layout/generic/crashtests/606642.xhtml16
-rw-r--r--layout/generic/crashtests/613455-1.svg12
-rw-r--r--layout/generic/crashtests/613629-1.xhtml14
-rw-r--r--layout/generic/crashtests/616052-1.html4
-rw-r--r--layout/generic/crashtests/619021.html5
-rw-r--r--layout/generic/crashtests/621424-1.html1
-rw-r--r--layout/generic/crashtests/621841-1.html20
-rw-r--r--layout/generic/crashtests/622596.html6
-rw-r--r--layout/generic/crashtests/641724.html315
-rw-r--r--layout/generic/crashtests/645072-1.html16
-rw-r--r--layout/generic/crashtests/645072-2.html17
-rw-r--r--layout/generic/crashtests/646561-1.html2
-rw-r--r--layout/generic/crashtests/646983-1.html6
-rw-r--r--layout/generic/crashtests/647332-1.html2
-rw-r--r--layout/generic/crashtests/650499-1.html15
-rw-r--r--layout/generic/crashtests/654002-1.html24
-rw-r--r--layout/generic/crashtests/654002-2.html26
-rw-r--r--layout/generic/crashtests/655462-1.html10
-rw-r--r--layout/generic/crashtests/656130-1.html17
-rw-r--r--layout/generic/crashtests/656130-2.html24
-rw-r--r--layout/generic/crashtests/660416.html17
-rw-r--r--layout/generic/crashtests/665853.html29
-rw-r--r--layout/generic/crashtests/667025.html22
-rw-r--r--layout/generic/crashtests/673770.html20
-rw-r--r--layout/generic/crashtests/679933-1.html13
-rw-r--r--layout/generic/crashtests/681489-1.html1
-rw-r--r--layout/generic/crashtests/682649-1.html18
-rw-r--r--layout/generic/crashtests/683702-1.xhtml24
-rw-r--r--layout/generic/crashtests/683712.html9
-rw-r--r--layout/generic/crashtests/688996-1.html18
-rw-r--r--layout/generic/crashtests/688996-2.html15
-rw-r--r--layout/generic/crashtests/691210.html5
-rw-r--r--layout/generic/crashtests/700031.xhtml9
-rw-r--r--layout/generic/crashtests/709398-1.html12
-rw-r--r--layout/generic/crashtests/718516.html70
-rw-r--r--layout/generic/crashtests/723108.html10
-rw-r--r--layout/generic/crashtests/724235.html28
-rw-r--r--layout/generic/crashtests/724978.xhtml219
-rw-r--r--layout/generic/crashtests/730559.html1
-rw-r--r--layout/generic/crashtests/734777.html2
-rw-r--r--layout/generic/crashtests/737313-1.html5
-rw-r--r--layout/generic/crashtests/737313-2.html5
-rw-r--r--layout/generic/crashtests/737313-3.html5
-rw-r--r--layout/generic/crashtests/740199-1.xhtml1
-rw-r--r--layout/generic/crashtests/742602.html6
-rw-r--r--layout/generic/crashtests/743364.html24
-rw-r--r--layout/generic/crashtests/747688.html6
-rw-r--r--layout/generic/crashtests/750066-iframe.html32
-rw-r--r--layout/generic/crashtests/750066.html34
-rw-r--r--layout/generic/crashtests/757413-2.html12
-rw-r--r--layout/generic/crashtests/757413.xhtml34
-rw-r--r--layout/generic/crashtests/762764-1.html18
-rw-r--r--layout/generic/crashtests/762902.html12
-rw-r--r--layout/generic/crashtests/765409.html25
-rw-r--r--layout/generic/crashtests/765621.html21
-rw-r--r--layout/generic/crashtests/767765.html32
-rw-r--r--layout/generic/crashtests/769120.html11
-rw-r--r--layout/generic/crashtests/769303-1.html33
-rw-r--r--layout/generic/crashtests/769303-2.html19
-rw-r--r--layout/generic/crashtests/777838.html27
-rw-r--r--layout/generic/crashtests/783228.html40
-rw-r--r--layout/generic/crashtests/784600.html17
-rw-r--r--layout/generic/crashtests/785555.html12
-rw-r--r--layout/generic/crashtests/786740-1.html31
-rw-r--r--layout/generic/crashtests/790252-1.html20
-rw-r--r--layout/generic/crashtests/790252-2.html36
-rw-r--r--layout/generic/crashtests/790260-1.html12
-rw-r--r--layout/generic/crashtests/791601.xhtml4
-rw-r--r--layout/generic/crashtests/794693.html9
-rw-r--r--layout/generic/crashtests/798020-1.html4
-rw-r--r--layout/generic/crashtests/798235-1.html8
-rw-r--r--layout/generic/crashtests/799207-1.html6
-rw-r--r--layout/generic/crashtests/799207-2.html6
-rw-r--r--layout/generic/crashtests/801268-1.html6
-rw-r--r--layout/generic/crashtests/804089-1.xhtml15
-rw-r--r--layout/generic/crashtests/807565-1.html2
-rw-r--r--layout/generic/crashtests/807565-2.html8
-rw-r--r--layout/generic/crashtests/810303.html15
-rw-r--r--layout/generic/crashtests/810726-2.html57
-rw-r--r--layout/generic/crashtests/810726.html8
-rw-r--r--layout/generic/crashtests/812822-1.html8
-rw-r--r--layout/generic/crashtests/812879-1.html6
-rw-r--r--layout/generic/crashtests/812879-2.html35
-rw-r--r--layout/generic/crashtests/812893.html15
-rw-r--r--layout/generic/crashtests/814995.html20
-rw-r--r--layout/generic/crashtests/822910.xhtml34
-rw-r--r--layout/generic/crashtests/824297-1.html12
-rw-r--r--layout/generic/crashtests/825810-1.html11
-rw-r--r--layout/generic/crashtests/825810-2.html11
-rw-r--r--layout/generic/crashtests/826483-1.html16
-rw-r--r--layout/generic/crashtests/826532-1.html15
-rw-r--r--layout/generic/crashtests/827076.html2
-rw-r--r--layout/generic/crashtests/827168-1.html12
-rw-r--r--layout/generic/crashtests/836895.html13
-rw-r--r--layout/generic/crashtests/837007.xhtml9
-rw-r--r--layout/generic/crashtests/840787.html18
-rw-r--r--layout/generic/crashtests/840818.html8
-rw-r--r--layout/generic/crashtests/842132-1.html27
-rw-r--r--layout/generic/crashtests/842166.html22
-rw-r--r--layout/generic/crashtests/844529-1.html4
-rw-r--r--layout/generic/crashtests/847130.xhtml15
-rw-r--r--layout/generic/crashtests/847208.html16
-rw-r--r--layout/generic/crashtests/847209.html16
-rw-r--r--layout/generic/crashtests/847211-1.html19
-rw-r--r--layout/generic/crashtests/849603.html47
-rw-r--r--layout/generic/crashtests/849987.html9
-rw-r--r--layout/generic/crashtests/850931.html32
-rw-r--r--layout/generic/crashtests/851396-1.html9
-rw-r--r--layout/generic/crashtests/854263-1.html27
-rw-r--r--layout/generic/crashtests/862185.html5
-rw-r--r--layout/generic/crashtests/863935.html25
-rw-r--r--layout/generic/crashtests/866547-1.html14
-rw-r--r--layout/generic/crashtests/866767-1.html7
-rw-r--r--layout/generic/crashtests/868906.html54
-rw-r--r--layout/generic/crashtests/876074-1.html20
-rw-r--r--layout/generic/crashtests/876155.html15
-rw-r--r--layout/generic/crashtests/883514-1.html18
-rw-r--r--layout/generic/crashtests/883514-2.html15
-rw-r--r--layout/generic/crashtests/885009-1.html7
-rw-r--r--layout/generic/crashtests/893496-1.html12
-rw-r--r--layout/generic/crashtests/893523.html7
-rw-r--r--layout/generic/crashtests/898871-iframe.xhtml7
-rw-r--r--layout/generic/crashtests/898871.html44
-rw-r--r--layout/generic/crashtests/898871.jpgbin0 -> 15000 bytes
-rw-r--r--layout/generic/crashtests/914501.html17
-rw-r--r--layout/generic/crashtests/914891.html9
-rw-r--r--layout/generic/crashtests/915475.xhtml5
-rw-r--r--layout/generic/crashtests/927558.html24
-rw-r--r--layout/generic/crashtests/942794-1.html20
-rw-r--r--layout/generic/crashtests/943509-1.html9
-rw-r--r--layout/generic/crashtests/944909-1.html9
-rw-r--r--layout/generic/crashtests/946167-1.html20
-rw-r--r--layout/generic/crashtests/947158-iframe.html777
-rw-r--r--layout/generic/crashtests/947158.html32
-rw-r--r--layout/generic/crashtests/949932.html13
-rw-r--r--layout/generic/crashtests/961859.html18
-rw-r--r--layout/generic/crashtests/963878.html37
-rw-r--r--layout/generic/crashtests/964078.html4
-rw-r--r--layout/generic/crashtests/970710.html40
-rw-r--r--layout/generic/crashtests/973701-1.xhtml5
-rw-r--r--layout/generic/crashtests/973701-2.xhtml6
-rw-r--r--layout/generic/crashtests/986899.html12
-rw-r--r--layout/generic/crashtests/crashtests.list821
-rw-r--r--layout/generic/crashtests/details-containing-only-text.html9
-rw-r--r--layout/generic/crashtests/details-display-none-summary-1.html11
-rw-r--r--layout/generic/crashtests/details-display-none-summary-2.html12
-rw-r--r--layout/generic/crashtests/details-display-none-summary-3.html13
-rw-r--r--layout/generic/crashtests/details-open-overflow-auto.html39
-rw-r--r--layout/generic/crashtests/details-open-overflow-hidden.html39
-rw-r--r--layout/generic/crashtests/details-three-columns.html30
-rw-r--r--layout/generic/crashtests/empty.html1
-rw-r--r--layout/generic/crashtests/file_324318-1.html1
-rw-r--r--layout/generic/crashtests/first-letter-638937-1.html45
-rw-r--r--layout/generic/crashtests/first-letter-638937-2.html11
-rw-r--r--layout/generic/crashtests/flex-nested-abspos-1.html7
-rw-r--r--layout/generic/crashtests/font-inflation-762332.html2
-rw-r--r--layout/generic/crashtests/image.jpgbin0 -> 2646 bytes
-rw-r--r--layout/generic/crashtests/large-border-radius-dashed.html1
-rw-r--r--layout/generic/crashtests/large-border-radius-dashed2.html1
-rw-r--r--layout/generic/crashtests/large-border-radius-dotted.html1
-rw-r--r--layout/generic/crashtests/large-border-radius-dotted2.html1
-rw-r--r--layout/generic/crashtests/outline-on-frameset.xhtml1
-rw-r--r--layout/generic/crashtests/solidblue.pngbin0 -> 135 bytes
-rw-r--r--layout/generic/crashtests/summary-position-out-of-flow.html30
-rw-r--r--layout/generic/crashtests/text-overflow-bug666751-1.html12
-rw-r--r--layout/generic/crashtests/text-overflow-bug666751-2.html12
-rw-r--r--layout/generic/crashtests/text-overflow-bug670564.xhtml3
-rw-r--r--layout/generic/crashtests/text-overflow-bug671796.xhtml5
-rw-r--r--layout/generic/crashtests/text-overflow-bug713610.html6
-rw-r--r--layout/generic/crashtests/text-overflow-iframe.html115
842 files changed, 19328 insertions, 0 deletions
diff --git a/layout/generic/crashtests/1001233.html b/layout/generic/crashtests/1001233.html
new file mode 100644
index 0000000000..aa877b5420
--- /dev/null
+++ b/layout/generic/crashtests/1001233.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+li::marker {
+ direction: rtl;
+ margin-right: 1em;
+}
+</style>
+</head>
+<body>
+Body
+<ul>
+<li>list item</li>
+</ul>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1001258-1.html b/layout/generic/crashtests/1001258-1.html
new file mode 100644
index 0000000000..fdb852351a
--- /dev/null
+++ b/layout/generic/crashtests/1001258-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+.r {
+ display: inline-block;
+ width: 40px;
+ height: 40px;
+}
+
+</style>
+</head>
+
+<body onload="document.getElementById('willFloatLeft').style.cssFloat = 'left';">
+ <div style="width: 100px; background: lightgray;">
+ <div class="r" style="background: red; width: 10px; float: left;"></div>
+ <div class="r" style="background: violet; width: 120px;" id="willFloatLeft" ></div>
+ <div style="clear: left;"></div>
+ <div class="r" style="background: blue;"></div>
+ <div class="r" style="background: yellow; float: right;"></div>
+ <div class="r" style="background: orange; position: relative;"></div>
+ </div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/1001994.html b/layout/generic/crashtests/1001994.html
new file mode 100644
index 0000000000..7c9d165a35
--- /dev/null
+++ b/layout/generic/crashtests/1001994.html
@@ -0,0 +1,14 @@
+<html class="reftest-paged"><body>
+
+<div style="position: fixed;">
+<ul style="position: sticky;">
+<span>
+mmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmm
+mmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmm
+mmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmm
+mmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmm
+mmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmm
+mmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmm mmmmmm mmmmmmmmmmmmmmmmm mmmmm mmmmm mmmmmmmm mmmmmmmm
+<span style="position: sticky;">a
+
+</body></html>
diff --git a/layout/generic/crashtests/1003441.xhtml b/layout/generic/crashtests/1003441.xhtml
new file mode 100644
index 0000000000..998f5ca982
--- /dev/null
+++ b/layout/generic/crashtests/1003441.xhtml
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(boom,0,1)">
+
+<splitter style="all: inherit;">
+ <box/>
+ <box/>
+ <box/>
+ <box/>
+ <iframe id="a" src="aaa"/>
+</splitter>
+
+<script id="script" xmlns="http://www.w3.org/1999/xhtml">
+
+ <![CDATA[//<![CDATA[
+
+var doc = document;
+function boom(i) {
+ if (i>6)
+ return;
+ var x=doc.getElementsByTagName('*');
+ if (x[i] && x[i+1]) {
+ var temp = x[i+1].getAttribute('style');
+ x[i+1].setAttribute('style', x[i].getAttribute('style'));
+ x[i].setAttribute('style', temp);
+ } else {
+ return;
+ }
+ i++;
+ setTimeout(boom,50,i);
+}
+
+//]]>
+
+ </script>
+
+ </window>
diff --git a/layout/generic/crashtests/1015562.html b/layout/generic/crashtests/1015562.html
new file mode 100644
index 0000000000..69fddcc7b2
--- /dev/null
+++ b/layout/generic/crashtests/1015562.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ document.getElementById("r").appendChild(document.createTextNode("B"));
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="r" style="display: grid;">A</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1015563-1.html b/layout/generic/crashtests/1015563-1.html
new file mode 100644
index 0000000000..5acfb644d4
--- /dev/null
+++ b/layout/generic/crashtests/1015563-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html style="display: inline-flex;">
+<body style="margin: -3642924795px; flex-grow: 1;"></body>
+</html>
diff --git a/layout/generic/crashtests/1015563-2.html b/layout/generic/crashtests/1015563-2.html
new file mode 100644
index 0000000000..0245bb45c3
--- /dev/null
+++ b/layout/generic/crashtests/1015563-2.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+ <div style="display: flex">
+ <div style="margin: -3642924795px; flex-grow: 1;"></div>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1015844.html b/layout/generic/crashtests/1015844.html
new file mode 100644
index 0000000000..5e265db994
--- /dev/null
+++ b/layout/generic/crashtests/1015844.html
@@ -0,0 +1,25 @@
+<style>
+.multicol {
+ width: 500px;
+ column-width: 100px;
+ height: 100px;
+ position: relative;
+}
+#clear {
+ position: absolute;
+}
+.float {
+ height: 300px;
+}
+</style>
+<div class="multicol">
+<div class="float">
+<div class="multicol">
+<div id="clear">
+<div class="float">
+<div class="multicol">
+<div class="float">&nbsp;
+</div>
+<div class="multicol">
+<div class="multicol">
+<div class="float">a
diff --git a/layout/generic/crashtests/1032450.html b/layout/generic/crashtests/1032450.html
new file mode 100644
index 0000000000..2e5678f96d
--- /dev/null
+++ b/layout/generic/crashtests/1032450.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+</head>
+
+<body style="display: -moz-inline-box;">
+<div style="display: table;position: relative; float: left;">
+<button style="display: table-column-group;">
+ <iframe style="position: absolute;"></iframe>
+</button>
+</div>
+
+</body></html>
diff --git a/layout/generic/crashtests/1032613-1.svg b/layout/generic/crashtests/1032613-1.svg
new file mode 100644
index 0000000000..c1e8639806
--- /dev/null
+++ b/layout/generic/crashtests/1032613-1.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="tweak()">
+ <pattern>
+ <rect id="r" />
+ </pattern>
+ <script>
+ function tweak() {
+ document.getElementById("r").style.textDecoration = "underline";
+ }
+ </script>
+</svg>
diff --git a/layout/generic/crashtests/1032613-2.html b/layout/generic/crashtests/1032613-2.html
new file mode 100644
index 0000000000..9ba11b3142
--- /dev/null
+++ b/layout/generic/crashtests/1032613-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+ <script>
+ function tweak() {
+ document.getElementById("c").style.textShadow = "3px 3px gray";
+ }
+ </script>
+ <body onload="tweak()">
+ <div id="c">hello
+ <svg height="0">
+ <clipPath>
+ <path d=""/>
+ </clipPath>
+ </svg>
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/1037903.html b/layout/generic/crashtests/1037903.html
new file mode 100644
index 0000000000..684a46db52
--- /dev/null
+++ b/layout/generic/crashtests/1037903.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html style="column-width: calc(15px);">
+<body>
+<video></video><audio style="box-decoration-break: clone; display: block; direction: rtl;"></audio>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1039454-1.html b/layout/generic/crashtests/1039454-1.html
new file mode 100644
index 0000000000..b049cbfa31
--- /dev/null
+++ b/layout/generic/crashtests/1039454-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML>
+<body>
+<div id="outer" style="width:200px; height:200px; background:blue; transform:translateY(10px)">
+ <div id="inner" style="width:200px; height:100px; background:yellow; transform:translateX(100px)">
+ </div>
+</div>
+<script>
+console.log(outer.getBoundingClientRect());
+outer.style.width = "400px";
+console.log(outer.getBoundingClientRect());
+outer.style.transform = "translateY(100px)";
+</script>
diff --git a/layout/generic/crashtests/1042489.html b/layout/generic/crashtests/1042489.html
new file mode 100644
index 0000000000..50885a76d4
--- /dev/null
+++ b/layout/generic/crashtests/1042489.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html style="column-width: 1px;">
+<body style="column-width: 1px; box-decoration-break: clone;">
+<div>A B</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1054010-1.html b/layout/generic/crashtests/1054010-1.html
new file mode 100644
index 0000000000..52557340a1
--- /dev/null
+++ b/layout/generic/crashtests/1054010-1.html
@@ -0,0 +1,97 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <style type="text/css">
+ .flexRow {
+ display: flex;
+ flex-direction: row;
+ flex-wrap: wrap;
+ justify-content: center;
+ }
+
+ .flexColumn {
+ display: flex;
+ flex-direction: column;
+ justify-content: center;
+ flex-basis: 100%;
+ }
+
+ .flexBlock {
+ flex: 0;
+ display: flex;
+ flex-direction: column;
+ padding: 5px;
+ border: 1px solid blue;
+ }
+
+ .flexColumn > .flexBlock:last-child {
+ flex: 1;
+ }
+ </style>
+ </head>
+ <body>
+ <div class="flexRow">
+ <div class="flexColumn">
+ <div class="flexBlock">
+ Nested layout 1
+ <div class="flexRow">
+ <div class="flexColumn">
+ <div class="flexBlock">
+ Nested layout 2
+ <div class="flexRow">
+ <div class="flexColumn">
+ <div class="flexBlock">
+ Nested layout 3
+ <div class="flexRow">
+ <div class="flexColumn">
+ <div class="flexBlock">
+ Nested layout 4
+ <div class="flexRow">
+ <div class="flexColumn">
+ <div class="flexBlock">
+ Nested layout 5
+ <div class="flexRow">
+ <div class="flexColumn">
+ <div class="flexBlock">
+ Nested layout 6
+ <div class="flexRow">
+ <div class="flexColumn">
+ <div class="flexBlock">
+ Nested layout 7
+ <div class="flexRow">
+ <div class="flexColumn">
+ <div class="flexBlock">
+ Nested layout 8
+ <div class="flexRow">
+ <div class="flexColumn">
+ <div class="flexBlock">
+ Nested layout 9
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/1058954-1.html b/layout/generic/crashtests/1058954-1.html
new file mode 100644
index 0000000000..4d989f7930
--- /dev/null
+++ b/layout/generic/crashtests/1058954-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+ <div style="display: -moz-box;">
+ <div style="position: relative; direction: rtl;">
+ <div style="position: absolute;">
+ </div>
+ </div>
+ </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1059138-1.html b/layout/generic/crashtests/1059138-1.html
new file mode 100644
index 0000000000..69055aa12e
--- /dev/null
+++ b/layout/generic/crashtests/1059138-1.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<title>Testcase for bug 1059138</title>
+<template>
+ <div class="inner" style="border: 1px solid black; display:flex; width: 500px;">
+ <button class="action-button">
+ ThisIsAButton
+ </button>
+ <slot></slot>
+ </div>
+</template>
+
+<script>
+ // Gets content from <template>
+ var template = document.querySelector('template').content;
+
+ // Creates an object based in the HTML Element prototype
+ class MyElement extends HTMLElement {
+ // Fires when an instance of the element is connected
+ connectedCallback() {
+ // Creates the shadow root
+ var shadowRoot = this.attachShadow({ mode: "open" });
+
+ // Adds a template clone into shadow root
+ var clone = document.importNode(template, true);
+ shadowRoot.appendChild(clone);
+ }
+ };
+ // Registers <my-elem> in the main document
+ customElements.define('my-elem', MyElement);
+</script>
+</head>
+<body>
+ <my-elem><div>ThisIsADivFlexItem</div></my-elem>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1102175-2.html b/layout/generic/crashtests/1102175-2.html
new file mode 100644
index 0000000000..1f485f68d8
--- /dev/null
+++ b/layout/generic/crashtests/1102175-2.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html>
+ <meta charset="utf-8">
+ <title>CSS-Writing Modes Test: propagation of the writing-mode property from body to root</title>
+ <link rel="author" title="Ting-Yu Lin" href="tlin@mozilla.com">
+ <link rel="author" title="Mozilla" href="http://www.mozilla.org/">
+ <link rel=help href="https://drafts.csswg.org/css-writing-modes-3/#principal-flow">
+ <link rel="match" href="wm-propagation-body-dynamic-change-002-ref.html">
+ <meta name=assert content="The writing mode of the newly inserted body must be propagated to the root.">
+
+ <script>
+ function runTest() {
+ document.body.offsetHeight;
+
+ var newBody = document.createElement("body");
+ newBody.id = "new-body";
+ var oldBody = document.getElementById("old-body");
+
+ /* Insert a new <body> before the old one, which should become the primary <body>. */
+ document.documentElement.insertBefore(newBody, oldBody);
+ }
+ </script>
+
+ <style>
+ #new-body {
+ /* This writing-mode should propagate to the root element. */
+ writing-mode: vertical-rl;
+ margin: 0;
+ }
+
+ #old-body {
+ writing-mode: horizontal-tb;
+ inline-size: 100px;
+ }
+
+ div {
+ background-color: blue;
+ height: 100px;
+ width: 100px;
+ }
+ </style>
+
+ <body id="old-body" onload="runTest();">
+ <div></div>
+ <p>Test passes if you see a blue square in the upper-right corner of the page</p>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/1134531.html b/layout/generic/crashtests/1134531.html
new file mode 100644
index 0000000000..35ddbb0606
--- /dev/null
+++ b/layout/generic/crashtests/1134531.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body onload="x.style.textTransform = 'capitalize';"><div id="x">b</div></body>
+</html>
diff --git a/layout/generic/crashtests/1134667.html b/layout/generic/crashtests/1134667.html
new file mode 100644
index 0000000000..e33eb99dd5
--- /dev/null
+++ b/layout/generic/crashtests/1134667.html
@@ -0,0 +1,2 @@
+x
+<ruby><x>
diff --git a/layout/generic/crashtests/1137723-1.html b/layout/generic/crashtests/1137723-1.html
new file mode 100644
index 0000000000..5d791adfff
--- /dev/null
+++ b/layout/generic/crashtests/1137723-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-paged">
+<head>
+ <meta charset="utf-8">
+<title>Testcase bug 1137723</title>
+
+<style>
+ .grid-comment{position:fixed;top:100%;}
+ a[href]:after{content:" (" attr(href) ")";}
+ </style>
+
+<style>
+@font-face { font-family: "slick"; src: url("non-existent-file.eot"); }
+</style>
+</head>
+
+<body>
+ <div style="height:7in"></div>
+
+ <div class="grid-comment">Artikel teilen
+
+<div>
+<a href="https://www.facebook.com/sharer/sharer.php?u=http://www.stuttgarter-zeitung.de/inhalt.griechenland-hilfe-bundestag-stimmt-verlaengerung-zu.daa3baae-e17d-47e8-ad28-62eece0b4cfa.html">shares</a>
+<a href="https://twitter.com/share?text=Griechenland-Hilfe:Bundestag stimmt Verlängerung zu&amp;url=http://www.stuttgarter-zeitung.de/inhalt.griechenland-hilfe-bundestag-stimmt-verlaengerung-zu.daa3baae-e17d-47e8-ad28-62eece0b4cfa.html">tweets</a>
+</div>
+
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1137723-2.html b/layout/generic/crashtests/1137723-2.html
new file mode 100644
index 0000000000..09ee495d8a
--- /dev/null
+++ b/layout/generic/crashtests/1137723-2.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-paged">
+<head>
+ <meta charset="utf-8">
+<title>Testcase bug 1137723</title>
+
+<style>
+ .grid-comment{position:fixed;top:100%;}
+ a[href]:after{content:" (" attr(href) ")";}
+ </style>
+
+<style>
+@font-face { font-family: "slick"; src: url("non-existent-file.eot"); }
+</style>
+</head>
+
+<body>
+ <div style="height:3in"></div>
+
+ <div class="grid-comment">Artikel teilen
+
+<div>
+<a href="https://www.facebook.com/sharer/sharer.php?u=http://www.stuttgarter-zeitung.de/inhalt.griechenland-hilfe-bundestag-stimmt-verlaengerung-zu.daa3baae-e17d-47e8-ad28-62eece0b4cfa.html">shares</a>
+<a href="https://twitter.com/share?text=Griechenland-Hilfe:Bundestag stimmt Verlängerung zu&amp;url=http://www.stuttgarter-zeitung.de/inhalt.griechenland-hilfe-bundestag-stimmt-verlaengerung-zu.daa3baae-e17d-47e8-ad28-62eece0b4cfa.html">tweets</a>
+</div>
+
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1140043-1.html b/layout/generic/crashtests/1140043-1.html
new file mode 100644
index 0000000000..202445c3b4
--- /dev/null
+++ b/layout/generic/crashtests/1140043-1.html
@@ -0,0 +1,7 @@
+<style>
+.justify-in-wide {
+ text-align-last: justify;
+ width: 3504270px;
+}
+</style>
+<div class="justify-in-wide">a b c d</div>
diff --git a/layout/generic/crashtests/1140043-2.html b/layout/generic/crashtests/1140043-2.html
new file mode 100644
index 0000000000..9a670f3e89
--- /dev/null
+++ b/layout/generic/crashtests/1140043-2.html
@@ -0,0 +1,7 @@
+<style>
+.justify-in-wide {
+ text-align-last: justify;
+ width: 3504270px;
+}
+</style>
+<div class="justify-in-wide"><span>a b c d</span> <span>e f g h</span></div>
diff --git a/layout/generic/crashtests/1140043-3.html b/layout/generic/crashtests/1140043-3.html
new file mode 100644
index 0000000000..c76920c8c8
--- /dev/null
+++ b/layout/generic/crashtests/1140043-3.html
@@ -0,0 +1,7 @@
+<style>
+.justify-in-wide {
+ text-align-last: justify;
+ width: 3504270px;
+}
+</style>
+<div class="justify-in-wide"><span><span>a b c d</span> d c b a</span> <span>e f g h <span>h g f e</span></span></div>
diff --git a/layout/generic/crashtests/1140268-1.html b/layout/generic/crashtests/1140268-1.html
new file mode 100644
index 0000000000..5e5510ba7f
--- /dev/null
+++ b/layout/generic/crashtests/1140268-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset=utf-8>
+<script>
+function boom()
+{
+ var e = document.getElementsByTagName("mo")[0];
+ e.setAttribute("style", "position: absolute; top: 0px;");
+ document.documentElement.offsetHeight;
+ e.setAttribute("style", "position: absolute; top: 100px;");
+}
+</script>
+</head>
+<body onload="boom();">
+<math><mo>boom!</mo></math>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1145768.html b/layout/generic/crashtests/1145768.html
new file mode 100644
index 0000000000..b8e6938db6
--- /dev/null
+++ b/layout/generic/crashtests/1145768.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ var emptyTail = q.firstChild.splitText(2);
+ document.documentElement.offsetHeight;
+ emptyTail.splitText(0);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div style="width: 1px; height: 1px;"><div id="q" style="writing-mode: vertical-rl;">&#x07;R</div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/1145931.html b/layout/generic/crashtests/1145931.html
new file mode 100644
index 0000000000..b1607bf5cc
--- /dev/null
+++ b/layout/generic/crashtests/1145931.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html><head>
+<meta charset="UTF-8">
+<style>
+body { column-count: 2; }
+div::after { content: "A"; }
+</style>
+
+<script>
+function boom() {
+ x.style.display = "contents";
+}
+</script>
+</head>
+<body onload="boom();"><div></div><div><div id="x"></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/1146103.html b/layout/generic/crashtests/1146103.html
new file mode 100644
index 0000000000..876e08bd6a
--- /dev/null
+++ b/layout/generic/crashtests/1146103.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: ruby-text; margin: -47891343%"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1146107.html b/layout/generic/crashtests/1146107.html
new file mode 100644
index 0000000000..661fa876c4
--- /dev/null
+++ b/layout/generic/crashtests/1146107.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: ruby-base; margin: -47891343%"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1146114.html b/layout/generic/crashtests/1146114.html
new file mode 100644
index 0000000000..5f148a1679
--- /dev/null
+++ b/layout/generic/crashtests/1146114.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: ruby-text; margin: 288230376151711740%"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1153478-iframe.html b/layout/generic/crashtests/1153478-iframe.html
new file mode 100644
index 0000000000..aee79c811c
--- /dev/null
+++ b/layout/generic/crashtests/1153478-iframe.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+<script>
+function main() {
+var elements = []
+elements = document.getElementsByTagName('time')
+setTimeout(function(){try{elements[11].innerHTML += "A"}catch(e){};}, 100)
+setTimeout(function(){try{elements[11].innerHTML += "A"}catch(e){};}, 200)
+}
+</script>
+</head>
+<body style="writing-mode:vertical-lr;direction:rtl;">
+<time><time><time> id="">>> <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time id=<time <time>>> id="">>> id="">>> id=<time <time id=<time <time>>
+</body>
+<script>
+document.addEventListener("DOMContentLoaded", function(event) {main()});
+</script>
+</html>
diff --git a/layout/generic/crashtests/1153478.html b/layout/generic/crashtests/1153478.html
new file mode 100644
index 0000000000..5bfb57ee59
--- /dev/null
+++ b/layout/generic/crashtests/1153478.html
@@ -0,0 +1,11 @@
+<html><head>
+ <title>Testcase for bug 1153478</title>
+</head>
+<body>
+
+<iframe width=550 height=900 src="1153478-iframe.html"></iframe>
+<iframe width=570 height=920 src="1153478-iframe.html"></iframe>
+<iframe width=950 height=550 src="1153478-iframe.html"></iframe>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1153695.html b/layout/generic/crashtests/1153695.html
new file mode 100644
index 0000000000..2e2898e0ac
--- /dev/null
+++ b/layout/generic/crashtests/1153695.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+
+ <head>
+ <meta charset="UTF-8">
+ <script>
+ function boom()
+ {
+ document.documentElement.offsetHeight;
+ document.body.appendChild(document.getElementById("x"));
+ document.documentElement.offsetHeight;
+ }
+ </script>
+ </head>
+
+ <body style="column-count: 4;" onload="boom();">
+ <div style="float: left; height: 10px; width: 10px;">
+ <div id="x">
+ <div style="height: 80px;"></div>
+ <div style="float: left; height: 10px;"></div>
+ </div>
+ </div>
+ </body>
+
+</html>
diff --git a/layout/generic/crashtests/1156222.html b/layout/generic/crashtests/1156222.html
new file mode 100644
index 0000000000..75dcc85d2e
--- /dev/null
+++ b/layout/generic/crashtests/1156222.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div><span dir="rtl"></span><audio style="display: ruby-base;"></audio></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1156257.html b/layout/generic/crashtests/1156257.html
new file mode 100644
index 0000000000..4799926299
--- /dev/null
+++ b/layout/generic/crashtests/1156257.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom()
+{
+ document.documentElement.offsetHeight;
+ document.getElementById("g").firstChild.remove();
+}
+</script>
+</head>
+<body onload="boom();">
+<div style="display: grid;" id="g">a b<br></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1157011.html b/layout/generic/crashtests/1157011.html
new file mode 100644
index 0000000000..c5fe133a87
--- /dev/null
+++ b/layout/generic/crashtests/1157011.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="display: inline-flex;"><div><div style="display: ruby-base;">f<br style="display: ruby-base-container;"></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/1169420-1.html b/layout/generic/crashtests/1169420-1.html
new file mode 100644
index 0000000000..1ddbaea4f4
--- /dev/null
+++ b/layout/generic/crashtests/1169420-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html style="writing-mode: vertical-lr;">
+ <body>
+ <div style="display: inline-flex;">
+ <div style="margin-inline-start: auto; margin-inline-end: 75px; direction: rtl;"></div>
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/1169420-2.html b/layout/generic/crashtests/1169420-2.html
new file mode 100644
index 0000000000..e096ed7f92
--- /dev/null
+++ b/layout/generic/crashtests/1169420-2.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html style="writing-mode: vertical-lr;">
+ <body>
+ <div style="display: inline-flex;">
+ <div style="margin-bottom: auto; margin-top: 75px; direction: rtl;"></div>
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/1178783-1.html b/layout/generic/crashtests/1178783-1.html
new file mode 100644
index 0000000000..845e4e0b16
--- /dev/null
+++ b/layout/generic/crashtests/1178783-1.html
@@ -0,0 +1,157 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+*
+{
+ margin: 0;
+ padding: 0;
+}
+html
+{
+ height: 100%;
+ display: flex;
+ flex-flow: row nowrap;
+}
+body
+{
+ flex: 1 1 0px;
+ min-width: 0;
+ display: flex;
+ flex-flow: row nowrap;
+}
+ul
+{
+ list-style: none;
+}
+.vertical
+{
+ flex: 1 1 0px;
+ min-width: 0;
+ display: flex;
+ flex-flow: column nowrap;
+}
+.vertical > li:first-child
+{
+ flex: 1 1 0px;
+ min-height: 0;
+ background-color: #0ff;
+}
+.vertical > li:last-child
+{
+ flex: 0 0 0px;
+ min-height: 0;
+ background-color: #f0f;
+ display: flex;
+ flex-flow: row nowrap;
+}
+.horizontal-separator
+{
+ flex: 0 0 5px;
+ cursor: row-resize;
+ background-color: #fff;
+}
+ </style>
+</head>
+<body>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+ <ul class="vertical">
+ <li></li>
+ <li class="horizontal-separator"></li>
+ <li>
+<!-- ... etc ... -->
diff --git a/layout/generic/crashtests/1183431.html b/layout/generic/crashtests/1183431.html
new file mode 100644
index 0000000000..e1d4c87c0c
--- /dev/null
+++ b/layout/generic/crashtests/1183431.html
@@ -0,0 +1,6 @@
+<!DOCTYPE>
+<html>
+<body>
+<div style="writing-mode: vertical-lr;"><div style="position: fixed;"></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1186147-1.html b/layout/generic/crashtests/1186147-1.html
new file mode 100644
index 0000000000..91ebc55f19
--- /dev/null
+++ b/layout/generic/crashtests/1186147-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="writing-mode: vertical-rl;"><div><span style="display: flex;">x</span></div>y</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1209952.html b/layout/generic/crashtests/1209952.html
new file mode 100644
index 0000000000..cf19c4f69c
--- /dev/null
+++ b/layout/generic/crashtests/1209952.html
@@ -0,0 +1,38 @@
+<style>
+.multicol-a {
+ width: 300px;
+ column-width: 100px;
+ column-gap: 0;
+ height: 100px;
+}
+.multicol-b {
+ border: 1px solid silver;
+ width: 200px;
+ column-width: 51px;
+ column-gap: 0;
+ height: 50px;
+}
+
+.step {
+ height: 1px;
+}
+.float-L {
+ width: 1px;
+ height: 1px;
+ float: left;
+}
+.float-R {
+ width: 1px;
+ height: 26px; /* 25 -> 26 crash */
+}
+</style>
+
+<div class="multicol-a">
+ <div class="float-R"></div>
+ <div class="multicol-b">
+ <div class="step"></div>
+ <div>
+ <div class="float-L"></div>
+ <div>
+ </div>
+</div>
diff --git a/layout/generic/crashtests/1221112-1.html b/layout/generic/crashtests/1221112-1.html
new file mode 100644
index 0000000000..24e60a37bf
--- /dev/null
+++ b/layout/generic/crashtests/1221112-1.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ .flexContainer {
+ display: flex;
+
+ /* Just for easier visualization: */
+ width: 600px;
+ justify-content: space-around;
+ border: 1px solid black;
+ }
+
+ .flexContainer:before {
+ position:absolute;
+ content:'before';
+ }
+ .flexContainer:after {
+ position:absolute;
+ content:'after'
+ }
+
+ .ordered-item {
+ position:relative;
+ order:5;
+ }
+ </style>
+ </head>
+ <body>
+ <div class="flexContainer">
+ <div class="ordered-item">ItemWithOrderSet
+ <!-- It's important that this remain unclosed, for some reason. -->
diff --git a/layout/generic/crashtests/1221112-2.html b/layout/generic/crashtests/1221112-2.html
new file mode 100644
index 0000000000..2ae372a9d1
--- /dev/null
+++ b/layout/generic/crashtests/1221112-2.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ .flexContainer {
+ display: flex;
+
+ /* Just for easier visualization: */
+ width: 600px;
+ justify-content: space-around;
+ border: 1px solid black;
+ }
+
+ .flexContainer:before {
+ position:absolute;
+ content:'before';
+ }
+ .flexContainer:after {
+ position:absolute;
+ content:'after'
+ }
+ </style>
+ </head>
+ <body>
+ <div class="flexContainer">
+ <div class="ordered-item">NormalFlexItem
+ <!-- It's important that this remain unclosed, for some reason. -->
diff --git a/layout/generic/crashtests/1221874-1.html b/layout/generic/crashtests/1221874-1.html
new file mode 100644
index 0000000000..85d5bab3c0
--- /dev/null
+++ b/layout/generic/crashtests/1221874-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ document.body.style.textOrientation = "sideways";
+}
+
+</script>
+</head>
+<body onload="boom();" style="writing-mode: tb-rl; display: table;">Hello</body>
+</html>
diff --git a/layout/generic/crashtests/1221904.html b/layout/generic/crashtests/1221904.html
new file mode 100644
index 0000000000..e303234daa
--- /dev/null
+++ b/layout/generic/crashtests/1221904.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var x = "K\u0756 ";
+ var y = "K\u000A ";
+
+ var t = document.createTextNode(x);
+ d.appendChild(t);
+ document.documentElement.offsetHeight;
+ t.data = y;
+}
+
+
+</script>
+</head>
+<body onload="boom();">
+<div id="d"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1222783.xhtml b/layout/generic/crashtests/1222783.xhtml
new file mode 100644
index 0000000000..29cba980f9
--- /dev/null
+++ b/layout/generic/crashtests/1222783.xhtml
@@ -0,0 +1,19 @@
+<?xml version="1.0"?>
+<!DOCTYPE html>
+<html lang="en" xmlns="http://www.w3.org/1999/xhtml">
+<title>Test, bug 1222783</title>
+<body>
+
+
+<div id="container" style="width: 400px">
+ <div id="float1" style="float: left; height: 50px; width: 50px"></div>
+ <div id="float2" style="float: left; clear: left; height: 50px; width: 200px"></div>
+
+ <frameset cols="50%,50%">
+ <frame></frame>
+ <frame></frame>
+ </frameset>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1223522.xhtml b/layout/generic/crashtests/1223522.xhtml
new file mode 100644
index 0000000000..cdcc69598b
--- /dev/null
+++ b/layout/generic/crashtests/1223522.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<td style="writing-mode: vertical-lr;"><col style="float: left; visibility: collapse;"><tr style="display: -moz-inline-box;"><div style="display: ruby-base-container;"><div style="display: list-item;"><td style="float: right;"></td></div></div></tr></col></td>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1223568-1.html b/layout/generic/crashtests/1223568-1.html
new file mode 100644
index 0000000000..8d09d878b7
--- /dev/null
+++ b/layout/generic/crashtests/1223568-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<div style="display:flex; justify-content: stretch end">a
diff --git a/layout/generic/crashtests/1223568-2.html b/layout/generic/crashtests/1223568-2.html
new file mode 100644
index 0000000000..6b44e485ca
--- /dev/null
+++ b/layout/generic/crashtests/1223568-2.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<span style="justify-content: stretch end true; display: inline-flex;"><span style="writing-mode: vertical-rl; display: -moz-inline-box;">f</span></span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1224230-1.html b/layout/generic/crashtests/1224230-1.html
new file mode 100644
index 0000000000..2743b43aeb
--- /dev/null
+++ b/layout/generic/crashtests/1224230-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<meta charset=utf-8>
+<script>
+function boom() {
+ var div = document.querySelector("div");
+ div.offsetHeight;
+ div.style.fontSize = "120%";
+}
+</script>
+<body onload="boom()">
+<div style="float:left; position:relative;">
+ <div style="display:inline;">
+ <img src="foo.jpg" style="float:left;">
+ Lorem ipsum dolor sit amet, consectetur adipiscing elit. Etiam tortor nulla,
+eleifend eu eleifend eu, scelerisque sit amet sapien. Sed iaculis tellus ut quam
+pharetra consequat. Donec vitae nulla eu mi porta vulputate. In vestibulum, erat
+quis aliquam tempor, lectus augue viverra justo, vitae semper nibh neque tempor
+orci. Etiam luctus aliquet magna id pellentesque. Interdum et malesuada fames ac
+ante ipsum primis in faucibus. Suspendisse sit amet eros volutpat, convallis
+purus non, porta sapien. Duis fermentum at tortor nec ultricies. Morbi et lacus
+vitae risus elementum condimentum quis vitae justo. Cum sociis natoque penatibus
+et magnis dis parturient montes, nascetur ridiculus mus.<br><br>
diff --git a/layout/generic/crashtests/1225005.html b/layout/generic/crashtests/1225005.html
new file mode 100644
index 0000000000..8608e033de
--- /dev/null
+++ b/layout/generic/crashtests/1225005.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="padding: 810520769306363pt; column-count: 10; transform: translate(50%);"><div style="position: absolute;"></div></body>
+</html>
diff --git a/layout/generic/crashtests/1225118.html b/layout/generic/crashtests/1225118.html
new file mode 100644
index 0000000000..833596243f
--- /dev/null
+++ b/layout/generic/crashtests/1225118.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html style="width: -moz-fit-content; display: grid;">
+<body style="border: 1px solid green; padding-right: 56030668px;"></body>
+</html>
diff --git a/layout/generic/crashtests/1225376.html b/layout/generic/crashtests/1225376.html
new file mode 100644
index 0000000000..f6e35be3ee
--- /dev/null
+++ b/layout/generic/crashtests/1225376.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="display: inline-grid;">
+ <div style="display: flex; align-self: right safe;"></div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1225592.html b/layout/generic/crashtests/1225592.html
new file mode 100644
index 0000000000..e4b5e6e6d9
--- /dev/null
+++ b/layout/generic/crashtests/1225592.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="grid-template-columns: repeat(16384, auto); display: grid;"></div>
+<div style="grid-template-columns: repeat(9000, auto) repeat(9000, auto); display: grid;"></div>
+
+<div style="grid-template-columns: 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ; display: grid;"></div>
+
+
+<div style='grid-template-areas: ". . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . "; display: grid;'></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1229437-1.html b/layout/generic/crashtests/1229437-1.html
new file mode 100644
index 0000000000..a2ecadf455
--- /dev/null
+++ b/layout/generic/crashtests/1229437-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<style>
+ rbc { display: ruby-base-container; }
+</style>
+<div style="column-width: 1px">
+ <ruby><rbc></rbc><rb><div style="float: right"></div></rb></ruby>X
+</div>
diff --git a/layout/generic/crashtests/1229437-2.html b/layout/generic/crashtests/1229437-2.html
new file mode 100644
index 0000000000..429c857a16
--- /dev/null
+++ b/layout/generic/crashtests/1229437-2.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<div style="column-width: 1px">
+ <ruby><rb></rb><rb><div style="float: right"></div></rb></ruby>X
+</div>
diff --git a/layout/generic/crashtests/1230378.xhtml b/layout/generic/crashtests/1230378.xhtml
new file mode 100644
index 0000000000..46331df282
--- /dev/null
+++ b/layout/generic/crashtests/1230378.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+
+body { font-family: monospace; }
+.k { column-count: 2; height:2em; line-height:1em;}
+.fl { float: left; }
+
+</style>
+</head>
+<body>
+
+<caption class="k"><br /><br />A<div class="fl"><table>B C D E F</table><table></table></div></caption>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1233191.html b/layout/generic/crashtests/1233191.html
new file mode 100644
index 0000000000..6a6a06edf9
--- /dev/null
+++ b/layout/generic/crashtests/1233191.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="width: 1px;"><fieldset style="display: grid;">y<legend></legend>x</fieldset></div>
+<div style="width: 1px;"><fieldset style="display: grid; overflow:hidden">y<legend></legend>x</fieldset></div>
+<div style="width: 1px;"><fieldset style="display: flex;">y<legend></legend>x</fieldset></div>
+<div style="width: 1px;"><fieldset style="display: flex; overflow:hidden">y<legend></legend>x</fieldset></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1233607.html b/layout/generic/crashtests/1233607.html
new file mode 100644
index 0000000000..bc3ecc852c
--- /dev/null
+++ b/layout/generic/crashtests/1233607.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html style="width: 1px;">
+<head>
+<meta charset="UTF-8">
+</head>
+<body onload="x.style.color='red';">
+<div id="x" style="overflow: scroll;"><input type="image" style="display: contents;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1234701-1.html b/layout/generic/crashtests/1234701-1.html
new file mode 100644
index 0000000000..237ec295f9
--- /dev/null
+++ b/layout/generic/crashtests/1234701-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+
+#a { display: inline-block; height: 30px; }
+#b { float: left; writing-mode: vertical-lr; border-top-style: solid; }
+#c { float: left; height: 28px; }
+
+</style>
+</head>
+<body onload="a.appendChild(b)">
+
+<div id="a"></div>
+<div id="b"><span id="c"></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1234701-2.html b/layout/generic/crashtests/1234701-2.html
new file mode 100644
index 0000000000..762427627f
--- /dev/null
+++ b/layout/generic/crashtests/1234701-2.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+
+#a { display: inline-block; height: 30px; }
+#b { float: left; writing-mode: vertical-lr; border-top-style: solid; }
+#c { float: left; height: 28px; }
+
+</style>
+</head>
+<body>
+
+<div id="a"><div id="b"><span id="c"></span></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1248227.html b/layout/generic/crashtests/1248227.html
new file mode 100644
index 0000000000..2b2f3ff982
--- /dev/null
+++ b/layout/generic/crashtests/1248227.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<div style="display: grid; grid-template-rows: subgrid repeat(auto-fill, []);"></div>
+
+<div style="display: grid">
+ <div style="display: grid; grid-template-rows: subgrid repeat(auto-fill, []);"></div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1271765.html b/layout/generic/crashtests/1271765.html
new file mode 100644
index 0000000000..729d2bd60b
--- /dev/null
+++ b/layout/generic/crashtests/1271765.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<body>
+<div id="content" class="entry">
+ <audio controls style="writing-mode: vertical-lr"></audio>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1272983-1.html b/layout/generic/crashtests/1272983-1.html
new file mode 100644
index 0000000000..32a5a302ee
--- /dev/null
+++ b/layout/generic/crashtests/1272983-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ div.foo {
+ margin-bottom: 50%;
+ display: -moz-box;
+ direction: rtl;
+ }
+ </style>
+</head>
+<body>
+ <div class="foo"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1272983-2.html b/layout/generic/crashtests/1272983-2.html
new file mode 100644
index 0000000000..cff041891a
--- /dev/null
+++ b/layout/generic/crashtests/1272983-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ div.foo {
+ padding-bottom: 50%;
+ display: -moz-box;
+ direction: rtl;
+ }
+ </style>
+</head>
+<body>
+ <div class="foo"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1275059.html b/layout/generic/crashtests/1275059.html
new file mode 100644
index 0000000000..bfcbfa6beb
--- /dev/null
+++ b/layout/generic/crashtests/1275059.html
@@ -0,0 +1,3 @@
+<div style="writing-mode: vertical-rl">
+<span style="text-combine-upright: all">
+<p>
diff --git a/layout/generic/crashtests/1278007.html b/layout/generic/crashtests/1278007.html
new file mode 100644
index 0000000000..f4e9e40da1
--- /dev/null
+++ b/layout/generic/crashtests/1278007.html
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<html><head>
+ <meta charset="utf-8">
+ <title></title>
+ <style type="text/css">
+.grid {
+ display: grid;
+}
+
+.sfb { align-self:baseline; }
+.slb { align-self:last baseline; }
+
+.vl { writing-mode: vertical-lr; }
+
+</style>
+</head>
+<body>
+
+<div class="grid"><input class="slb"></div>
+<div class="grid"><input class="sfb"></div>
+
+<div class="grid"><input class="slb vl"></div>
+<div class="grid"><input class="sfb vl"></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1278080.html b/layout/generic/crashtests/1278080.html
new file mode 100644
index 0000000000..b9cb65fcbc
--- /dev/null
+++ b/layout/generic/crashtests/1278080.html
@@ -0,0 +1,29 @@
+<style>
+.columns {
+ columns: 5;
+ column-fill: auto;
+ height: 100px;
+}
+.grid {
+ display: grid;
+ max-height: 180px;
+ grid-auto-rows: 30px;
+ grid-gap: 12px;
+}
+span {
+ grid-row: 2;
+}
+i {
+ display: block;
+ height: 60px;
+}
+</style>
+<div class="columns"><div class="grid"><span><i></i></span></div></div>
+<script>
+window.onload = function(){
+ var x = document.createElementNS("http://www.w3.org/1999/xhtml", "x");
+ var r = new Range();
+ r.selectNode(document.getElementsByTagName('span')[0]);
+ setTimeout(function(){ r.surroundContents(x); }, 1);
+};
+</script>
diff --git a/layout/generic/crashtests/1278461-1.html b/layout/generic/crashtests/1278461-1.html
new file mode 100644
index 0000000000..acafb25907
--- /dev/null
+++ b/layout/generic/crashtests/1278461-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252">
+<script>
+
+function boom()
+{
+ x.style.display = "contents";
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+ <div style="column-width: 1px;">
+ <div style="display: grid;">
+ <div style="height: 200px;">v</div>
+ <div style="height: 200px;" id="x">x</div>
+ </div>
+ </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1278461-2.html b/layout/generic/crashtests/1278461-2.html
new file mode 100644
index 0000000000..68f43ef27e
--- /dev/null
+++ b/layout/generic/crashtests/1278461-2.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html class="reftest-wait"><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252"></head><body>
+<style>
+html{columns:50px auto}
+body{display:grid}
+div{height:200px}
+</style>
+<script>
+window.onload=function(){
+var b = document.body, v;
+b.appendChild(document.createElementNS('http://www.w3.org/1999/xhtml', 'div'));
+b.appendChild(document.createElementNS('http://www.w3.org/1999/xhtml', 'div'));
+b.appendChild(v = document.createElementNS('http://www.w3.org/1999/xhtml', 'div'));
+setTimeout(function(){
+ v.style.overflow = "hidden";
+ document.documentElement.className = '';
+ },100);
+};
+</script>
+
+<div></div><div></div><div style="overflow: hidden;"></div></body></html>
diff --git a/layout/generic/crashtests/1279814.html b/layout/generic/crashtests/1279814.html
new file mode 100644
index 0000000000..71a9a6e3b4
--- /dev/null
+++ b/layout/generic/crashtests/1279814.html
@@ -0,0 +1,35 @@
+<!-- 128 LRI / RLI -->
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+<!-- 64 PDI -->
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;&#x2069;
+<!-- 64 LRI / RLI -->
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
+&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;&#x2066;&#x2067;
diff --git a/layout/generic/crashtests/1281102.html b/layout/generic/crashtests/1281102.html
new file mode 100644
index 0000000000..5b1c753fb0
--- /dev/null
+++ b/layout/generic/crashtests/1281102.html
@@ -0,0 +1,30 @@
+<script>
+function start() {
+ o46=(new DOMParser()).parseFromString("<menu><li></li>a a",'text/html');
+ document.replaceChild(o46.documentElement,document.documentElement);
+ o66=document.createElement('form');
+ o100=document.createElement('table');
+ o119=document.createElement('iframe');
+ o66.appendChild(o119);
+ o135=document.createElement('tfoot');
+ o100.appendChild(o135);
+ document.body.appendChild(o100);
+ o66.style.display='grid';
+ o281=document.createElement('table');
+ o135.appendChild(o281);
+ o310=document.createTextNode("{ }");
+ o119.style.pageBreakBefore='left';
+ o418=document.createElement('th');
+ o100.appendChild(o310);
+ o281.appendChild(o418);
+ o135.style.display='table-row-group';
+ document.documentElement.style.columnCount='59';
+ setTimeout(f2, 4);
+}
+function f2() {
+ o100.setAttribute('style'," transition-delay: 128ms; padding-right: 5rem");
+ o418.appendChild(o66);
+ setTimeout("location.reload()",800);
+}
+</script>
+<body onload="start()"></body>
diff --git a/layout/generic/crashtests/1297427-non-equal-centers.html b/layout/generic/crashtests/1297427-non-equal-centers.html
new file mode 100644
index 0000000000..e51c8df324
--- /dev/null
+++ b/layout/generic/crashtests/1297427-non-equal-centers.html
@@ -0,0 +1,14 @@
+<!doctype html>
+<html>
+<meta charset="utf-8" />
+<style>
+#box {
+ border-radius: 335px;
+ width: 600px;
+ height: 401px;
+ border-style: dotted;
+ border-width: 41px 1px;
+}
+</style>
+<div id="box"></div>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/1304441.html b/layout/generic/crashtests/1304441.html
new file mode 100644
index 0000000000..26d7dcdd6e
--- /dev/null
+++ b/layout/generic/crashtests/1304441.html
@@ -0,0 +1,9 @@
+<details>
+<summary>
+<li>
+<style>
+summary{
+all:initial
+}
+:first-child::first-line
+{}
diff --git a/layout/generic/crashtests/1308876-1.html b/layout/generic/crashtests/1308876-1.html
new file mode 100644
index 0000000000..2628e0aef6
--- /dev/null
+++ b/layout/generic/crashtests/1308876-1.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<style>
+* { margin: 0; padding: 0; }
+div.content { width: 370px; display: inline-block; }
+</style>
+<div class="content">
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+ <div class="content">hello
+</div>
diff --git a/layout/generic/crashtests/1316649.html b/layout/generic/crashtests/1316649.html
new file mode 100644
index 0000000000..cfef7d0f0d
--- /dev/null
+++ b/layout/generic/crashtests/1316649.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<html>
+<script>
+addEventListener('DOMContentLoaded', function(){
+ obj1.style.writingMode = "rl";
+ obj2.style.writingMode = "rl";
+ //obj3.style.writingMode = "rl";
+ //obj4.style.writingMode = "rl";
+ obj5.style.writingMode = "rl";
+ sobj1.style.writingMode = "rl";
+ sobj2.style.writingMode = "rl";
+ //sobj3.style.writingMode = "rl";
+ //sobj4.style.writingMode = "rl";
+ sobj5.style.writingMode = "rl";
+});
+</script>
+<body style="writing-mode:tb">
+<button style="display:grid">
+<div id=obj1></div>
+</button>
+<button style="display:inline-grid">
+<div id=obj2></div>
+</button>
+<!--
+<button style="display:flex">
+<div id=obj3></div>
+</button>
+<button style="display:inline-flex">
+<div id=obj4></div>
+</button>
+-->
+<button style="columns:2">
+<div id=obj5></div>
+</button>
+
+<button style="display:grid; overflow:hidden">
+<div id=sobj1></div>
+</button>
+<button style="display:inline-grid; overflow:hidden">
+<div id=sobj2></div>
+</button>
+<!--
+<button style="display:flex; overflow:hidden">
+<div id=sobj3></div>
+</button>
+<button style="display:inline-flex; overflow:hidden">
+<div id=sobj4></div>
+</button>
+-->
+<button style="columns:2; overflow:hidden">
+<div id=sobj5></div>
+</button>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1316884-1.html b/layout/generic/crashtests/1316884-1.html
new file mode 100644
index 0000000000..edcca7626f
--- /dev/null
+++ b/layout/generic/crashtests/1316884-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<meta charset="UTF-8">
+<script>
+addEventListener("DOMContentLoaded", function(){
+ setTimeout(function(){
+ o_0.appendChild(document.createElement("span"));
+ document.documentElement.removeAttribute("class");
+ }, 0);
+});
+</script>
+<body style="columns: 5; column-fill: auto; height: 100px;">
+<div style="display: grid; grid-auto-rows: 30px; grid-template-rows: 5px min-content 50px;">
+<span style="page-break-inside: avoid; grid-row: 2; height: 60px;">
+<div id=o_0 style="display: grid; grid-gap: 0; grid-template-rows: min-content 50px; grid-auto-rows: 30px;">
+<span style="grid-row: 1/span 4;"></span>
+</div>
+</span>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1343552-1.html b/layout/generic/crashtests/1343552-1.html
new file mode 100644
index 0000000000..fafe8930c7
--- /dev/null
+++ b/layout/generic/crashtests/1343552-1.html
@@ -0,0 +1,32 @@
+<style>
+.class1 { float: left; white-space: pre-line; }
+.class2 { border-bottom-style: solid; font-face: Arial; font-size: 7ex; }
+</style>
+<script>
+function go() {
+ menuitem.appendChild(document.body.firstChild);
+ canvas.toBlob(callback);
+}
+function callback() {
+ var s = menu.style;
+ s.setProperty("flex-direction", "row-reverse");
+ option.scrollBy();
+ document.implementation.createHTMLDocument("foo").adoptNode(progress);
+ s.setProperty("flex-direction", "column");
+ canvas.toBlob(callback);
+}
+</script>
+aaaaaaaaaaaaaaaaaa
+</head>
+<body onload=go()>
+<del class="class1">
+<span class="class2">
+<menu id="menu">
+<menuitem>
+</menu>
+<menuitem id="menuitem">
+<progress id="progress">
+</del>
+<ol dir="rtl">l+0</ol>
+<canvas id="canvas">
+<option id="option">
diff --git a/layout/generic/crashtests/1343552-2.html b/layout/generic/crashtests/1343552-2.html
new file mode 100644
index 0000000000..f4e548e58e
--- /dev/null
+++ b/layout/generic/crashtests/1343552-2.html
@@ -0,0 +1,31 @@
+<style>
+.class1 { float: left; white-space: pre-line; }
+.class2 { border-bottom-style: solid; font-face: Arial; font-size: 7ex; }
+</style>
+<script>
+function go() {
+ progress.remove();
+ menu.style.setProperty("flex-direction", "column");
+ setTimeout(callback,0);
+}
+function callback() {
+ menu.style.setProperty("flex-direction", "row-reverse");
+ option.scrollBy();
+}
+</script>
+<body onload=go()>
+<del class="class1">
+<span class="class2">
+<menu id="menu">
+<menuitem>
+</menuitem></menu>
+<menuitem id="menuitem">
+<progress id="progress">
+</progress>aaaaaaaaaaaaaaaaaa
+
+
+</menuitem></span></del>
+<ol dir="rtl"></ol>
+<canvas id="canvas">
+<option id="option">
+</option></canvas>
diff --git a/layout/generic/crashtests/1346454-1.html b/layout/generic/crashtests/1346454-1.html
new file mode 100644
index 0000000000..bf8eceee32
--- /dev/null
+++ b/layout/generic/crashtests/1346454-1.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+
+<style>
+ol {
+ list-style-position: inside;
+ column-width: calc(0px);
+}
+li {
+ float: left;
+}
+li:last-child {
+ padding-block-end: calc(50%);
+ float: none;
+}
+</style>
+
+<script>
+function boom(){
+ document.getElementById("tgt").style.display = "block";
+}
+</script>
+</head>
+
+<body onload=boom()>
+<ol>
+<li id=tgt></li>
+<li></li>
+<li></li>
+</ol>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1346454-2.html b/layout/generic/crashtests/1346454-2.html
new file mode 100644
index 0000000000..0e87f4c491
--- /dev/null
+++ b/layout/generic/crashtests/1346454-2.html
@@ -0,0 +1,12 @@
+<style>
+#x { float: left; }
+dir {
+ list-style-position: inside;
+ column-width: 3px;
+}
+</style>
+<dir>
+<div>
+<li>
+<li id=x>
+<li> \ No newline at end of file
diff --git a/layout/generic/crashtests/1349650.html b/layout/generic/crashtests/1349650.html
new file mode 100644
index 0000000000..c225d02863
--- /dev/null
+++ b/layout/generic/crashtests/1349650.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body style="display: grid;">
+<div style="display:flex; position:fixed;"></div>
+<div style="order:-1;"></div>
+</body>
+</html>
+
diff --git a/layout/generic/crashtests/1349816-1.html b/layout/generic/crashtests/1349816-1.html
new file mode 100644
index 0000000000..48aa48b381
--- /dev/null
+++ b/layout/generic/crashtests/1349816-1.html
@@ -0,0 +1,6 @@
+<textarea dir='rtl' style='white-space:nowrap' draggable='true'>
+LFIodxNi
+&#x9C;&#x102C;&#xEC;&#x13;&#xB7;&#x8D;&#x210F;&#xBA;
+&#xAD;&#x1A;
+</textarea>
+<noscript hidden contenteditable='true' title='&#x289;' itemscope>
diff --git a/layout/generic/crashtests/1350372.html b/layout/generic/crashtests/1350372.html
new file mode 100644
index 0000000000..58858b3518
--- /dev/null
+++ b/layout/generic/crashtests/1350372.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+function boom(){
+ let root = document.documentElement,
+ inp = document.createElement("input"),
+ aud = document.createElement("audio"),
+ vid = document.createElement("video");
+ inp.type = "image";
+ document.body.appendChild(inp);
+ document.body.appendChild(aud);
+ document.body.appendChild(vid);
+ root.style.columnWidth = "0px";
+ setTimeout(function(){
+ inp.style.display = "contents";
+ setTimeout(function(){
+ inp.remove();
+ inp.appendChild(vid);
+ setTimeout(function(){
+ root.style.strokeWidth = "0px";
+ }, 10);
+ }, 10);
+ }, 10);
+}
+addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+<body></body>
+</html>
diff --git a/layout/generic/crashtests/1364361-1.html b/layout/generic/crashtests/1364361-1.html
new file mode 100644
index 0000000000..5056a52df7
--- /dev/null
+++ b/layout/generic/crashtests/1364361-1.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<style>
+details {
+ column-count: 3;
+ column-width: 5em;
+ background-color: yellow;
+ overflow: scroll;
+ width: 300px; height: 300px;
+}
+</style>
+<details>
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+abcde
+</details>
diff --git a/layout/generic/crashtests/1367413-1.html b/layout/generic/crashtests/1367413-1.html
new file mode 100644
index 0000000000..1b77e9c52a
--- /dev/null
+++ b/layout/generic/crashtests/1367413-1.html
@@ -0,0 +1,54 @@
+<!DOCTYPE HTML>
+<title>Test for dynamic re-pagination of absolutely positioned elements</title>
+<link rel="author" title="Mats Palmgren" href="mailto:mats@mozilla.com">
+<link rel="author" title="L. David Baron" href="https://dbaron.org/">
+<style>
+
+#multicol {
+ columns: 3;
+ column-fill: auto;
+ column-gap: 15px;
+ height: 500px;
+ width: 300px;
+ background: yellow;
+}
+
+#relpos {
+ position: relative;
+ background: aqua;
+ height: 250px;
+}
+
+#abspos {
+ position: absolute;
+ top: 60px;
+ right: 0;
+ height: 80px;
+ width: 50px;
+ background: blue;
+ transform: scale(0.9);
+}
+
+#overflow {
+ height: 100px;
+ width: 30px;
+ background: grey;
+}
+</style>
+<body style="width: 700px">
+
+<div id="multicol">
+ <div id="relpos">
+ <div id="abspos"><div id="overflow"></div></div>
+ </div>
+</div>
+
+<script>
+
+var mc = document.getElementById("multicol");
+mc.offsetHeight; // flush layout
+mc.style.height = "140px";
+mc.offsetHeight; // flush layout
+mc.parentNode.style.width = "800px";
+
+</script>
diff --git a/layout/generic/crashtests/1368617-1.html b/layout/generic/crashtests/1368617-1.html
new file mode 100644
index 0000000000..656829d68c
--- /dev/null
+++ b/layout/generic/crashtests/1368617-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<style>
+.x:first-line { letter-spacing: 1px; }
+.x:first-letter { float: left; }
+</style>
+<script>document.documentElement.offsetTop;</script>
+<p class=x>&nbsp;</p>
+<script>document.documentElement.offsetTop;</script>
+<a href=""><svg></svg></a>
diff --git a/layout/generic/crashtests/1373586.html b/layout/generic/crashtests/1373586.html
new file mode 100644
index 0000000000..3e5a47cfd2
--- /dev/null
+++ b/layout/generic/crashtests/1373586.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<script>
+// This is the constant in nsTextFrame.cpp of the number of lines which
+// a text run can be built up to.
+const NUM_LINES_TO_BUILD_TEXT_RUNS = 200;
+// Push the affecting line to be the last line in the text run.
+for (let i = 0; i < NUM_LINES_TO_BUILD_TEXT_RUNS - 1; i++) {
+ document.write('x<br>');
+}
+// The exact number here isn't important. It just needs to be large
+// enough that '\n' would be inside text after a line break.
+for (let i = 0; i < 2000; i++) {
+ document.write('ã‚');
+}
+document.write('\nã‚<br>');
+// Then this ruby would not get its text run.
+document.write('x<ruby>x</ruby>');
+</script>
diff --git a/layout/generic/crashtests/1375858.html b/layout/generic/crashtests/1375858.html
new file mode 100644
index 0000000000..b6d89f6201
--- /dev/null
+++ b/layout/generic/crashtests/1375858.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<style>
+ *::marker, * {
+ transform-style:preserve-3d;
+ }
+</style>
+</head>
+<body>
+ <li></li>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1381134-2.html b/layout/generic/crashtests/1381134-2.html
new file mode 100644
index 0000000000..d3ac73507a
--- /dev/null
+++ b/layout/generic/crashtests/1381134-2.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+addEventListener("DOMContentLoaded", () => {
+ [d1, d2] = document.getElementsByTagName("div");
+ [s1, s2] = document.getElementsByTagName("span")
+ d3 = document.createElement("div")
+ d4 = document.createElement("div")
+ d4.setAttribute("class", "grid")
+ d3.appendChild(d4)
+ d1.appendChild(document.createElement("span"))
+ setTimeout(() => {
+ d2.removeChild(s2)
+ setTimeout(() => {
+ d2.insertBefore(d3, s1)
+ }, 100)
+ }, 100)
+})
+</script>
+<style>
+.columns {
+ columns: 3;
+}
+.grid {
+ border:5px solid;
+ counter-reset: item;
+}
+.grid * { display:block; }
+span { display:contents; }
+span::before { content: counter(item) ":before"; }
+span::after { content: counter(item) ":after"; }
+</style>
+</head>
+<body>
+<div class=columns>
+<div class=grid>
+<c></c>
+<span><c></c></span>
+<span><c></c></span>
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1381134.html b/layout/generic/crashtests/1381134.html
new file mode 100644
index 0000000000..a45fa04ecb
--- /dev/null
+++ b/layout/generic/crashtests/1381134.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+addEventListener("DOMContentLoaded", () => {
+ [d1, d2] = document.getElementsByTagName("div");
+ [s1, s2] = document.getElementsByTagName("span")
+ d3 = document.createElement("div")
+ d4 = document.createElement("div")
+ d4.setAttribute("class", "grid")
+ d3.appendChild(d4)
+ d1.appendChild(document.createElement("span"))
+ setTimeout(() => {
+ d2.removeChild(s2)
+ setTimeout(() => {
+ d2.insertBefore(d3, s1)
+ }, 100)
+ }, 100)
+})
+</script>
+<style>
+.columns {
+ columns: 3;
+}
+.grid {
+ display: grid;
+ border:5px solid;
+ counter-reset: item;
+}
+span { display:contents; }
+span::before { content: counter(item) ":before"; }
+span::after { content: counter(item) ":after"; }
+</style>
+</head>
+<body>
+<div class=columns>
+<div class=grid>
+<c></c>
+<span><c></c></span>
+<span><c></c></span>
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1401420-1.html b/layout/generic/crashtests/1401420-1.html
new file mode 100644
index 0000000000..114f0f0ba6
--- /dev/null
+++ b/layout/generic/crashtests/1401420-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<style> rbc { display: ruby-base-container; } </style>
+<div style="column-width: 1px">
+x <ruby><rbc>aaaaaaaaaaaaaa</rbc><rbc><div style="float: left"></div></rbc></ruby>
+</div>
diff --git a/layout/generic/crashtests/1401709.html b/layout/generic/crashtests/1401709.html
new file mode 100644
index 0000000000..6ad364c3b1
--- /dev/null
+++ b/layout/generic/crashtests/1401709.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+ <ruby>
+ <rtc style="writing-mode: vertical-rl">
+ <div style="float: left"></div>
+ </rtc>
+ </ruby>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1401807.html b/layout/generic/crashtests/1401807.html
new file mode 100644
index 0000000000..835e14b048
--- /dev/null
+++ b/layout/generic/crashtests/1401807.html
@@ -0,0 +1,15 @@
+<html>
+ <head>
+ <style></style>
+ <script>
+ try { o1 = document.createElement('acronym') } catch(e) { }
+ try { o2 = document.createElement('video') } catch(e) { }
+ try { o3 = document.createElement('progress') } catch(e) { }
+ try { document.documentElement.appendChild(o1) } catch(e) { }
+ try { document.documentElement.appendChild(o2) } catch(e) { }
+ try { o1.appendChild(o3) } catch(e) { }
+ try { o3.style.writingMode = 'sideways-lr' } catch(e) { }
+ try { document.styleSheets[0].insertRule('* { column-width: calc(15px); display: flow-root}', 0); } catch(e) { }
+ </script>
+ </head>
+</html>
diff --git a/layout/generic/crashtests/1404222-empty-shape.html b/layout/generic/crashtests/1404222-empty-shape.html
new file mode 100644
index 0000000000..0f4a62c2cc
--- /dev/null
+++ b/layout/generic/crashtests/1404222-empty-shape.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<div style="float: left; shape-outside: linear-gradient(to top, green 50%, transparent 50%);"></div>
diff --git a/layout/generic/crashtests/1405443.html b/layout/generic/crashtests/1405443.html
new file mode 100644
index 0000000000..79313ae1c4
--- /dev/null
+++ b/layout/generic/crashtests/1405443.html
@@ -0,0 +1,19 @@
+<style>
+#htmlvar00009 { page-break-inside: avoid; }
+* { padding-left: 1vw; border-right: solid green 3em; }
+#htmlvar00001 { columns: 1px; )
+</style>
+<script>
+function jsfuzzer() {
+try { htmlvar00009.appendChild(htmlvar00013); } catch(e) { }
+try { var var00143 = htmlvar00009.x; } catch(e) { }
+try { htmlvar00009.appendChild(document.createElement("table").createCaption()); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<dl id="htmlvar00001">
+A
+<img id="htmlvar00009" align="left"></img>
+<menu id="htmlvar00013">
+<menuitem>
+<hr>
diff --git a/layout/generic/crashtests/1405813.html b/layout/generic/crashtests/1405813.html
new file mode 100644
index 0000000000..f349520b06
--- /dev/null
+++ b/layout/generic/crashtests/1405813.html
@@ -0,0 +1,10 @@
+<style>
+* { height: 0vmin; padding-bottom: 1vmax; display: grid; columns: 0px }
+</style>
+<details>
+<summary>
+V
+<link>
+<content>
+>
+<video>
diff --git a/layout/generic/crashtests/1405896.html b/layout/generic/crashtests/1405896.html
new file mode 100644
index 0000000000..0d3b6ddb24
--- /dev/null
+++ b/layout/generic/crashtests/1405896.html
@@ -0,0 +1,31 @@
+<!-- a -->
+<style>
+* {
+ height: 0vmin;
+ display: grid
+}
+.class1 {
+ columns: 0px;
+ page-break-before: always;
+ grid-row-start: last
+}
+</style>
+<script>
+function jsfuzzer() {
+ try { htmlvar00045.replaceChild(htmlvar00013,htmlvar00045.childNodes[6]); } catch(e) { }
+}
+</script>
+<body onload=jsfuzzer()>
+<details id="htmlvar00013" class="class1"></details>
+<details class="class1" open="">
+<form>
+<h6 id="htmlvar00045">
+>
+<link>
+<content>
+<embed>
+>
+#
+K
+</content>
+<!-- a -->
diff --git a/layout/generic/crashtests/1406252-1.html b/layout/generic/crashtests/1406252-1.html
new file mode 100644
index 0000000000..df0f4fcdd7
--- /dev/null
+++ b/layout/generic/crashtests/1406252-1.html
@@ -0,0 +1,13 @@
+<style>
+#htmlvar00006 {
+ display: flex; cellspacing: 1;
+ writing-mode: vertical-lr;
+}
+* { -webkit-flex: auto; }
+#htmlvar00007 { flex-grow: 0.614207684486; }
+#htmlvar00006 { flex-flow: column nowrap; }
+</style>
+<output id="htmlvar00006" marginheight="0">
+<select id="htmlvar00007" scrollamount="-1">
+</select>
+<dl>
diff --git a/layout/generic/crashtests/1415185.html b/layout/generic/crashtests/1415185.html
new file mode 100644
index 0000000000..c1ef181abf
--- /dev/null
+++ b/layout/generic/crashtests/1415185.html
@@ -0,0 +1,18 @@
+<html>
+ <head>
+ <style>
+ * { column-count: 17 }
+ </style>
+ <script>
+ try { o1 = document.createElement('p') } catch(e) { }
+ try { o2 = document.createElement('iframe') } catch(e) { }
+ try { o3 = document.createElement('details') } catch(e) { }
+ try { o4 = document.createElement('track') } catch(e) { }
+ try { document.documentElement.appendChild(o1) } catch(e) { }
+ try { document.documentElement.appendChild(o2) } catch(e) { }
+ try { o1.appendChild(o3) } catch(e) { }
+ try { o2.contentWindow.location.reload() } catch(e) { }
+ try { o3.appendChild(o4) } catch(e) { }
+ </script>
+ </head>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/1416544.html b/layout/generic/crashtests/1416544.html
new file mode 100644
index 0000000000..713568d107
--- /dev/null
+++ b/layout/generic/crashtests/1416544.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+
+ body {
+ columns: 2;
+ -webkit-columns: 2;
+ }
+ span {
+ float: right;
+ }
+
+ </style>
+</head>
+<body>
+
+ <div>
+ a
+ <span>1</span>
+ </div>
+
+ <div>
+ <div>
+ b
+ <span>2</span>
+ <div></div>
+ </div>
+ </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1427824.html b/layout/generic/crashtests/1427824.html
new file mode 100644
index 0000000000..d69fcb6cff
--- /dev/null
+++ b/layout/generic/crashtests/1427824.html
@@ -0,0 +1,10 @@
+<!doctype html>
+<div id="container"></div>
+<script>
+let contents = document.createElement('div');
+contents.style.display = "contents";
+container.appendChild(contents);
+container.appendChild(document.createElement('colgroup'));
+container.offsetTop;
+contents.appendChild(document.createElement('colgroup'));
+</script>
diff --git a/layout/generic/crashtests/1431781-2.html b/layout/generic/crashtests/1431781-2.html
new file mode 100644
index 0000000000..2a29c0b07d
--- /dev/null
+++ b/layout/generic/crashtests/1431781-2.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<style>
+body { column-width: 1px; }
+dd { height: 13px }
+</style>
+<script>
+ function go() {
+ document.body.style.width = "1240px";
+ document.body.offsetHeight;
+ }
+</script>
+</head>
+<body onload="go()">
+<span>
+<span>
+ a
+ <meter></meter>
+ <dl>
+ <dd>
+ b
+ c
+ d
+ <menu></menu>
+ e
+ f
diff --git a/layout/generic/crashtests/1431781.html b/layout/generic/crashtests/1431781.html
new file mode 100644
index 0000000000..cd0733be48
--- /dev/null
+++ b/layout/generic/crashtests/1431781.html
@@ -0,0 +1,22 @@
+<style>
+body { column-width: 0px }
+dd { height: 1vmax }
+</style>
+<script>
+function eh1() {
+ a.clientHeight;
+ window.document.linkColor = "1";
+}
+</script>
+<content id="a">
+</div>
+<data>
+a
+<meter></meter>
+<dl>
+<dd>
+<style onload="eh1()"></style>
+<m>a
+a
+a<menu>a
+a
diff --git a/layout/generic/crashtests/1458028.html b/layout/generic/crashtests/1458028.html
new file mode 100644
index 0000000000..4bf2db4db6
--- /dev/null
+++ b/layout/generic/crashtests/1458028.html
@@ -0,0 +1,13 @@
+<style>
+.cl { page-break-inside: avoid; }
+summary::first-letter { float: right; }
+</style>
+<script>
+function go() {
+ a.remove();
+}
+</script>
+<body onload=go()>
+<details>
+<summary id="a" class="cl">
+T
diff --git a/layout/generic/crashtests/1459697.html b/layout/generic/crashtests/1459697.html
new file mode 100644
index 0000000000..0276a3f1a2
--- /dev/null
+++ b/layout/generic/crashtests/1459697.html
@@ -0,0 +1,13 @@
+<style>
+* {
+ shape-margin: 33%;
+ shape-outside: ellipse(20% 47% at 66% 79%)
+}
+.cl {
+ border-right-style: dashed;
+ float: right;
+ border-bottom-style: dashed;
+}
+</style>
+<button>
+<del class="cl">
diff --git a/layout/generic/crashtests/1460158-1.html b/layout/generic/crashtests/1460158-1.html
new file mode 100644
index 0000000000..b3b5ec6f0f
--- /dev/null
+++ b/layout/generic/crashtests/1460158-1.html
@@ -0,0 +1,15 @@
+<style>
+.cl {
+ display: list-item;
+ list-style-position: inside;
+}
+</style>
+<script>
+function go() {
+ a.appendChild(b);
+}
+</script>
+<body onload=go()>
+<progress id="a"></progress>
+<details class="cl">
+<summary id="b">
diff --git a/layout/generic/crashtests/1460158-2.html b/layout/generic/crashtests/1460158-2.html
new file mode 100644
index 0000000000..0272168368
--- /dev/null
+++ b/layout/generic/crashtests/1460158-2.html
@@ -0,0 +1,17 @@
+<style>
+.cl {
+ display: list-item;
+ list-style-position: inside;
+ position: relative;
+}
+#b { position: absolute; }
+</style>
+<script>
+function go() {
+ a.appendChild(b);
+}
+</script>
+<body onload=go()>
+<progress id="a"></progress>
+<details class="cl">
+<summary id="b">
diff --git a/layout/generic/crashtests/1460158-3.html b/layout/generic/crashtests/1460158-3.html
new file mode 100644
index 0000000000..6bbd4a7d23
--- /dev/null
+++ b/layout/generic/crashtests/1460158-3.html
@@ -0,0 +1,14 @@
+<style>
+.cl {
+ display: list-item;
+ list-style-position: inside;
+}
+</style>
+<script>
+function go() {
+ a.removeChild(b);
+}
+</script>
+<body onload=go()>
+<details class="cl" id="a">
+<summary id="b">
diff --git a/layout/generic/crashtests/1461039.html b/layout/generic/crashtests/1461039.html
new file mode 100644
index 0000000000..7d687908bc
--- /dev/null
+++ b/layout/generic/crashtests/1461039.html
@@ -0,0 +1,15 @@
+<style>
+.cl {
+ overflow-y: auto;
+ text-overflow: ellipsis;
+}
+</style>
+<script>
+function go() {
+ a.appendChild(b);
+}
+</script>
+<body onload=go()>
+<li id="b">
+<li class="cl">
+<ruby id="a">)
diff --git a/layout/generic/crashtests/1461979-1.html b/layout/generic/crashtests/1461979-1.html
new file mode 100644
index 0000000000..3250a922d1
--- /dev/null
+++ b/layout/generic/crashtests/1461979-1.html
@@ -0,0 +1,13 @@
+<html>
+ <head>
+ <script>
+ function start () {
+ try { o1 = document.createElementNS('http://www.w3.org/2000/svg', 'style') } catch (e) {}
+ try { document.head.appendChild(o1) } catch (e) {}
+ try { o1.sheet.insertRule('* { padding-top:calc(439804in) }', 0) } catch (e) {}
+ try { o1.sheet.insertRule('* { position:absolute}', 0) } catch (e) {}
+ }
+ window.addEventListener('load', start)
+ </script>
+ </head>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/1463977.html b/layout/generic/crashtests/1463977.html
new file mode 100644
index 0000000000..6569c8c476
--- /dev/null
+++ b/layout/generic/crashtests/1463977.html
@@ -0,0 +1,5 @@
+<table cellpadding='89181367.20'>
+<td>
+<button>
+<q>
+<meter>
diff --git a/layout/generic/crashtests/1466224.html b/layout/generic/crashtests/1466224.html
new file mode 100644
index 0000000000..a0343eef12
--- /dev/null
+++ b/layout/generic/crashtests/1466224.html
@@ -0,0 +1,27 @@
+<script>
+window.requestIdleCallback(function() {
+ document.documentElement.style.display="none";
+ document.documentElement.getBoundingClientRect();
+ document.documentElement.style.display="";
+});
+</script>
+<style>
+#a {
+ display: table-caption;
+}
+:not(altGlyphDef) {
+ text-indent: 1vw;
+ overflow-x: scroll;
+}
+#b {
+ bottom: 0em;
+ font: small/7% cursive;
+ transform: translate3d(0px, 1px, -1px);
+ max-height: 3mm;
+ filter: brightness(0);
+}
+</style>
+<button id="a">
+<dialog id="b" open="">
+<h5>&
+
diff --git a/layout/generic/crashtests/1467239.html b/layout/generic/crashtests/1467239.html
new file mode 100644
index 0000000000..3f49a66c56
--- /dev/null
+++ b/layout/generic/crashtests/1467239.html
@@ -0,0 +1,14 @@
+<style>
+.b {
+ display: grid;
+ contain: strict;
+}
+</style>
+<script>
+function go() {
+ a.data = "A";
+}
+</script>
+<body onload=go()>
+<form class="b">
+<object id="a">
diff --git a/layout/generic/crashtests/1472403.html b/layout/generic/crashtests/1472403.html
new file mode 100644
index 0000000000..fabfc5431c
--- /dev/null
+++ b/layout/generic/crashtests/1472403.html
@@ -0,0 +1,6 @@
+<!doctype html>
+<div id="target"></div>
+<script>
+ let element = document.createElement('_moz_generated_content_image');
+ target.appendChild(element);
+</script>
diff --git a/layout/generic/crashtests/1474768.html b/layout/generic/crashtests/1474768.html
new file mode 100644
index 0000000000..0735cc64cc
--- /dev/null
+++ b/layout/generic/crashtests/1474768.html
@@ -0,0 +1,22 @@
+<style>
+* {
+ max-height: 0mm;
+}
+:not(script) {
+ columns: 0px;
+ border-right-style: dashed;
+}
+</style>
+<script>
+function go() {
+ a.replaceWith(b);
+}
+</script>
+<body onload=go()>
+<data>
+<video></video>
+<br></br>
+<span>
+<ol>
+<li id="a"></li>
+<form id="b">
diff --git a/layout/generic/crashtests/1478178.html b/layout/generic/crashtests/1478178.html
new file mode 100644
index 0000000000..08a9dfc723
--- /dev/null
+++ b/layout/generic/crashtests/1478178.html
@@ -0,0 +1,6 @@
+<p style="text-align-last: justify">
+A
+<wbr/>
+&#x0C;
+<!-- A -->
+</p>
diff --git a/layout/generic/crashtests/1483972.html b/layout/generic/crashtests/1483972.html
new file mode 100644
index 0000000000..1a31be16cc
--- /dev/null
+++ b/layout/generic/crashtests/1483972.html
@@ -0,0 +1,10 @@
+<script>
+window.onload=function(){
+ window.frames[0].document.body.appendChild(a);
+ var o=window.frames[0].document.getElementById('a');
+ document.getElementById('b').appendChild(o.parentNode.removeChild(o));
+}
+</script>
+<audio id='a' controls autobuffer='true'></audio>
+<time id='b'>
+<iframe hidden>
diff --git a/layout/generic/crashtests/1486457.html b/layout/generic/crashtests/1486457.html
new file mode 100644
index 0000000000..cf1999cb96
--- /dev/null
+++ b/layout/generic/crashtests/1486457.html
@@ -0,0 +1,19 @@
+<style>
+* { display: ruby-text-container }
+div { float: right }
+</style>
+<script>
+function start() {
+ try { o1 = document.createElement('div') } catch (e) {}
+ try { o2 = document.createElement('img') } catch (e) {}
+ try { o3 = document.createElement('img') } catch (e) {}
+ try { o4 = document.createElement('img') } catch (e) {}
+ try { o3.innerText = '%\n' } catch (e) {}
+ try { o4.align = 'right' } catch (e) {}
+ try { o3.appendChild(o4) } catch (e) {}
+ try { o2.appendChild(o3) } catch (e) {}
+ try { document.documentElement.appendChild(o1) } catch (e) {}
+ try { document.documentElement.appendChild(o2) } catch (e) {}
+}
+window.addEventListener('load', start)
+</script>
diff --git a/layout/generic/crashtests/1488762-1.html b/layout/generic/crashtests/1488762-1.html
new file mode 100644
index 0000000000..2f3a30f02f
--- /dev/null
+++ b/layout/generic/crashtests/1488762-1.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+ <title>testcase</title>
+ <style>
+ * {
+ display: flex;
+ flex-flow: wrap;
+ min-width: -moz-fit-content;
+
+ flex-grow: 0.05;
+ margin: 0 88em 0 65170px;
+ font-size: calc(59902%);
+ }
+ </style>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1488910-1.html b/layout/generic/crashtests/1488910-1.html
new file mode 100644
index 0000000000..62fd8c1974
--- /dev/null
+++ b/layout/generic/crashtests/1488910-1.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+ <style id='style'></style>
+ <script>
+ function start() {
+ o1 = document.createElement('a')
+ o2 = document.createElement('a')
+ o1.textContent = '-=–ð¢'
+ o1.setAttribute('style', 'block-size: calc(3px) !important')
+ o1.appendChild(o2)
+ document.documentElement.appendChild(o1)
+ document.getElementById('style').textContent = 'HTML * { -moz-columns: 0px !important } * { float: right} :first-letter,H{\'}:not(c),* { overflow: hidden !important }'
+ window.scrollByPages(4096, {})
+ o2.insertAdjacentHTML('beforebegin', '<d>')
+ }
+ window.addEventListener('load', start)
+ </script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1488910-2.html b/layout/generic/crashtests/1488910-2.html
new file mode 100644
index 0000000000..4ed8439d63
--- /dev/null
+++ b/layout/generic/crashtests/1488910-2.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+ <style id='style'></style>
+ <script>
+ function start() {
+ o1 = document.createElement('a')
+ o2 = document.createElement('a')
+ o1.textContent = '-=–ð¢'
+ o1.setAttribute('style', 'block-size: calc(3px) !important')
+ o1.appendChild(o2)
+ document.documentElement.appendChild(o1)
+ document.getElementById('style').textContent = 'HTML * { columns: 0px !important } * { float: right} :first-letter,H{\'}:not(c),* { overflow: hidden !important }'
+ window.scrollByPages(4096, {})
+ o2.insertAdjacentHTML('beforebegin', '<d>')
+ }
+ window.addEventListener('load', start)
+ </script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1489287.html b/layout/generic/crashtests/1489287.html
new file mode 100644
index 0000000000..4d511e83a0
--- /dev/null
+++ b/layout/generic/crashtests/1489287.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+ <script>
+ function start() {
+ o1 = document.createElement('u')
+ o2 = document.createElement('li')
+ o3 = document.createElement('style')
+ o2.textContent = '\nr'
+ o1.appendChild(o2)
+ document.documentElement.appendChild(o1)
+ o3.textContent = 'html { white-space: pre } :first-letter { float: left }'
+ document.documentElement.appendChild(o3)
+ }
+ document.addEventListener('DOMContentLoaded', start)
+ </script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1489770.html b/layout/generic/crashtests/1489770.html
new file mode 100644
index 0000000000..0873d0743c
--- /dev/null
+++ b/layout/generic/crashtests/1489770.html
@@ -0,0 +1,23 @@
+<style>
+#a {
+ grid-auto-rows: min-content;
+ display: grid;
+}
+:not(html) {
+ margin-bottom: -1vmin;
+ column-width: 0;
+}
+</style>
+<script>
+function go() {
+ a.appendChild(b);
+ document.documentElement.style.display = "none"
+ document.documentElement.getBoundingClientRect()
+ document.documentElement.style.display = ""
+}
+</script>
+<a id="a">A</a>
+<ul>
+<li>
+<audio onloadstart="go()" src="">
+<keygen id="b">
diff --git a/layout/generic/crashtests/1489863.html b/layout/generic/crashtests/1489863.html
new file mode 100644
index 0000000000..dd110d8459
--- /dev/null
+++ b/layout/generic/crashtests/1489863.html
@@ -0,0 +1,15 @@
+<script>
+window.onload=function(){
+ document.getElementById('a').style='white-space:pre'
+}
+</script>
+<style>
+:last-child::first-letter {
+ float:right;
+}
+:empty {
+ padding-left:82%;
+}
+</style>
+<embed>
+<data id='a'>A
diff --git a/layout/generic/crashtests/1490032.html b/layout/generic/crashtests/1490032.html
new file mode 100644
index 0000000000..45123665b0
--- /dev/null
+++ b/layout/generic/crashtests/1490032.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+ <title>AddressSanitizer: SEGV /builds/worker/workspace/build/src/obj-firefox/dist/include/nsTArray.h in Length</title>
+ <style class="">
+ @namespace math url(http://www.w3.org/1998/Math/MathML);
+ *>* {
+ display: grid;
+ max-block-size: calc(3*25px + 50%);
+ -webkit-align-self: start;
+ grid-template-rows: repeat(auto-fill, minmax(1ch, min-content)) minmax(min-content, 0);
+ }
+
+ *,
+ HTML {
+ columns: 2 10px;
+ page-break-inside: avoid !important;
+
+ </style>
+</head>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/1490685.html b/layout/generic/crashtests/1490685.html
new file mode 100644
index 0000000000..6a41850643
--- /dev/null
+++ b/layout/generic/crashtests/1490685.html
@@ -0,0 +1 @@
+<img class="" srcset="data:;base64,R0lGODlhAQA//wAAACwAAAAAAQABADs 0x"/>
diff --git a/layout/generic/crashtests/1493708.html b/layout/generic/crashtests/1493708.html
new file mode 100644
index 0000000000..e4615e1e66
--- /dev/null
+++ b/layout/generic/crashtests/1493708.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+ <style>
+ * {
+ column-width: calc(-15px);
+ transform-style: preserve-3d ! important;
+ }
+ </style>
+</head>
+
+<body>
+ <iframe></iframe>
+ <textarea autofocus minlength="">
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/1493710.html b/layout/generic/crashtests/1493710.html
new file mode 100644
index 0000000000..738b2af9be
--- /dev/null
+++ b/layout/generic/crashtests/1493710.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+ <style id="id_3">
+ * {
+ position: absolute !important
+ </style>
+ <script>
+ function start() {
+ window.CustomElement0 = class extends HTMLElement {
+ constructor() {
+ super();
+ this.attachShadow({
+ mode: 'open'
+ })
+ }
+ }
+ customElements.define('custom-element-0', CustomElement0)
+ o1 = document.createElement('input')
+ o2 = document.createElement('custom-element-0')
+ document.documentElement.appendChild(o2)
+ o2.shadowRoot.prepend('', undefined, o1, '', undefined, document.getElementById('id_3'))
+ }
+ document.addEventListener('DOMContentLoaded', start)
+ </script>
+</head>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/1493741.html b/layout/generic/crashtests/1493741.html
new file mode 100644
index 0000000000..59ba5df1c4
--- /dev/null
+++ b/layout/generic/crashtests/1493741.html
@@ -0,0 +1,6 @@
+<style>
+ video::after {
+ content: "";
+ }
+</style>
+<video></video>
diff --git a/layout/generic/crashtests/1494380.html b/layout/generic/crashtests/1494380.html
new file mode 100644
index 0000000000..ac43c4a528
--- /dev/null
+++ b/layout/generic/crashtests/1494380.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<style>
+div {
+ text-combine-upright: all;
+ writing-mode: vertical-rl;
+ display: contents;
+ text-emphasis: dot;
+}
+</style>
+<div>test</div>
diff --git a/layout/generic/crashtests/1505817.html b/layout/generic/crashtests/1505817.html
new file mode 100644
index 0000000000..185a210514
--- /dev/null
+++ b/layout/generic/crashtests/1505817.html
@@ -0,0 +1,27 @@
+<style>
+ html {
+ word-spacing: calc(-47em + 255px);
+ }
+
+ * {
+ float: left;
+ column-count: 14;
+ }
+
+ *::first-letter {
+ -moz-margin-start: calc(25px*3);
+ }
+</style>
+<script>
+ function start() {
+ o1 = document.createElement('c')
+ audio = document.getElementById('audio_0')
+ audio.insertAdjacentText('beforebegin', 'Ù\n-†­ð†3ê')
+ audio.getClientRects()
+ audio.insertAdjacentElement('beforebegin', o1)
+ audio.getClientRects()
+ }
+
+ window.addEventListener('load', start)
+</script>
+<audio id="audio_0" muted>
diff --git a/layout/generic/crashtests/1506216.html b/layout/generic/crashtests/1506216.html
new file mode 100644
index 0000000000..b09dca1eb7
--- /dev/null
+++ b/layout/generic/crashtests/1506216.html
@@ -0,0 +1,4 @@
+<style>
+:root { columns: 5px }
+</style>
+<hr style="column-span:all">
diff --git a/layout/generic/crashtests/1506306.html b/layout/generic/crashtests/1506306.html
new file mode 100644
index 0000000000..0296c3e25f
--- /dev/null
+++ b/layout/generic/crashtests/1506306.html
@@ -0,0 +1,8 @@
+<script>
+function go() {
+ document.linkColor = "0";
+}
+</script>
+<body onload=go()>
+<li style="columns: 1px">
+<title style="column-span: all; display: table">A</title>
diff --git a/layout/generic/crashtests/1507196.html b/layout/generic/crashtests/1507196.html
new file mode 100644
index 0000000000..65f4943ec7
--- /dev/null
+++ b/layout/generic/crashtests/1507196.html
@@ -0,0 +1,30 @@
+<html>
+
+<head>
+ <style class="">
+ * {
+ border-block-start-style: ridge;
+ margin-block-end: calc(27914%) !important;
+ float: left;
+ margin-inline-start: 3em;
+ column-width: 15px
+ }
+
+ HTML {
+ width: calc(25px* 3);
+ font: condensed bold italic small-caps 19769px/calc(1 + 2*188/4) Times New Roman, serif ! important;
+ height: calc(153%) !important;
+ }
+ </style>
+ <script>
+ function start() {
+ o1 = document.createElementNS('http://www.w3.org/1999/xhtml', 'c')
+ document.documentElement.appendChild(o1)
+ o1.scrollTop = 100
+ o1.dir = ''
+ }
+ document.addEventListener('DOMContentLoaded', start)
+ </script>
+</head>
+
+</html>
diff --git a/layout/generic/crashtests/1513275.html b/layout/generic/crashtests/1513275.html
new file mode 100644
index 0000000000..1abb5137a5
--- /dev/null
+++ b/layout/generic/crashtests/1513275.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<div style="width: 1ex">
+<ruby>
+hello
+<math style="display: ruby-base-container">
+<mfenced>a</mfenced>
+</math>
+</ruby>
+</div>
diff --git a/layout/generic/crashtests/1513282.html b/layout/generic/crashtests/1513282.html
new file mode 100644
index 0000000000..367a9afb6a
--- /dev/null
+++ b/layout/generic/crashtests/1513282.html
@@ -0,0 +1,16 @@
+<html>
+<style id="style">
+ * {
+ display: contents;
+ }
+ *::first-line,
+ #id_3 {
+</style>
+<script>
+ function start() {
+ const style = document.getElementById('style')
+ style.prepend('�')
+ }
+ document.addEventListener('DOMContentLoaded', start)
+</script>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/1515124.html b/layout/generic/crashtests/1515124.html
new file mode 100644
index 0000000000..027cec5b4b
--- /dev/null
+++ b/layout/generic/crashtests/1515124.html
@@ -0,0 +1,26 @@
+<style>
+* {
+ columns: 0;
+ break-before: page;
+ overflow-wrap: break-word;
+}
+</style>
+<script>
+function go() {
+try { b.appendChild(a); } catch(e) { }
+try { c.style.setProperty("border-collapse", "collapse"); } catch(e) { }
+}
+</script>
+<body onload=go()>
+<menu>
+<menuitem>
+<div style="display: grid">
+<table>
+A
+<li>
+<th id="a">
+</table>
+<time id="b">
+</menu>
+<dl id="c">
+AA
diff --git a/layout/generic/crashtests/1517033.html b/layout/generic/crashtests/1517033.html
new file mode 100644
index 0000000000..f882ec2931
--- /dev/null
+++ b/layout/generic/crashtests/1517033.html
@@ -0,0 +1,24 @@
+<!-- COMMENT -->
+<style id="style"></style>
+<script>
+ function start() {
+ try { o = [] } catch (e) {}
+ try { window = window } catch (e) {}
+ try { document = document } catch (e) {}
+ try { header_0 = document.getElementById('header') } catch (e) {}
+ try { style_0 = document.getElementById('style') } catch (e) {}
+ try { style_1 = document.createElement('style') } catch (e) {}
+ try { computed = window.getComputedStyle(style_0) } catch (e) {}
+ try { style_1.textContent = '#header, i { column-span:all } c,* { columns: 2 !important }' } catch (e) {}
+ try { document.firstElementChild.appendChild(style_1) } catch (e) {}
+ try { computed.getPropertyValue('quotes') } catch (e) {}
+ try { header_0.style.setProperty('scroll-behavior', 'smooth', undefined) } catch (e) {}
+ try { window.scrollBy(256, 1) } catch (e) {}
+ try { header_0.style.setProperty('scroll-snap-type', 'both mandatory', '') } catch (e) {}
+ try { header_0.getClientRects() } catch (e) {}
+ try { style_1.sheet.insertRule('i { }', undefined) } catch (e) {}
+ }
+ window.addEventListener('load', start)
+</script>
+<header id="header"></header>
+<!-- COMMENT -->
diff --git a/layout/generic/crashtests/1517297.html b/layout/generic/crashtests/1517297.html
new file mode 100644
index 0000000000..f729d130f6
--- /dev/null
+++ b/layout/generic/crashtests/1517297.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+ <style>
+ * {
+ column-count: 1;
+ min-width: -moz-min-content;
+ column-span: all;
+ }
+
+ ins {
+ display: grid;
+ }
+ </style>
+</head>
+<body>
+ <a>
+ <ins>MJ]yYfC&gt;;M|</ins>
+ <keygen></keygen>
+ </a>
+</body>
+</html>
+
diff --git a/layout/generic/crashtests/1520798-1.xhtml b/layout/generic/crashtests/1520798-1.xhtml
new file mode 100644
index 0000000000..af694305a8
--- /dev/null
+++ b/layout/generic/crashtests/1520798-1.xhtml
@@ -0,0 +1,10 @@
+<window xmlns:html="http://www.w3.org/1999/xhtml"
+ xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="go()">
+<div id="tweakMe">abc</div>
+<script>
+ function go() {
+ document.getElementById("tweakMe").style.overflowAnchor = "none";
+ }
+</script>
+</window>
diff --git a/layout/generic/crashtests/1520798-2.html b/layout/generic/crashtests/1520798-2.html
new file mode 100644
index 0000000000..83a27ab4ca
--- /dev/null
+++ b/layout/generic/crashtests/1520798-2.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<head>
+ <script>
+ function go() {
+ document.getElementById("tweakMe").style.overflowAnchor = "none";
+ }
+ </script>
+</head>
+<body onload="go()">
+ <div style="position:fixed">
+ <div id="tweakMe">Hi</div>
+ </div>
+</body>
diff --git a/layout/generic/crashtests/1528771.html b/layout/generic/crashtests/1528771.html
new file mode 100644
index 0000000000..40357f791e
--- /dev/null
+++ b/layout/generic/crashtests/1528771.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+ <style>
+ * {
+ display: inline-grid;
+ grid-template-columns: repeat(9999, minmax(1%, 25054ex) minmax(1%, 2%) 1px) repeat(auto-fit, minmax(1%, 2%));
+ }
+ </style>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1539656.html b/layout/generic/crashtests/1539656.html
new file mode 100644
index 0000000000..7d4ac06948
--- /dev/null
+++ b/layout/generic/crashtests/1539656.html
@@ -0,0 +1,14 @@
+<script>
+document.addEventListener("DOMContentLoaded", function() {
+ var o=document.getElementById('b');
+ o.parentNode.removeChild(o);
+ window.frames[0].document.body.appendChild(document.getElementById('a'));
+})
+</script>
+<ol>
+<li>
+<table id='a'>
+</table>
+<iframe></iframe>
+</li>
+<ul id='b'>
diff --git a/layout/generic/crashtests/1542441.html b/layout/generic/crashtests/1542441.html
new file mode 100644
index 0000000000..8b9644edf5
--- /dev/null
+++ b/layout/generic/crashtests/1542441.html
@@ -0,0 +1,37 @@
+<style>
+.multicol-a {
+ width: 300px;
+ column-width: 100px;
+ column-gap: 0;
+ height: 100px;
+}
+.multicol-b {
+ border: 1px solid silver;
+ width: 200px;
+ column-width: 51px;
+ column-gap: 0;
+ height: 50px;
+}
+
+.step {
+ height: 1px;
+}
+.float-L {
+ width: 1px;
+ height: 1px;
+ float: left;
+}
+.float-R {
+ width: 1px;
+ height: 26px; /* 25 -> 26 crash */
+}
+</style>
+
+<div class="multicol-a">
+ <div class="float-R"></div>
+ <div class="multicol-b">
+ <div class="step"></div>
+ <div class="float-L"></div>
+ </div>
+</div>
+
diff --git a/layout/generic/crashtests/1543140-1.html b/layout/generic/crashtests/1543140-1.html
new file mode 100644
index 0000000000..010316c796
--- /dev/null
+++ b/layout/generic/crashtests/1543140-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ * {
+ overflow: auto;
+ perspective: 1px;
+ padding-inline: 50000ex;
+ margin: inherit;
+ font-size-adjust: 30000 !important;
+ direction: rtl;
+ }
+ #id_0 {
+ inline-size: 1%;
+ position: absolute;
+ }
+ </style>
+
+</head>
+<body>
+<wbr id="id_0"/>
+<wbr/>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1544060-1.html b/layout/generic/crashtests/1544060-1.html
new file mode 100644
index 0000000000..87fc333f7b
--- /dev/null
+++ b/layout/generic/crashtests/1544060-1.html
@@ -0,0 +1,3 @@
+<html>
+<body hidden style="scroll-snap-type:both proximity!important">
+</html>
diff --git a/layout/generic/crashtests/1544060-2.html b/layout/generic/crashtests/1544060-2.html
new file mode 100644
index 0000000000..17db889e64
--- /dev/null
+++ b/layout/generic/crashtests/1544060-2.html
@@ -0,0 +1 @@
+<html hidden style="scroll-snap-type:both proximity!important"></html>
diff --git a/layout/generic/crashtests/1553824.html b/layout/generic/crashtests/1553824.html
new file mode 100644
index 0000000000..afa0fb0a8e
--- /dev/null
+++ b/layout/generic/crashtests/1553824.html
@@ -0,0 +1,86 @@
+<body onload="test()">
+<script>
+function test() {
+ document.body.offsetWidth;
+ let grid = document.querySelector(".container");
+ grid.style = "grid-template-columns:none";
+}
+</script>
+
+<style>
+body {
+ font: 1.2em Arial, Verdana, sans-serif;
+ background-color: #fff;
+}
+
+.container {
+ display: grid;
+ gap: 10px;
+ grid-template-columns: 1fr 1fr 1fr 1fr;
+ grid-template-rows: auto auto auto;
+}
+
+header,
+footer,
+aside,
+li,.box {
+ background-color: rgb(120, 70, 123);
+ border: 5px solid rgb(88, 55, 112);
+ color: #fff;
+ border-radius: 5px;
+ padding: 20px;
+}
+
+aside {
+ grid-row: 1 / -1;
+ grid-column: 1;
+}
+
+header {
+ grid-column: 2 / -2;
+}
+
+ul {
+ gap: 10px;
+ grid-row: 2;
+ grid-column: 2 / -1;
+ margin: 0;
+ padding: 0;
+ list-style: none;
+ display: grid;
+ grid-template-columns: subgrid;
+}
+
+footer {
+ grid-row: 3;
+ grid-column: 2 / -1;
+}
+
+.box {
+ grid-column: -2;
+ grid-row:1;
+}
+
+</style>
+
+
+<div class="container">
+ <header>This is my header</header>
+ <div class="box"></div>
+ <aside>I should stretch from the top to the bottom of the grid</aside>
+ <ul>
+ <li>A</li>
+ <li>B</li>
+ <li>C</li>
+ <li>D</li>
+ <li>E</li>
+ <li>F</li>
+ <li>G</li>
+ <li>H</li>
+ <li>I</li>
+ <li>J</li>
+ <li>K</li>
+ </ul>
+ <footer>I am a footer</footer>
+</div>
+
diff --git a/layout/generic/crashtests/1554824.html b/layout/generic/crashtests/1554824.html
new file mode 100644
index 0000000000..ba5dd26da0
--- /dev/null
+++ b/layout/generic/crashtests/1554824.html
@@ -0,0 +1,25 @@
+<style>
+* {
+ min-height: 4em;
+ height: 0.238em;
+ white-space: pre;
+ column-width: 0em;
+ -webkit-transform-style: preserve-3d;
+}
+</style>
+<script>
+function go() {
+ a.after("x")
+}
+</script>
+</head>
+<body onload=go()>
+a
+<a style="direction: rtl">
+</a>
+</pre>
+<ul>
+<li id="a">
+</ul>
+</canvas>
+</font>
diff --git a/layout/generic/crashtests/1555142.html b/layout/generic/crashtests/1555142.html
new file mode 100644
index 0000000000..20c371bfea
--- /dev/null
+++ b/layout/generic/crashtests/1555142.html
@@ -0,0 +1,15 @@
+<style>
+#a {
+ display: -webkit-inline-box;
+ -webkit-box-orient: vertical;
+ -webkit-line-clamp: 1;
+ width: 0;
+}
+span {
+ display: inline-block;
+ width: 10px;
+ height: 10px;
+}
+</style>
+<body onload="b.remove()">
+<div id="a"><span id="b"></span>x</div>
diff --git a/layout/generic/crashtests/1560349.html b/layout/generic/crashtests/1560349.html
new file mode 100644
index 0000000000..a2cfe2c032
--- /dev/null
+++ b/layout/generic/crashtests/1560349.html
@@ -0,0 +1,12 @@
+<style>
+ #id_0 {
+ grid-template-rows: [ line_name_37 ] repeat(18022, [ line_name_38 ] 60% [ line_name_39 line_name_40 line_name_41 ] minmax(max-content, 24ex) [ line_name_42 ]) [ line_name_43 ] repeat(auto-fit, [ line_name_44 ] minmax(61%, min-content) [ line_name_45 line_name_46 ]) [ line_name_47 ] minmax(min-content, 25%) [ line_name_48 ];
+ }
+
+ .class_0 {
+ grid-row-end: line_name_19;
+ display: inline-grid;
+ }
+</style>
+<ol class="class_0" id="id_0">
+ <li class="class_0">
diff --git a/layout/generic/crashtests/1560397-2.html b/layout/generic/crashtests/1560397-2.html
new file mode 100644
index 0000000000..6e9305189e
--- /dev/null
+++ b/layout/generic/crashtests/1560397-2.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+ <style>
+
+ .class_2, .class_3 {
+ display: inline-grid;
+ grid: repeat(3, 6%) repeat(1, minmax(1em, 3%))/repeat(1, auto);
+ grid-row: i;
+ grid-auto-columns: 1px;
+ }
+ .class_2 {
+ grid-column: span 999999;
+ grid-template-columns: subgrid repeat(99999, [a]) repeat(auto-fill,[b]);
+ }
+ </style>
+</head>
+<body>
+<big class="class_3">
+ <em class="class_2">
+ <x style="grid-column:b">A</x>
+ <x style="grid-column:a -1">A</x>
+ </em>
+</big>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1560397.html b/layout/generic/crashtests/1560397.html
new file mode 100644
index 0000000000..416616d3bd
--- /dev/null
+++ b/layout/generic/crashtests/1560397.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+ <style>
+ BIG, .class_2 {
+ position: fixed;
+ rotate: 4.201792242287117rad z;
+ }
+
+ .class_2, .class_3 {
+ display: inline-grid;
+ grid: repeat(25976, 2vh) repeat(auto-fit, minmax(0, max-content)) repeat(3, 6%) repeat(1, minmax(1em, 3%))/repeat(1, auto);
+ grid-row: i
+ }
+ </style>
+</head>
+<body>
+<big class="class_3">
+ <em class="class_2"></em>
+</big>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1562105.html b/layout/generic/crashtests/1562105.html
new file mode 100644
index 0000000000..cc0a8eb98e
--- /dev/null
+++ b/layout/generic/crashtests/1562105.html
@@ -0,0 +1,6 @@
+<script>
+document.addEventListener("DOMContentLoaded", function(){
+ document.documentElement.hidden = 'true'
+ window.scrollBy(9, 13)
+})
+</script>
diff --git a/layout/generic/crashtests/1563131.html b/layout/generic/crashtests/1563131.html
new file mode 100644
index 0000000000..086cc9e12d
--- /dev/null
+++ b/layout/generic/crashtests/1563131.html
@@ -0,0 +1,17 @@
+<style>
+#c {
+ margin-right: 24vmin;
+}
+#b {
+ column-count: 1;
+ max-width: 18%;
+ writing-mode: tb;
+}
+#a {
+ translate: 0px 9px 0px;
+ white-space: pre-line;
+}
+</style>
+<fieldset id="a">
+<fieldset id="b">
+<select id="c">a</select>
diff --git a/layout/generic/crashtests/1568001-1.html b/layout/generic/crashtests/1568001-1.html
new file mode 100644
index 0000000000..b60ab99437
--- /dev/null
+++ b/layout/generic/crashtests/1568001-1.html
@@ -0,0 +1,19 @@
+<style>
+* {
+ margin: 69;
+ width: 1vw;
+ font-size: 0.002rem;
+ height: 0;
+ columns: 9px;
+ column-span: all;
+}
+</style>
+<script>
+window.onload = () => {
+ a.click()
+}
+</script>
+<t>
+<br style="margin: auto 1"></br>
+<details style="display: -webkit-inline-flex">
+<summary id="a">
diff --git a/layout/generic/crashtests/1568001-2.html b/layout/generic/crashtests/1568001-2.html
new file mode 100644
index 0000000000..5679d12b8f
--- /dev/null
+++ b/layout/generic/crashtests/1568001-2.html
@@ -0,0 +1,13 @@
+<style>
+* {
+ margin: 69px;
+ width: 1vw;
+ font-size: 0;
+ height: 0;
+ columns: 9px;
+ column-span: all;
+}
+</style>
+
+<br style="margin: auto 1"><br>
+<div>
diff --git a/layout/generic/crashtests/1569639.html b/layout/generic/crashtests/1569639.html
new file mode 100644
index 0000000000..88e50aa58c
--- /dev/null
+++ b/layout/generic/crashtests/1569639.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+ <style>
+ #id_0 {
+ display: inline-grid;
+ grid-template-rows: [ l0 ] repeat(58321, [ l1 ] minmax(26571ch, max-content) [ l2 ]) [ l3 ] repeat(auto-fill, [ l4 l5 ] minmax(min-content, 46.15128007109454em) [ l6 ])
+ }
+ </style>
+</head>
+<body>
+ <abbr id="id_0"></abbr>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1571239.html b/layout/generic/crashtests/1571239.html
new file mode 100644
index 0000000000..bf0bccd586
--- /dev/null
+++ b/layout/generic/crashtests/1571239.html
@@ -0,0 +1,22 @@
+<style>
+.b {
+ font-size: 0.0136in;
+ writing-mode: tb;
+}
+* {
+ column-count: 7;
+ width: 7pt;
+}
+</style>
+<script>
+function go() {
+ a.style.setProperty("column-span", "all")
+}
+</script>
+<body onload=go()>
+<q>
+<ins class="b">
+<pre></pre>
+<q id="a">A</q>
+</ins>
+<!-- a -->
diff --git a/layout/generic/crashtests/1571460.html b/layout/generic/crashtests/1571460.html
new file mode 100644
index 0000000000..fc662faaaa
--- /dev/null
+++ b/layout/generic/crashtests/1571460.html
@@ -0,0 +1,29 @@
+<html>
+<head>
+ <style>
+ BDO {
+ shape-outside: url(data:image/bmp;base64,Qk0IBQAAAAAAAGoBAAAoAAAAIAAAACAAAAABAAgAAQAAAJ4DAADDDgAAww4AAE0AAABNAAAAAAAAAP///wBAIMAAQCCgAEAA4ABAAMAAQCCAAEAAoACAAKAAgACAAIAggACAAGAAgCBgAMAAYACAQGAAwABAAIAgQADAIEAAwAAgAP8AAADAICAAgEBAAMAgAADAQCAAwEAAAIBAIADAYAAAgGBAAIBgIACAYAAAgIAAAICAIABAoAAAQMAAAECAIABAoCAAQMAgAAD/AABAoEAAQIBAAEBgQAAA4CAAAOBAAADAQAAA4GAAAMBgAECAYAAAoGAAAOCgAACAYAAAwKAAAODAAAD//wAA4OAAAMDAAACAgABAYGAAAMDgAACAoAAAYIAAAKDgAACAwAAAYKAAAIDgAABgwABAYIAAAGDgAABAoAAAQMAAAEDgAAAgwAAAIOAAAAD/AEBAoABAQIAAQEBgAP///wAESAAFBAQFBQUABAcBCAQJAAQLCwsNBA8ABhISExMTEwAABEgBBAEEBAUABAcHBwgECQAECwsLDQQPAAYSEhITExMAAAAKSEhIR0dHAgIFAgQDBAoADgwMDBAPERERFBQUFhMTAAABSAFIBEcABEYCAgIEAwAMBgYKCgwMDBAQEBERBBQBFgETAAAGRwAERkYCAgQDAAQGBgoKBAwABBAQEREEFAIWAAAACkdHRUdHR0ZGRgIEAwAEBgYGCgQMAAQQEBARBBQCFgAABkUABEZEREQESQRKBA4EFQQXAhgAAAZFAAhERERDQ0lJSQRKAANLDg4ABRUABhkXFxgYGAAABkUERAAEQ0NJSQRKAARLSw4OBBUABhkZFxcYGAAABkUERAAHQ0NDSUpKSgAESwEOBBUABhkZGRgaGAAABkIEQAAEQz4+PgRBAARLODg4BBsABhkcHBwaGgAABkIEQAQ+AAQ7QUFBBDgABCgbGxsEHAEdARoAAAZCBEAEPgAEOztBQQQ4AAQoKBsbBBwCHQAABkIAB0BAQD0+Oj4ABDsBQQQ4AAQoKCgbBBwCHQAABj8EPQQ6BDcELgAKJygnKCIfHx8eHgAABj8EPQQ6BDcAAzEuLgAEJwAHIiIfHx4eHgAAAAAEPDw/PAQ/AAU9PTo9OgAENwAEMTExLgQnAAciIiIfHh4eAAAABDwEPwQ9BDcEMQAMLycnJyYiIiIjHh4eAAAEPAAEPzk/PwQ9AAQ2Nzc3BDEADC8vLycmJiIiIyMeHgAAABM8PDk8Pz8/PT82PT03NzcyMTExAAQvAAkmJiMmIiAjIyMAAAAAAzk5PAAFOQAYPTY2NjIyNzIyLS0tKysvKyYjJiMgICMgAAAIOQQ2BDIELQUrAAcjIyMgICAgAAAACTkAAzY2NgAEMgQtBysABSMkJCQgAAAAACA5NTk1OTk5MzY2MzYwNjIsLSwtLSorKyorKyshIyEkIAAAACA1OTU5NTU5NTM2MzYwMDIwLSwsLSwqKyorKSsrISEhIQAACDUAAzMzMwAFMAQsBCoFKQMhAAABNQE0BzUEMwQwAAMsLCwABCoGKQIhAAABNAc1BDMAAzAwMAAFLAQqCCkAAAQ0BDUEMwQwBCwEKgQpAAQlJSklAAAENAQ1AAMzMzMABTAAAywsLAAFKgQpBCUAAAU0BDUEMwQwBCwEKgAHKSkpJSUlJQAAAAQ0BDUEMwQwBCwEKgQpBCUAAQ==) ! important;
+ }
+
+ *, TITLE {
+ columns: 57 ! important;
+ }
+ </style>
+ <script>
+ function start () {
+ document.body.offsetTop;
+ const style = document.createElement('style')
+ document.head.appendChild(style)
+ style.sheet.insertRule('*{ float: left!important }', 0)
+ }
+
+ window.addEventListener('load', start)
+ </script>
+</head>
+<bdo>
+ f蓜𖹽𖻄ð…»ó ™³-=‌ð©¬Û°ó ¯â˜†AÛ¹âŸ*á©¿RÛ°ð¨£áð†«ð‡½ð¢ “ð…¯ð…¨ð‰‚
/ð¿Ž8é´£ÌÍ៞𪜎٩Ⱥ-ðŸã‚š0𯴘​󠱧n‪ðº¹ó °§9𯵙壆녩٪㫙ð‰ƒð‘“ A٫𧲨𯌭󠂉𩾃󠓕0è• ð‘«¢7𯕔0%=/*
+ <abbr>
+ <i> ÍŒ?𛩰𥴠剘٩𖷕٩á·A߭ 󠠟+=𛔯]ó ¹¢vك𠩒🻆ð–¹ð¹êšó ž ó ª ð¯¨Žà¯Œy</i>
+ </abbr>
+</bdo>
+</html>
diff --git a/layout/generic/crashtests/1571598.html b/layout/generic/crashtests/1571598.html
new file mode 100644
index 0000000000..0096a8252d
--- /dev/null
+++ b/layout/generic/crashtests/1571598.html
@@ -0,0 +1,14 @@
+<style>
+* {
+ width: 66%;
+ quotes: none;
+ padding-right: 1px;
+ column-width: 0;
+}
+</style>
+<menuitem>A</menu>
+<font style="writing-mode: sideways-rl">
+<link>
+<data>A</command>
+</font>
+<q>
diff --git a/layout/generic/crashtests/1571897.html b/layout/generic/crashtests/1571897.html
new file mode 100644
index 0000000000..af7b9d4a7a
--- /dev/null
+++ b/layout/generic/crashtests/1571897.html
@@ -0,0 +1,15 @@
+<style>
+#a {
+ font-size: 0.013em;
+ max-height: 1px;
+ padding-top: 94vw;
+}
+* {
+ word-break: break-all;
+ columns: 0px;
+}
+:root {
+ display: -webkit-inline-box;
+}
+</style>
+<menu id="a">AAAA</menu>
diff --git a/layout/generic/crashtests/1572901.html b/layout/generic/crashtests/1572901.html
new file mode 100644
index 0000000000..72317955dc
--- /dev/null
+++ b/layout/generic/crashtests/1572901.html
@@ -0,0 +1,19 @@
+<style id="a">
+* {
+ font: 0px/0px serif;
+ columns: 0;
+ display: inherit;
+}
+</style>
+<script>
+function go() {
+ a.appendChild(b)
+}
+</script>
+<body onload=go()>
+<details style="height: 1vw; display: inline" open="">
+<summary></br>
+<s dir="">
+<svg>
+</summary>
+<optgroup id="b">
diff --git a/layout/generic/crashtests/1573216.html b/layout/generic/crashtests/1573216.html
new file mode 100644
index 0000000000..3be0921533
--- /dev/null
+++ b/layout/generic/crashtests/1573216.html
@@ -0,0 +1,20 @@
+<style>
+body::first-letter {}
+#c { display: initial }
+* {
+ columns: 0;
+ contain: size layout;
+ writing-mode: vertical-rl
+}
+</style>
+<script>
+function go() {
+ a.size = "0"
+ var x = b.offsetWidth
+ document.title = "a"
+}
+</script>
+<body onload=go()>
+<title id="c">A</title>
+<hr id="b">
+<font id="a">
diff --git a/layout/generic/crashtests/1574552.html b/layout/generic/crashtests/1574552.html
new file mode 100644
index 0000000000..8a29aeb80d
--- /dev/null
+++ b/layout/generic/crashtests/1574552.html
@@ -0,0 +1,6 @@
+<style>
+* { float: right }
+</style>
+<ruby>
+<table>
+A
diff --git a/layout/generic/crashtests/1574993.html b/layout/generic/crashtests/1574993.html
new file mode 100644
index 0000000000..c41761674a
--- /dev/null
+++ b/layout/generic/crashtests/1574993.html
@@ -0,0 +1,21 @@
+<style>
+* {
+ font: 0px/0px serif;
+ columns: 0;
+ display: inherit;
+}
+.x {
+ height: 1vw;
+ display: inline;
+}
+</style>
+<script>
+function go() {
+ a.prepend(null)
+}
+</script>
+<body onload=go()>
+<details class="x" open="">
+<s dir="rtl">
+<table id="a">
+<svg></svg>
diff --git a/layout/generic/crashtests/1582019.html b/layout/generic/crashtests/1582019.html
new file mode 100644
index 0000000000..9486c44a6f
--- /dev/null
+++ b/layout/generic/crashtests/1582019.html
@@ -0,0 +1,22 @@
+<style>
+.x {
+ font-family: serif;
+ max-width: 0vmin;
+ top: 1vh
+}
+* {
+ border-right: blue 1px solid;
+ column-count: 9;
+}
+#a {
+ column-span: all;
+}
+#b {
+ position: relative;
+</style>
+<h6 id="a">C</h6>
+<l>q
+p f
+<pre id="b" wrap>
+<dialog style="word-break:break-all" open class="x">Cp</pre>
+<q>6/N_s/"eve"
diff --git a/layout/generic/crashtests/1586470.html b/layout/generic/crashtests/1586470.html
new file mode 100644
index 0000000000..5ba0af8380
--- /dev/null
+++ b/layout/generic/crashtests/1586470.html
@@ -0,0 +1,9 @@
+<style>
+.a {
+ max-height: 0vw;
+ writing-mode: vertical-rl;
+ box-decoration-break: clone
+}
+</style>
+<dl style="column-width:3em">
+<dd class="a" dir="RTL">A</dd>
diff --git a/layout/generic/crashtests/1588955-very-large-frameset.html b/layout/generic/crashtests/1588955-very-large-frameset.html
new file mode 100644
index 0000000000..17568ffbda
--- /dev/null
+++ b/layout/generic/crashtests/1588955-very-large-frameset.html
@@ -0,0 +1,9 @@
+<style>
+* { scale: 64 }
+</style>
+<script>
+window.onload = () => {
+ a.appendChild(document.createElement("frameset"))
+}
+</script>
+<ol id="a">
diff --git a/layout/generic/crashtests/1590569.html b/layout/generic/crashtests/1590569.html
new file mode 100644
index 0000000000..c3243532e5
--- /dev/null
+++ b/layout/generic/crashtests/1590569.html
@@ -0,0 +1,24 @@
+<style>
+html {
+ word-wrap: break-word;
+ contain: size layout;
+ columns: 0;
+}
+</style>
+<script>
+function go() {
+ window.scrollBy()
+ a.insertCell(0)
+}
+</script>
+<video height="0"></video>
+<datalist></datalist>
+<map>
+<ol style="height: 4vmin">
+A-A A
+</li>
+</ol>
+<style onload="go()"></style>
+<marquee></marquee>
+<table>
+<tr id="a">&gt;AAAA</tr>
diff --git a/layout/generic/crashtests/1596310.html b/layout/generic/crashtests/1596310.html
new file mode 100644
index 0000000000..3d471046b2
--- /dev/null
+++ b/layout/generic/crashtests/1596310.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="reftest-paged">
+<head>
+ <style>
+@page { size:5in 3in; margin:0; }
+html,body { padding:0; margin:0; height:100%; }
+div {
+ margin-bottom: 1em;
+ height: 100%;
+ page-break-after: always;
+}
+</style>
+</head>
+<body>
+ <div>A</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1601819-1.html b/layout/generic/crashtests/1601819-1.html
new file mode 100644
index 0000000000..2b63fc6c30
--- /dev/null
+++ b/layout/generic/crashtests/1601819-1.html
@@ -0,0 +1,11 @@
+<style>
+* {
+ page-break-before: left;
+ display: grid;
+}
+</style>
+<details style="column-width: 0em" open>
+<form>
+<fieldset>
+<x>
+<datalist>
diff --git a/layout/generic/crashtests/1608851-1.html b/layout/generic/crashtests/1608851-1.html
new file mode 100644
index 0000000000..2333a9b150
--- /dev/null
+++ b/layout/generic/crashtests/1608851-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+ <style>
+ * {
+ display: inline-grid;
+ position: fixed;
+ grid-template-columns: subgrid [ line_name_15 ];
+ scale: 38873 !important;
+ }
+ </style>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1608851-2.html b/layout/generic/crashtests/1608851-2.html
new file mode 100644
index 0000000000..73f9b055e5
--- /dev/null
+++ b/layout/generic/crashtests/1608851-2.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+ <style>
+ * {
+ display: inline-grid;
+ position: fixed;
+ grid-template-columns: subgrid [ line_name_15 ];
+ scale: 1 !important;
+ }
+ </style>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1613210.html b/layout/generic/crashtests/1613210.html
new file mode 100644
index 0000000000..bb45ce6d7e
--- /dev/null
+++ b/layout/generic/crashtests/1613210.html
@@ -0,0 +1,31 @@
+<html>
+<head>
+ <style>
+ #id_0 {
+ padding-block-end: 88%;
+ }
+
+ * {
+ columns: auto 5543 !important;
+ font-size: 196vh;
+ border-inline-end: outset 27314em hsla(224.63915115406618deg 47% 78% / 5%);
+ margin-bottom: 56%;
+ grid-template: none / subgrid [ line_name_1 line_name_2 ];
+ max-block-size: 39821vw;
+ border-style: dashed;
+ }
+
+ RUBY {
+ min-width: max-content;
+ display: block grid;
+ }
+ </style>
+</head>
+<body>
+<ruby>
+ <ruby id="id_0">
+ </ruby>
+ <rt></rt>
+</ruby>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1614101.html b/layout/generic/crashtests/1614101.html
new file mode 100644
index 0000000000..8490fb9c62
--- /dev/null
+++ b/layout/generic/crashtests/1614101.html
@@ -0,0 +1,44 @@
+<!DOCTYPE HTML>
+<!--
+ Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html class="reftest-wait"><head>
+ <meta charset="utf-8">
+ <title>Testcase for bug 1614101</title>
+ <style>
+ @keyframes w {
+ 0%, 33% { width:10% }
+ 33%, 50% { width:50% }
+ 50%, 99% { width:10% }
+ 99%, 100% { display:none }
+ }
+
+ .a {
+ column-count: 2;
+ width: 1%;
+ writing-mode: vertical-lr;
+ }
+ </style>
+</head>
+<body>
+
+ <div style="width:10%; border:solid; animation: w .01s infinite">
+ <span>
+ zzzzzzzz
+ <x class="a"><div style="height:30px">A <br> a <br> a <br> a <br> a <br> a <br> B</div></x>
+ <textarea style="width:10px"></textarea>y
+ <canvas>
+ </span>
+ </div>
+ <script>
+ function destroy() {
+ document.body.style.display = 'none';
+ document.documentElement.removeAttribute('class');
+ }
+
+ document.body.getBoundingClientRect();
+ setTimeout(destroy, 500)
+ </script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1618312.html b/layout/generic/crashtests/1618312.html
new file mode 100644
index 0000000000..b0cc32b427
--- /dev/null
+++ b/layout/generic/crashtests/1618312.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+ <style class=''>
+ DIV {
+ grid: subgrid repeat(7806, [ line_name_1 line_name_2 ]) / auto-flow dense minmax(min-content, 90fr)
+ }
+
+ * {
+ overflow: scroll;
+ position: absolute;
+ display: inline-grid !important;
+ }
+ </style>
+</head>
+<body>
+ó ­‰R5¿󠽿𓗺ð†­%/*3êš·ä늗𛸌󠂀󠥄J
+<div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1618564.html b/layout/generic/crashtests/1618564.html
new file mode 100644
index 0000000000..2eb619c82b
--- /dev/null
+++ b/layout/generic/crashtests/1618564.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<style>
+ * {
+ border-image-source: url(solidblue.gif);
+ }
+</style>
+<script>
+ window.addEventListener('load', () => {
+ const mtd = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'mtd')
+ document.documentElement.appendChild(mtd)
+ })
+</script>
diff --git a/layout/generic/crashtests/1625051-1.html b/layout/generic/crashtests/1625051-1.html
new file mode 100644
index 0000000000..78bf13616f
--- /dev/null
+++ b/layout/generic/crashtests/1625051-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<style>
+div { width: 150000px; }
+span {
+ display: grid;
+ min-width: min-content;
+ grid-template-columns: repeat(auto-fit, minmax(0%, auto));
+}
+</style>
+
+<span class="class3">
+ <div></div>
+</span>
diff --git a/layout/generic/crashtests/1625051-2.html b/layout/generic/crashtests/1625051-2.html
new file mode 100644
index 0000000000..2f9dfb557a
--- /dev/null
+++ b/layout/generic/crashtests/1625051-2.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<style>
+div { width: 150000px; }
+span {
+ display: grid;
+ min-width: min-content;
+ grid-template-columns: repeat(auto-fit, minmax(0%, auto) 1px);
+}
+</style>
+
+<span class="class3">
+ <div></div>
+</span>
diff --git a/layout/generic/crashtests/1626970.html b/layout/generic/crashtests/1626970.html
new file mode 100644
index 0000000000..96e59656c5
--- /dev/null
+++ b/layout/generic/crashtests/1626970.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+ <style>
+ * {
+ padding-block-end: 46% ! important;
+ }
+ </style>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ window.scrollByLines(536870912, {})
+ })
+ </script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1628804.html b/layout/generic/crashtests/1628804.html
new file mode 100644
index 0000000000..937a3474d1
--- /dev/null
+++ b/layout/generic/crashtests/1628804.html
@@ -0,0 +1,21 @@
+<style>
+.c {
+ box-decoration-break: clone;
+ padding-bottom: 41vmax;
+}
+</style>
+<script>
+go = () => {
+ try { b.appendChild(a) } catch(e) { }
+}
+</script>
+<body onload=go()>
+<button style="columns: 72 0px">
+<dl style="columns: 1">
+<dd>-</dd>
+<dt id="b" style="float: left" class="c">x</dt>
+</dl>
+<dl>
+<map id="a">
+<canvas></canvas>
+<details open="">x</details>
diff --git a/layout/generic/crashtests/1629575-1.html b/layout/generic/crashtests/1629575-1.html
new file mode 100644
index 0000000000..e8eaf3d250
--- /dev/null
+++ b/layout/generic/crashtests/1629575-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+ <style>
+ .grid-container {
+ display: grid;
+ /* Repeat auto-fill which is less than the number of elements in the grid. */
+ grid-template-columns: 1px 1px 1px 1px repeat(auto-fill, 1px 1px 1px);
+ width: 13px;
+ }
+ div > div {
+ /* Any name will work */
+ grid-column-start: x;
+ }
+ </style>
+ <div class="grid-container">
+ <div>x</div>
+ <div>y</div>
+ <div>z</div>
+ <div>w</div>
+ </div>
+</html>
diff --git a/layout/generic/crashtests/1629575-2.html b/layout/generic/crashtests/1629575-2.html
new file mode 100644
index 0000000000..e8b5df190a
--- /dev/null
+++ b/layout/generic/crashtests/1629575-2.html
@@ -0,0 +1,69 @@
+<!DOCTYPE html>
+<html><head>
+
+
+ <style>
+ .grid-container {
+ display: grid;
+ border: solid thick;
+ margin: 10px;
+ }
+
+ .columns {
+ grid-template-columns: repeat(auto-fill, 50px 50px);
+ grid-auto-rows: 25px;
+ grid-column-gap: 100px;
+ width: 300px;
+ }
+
+ .rows {
+ grid-auto-flow: column;
+ grid-template-rows: repeat(auto-fill, 50px 50px);
+ grid-auto-columns: 25px;
+ grid-row-gap: 100px;
+ width: min-content;
+ height: 300px;
+ }
+
+ .grid-container>div {
+ background: lime;
+ }
+ </style>
+
+<style>
+ div { grid-column-start: first;}
+</style>
+
+</head>
+
+<body>
+
+ <div class="grid-container columns">
+ <div></div>
+ <div></div>
+ <div></div>
+ <div></div>
+ </div>
+ <div class="grid-container columns"
+ style="grid-template-columns: repeat(auto-fill, 50px 50px 50px)">
+ <div></div>
+ <div></div>
+ <div></div>
+ <div></div>
+ </div>
+ <div class="grid-container columns"
+ style="grid-template-columns: repeat(auto-fill, 50px 50px 50px 50px)">
+ <div></div>
+ <div></div>
+ <div></div>
+ <div></div>
+ </div>
+ <div class="grid-container rows">
+ <div></div>
+ <div></div>
+ <div></div>
+ <div></div>
+ </div>
+
+
+</body></html>
diff --git a/layout/generic/crashtests/1630385.html b/layout/generic/crashtests/1630385.html
new file mode 100644
index 0000000000..2fcb2f155e
--- /dev/null
+++ b/layout/generic/crashtests/1630385.html
@@ -0,0 +1,26 @@
+<html class="reftest-wait">
+<script>
+window.setTimeout(() => {
+ try{ c.style.cssText="margin-top:78%" }catch(e){}
+ try{ b.style.cssText="padding-right:100em" }catch(e){}
+ try{ b.scrollIntoView() }catch(e){}
+ try{ b.setAttribute('style', "filter:opacity()drop-shadow(2px 8vmax hsl(2,9%,6%))opacity(") }catch(e){}
+ try{ b.scrollIntoView() }catch(e){}
+ try{ a.setAttribute('style', "") }catch(e){}
+ try{ a.offsetHeight }catch(e){}
+ try{ a.textContent="" }catch(e){}
+ setTimeout(() => {
+ document.documentElement.className = "";
+ }, 0)
+}, 0)
+</script>
+<style>
+:last-of-type {
+ overflow-y:clip;
+}
+</style>
+<body id='a'>
+e
+<samp id='b'>
+</samp>
+<canvas id='c'/>
diff --git a/layout/generic/crashtests/1633434.html b/layout/generic/crashtests/1633434.html
new file mode 100644
index 0000000000..8a60b2072c
--- /dev/null
+++ b/layout/generic/crashtests/1633434.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg')
+ svg.setAttribute('height', '6')
+ svg.setAttribute('width', '1pc')
+ document.documentElement.appendChild(svg)
+ svg.style.setProperty('height', '5%', undefined)
+ svg.width.baseVal.valueInSpecifiedUnits = 1.988164037240853e+38
+ })
+ </script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1633737-1.html b/layout/generic/crashtests/1633737-1.html
new file mode 100644
index 0000000000..d42258dc73
--- /dev/null
+++ b/layout/generic/crashtests/1633737-1.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+ <style>* {
+ grid-template: none/repeat(58, minmax(19443em, max-content) minmax(2vh, max-content)) repeat(auto-fill, 1vw minmax(3%, 1in)) 1px repeat(25817, minmax(25in, min-content))
+ </style>
+ <button style='display:inline-grid'></button>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1633737-2.html b/layout/generic/crashtests/1633737-2.html
new file mode 100644
index 0000000000..1e2274f8b4
--- /dev/null
+++ b/layout/generic/crashtests/1633737-2.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+ <style>
+div { grid-template-columns: 9919443em repeat(auto-fill, 1in 1in 1in) repeat(25817, 25in); }
+ </style>
+ <div style='display:inline-grid'></div>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1633737-3.html b/layout/generic/crashtests/1633737-3.html
new file mode 100644
index 0000000000..19fc6d78be
--- /dev/null
+++ b/layout/generic/crashtests/1633737-3.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<!--
+ any copyright is dedicated to the public domain.
+ http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html><head>
+ <title>Testcase for Bug 1633737</title>
+ <style>
+html,body {
+ color:black; background-color:white; font:15px/1 monospace; padding:0; margin:0;
+}
+
+.grid {
+ display: grid;
+ width: min-content;
+ grid-template-columns: repeat(9998,0) repeat(auto-fill, 5px 10px 15px 20px);
+ grid-auto-columns: 500px; /* should not be used */
+ border: 1px solid;
+ margin-bottom: 2px;
+}
+
+x { grid-column: 1 / foo; }
+
+ </style>
+</head>
+<body>
+
+<div class="grid"><x></x></div>
+<script>
+ document.body.offsetHeight;
+ window.getComputedStyle(document.querySelectorAll('.grid')[0]).gridTemplateColumns;
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1633737-4.html b/layout/generic/crashtests/1633737-4.html
new file mode 100644
index 0000000000..804837dce5
--- /dev/null
+++ b/layout/generic/crashtests/1633737-4.html
@@ -0,0 +1,53 @@
+<!DOCTYPE HTML>
+<!--
+ Any copyright is dedicated to the Public Domain.
+ http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html><head>
+ <title>Testcase for Bug 1633737</title>
+ <style>
+html,body {
+ color:black; background-color:white; font:15px/1 monospace; padding:0; margin:0;
+}
+
+.grid {
+ display: grid;
+ width: min-content;
+ grid-auto-columns: 500px; /* should not be used */
+ border: 1px solid;
+ margin-bottom: 2px;
+}
+
+x { grid-column: 1 / foo; }
+
+ </style>
+</head>
+<body>
+
+<script>
+const MAX_LINE_NUMBER = 10000;
+const sz = ["5px", "10px", "15px", "20px", "25px"];
+const cols = [9997, 9998, 9999, 10000, 10001];
+for (let len = 1; len <= sz.length; ++len) {
+ for (const c of cols) {
+ if (c + len + 1 < MAX_LINE_NUMBER) {
+ continue;
+ }
+ let grid = document.createElement("div");
+ grid.className = "grid";
+ let s = "repeat(" + c + ",0) " + "repeat(auto-fill,";
+ for (let i = 0; i < len; ++i) {
+ s += " " + sz[i];
+ }
+ s += ")";
+ grid.style.gridTemplateColumns = s;
+ console.log(s);
+ let item = document.createElement("x");
+ grid.appendChild(item);
+ document.body.appendChild(grid);
+ }
+}
+</script>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/1633737-5.html b/layout/generic/crashtests/1633737-5.html
new file mode 100644
index 0000000000..889a53836a
--- /dev/null
+++ b/layout/generic/crashtests/1633737-5.html
@@ -0,0 +1,39 @@
+<!DOCTYPE HTML>
+<!--
+ any copyright is dedicated to the public domain.
+ http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<html><head>
+ <title>Testcase for Bug 1633737</title>
+ <style>
+html,body {
+ color:black; background-color:white; font:15px/1 monospace; padding:0; margin:0;
+}
+
+.grid {
+ display: grid;
+ width: min-content;
+ grid-template-columns: repeat(9998,0) repeat(auto-fit, 5px [b] 10px [c] 15px [d] 20px [e] 25px);
+ grid-auto-columns: 500px; /* should not be used */
+ border: 1px solid;
+ margin-bottom: 2px;
+}
+
+x { grid-column: b / e; }
+
+ </style>
+</head>
+<body>
+
+<div class="grid"><x style="grid-column: b / e"></x></div>
+<div class="grid"><x style="grid-column: 1 / e"></x></div>
+<div class="grid"><x style="grid-column: c / foo"></x></div>
+<div class="grid"><x style="grid-column: b / d"></x></div>
+<script>
+ document.body.offsetHeight;
+ document.querySelectorAll('.grid').forEach(function(grid){
+ window.getComputedStyle(grid).gridTemplateColumns;
+ });
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1633828.html b/layout/generic/crashtests/1633828.html
new file mode 100644
index 0000000000..f0db68e853
--- /dev/null
+++ b/layout/generic/crashtests/1633828.html
@@ -0,0 +1,36 @@
+<script>
+var limit = 0
+function go() {
+ part1()
+ part1()
+ window.find("foo",true,true,true,true,false)
+}
+function part2() {
+ if(++limit > 2) { return; }
+ g.appendChild(a)
+ d.insertAdjacentText("afterEnd", "foo")
+ f.addEventListener("DOMAttrModified", () => {
+ window.getSelection().deleteFromDocument()
+ b.select()
+ })
+}
+function part1() {
+ var x = window.getSelection()
+ g.appendChild(c)
+ g.addEventListener("DOMSubtreeModified", part2)
+ c.border = "1"
+ document.createElement("rp").prepend(x.focusNode)
+ window.find("foo")
+ a.value = ""
+ x.collapseToEnd()
+}
+</script>
+<body onload=go()>
+<button id="a"></button>
+<li>
+<textarea id="b"></textarea>
+</li>
+<image id="c"></image>
+<br id="d">
+<font id="f">
+<font id="g">
diff --git a/layout/generic/crashtests/1638860-1.html b/layout/generic/crashtests/1638860-1.html
new file mode 100644
index 0000000000..6d9e0ddfcf
--- /dev/null
+++ b/layout/generic/crashtests/1638860-1.html
@@ -0,0 +1,24 @@
+<html>
+<body>
+ <style>
+ html {
+ -moz-transform-style: preserve-3d;
+ }
+ div,html {
+ display: inline-grid;
+ grid-template-columns: subgrid;
+ }
+ div {
+ position: fixed;
+ }
+ </style>
+ <script>
+ window.addEventListener('load', () => {
+ const div = document.createElementNS('http://www.w3.org/1999/xhtml', 'div')
+ const text = document.createTextNode('BAR')
+ div.appendChild(text)
+ document.documentElement.appendChild(div)
+ })
+ </script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1638860-2.html b/layout/generic/crashtests/1638860-2.html
new file mode 100644
index 0000000000..a04861a662
--- /dev/null
+++ b/layout/generic/crashtests/1638860-2.html
@@ -0,0 +1,26 @@
+<html>
+<body>
+ <style>
+ div {
+ position: relative;
+ }
+ span,div {
+ display: inline-grid;
+ grid-template-columns: subgrid;
+ }
+ span {
+ position: absolute;
+ }
+ </style>
+ <script>
+ window.addEventListener('load', () => {
+ const span = document.createElementNS('http://www.w3.org/1999/xhtml', 'span')
+ const text = document.createTextNode('BAR')
+ span.appendChild(text)
+ const div = document.getElementsByTagName('div')[0];
+ div.appendChild(span)
+ })
+ </script>
+<div>FOO</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1638906.html b/layout/generic/crashtests/1638906.html
new file mode 100644
index 0000000000..39b65e32f4
--- /dev/null
+++ b/layout/generic/crashtests/1638906.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+ <style>
+ *, LI {
+ display: inline-grid;
+ grid-row: line_name_1 / auto;
+ }
+ HTML {
+ scale: -102 63;
+ }
+ * {
+ grid: subgrid [ line_name_5 ] / auto-flow dense fit-content(40%);
+ }
+ </style>
+
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const style = document.createElement('style')
+ document.head.appendChild(style)
+ const sheet = style.sheet
+ sheet.addRule('script', 'position:absolute!important', (820656062 % sheet.cssRules.length))
+ })
+ </script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1640028.html b/layout/generic/crashtests/1640028.html
new file mode 100644
index 0000000000..6ada5791d3
--- /dev/null
+++ b/layout/generic/crashtests/1640028.html
@@ -0,0 +1,31 @@
+<style>
+* {
+ column-width: 15em;
+ display: flex;
+}
+#a {
+ writing-mode: tb;
+ display: inline-grid;
+ font-size-adjust: 5;
+}
+</style>
+<script>
+window.onload = () => {
+ b.align = "ABSMIDDLE"
+ c.scrollBy(0.6938726108254376,0.19469668495287307)
+ d.insertCell(1)
+}
+</script>
+<data id="a">
+<details style="width: 0pt">
+<summary style="max-width: 0vh">
+<table>
+<tr id="d">
+<th></th>
+<col id="b">
+</table>
+aaaaaa
+aaaaaaaaaaaaa
+</details>
+aaaaaaaaaaaaaaaaaaaa
+<fePointLight id="c">
diff --git a/layout/generic/crashtests/1640051.html b/layout/generic/crashtests/1640051.html
new file mode 100644
index 0000000000..b9766b459b
--- /dev/null
+++ b/layout/generic/crashtests/1640051.html
@@ -0,0 +1,20 @@
+<style>
+* {
+ column-width: 0em;
+ font-weight: bold;
+ overflow-wrap: break-word
+}
+</style>
+<script>
+window.onload = () => {
+ a.style.setProperty("display", "flex")
+}
+</script>
+<time>AAAAAAAAAAAAAAAAAA</time>
+<content style="font-size: large">AAAAAAAAAAAAAA</content>
+<layer>AAAAAAAAAAA</layer>
+<pre id="a" wrap="">
+<dir>
+<li>AAAAAAAAAAAAAAA</li>
+</pre>
+<svg>
diff --git a/layout/generic/crashtests/1640275.html b/layout/generic/crashtests/1640275.html
new file mode 100644
index 0000000000..a28d08d981
--- /dev/null
+++ b/layout/generic/crashtests/1640275.html
@@ -0,0 +1,14 @@
+<style>
+* {
+ display: -webkit-inline-flex;
+ margin-top: 7vw;
+ column-count: 6;
+}
+</style>
+<script>
+window.onload = () => {
+ document.createElement("select").add(a)
+}
+</script>
+<details open="true"><datalist>
+<option id="a">
diff --git a/layout/generic/crashtests/1644819.html b/layout/generic/crashtests/1644819.html
new file mode 100644
index 0000000000..b08a411835
--- /dev/null
+++ b/layout/generic/crashtests/1644819.html
@@ -0,0 +1,20 @@
+<style>
+#x {
+ -webkit-user-select: none;
+ word-break: break-word;
+ width: 0vh;
+ -webkit-perspective: 89px;
+ display: flex;
+ height: 1ch;
+}
+</style>
+<script>
+window.onload = () => {
+ document.execCommand("selectAll");
+ document.execCommand("selectAll");
+ document.execCommand("backColor", false, "r");
+ document.execCommand("superscript");
+}
+</script>
+<dl style="columns:1px">
+<dt id="x" contenteditable>aaa</dt>
diff --git a/layout/generic/crashtests/1645549-1.html b/layout/generic/crashtests/1645549-1.html
new file mode 100644
index 0000000000..647373800d
--- /dev/null
+++ b/layout/generic/crashtests/1645549-1.html
@@ -0,0 +1,19 @@
+<style>
+#a {
+ display: flex;
+ flex-flow: column-reverse;
+}
+:not(wbr) {
+ column-width: 1px;
+}
+</style>
+<script>
+window.onload = () => {
+ a.insertBefore(b, a.childNodes[0])
+ document.documentElement.style.display = "none"
+ document.documentElement.getBoundingClientRect()
+ document.documentElement.style.display = ""
+}
+</script>
+<label id="a">x</label>
+<details id="b">
diff --git a/layout/generic/crashtests/1648577.html b/layout/generic/crashtests/1648577.html
new file mode 100644
index 0000000000..f2244a56c1
--- /dev/null
+++ b/layout/generic/crashtests/1648577.html
@@ -0,0 +1,18 @@
+<style>
+#a {
+ flex-wrap: wrap-reverse;
+ float: right;
+ display: inline-flex;
+}
+#b {
+ order: 4;
+ break-after: page;
+}
+body:last-child {
+ columns: 1px;
+}
+</style>
+<time id="a">
+<video></video>
+<ol id="b"></ol>
+<link>x</link>
diff --git a/layout/generic/crashtests/1652618.html b/layout/generic/crashtests/1652618.html
new file mode 100644
index 0000000000..385c18ee62
--- /dev/null
+++ b/layout/generic/crashtests/1652618.html
@@ -0,0 +1,15 @@
+<style>
+* {
+ float: left !important;
+ all: initial;
+ block-size: 247ch;
+ columns: 251ch auto;
+}
+</style>
+<script>
+window.addEventListener('load', () => {
+ var x = document.createElementNS('http://www.w3.org/1999/xhtml', 'audio')
+ try { x.innerHTML = '<marquee>' } catch (e) {}
+ try { document.documentElement.appendChild(x) } catch (e) {}
+})
+</script>
diff --git a/layout/generic/crashtests/1652897.html b/layout/generic/crashtests/1652897.html
new file mode 100644
index 0000000000..bc96f46e73
--- /dev/null
+++ b/layout/generic/crashtests/1652897.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<script>
+// DO NOT move this script to the end of this file
+// as the bug depends on this specific tree structure
+document.addEventListener("DOMContentLoaded", () => {
+ window.getSelection().selectAllChildren(document.body)
+ window.getSelection().modify('extend','left','word')
+});
+</script>
+<table>
+<caption>
+<caption>
diff --git a/layout/generic/crashtests/1654925.html b/layout/generic/crashtests/1654925.html
new file mode 100644
index 0000000000..410a42e773
--- /dev/null
+++ b/layout/generic/crashtests/1654925.html
@@ -0,0 +1,16 @@
+<script>
+function go() {
+ a.appendChild(b)
+}
+</script>
+<style>
+#b {
+ display: unset;
+ position: fixed;
+}
+</style>
+<body onload=go()>
+<ul id="a">
+<audio id="b">
+<marquee></marquee>
+<span>x</span>
diff --git a/layout/generic/crashtests/1663222.html b/layout/generic/crashtests/1663222.html
new file mode 100644
index 0000000000..132436c3fc
--- /dev/null
+++ b/layout/generic/crashtests/1663222.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<style>
+.a {
+ letter-spacing: 0.635em;
+ float: left;
+}
+.b {
+ column-span: all;
+ line-height: 89vmax;
+ padding-bottom: 6vmax;
+}
+:not(animateTransform) {
+ word-break: break-word;
+ columns: 15px;
+}
+</style>
+<legend class="b">
+<input itemprop="">
+<o>s.ykED*-U6p]6</>8&quotFX7wpo&mK`</><details class="a"><summary>cx.6W</>.2;3\52A
diff --git a/layout/generic/crashtests/1666592.html b/layout/generic/crashtests/1666592.html
new file mode 100644
index 0000000000..9f4518c0c4
--- /dev/null
+++ b/layout/generic/crashtests/1666592.html
@@ -0,0 +1,2 @@
+<style>#a{display:flex;flex-flow:column-reverse}:not(w){column-width:1px</style><l id="a"><<label id="a">x<l>x</label>a i
+
diff --git a/layout/generic/crashtests/1670336.html b/layout/generic/crashtests/1670336.html
new file mode 100644
index 0000000000..34e5fa2d76
--- /dev/null
+++ b/layout/generic/crashtests/1670336.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<style>
+.c1 {
+ column-span: all;
+ border-bottom-style: groove;
+ float: left;
+ border-width: 0em 0em 9em 1em;
+ box-decoration-break: clone;
+ height: 21vmin;
+}
+.c2 {
+ height: 74vmin;
+}
+:not(param) {
+ column-width: 1px;
+}
+</style>
+<script>
+function go() {
+ a.lastElementChild.appendChild(b)
+ window.requestIdleCallback(window.close)
+}
+function fuzz() {
+ var x = document.createElementNS("", "f")
+ x.prepend("1")
+ b.insertAdjacentHTML("afterEnd", x.outerHTML)
+}
+</script>
+<body onload=go()>
+<aside id="a">
+<data id="b" class="c1">U-.9zA</shadow>
+</aside>
+<details ontoggle="fuzz()" open="" class="c2">
diff --git a/layout/generic/crashtests/1676970.html b/layout/generic/crashtests/1676970.html
new file mode 100644
index 0000000000..fd3af85db2
--- /dev/null
+++ b/layout/generic/crashtests/1676970.html
@@ -0,0 +1,20 @@
+<script>
+function go() {
+ a.appendChild(c)
+ a.getRootNode().addEventListener("DOMSubtreeModified", eh, { once: true })
+ b.setAttribute("oninvalid", "eh()")
+}
+function eh() {
+ b.setAttribute("role", "dialog")
+ window.scrollBy(0.802, 0.384)
+ var x = document.getSelection()
+ x.extend(a)
+ x.modify("move", "forward", "lineboundary")
+ a.style.setProperty("column-span", "all")
+}
+</script>
+<body onload=go()>
+<select>
+<option id="a" contenteditable="true">x</span>
+<input id="b">
+<textarea id="c">
diff --git a/layout/generic/crashtests/1677518-1.html b/layout/generic/crashtests/1677518-1.html
new file mode 100644
index 0000000000..cbf6161c44
--- /dev/null
+++ b/layout/generic/crashtests/1677518-1.html
@@ -0,0 +1,15 @@
+<html class="reftest-wait">
+<head>
+<script>
+function finish() {
+ document.documentElement.className = "";
+}
+ window.addEventListener('load', () => {
+ const video = document.createElementNS('http://www.w3.org/1999/xhtml', 'video')
+ document.documentElement.appendChild(video)
+ setTimeout(async () => { video.poster = '1677518-1.jpg'; setTimeout(finish, 500); }, 165 )
+ video.setAttribute('poster', '1677518-1.svg')
+ })
+ </script>
+</head>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/1677518-1.jpg b/layout/generic/crashtests/1677518-1.jpg
new file mode 100644
index 0000000000..ab1a9b1165
--- /dev/null
+++ b/layout/generic/crashtests/1677518-1.jpg
Binary files differ
diff --git a/layout/generic/crashtests/1677518-1.svg b/layout/generic/crashtests/1677518-1.svg
new file mode 100644
index 0000000000..3f7b668b02
--- /dev/null
+++ b/layout/generic/crashtests/1677518-1.svg
@@ -0,0 +1,29 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xlink="http://www.w3.org/1999/xlink"
+ class="reftest-wait"
+ onload="setTimeAndSnapshot(2, true)">
+ <script xlink:href="../smil-util.js" type="text/javascript"/>
+ <!--
+ Test that ends are sampled first.
+ -->
+ <rect width="100" height="100" fill="red">
+ <animate attributeName="y" attributeType="XML" from="0" to="0" id="a"
+ begin="-3s; 1.5s" dur="20s"/>
+ <animate attributeName="fill" attributeType="CSS"
+ values="orange; green; purple"
+ begin="a.begin-0.5s; 1.5s" dur="2s" restart="whenNotActive"/>
+ <!--
+ So initially we have:
+ a: -3->17s
+ (b): -3.5->-1.5s (instance times: -3.5s, 1.5s)
+
+ At t=1.5s we get an early end on 'a', giving us:
+ a: 1.5->21.5s
+ (b): 1.0->3.0s (instance times: 1.0s, 1.5s)
+
+ If, at t=1.5s, we sample the second animation first, we'll start an
+ interval from 1.5s instead of 1.0s. So this is a test that ends are
+ actually sampled first.
+ -->
+ </rect>
+</svg>
diff --git a/layout/generic/crashtests/1679794.html b/layout/generic/crashtests/1679794.html
new file mode 100644
index 0000000000..dbc83a3483
--- /dev/null
+++ b/layout/generic/crashtests/1679794.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+ <style>
+ * {
+ writing-mode: sideways-rl;
+ scale: 99 calc(88.16690992045048 * 43820.370300978146)
+ }
+
+ TIME,
+ *:-moz-full-screen {
+ inset: -3732em;
+ font-size: 62235vh ! important;
+ }
+
+ * ~ * {
+ position: absolute;
+ padding-left: 1520280669.8216546cm ! important;
+ }
+ </style>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const time = document.createElementNS('http://www.w3.org/1999/xhtml', 'time')
+ document.documentElement.appendChild(time)
+ })
+ </script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1680406.html b/layout/generic/crashtests/1680406.html
new file mode 100644
index 0000000000..d86973a056
--- /dev/null
+++ b/layout/generic/crashtests/1680406.html
@@ -0,0 +1,16 @@
+<style>
+.a {
+ column-count: 4;
+ display: block;
+}
+* {
+ height: 1vmax;
+ grid-row-gap: 7em;
+ display: -webkit-flex;
+ -webkit-flex-direction: column
+}
+</style>
+<time class="a"></x>
+<label>
+x
+<q>
diff --git a/layout/generic/crashtests/1681788.html b/layout/generic/crashtests/1681788.html
new file mode 100644
index 0000000000..c6c732caef
--- /dev/null
+++ b/layout/generic/crashtests/1681788.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+ <style>
+ * {
+ display: inline-flex;
+ padding-bottom: 28%;
+ block-size: 86%;
+ box-sizing: border-box;
+ border-block: ridge 3267675504.837444em currentcolor;
+ }
+ </style>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1682032.html b/layout/generic/crashtests/1682032.html
new file mode 100644
index 0000000000..2974e5ec0d
--- /dev/null
+++ b/layout/generic/crashtests/1682032.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+ <script>
+ window.addEventListener('load', () => {
+ const svg = document.createElementNS('http://www.w3.org/2000/svg', 'style')
+ document.documentElement.appendChild(svg)
+ svg.textContent = `
+ HTML { column-rule-color: rgba( 4294967295%, 0%, 0%, 0% );
+ inset-block: 4294967295% 0%;
+ min-block-size: 4294967295%;
+ position: fixed;
+ aspect-ratio: 4294967295 / 4294967295;`
+ })
+ </script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1682686-1.html b/layout/generic/crashtests/1682686-1.html
new file mode 100644
index 0000000000..10bbf5077c
--- /dev/null
+++ b/layout/generic/crashtests/1682686-1.html
@@ -0,0 +1,60 @@
+<!DOCTYPE html>
+<meta charset="UTF-8">
+<body onload="document.body.style.width = '95%'">
+<div style="padding: 10px; display: grid; grid-template-rows: min-content auto;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<div style="display: grid;">
+<span>TEST</span>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1682686-2.html b/layout/generic/crashtests/1682686-2.html
new file mode 100644
index 0000000000..3aef0e7c1f
--- /dev/null
+++ b/layout/generic/crashtests/1682686-2.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<style>
+ .grid {
+ display: grid;
+ border-left: 1px solid blue;
+ margin-left: 0.5em;
+ }
+</style>
+<body onload="document.body.style.width = '95%'">
+ <div class="grid">1
+ <div class="grid">2
+ <div class="grid">3
+ <div class="grid">4
+ <div class="grid">5
+ <div class="grid">6
+ <div class="grid">7
+ <div class="grid">8
+ <div class="grid">9
+ <div class="grid">10
+ <div class="grid">11
+ <div class="grid">12
+ <div class="grid">13
+ <div class="grid">14
+ <div class="grid">15
+ <div class="grid">16
+ <div class="grid">17
+ <div class="grid">18
+ <div class="grid">19
+ <div class="grid">20
+ <div class="grid">21
+ <div class="grid">22
+ <div class="grid">23
+ <div class="grid">24
+ <div class="grid">25
+ <div class="grid">26
diff --git a/layout/generic/crashtests/1682882.html b/layout/generic/crashtests/1682882.html
new file mode 100644
index 0000000000..ad6ba94375
--- /dev/null
+++ b/layout/generic/crashtests/1682882.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+ <style id='style'>
+ * {
+ all: revert;
+ }
+ </style>
+ <script>
+ window.addEventListener('load', () => {
+ const style_0 = document.getElementById('style')
+ const style_1 = document.createElement('style')
+ document.head.appendChild(style_1)
+ style_1.sheet.insertRule(`* { position: absolute; scroll-padding-inline: 3195984415.1022196vh }`, 0)
+ style_1.sheet.insertRule(`*::first-line { border-left-color: transparent }`, 0)
+ style_1.sheet.insertRule(`* ~ * { display: contents }`, 0)
+ const xhr = new XMLHttpRequest()
+ xhr.open('POST', 'FOOBAR', false)
+ xhr.send()
+ style_0.innerHTML = '<div></div>'
+ })
+ </script>
+</head>
+<ol hidden>
+ <li>
+ <li contenteditable='true'></li>
+</ol>
+</html>
diff --git a/layout/generic/crashtests/1683126.html b/layout/generic/crashtests/1683126.html
new file mode 100644
index 0000000000..8d08ab3127
--- /dev/null
+++ b/layout/generic/crashtests/1683126.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html class="reftest-paged">
+<head>
+ <style>
+ * {
+ border-block-width: 1151557106.9598303in ! important;
+ border-block-end-style: double;
+ }
+
+ * * {
+ position: fixed;
+ }
+ </style>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1697262-1.html b/layout/generic/crashtests/1697262-1.html
new file mode 100644
index 0000000000..590952b19e
--- /dev/null
+++ b/layout/generic/crashtests/1697262-1.html
@@ -0,0 +1,17 @@
+<script>
+window.onload = () => {
+ try { document.getElementById('a').setAttribute('style', 'left:76%') } catch (e) {}
+ window.print()
+ setTimeout(window.close, 250)
+}
+</script>
+<style>
+:last-of-type {
+ position: relative;
+}
+</style>
+<select>
+<optgroup label='y'>
+<option>
+</select>
+<video id='a'>
diff --git a/layout/generic/crashtests/1699263.html b/layout/generic/crashtests/1699263.html
new file mode 100644
index 0000000000..5a1aefa083
--- /dev/null
+++ b/layout/generic/crashtests/1699263.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ BODY {
+ position: fixed ! important;
+ }
+
+ * {
+ aspect-ratio: auto 3962283067.99873 / 2091098098.4395208;
+ filter: url(#id_1) ! important;
+ inset: 49% auto;
+ height: 261118874%
+ }
+ </style>
+</head>
+<body></body>
+</html>
diff --git a/layout/generic/crashtests/1699468.html b/layout/generic/crashtests/1699468.html
new file mode 100644
index 0000000000..6f86e4cd41
--- /dev/null
+++ b/layout/generic/crashtests/1699468.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ HTML {
+ flex-direction: column;
+ }
+
+ EMBED {
+ inline-size: min-content;
+ width: 621490006%;
+ }
+
+ HTML {
+ display: inline-flex !important;
+ }
+
+ * {
+ aspect-ratio: 2044245302.5699975 / 2382682379.6661625;
+ writing-mode: vertical-lr;
+ }
+ </style>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const embed = document.createElement('embed')
+ document.documentElement.appendChild(embed)
+ })
+ </script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1728319.html b/layout/generic/crashtests/1728319.html
new file mode 100644
index 0000000000..1ef3bf1554
--- /dev/null
+++ b/layout/generic/crashtests/1728319.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ * {
+ padding-right: 2589893033.302024Q;
+ display: inline-flex;
+ }
+ </style>
+</head>
+</html>
diff --git a/layout/generic/crashtests/1730506.html b/layout/generic/crashtests/1730506.html
new file mode 100644
index 0000000000..9910e5e016
--- /dev/null
+++ b/layout/generic/crashtests/1730506.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ * {
+ grid-column-gap: 3970820911.345316ex !important;
+ }
+ </style>
+ <script>
+ document.addEventListener("DOMContentLoaded", () => {
+ const style = document.createElement("style")
+ document.head.appendChild(style)
+ style.sheet.insertRule(`* { display: inline-flex; }`, 0)
+ })
+ </script>
+</head>
+<img>
+<script></script>
+<b></b>
+<table></table>
+</html>
diff --git a/layout/generic/crashtests/1730570.html b/layout/generic/crashtests/1730570.html
new file mode 100644
index 0000000000..79193375c2
--- /dev/null
+++ b/layout/generic/crashtests/1730570.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ * {
+ padding-left: 385945468.9776893vmin ! important;
+ flex-direction: column-reverse;
+ }
+
+ HTML {
+ writing-mode: sideways-lr;
+ }
+
+ #id_0 * {
+ padding-right: 4243575909.3360567ch !important;
+ border-left: inset rgb(27% 15% 81% / 1%);
+ }
+
+ #id_1 {
+ display: inline flex ! important;
+ }
+
+ #id_2 {
+ aspect-ratio: 321484271.5137855 / 2731818911.2819076;
+ }
+ </style>
+</head>
+<h1 id="id_0">
+ <sup id="id_1">
+ <select id="id_2"></select>
+ </sup>
+</h1>
+</html>
diff --git a/layout/generic/crashtests/1734015.html b/layout/generic/crashtests/1734015.html
new file mode 100644
index 0000000000..950a3f51cc
--- /dev/null
+++ b/layout/generic/crashtests/1734015.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ * {
+ all: initial;
+ }
+ </style>
+ <script>
+ document.addEventListener("DOMContentLoaded", () => {
+ const selection = document.getSelection()
+ const option = document.getElementById("id_0")
+ selection.setPosition(option)
+ selection.modify("move", "backward", "line")
+ })
+ </script>
+</head>
+<select>
+ <option id="id_0"></option>
+</select>
+</html>
diff --git a/layout/generic/crashtests/1776079.html b/layout/generic/crashtests/1776079.html
new file mode 100644
index 0000000000..e9c66092b0
--- /dev/null
+++ b/layout/generic/crashtests/1776079.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<style>
+html {
+ column-width: 0px;
+}
+.a {
+ break-inside: avoid;
+ word-wrap: break-word;
+ visibility: collapse;
+ display: flex;
+}
+</style>
+<li>
+<time>a</time>
+</li>
+<base></base>
+<q>
+<li class="a">aaaaaaaaaaaa</li>
+<ul style="writing-mode: sideways-lr">aaa</ul>
diff --git a/layout/generic/crashtests/1791606.html b/layout/generic/crashtests/1791606.html
new file mode 100644
index 0000000000..f748d5b6d1
--- /dev/null
+++ b/layout/generic/crashtests/1791606.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+ <style>
+ * {
+ white-space: pre;
+ padding: 1px 30% 35%;
+ scroll-snap-type: block proximity;
+ overflow-y: hidden !important;
+ scroll-snap-align: center;
+ scroll-margin-block-end: 100vmax;
+ }
+ </style>
+</head>
+<body>
+𛵺𫗡<\n\r󠼘0𛇶)0á©¿\rð†¬ÙƒÙ©ã»¡\r\n\uDCFFNá·ó ¿°ð¥œ´&=0䱜󠖰괚۰å¶Nó ‹ á·“\n\rð¯ºð–¡‚🇚󠄢2ð €®\r0󠾎𯇫⭲<\uDB3A-ó ž„ð’´™ð¯¸ð’»Dó šµ4꙯ká·¸Ù«â¡ð††' hidden draggable='false' title='󠙘᷾𖄨ð¡¾]{+ä¤ð¯›ž-​ð†‰cH\náž\uDC1D\uDC1DÒ‡ð…©ä¡´I+٠𛽋?ë°¼ó ˆ….𛾺9𛼨𯽢.\r𯩃(\r^ó ’𯮑󠯶𡥳 2\f\n\ró ’‮۰\n󠋇𩙅4R𦤔⛨ﰸÎÙ ]+=ó ®+ð£ŠÛ°Òƒ90a\uDC1Dó ¥–á·±cᆹ۹迅b𖑎㤜᭱i\u202F᧪ᷭ-ð‡½äŒ½\uDC1D٠颇\r0è·ð…¥ï»¿' itemid='ð–ˆ·\r\n倂2R𯽄%Ù«!𛣑󠱸肨0𯩋󠉲ð…±ð¯ˆªU%ì º\0' translate='no' autocapitalize='words' spellcheck='false' accesskey='&'>
+<i id='id_0' tabindex='32'>
+ </del>
+</i>
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+ document.getElementById('id_0').focus({});
+ setTimeout(() => {
+ document.documentElement.className = "";
+ }, 1000);
+});
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/1799749.html b/layout/generic/crashtests/1799749.html
new file mode 100644
index 0000000000..8107058d48
--- /dev/null
+++ b/layout/generic/crashtests/1799749.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<div style="overflow: auto;">
+<canvas style="margin-left: auto; filter: url(#htmlvar00005); display: list-item;" width="1">a</canvas>
+<div id="htmlvar00005" style="bottom: 0; display: list-item; overflow: auto;"></div>
+</div>
diff --git a/layout/generic/crashtests/1807958.html b/layout/generic/crashtests/1807958.html
new file mode 100644
index 0000000000..3eb1023b09
--- /dev/null
+++ b/layout/generic/crashtests/1807958.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ #id_1 {
+ writing-mode: sideways-rl;
+ columns: 3364184556 118834207.58399546em !important;
+ }
+
+ * {
+ padding-block-start: 1150693220%;
+ content-visibility: hidden;
+ border-top-style: groove;
+ overflow-block: scroll;
+ min-block-size: 2744448288.222785px;
+ display: flex;
+ padding-inline-end: 3966002714.7525673Q !important;
+ }
+
+ SLOT {
+ display: inline;
+ }
+ </style>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ document.documentElement.appendChild(document.getElementById('id_0'))
+ })
+ </script>
+</head>
+<slot id='id_0'>
+ <slot id='id_1'></slot>
+</slot>
+</html>
diff --git a/layout/generic/crashtests/1816574.html b/layout/generic/crashtests/1816574.html
new file mode 100644
index 0000000000..de5d440d90
--- /dev/null
+++ b/layout/generic/crashtests/1816574.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ * {
+ grid-gap: 164.70272054344653vw 68%;
+ }
+ </style>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const style = document.createElement("style")
+ document.documentElement.appendChild(style)
+ style.textContent = `
+ @font-face { }
+ * {
+ column-width: 161.0069566994682Q;
+ offset-anchor: left 0ex top -32ch;
+ break-inside: avoid;
+ }`
+ style.sheet.insertRule(`* {
+ aspect-ratio: 2334586695.701634 / 653082496.7273545 ! important;
+ margin-top: -84em;
+ min-inline-size: 162em;
+ font-size-adjust: 8198;
+ }`, 0)
+ })
+ </script>
+</head>
+<h4></h4>
+<svg></svg>
+<fieldset>
+ <legend>
+ <cite>
+  e\r𠪢0ið…¯ó ‡©0*=ð¤µ*=\nâ€ï¿½' lang='ar'>
+ <h5></h5>
+ </cite>
+ </legend>
+</fieldset>
+</html>
diff --git a/layout/generic/crashtests/1821603.html b/layout/generic/crashtests/1821603.html
new file mode 100644
index 0000000000..5935121cde
--- /dev/null
+++ b/layout/generic/crashtests/1821603.html
@@ -0,0 +1,4 @@
+<!doctype html>
+<div style="display: flex">
+ <div style="visibility: collapse; direction: rtl"></div>
+</div>
diff --git a/layout/generic/crashtests/1822118.html b/layout/generic/crashtests/1822118.html
new file mode 100644
index 0000000000..d4776fa6b7
--- /dev/null
+++ b/layout/generic/crashtests/1822118.html
@@ -0,0 +1,11 @@
+<style>
+.a {
+ min-width: 641em;
+ display: list-item inline;
+}
+</style>
+A
+<ruby>
+<rp class="a">
+<rt>
+<fieldset class="a">
diff --git a/layout/generic/crashtests/1825434.html b/layout/generic/crashtests/1825434.html
new file mode 100644
index 0000000000..a7d6adba57
--- /dev/null
+++ b/layout/generic/crashtests/1825434.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<style>
+.rel {
+ position: relative;
+}
+
+.abs {
+ width: 100%;
+ position: absolute;
+ padding-top: 50%;
+}
+</style>
+
+<div class="rel">
+ <div class="abs"></div>
+</div>
diff --git a/layout/generic/crashtests/225868-1-inner.html b/layout/generic/crashtests/225868-1-inner.html
new file mode 100644
index 0000000000..db8fbc73c9
--- /dev/null
+++ b/layout/generic/crashtests/225868-1-inner.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<style type="text/css">
+
+html { overflow: hidden; }
+
+</style>
+</head>
+<body onload="setTimeout(function(){document.write('<body onload=&quot;parent.document.documentElement.removeAttribute(\'class\');&quot;>2</body>'); document.close();}, 0);">
+
+1
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/225868-1.html b/layout/generic/crashtests/225868-1.html
new file mode 100644
index 0000000000..55f221a7cc
--- /dev/null
+++ b/layout/generic/crashtests/225868-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head></head>
+<body>
+<iframe src="225868-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/layout/generic/crashtests/255468.xhtml b/layout/generic/crashtests/255468.xhtml
new file mode 100644
index 0000000000..62a859511e
--- /dev/null
+++ b/layout/generic/crashtests/255468.xhtml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
+ "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
+<head>
+<title>Iridescence</title>
+<style type="text/css" title="Crashme" disabled="disabled">
+ul.tree ul {
+ list-style-position: inside;
+}
+
+span.type:after {
+ content: ": ";
+}
+
+</style>
+</head>
+<body>
+<h1>Crash Test</h1>
+<table><tbody>
+<tr><td><ul class="struct tree"><li><span class="type">A</span> X<ul><li><span class="type">L</span> <var>Size</var></li><li><var>data</var></li></ul></li></ul></td></tr>
+</tbody></table>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/255982-1.html b/layout/generic/crashtests/255982-1.html
new file mode 100644
index 0000000000..42ab38a761
--- /dev/null
+++ b/layout/generic/crashtests/255982-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged">
+<body>
+<style type="text/css">
+@page { size:5in 3in; margin:0.5in; }
+</style>
+<div style="width: 60%; float: left; height: 1.6in; ">a float</div>
+<div style="width: 60%; float: left; height: 1.6in; border:1px solid black; ">overlaps page break</div>
+<br />
+<div style="width: 60%; float: left;">3rd float</div>
+<div style="width: 60%; float: left;">4th float</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/255982-2.html b/layout/generic/crashtests/255982-2.html
new file mode 100644
index 0000000000..f595621139
--- /dev/null
+++ b/layout/generic/crashtests/255982-2.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged">
+<body>
+<div style="width: 60%; float: left; height: 1.6in; ">a float</div>
+<div style="width: 60%; float: left; height: 1.6in; border:1px solid black; ">overlaps page break</div>
+Some text
+<div style="width: 60%; float: left;">3rd float</div>
+<div style="width: 60%; float: left;">4th float</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/255982-3.html b/layout/generic/crashtests/255982-3.html
new file mode 100644
index 0000000000..766dffa177
--- /dev/null
+++ b/layout/generic/crashtests/255982-3.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged">
+<body>
+<div style="width: 60%; float: left; height: 1.6in; ">a float</div>
+<div style="width: 60%; float: left; height: 1.6in; border:1px solid black;">overlaps page break</div>
+Some text
+<div style="width: 60%; float: left;">3rd float</div>
+<div style="width: 60%; float: left;">4th float</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/255982-4.html b/layout/generic/crashtests/255982-4.html
new file mode 100644
index 0000000000..6fb1ff2c62
--- /dev/null
+++ b/layout/generic/crashtests/255982-4.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged">
+<body>
+<style type="text/css">
+@page { size:5in 3in; margin:0.5in; }
+</style>
+<div style="width: 60%; float: left; height: 1.6in; ">a float</div>
+<div style="width: 60%; float: left; height: 1.6in; border:1px solid black; ">overlaps page break</div>
+This is enough text to trigger a line break.
+<div style="width: 60%; float: left;">3rd float</div>
+<div style="width: 60%; float: left;">4th float</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/25888-1.html b/layout/generic/crashtests/25888-1.html
new file mode 100644
index 0000000000..bfe0f79e51
--- /dev/null
+++ b/layout/generic/crashtests/25888-1.html
@@ -0,0 +1,6 @@
+<title>Hang while developing patch for bug 25888</title>
+
+<div style="width:500px">
+<div style="float:left;width:600px;height:30px"></div>
+Hello
+</div>
diff --git a/layout/generic/crashtests/25888-2.html b/layout/generic/crashtests/25888-2.html
new file mode 100644
index 0000000000..065218f31d
--- /dev/null
+++ b/layout/generic/crashtests/25888-2.html
@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<title>Testcase for hang while developing bug 25888 (hit on www.flightaware.com)</title>
+
+<div style="border: solid 1em; width: 500px; height: 500px">
+ <div style="float:right; width: 300px; height: 3px;background:yellow;"></div>
+ <div style="float:left; width: 220px; height: 100px;background:aqua;"></div>
+ hi
+</div>
diff --git a/layout/generic/crashtests/264937-1.html b/layout/generic/crashtests/264937-1.html
new file mode 100644
index 0000000000..fe0291481e
--- /dev/null
+++ b/layout/generic/crashtests/264937-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html><head>
+ <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+ <title>Testcase for bug 264937</title>
+
+<style type="text/css">
+ p:first-letter {
+ background-color: lime;
+ }
+</style>
+
+</head>
+<body>
+
+ <p>"Test word</p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/265867-1.html b/layout/generic/crashtests/265867-1.html
new file mode 100644
index 0000000000..e9da8c7f6f
--- /dev/null
+++ b/layout/generic/crashtests/265867-1.html
@@ -0,0 +1,11 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<BODY STYLE="FLOAT:RIGHT;"></BODY>
+<MARQUEE STYLE="MARGIN:99999999999px;"></MARQUEE>
+<B STYLE="FLOAT:RIGHT; PADDING:99999999999px;"></B>
+</BODY>
+</HTML>
+
+
diff --git a/layout/generic/crashtests/265867-2.html b/layout/generic/crashtests/265867-2.html
new file mode 100644
index 0000000000..c0ece7c279
--- /dev/null
+++ b/layout/generic/crashtests/265867-2.html
@@ -0,0 +1,3 @@
+<DIV STYLE="display:table-column-group;">
+ <DIV>Hello</DIV>
+</DIV>
diff --git a/layout/generic/crashtests/286491.html b/layout/generic/crashtests/286491.html
new file mode 100644
index 0000000000..5b7e632f05
--- /dev/null
+++ b/layout/generic/crashtests/286491.html
@@ -0,0 +1,26 @@
+<html><head><title>Testcase bug 286491 - Crash with evil testcase with iframe and flash inside it</title>
+<style>a:hover{display:block;}</style>
+<script>
+function doe(){
+document.links[1].style.display='block';
+setTimeout(doe2,0);
+}
+function doe2(){
+document.links[1].style.display='';
+document.links[0].style.display='block';
+setTimeout(doe3,0);
+}
+function doe3(){
+document.links[0].style.display='';
+}
+</script>
+</head>
+<body onload="setInterval(doe,20)">
+<button onclick="doe()">doe()</button>
+<button onclick="setInterval(doe,20)">setInterval(doe,20)</button><br>
+<span><a href="#">link1</a><a href="#">link2</a></span>
+<br>
+<iframe src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%0A%3Cobject%20classid%3D%22clsid%3AD27CDB6E-AE6D-11cf-96B8-444553540000%22%20codebase%3D%22https%3A//download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab%23version%3D3%2C0%2C0%2C0%22%3E%3Cembed%20src%3D%22data%3Aapplication/x-shockwave-flash%2CFWS%2505d%2500%2500%2500%2560%2500%253E%2580%2500%2519%2500%2500%250C%2501%2500C%2502%25FF%25CC%2500%253F%250C%250E%2500%2500%2500%2501%2500%2511%2500%2505Arial%2500%2500%2502%2500%257F%2509%2523%2500%2500%2500%2502%2500g%25EC%252Fg%25EC%250F0%250D0%2501%2500%2518%2501%2500%2500%2500%25FF%2502%2500%2500%2500%2500%2500%2500%28%2500mytext%2500%2589%2506%2506%2501%2500%2502%2500%2514%2583%2516%2520%2540%2500%2500%2500%22%20pluginspage%3D%22http%3A//www.macromedia.com/go/getflashplayer%22%20type%3D%22application/x-shockwave-flash%22%20height%3D%2240%22%20width%3D%22100%22%3E%3C/object%3E%0A%3C/body%3E%3C/html%3E"></iframe>
+
+
+</body></html>
diff --git a/layout/generic/crashtests/289864-1.html b/layout/generic/crashtests/289864-1.html
new file mode 100644
index 0000000000..ed8299a9a0
--- /dev/null
+++ b/layout/generic/crashtests/289864-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<img src="289864-1.jpg" height="9999999" width="9999999" />
+</body>
+</html>
diff --git a/layout/generic/crashtests/289864-1.jpg b/layout/generic/crashtests/289864-1.jpg
new file mode 100644
index 0000000000..6337fc5717
--- /dev/null
+++ b/layout/generic/crashtests/289864-1.jpg
Binary files differ
diff --git a/layout/generic/crashtests/295292-1.html b/layout/generic/crashtests/295292-1.html
new file mode 100644
index 0000000000..1961db5364
--- /dev/null
+++ b/layout/generic/crashtests/295292-1.html
@@ -0,0 +1,13 @@
+<html>
+ <head>
+ <style type="text/css">
+ div{overflow:hidden;}
+ div.menubar{position:fixed;width:100%;}
+ </style>
+ </head>
+ <body>
+ <div class="menubar">
+ </div>
+ if you can't see this, it crashed.
+ </body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/295292-2.html b/layout/generic/crashtests/295292-2.html
new file mode 100644
index 0000000000..15d070f83b
--- /dev/null
+++ b/layout/generic/crashtests/295292-2.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<title>Test Page</title>
+<style>
+#problem {
+ left:0;
+ top:0;
+ width: 0;
+ overflow: hidden;
+ position: fixed;
+}
+</style>
+</head>
+<body>
+
+<div id="problem">
+this should be hidden
+</div>
+
+page loaded
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/302260-1.html b/layout/generic/crashtests/302260-1.html
new file mode 100644
index 0000000000..ce4e0fb7a7
--- /dev/null
+++ b/layout/generic/crashtests/302260-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head>
+
+<style type="text/css">
+
+body {
+ text-indent:20px;
+}
+
+span {
+ float:right;
+}
+</style>
+</head>
+
+<body><span>What's Clicking Now</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/307979-1.html b/layout/generic/crashtests/307979-1.html
new file mode 100644
index 0000000000..7a9a10a1f9
--- /dev/null
+++ b/layout/generic/crashtests/307979-1.html
@@ -0,0 +1,27 @@
+<html class="reftest-wait">
+<head>
+
+<title>Crash testcase</title>
+
+<script>
+
+function foo()
+{
+ document.body.appendChild(document.createElement('frameset'));
+ setTimeout(bar, 30);
+}
+
+function bar()
+{
+ document.body.style.display = '-moz-box';
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(foo, 30);">
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/309322-1.html b/layout/generic/crashtests/309322-1.html
new file mode 100644
index 0000000000..4382061748
--- /dev/null
+++ b/layout/generic/crashtests/309322-1.html
@@ -0,0 +1,56 @@
+<html><head>
+<title>Testcase1 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
+<style>
+*[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
+display:table-caption;
+}
+</style>
+<script>
+function doe(i){
+var x=document.body.getElementsByTagName('*');
+var xl=x.length;i=i+1;
+x[i-1].removeAttribute('toggle_style');
+if ((i)<xl) x[i].setAttribute('toggle_style','toggle_style');
+if ((i+1)<xl) {x[i+1].setAttribute('toggle_style1','toggle_style');
+x[i].removeAttribute('toggle_style1');
+}
+if ((i+2)<xl) {x[i+2].setAttribute('toggle_style2','toggle_style');
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+3)<xl) {x[i+3].setAttribute('toggle_style3','toggle_style');
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+4)<xl) {x[i+4].setAttribute('toggle_style4','toggle_style');
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+4)==xl) {
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+3)==xl) {
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+2)==xl) {
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+1)==xl) {
+x[i].removeAttribute('toggle_style1');
+}
+setTimeout(doe,20,i);
+}
+
+function doe2(){
+var x=document.links[0].cloneNode(true);
+document.links[0].appendChild(x);
+}
+</script>
+</head>
+<body onload="doe(1)">
+<button onclick="doe(1)">Clicking on this button should not crash Mozilla</button>
+<table><tbody><tr><td>
+
+<span><br></span>
+<a href="#">Galloway<span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span></a>
+
+</td></tr></tbody></table>
+
+</body></html>
diff --git a/layout/generic/crashtests/309322-2.html b/layout/generic/crashtests/309322-2.html
new file mode 100644
index 0000000000..f1450a0473
--- /dev/null
+++ b/layout/generic/crashtests/309322-2.html
@@ -0,0 +1,56 @@
+<html><head>
+<title>Testcase2 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
+<style>
+*[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
+display:table-caption;
+}
+</style>
+<script>
+function doe(i){
+var x=document.body.getElementsByTagName('*');
+var xl=x.length;i=i+1;
+x[i-1].removeAttribute('toggle_style');
+if ((i)<xl) x[i].setAttribute('toggle_style','toggle_style');
+if ((i+1)<xl) {x[i+1].setAttribute('toggle_style1','toggle_style');
+x[i].removeAttribute('toggle_style1');
+}
+if ((i+2)<xl) {x[i+2].setAttribute('toggle_style2','toggle_style');
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+3)<xl) {x[i+3].setAttribute('toggle_style3','toggle_style');
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+4)<xl) {x[i+4].setAttribute('toggle_style4','toggle_style');
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+4)==xl) {
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+3)==xl) {
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+2)==xl) {
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+1)==xl) {
+x[i].removeAttribute('toggle_style1');
+}
+setTimeout(doe,20,i);
+}
+
+function doe2(){
+var x=document.links[0].cloneNode(true);
+document.links[0].appendChild(x);
+}
+</script>
+</head>
+<body onload="doe(1)">
+<button onclick="doe(1)">Clicking on this button should not crash Mozilla</button>
+<table><tbody><tr><td>
+
+<span><br></span>
+<a href="#">Galloway<span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span><span>Galloway</span></a>
+
+</td></tr></tbody></table>
+
+</body></html>
diff --git a/layout/generic/crashtests/309322-3.html b/layout/generic/crashtests/309322-3.html
new file mode 100644
index 0000000000..96148ffe4f
--- /dev/null
+++ b/layout/generic/crashtests/309322-3.html
@@ -0,0 +1,48 @@
+<html><head>
+<title>Testcase3 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
+<style>
+*[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
+display:table-caption;
+}
+</style>
+<script>
+function doe(i){
+var x=document.body.getElementsByTagName('*');
+var xl=x.length;i=i+1;
+x[i-1].removeAttribute('toggle_style');
+x[i].setAttribute('toggle_style','toggle_style');
+if ((i+1)<xl) {x[i+1].setAttribute('toggle_style1','toggle_style');
+x[i].removeAttribute('toggle_style1');
+}
+if ((i+2)<xl) {x[i+2].setAttribute('toggle_style2','toggle_style');
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+3)<xl) {x[i+3].setAttribute('toggle_style3','toggle_style');
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+4)<xl) {x[i+4].setAttribute('toggle_style4','toggle_style');
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+4)==xl) {
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+3)==xl) {
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+2)==xl) {
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+1)==xl) {
+x[i].removeAttribute('toggle_style1');
+}
+setTimeout(doe,20,i);
+}
+
+
+</script></head><body onload="doe(3)">
+<button onclick="doe(3)">Clicking on this button should not create extra "Galloway" text</button>
+<table><tbody><tr><td>
+<span><br></span>
+<a href="#">Galloway</a>
+</td></tr></tbody></table>
+</body></html>
diff --git a/layout/generic/crashtests/309322-4.html b/layout/generic/crashtests/309322-4.html
new file mode 100644
index 0000000000..9b9b6a5bbf
--- /dev/null
+++ b/layout/generic/crashtests/309322-4.html
@@ -0,0 +1,48 @@
+<html><head>
+<title>Testcase4 bug 309322 - Evil testcase using multiple display:table-caption causes crash</title>
+<style>
+*[toggle_style],*[toggle_style1],*[toggle_style2],*[toggle_style3],*[toggle_style4]{
+display:table-caption;
+}
+</style>
+<script>
+function doe(i){
+var x=document.body.getElementsByTagName('*');
+var xl=x.length;i=i+1;
+x[i-1].removeAttribute('toggle_style');
+x[i].setAttribute('toggle_style','toggle_style');
+if ((i+1)<xl) {x[i+1].setAttribute('toggle_style1','toggle_style');
+x[i].removeAttribute('toggle_style1');
+}
+if ((i+2)<xl) {x[i+2].setAttribute('toggle_style2','toggle_style');
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+3)<xl) {x[i+3].setAttribute('toggle_style3','toggle_style');
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+4)<xl) {x[i+4].setAttribute('toggle_style4','toggle_style');
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+4)==xl) {
+x[i+3].removeAttribute('toggle_style4');
+}
+if ((i+3)==xl) {
+x[i+2].removeAttribute('toggle_style3');
+}
+if ((i+2)==xl) {
+x[i+1].removeAttribute('toggle_style2');
+}
+if ((i+1)==xl) {
+x[i].removeAttribute('toggle_style1');
+}
+setTimeout(doe,20,i);
+}
+
+
+</script></head><body onload="doe(3)">
+<button onclick="doe(3)">Clicking on this button and then closing this tab/window should not crash Mozilla</button>
+<table><tbody><tr><td>
+<span><br></span>
+<a href="#"><img src="data:image/gif;base64,R0lGODlhAQABAIABAAD/AP///ywAAAAAAQABAAACAkQBADs="></a>
+</td></tr></tbody></table>
+</body></html>
diff --git a/layout/generic/crashtests/310556-1.xhtml b/layout/generic/crashtests/310556-1.xhtml
new file mode 100644
index 0000000000..260960008e
--- /dev/null
+++ b/layout/generic/crashtests/310556-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+
+<style type="text/css">
+
+span:before {
+ content: "";
+}
+
+</style>
+
+</head>
+
+<body>
+
+X<span/>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/321224.xhtml b/layout/generic/crashtests/321224.xhtml
new file mode 100644
index 0000000000..a21c4b7b0a
--- /dev/null
+++ b/layout/generic/crashtests/321224.xhtml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <tabpanels>
+ <nativescrollbar/>
+ </tabpanels>
+</window> \ No newline at end of file
diff --git a/layout/generic/crashtests/322780-1.xhtml b/layout/generic/crashtests/322780-1.xhtml
new file mode 100644
index 0000000000..cf914cfaf0
--- /dev/null
+++ b/layout/generic/crashtests/322780-1.xhtml
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <label>
+ <foopy style="display: block; float:left;" />
+ </label>
+</window>
diff --git a/layout/generic/crashtests/323381-1.html b/layout/generic/crashtests/323381-1.html
new file mode 100644
index 0000000000..3f2c17f9c0
--- /dev/null
+++ b/layout/generic/crashtests/323381-1.html
@@ -0,0 +1 @@
+<iframe src="data:text/html,foo" width="808080"></iframe>
diff --git a/layout/generic/crashtests/323381-2.html b/layout/generic/crashtests/323381-2.html
new file mode 100644
index 0000000000..ab28e6bb54
--- /dev/null
+++ b/layout/generic/crashtests/323381-2.html
@@ -0,0 +1 @@
+<div style="width: 808080px;">foo</div>
diff --git a/layout/generic/crashtests/323386-1.html b/layout/generic/crashtests/323386-1.html
new file mode 100644
index 0000000000..437b9a16b9
--- /dev/null
+++ b/layout/generic/crashtests/323386-1.html
@@ -0,0 +1 @@
+<TEXTAREA COLS="381762666"> \ No newline at end of file
diff --git a/layout/generic/crashtests/323389-1.html b/layout/generic/crashtests/323389-1.html
new file mode 100644
index 0000000000..591ebb539e
--- /dev/null
+++ b/layout/generic/crashtests/323389-1.html
@@ -0,0 +1,7 @@
+<HTML>
+<HEAD>
+<meta http-equiv="Content-Type" content="text/html; charset=GB18030">
+
+<TEXTAREA>
+ ˆˆˆˆˆˆ
+
diff --git a/layout/generic/crashtests/323389-2.html b/layout/generic/crashtests/323389-2.html
new file mode 100644
index 0000000000..74fea379a3
--- /dev/null
+++ b/layout/generic/crashtests/323389-2.html
@@ -0,0 +1,8 @@
+<html><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=ISO-8859-1"></head>
+
+<body>
+
+blocking&#8209;aviary1.0.8
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/323493-1.html b/layout/generic/crashtests/323493-1.html
new file mode 100644
index 0000000000..12e14f6a8d
--- /dev/null
+++ b/layout/generic/crashtests/323493-1.html
@@ -0,0 +1,16 @@
+<html><head><style>
+* {
+ display: table;
+ position: absolute;
+}
+</style>
+
+</head>
+
+<body>
+<table><tbody><tr><td>One</td><td>Two</td></tr><tr><td>Three</td><td>Four</td></tr></tbody></table>
+<ul><li>One</li><li>Two</li><li>Three</li></ul>
+
+<p>Lorem ipsum dolor sit amet, consectetuer adipiscing elit, sed diam nonummy nibh euismod tincidunt ut laoreet dolore magna aliquam erat volutpat. Ut wisi enim ad minim veniam, quis nostrud exerci tation ullamcorper suscipit lobortis nisl ut aliquip ex ea commodo consequat. Duis autem vel eum iriure dolor in hendrerit in vulputate velit esse molestie consequat, vel illum dolore eu feugiat nulla facilisis at vero eros et accumsan et iusto odio dignissim qui blandit praesent luptatum zzril delenit augue duis dolore te feugait nulla facilisi. Nam liber tempor cum soluta nobis eleifend option congue nihil imperdiet doming id quod mazim placerat facer possim assum. Typi non habent claritatem insitam; est usus legentis in iis qui facit eorum claritatem. Investigationes demonstraverunt lectores legere me lius quod ii legunt saepius. Claritas est etiam processus dynamicus, qui sequitur mutationem consuetudium lectorum. Mirum est notare quam littera gothica, quam nunc putamus parum claram, anteposuerit litterarum formas humanitatis per seacula quarta decima et quinta decima. Eodem modo typi, qui nunc nobis videntur parum clari, fiant sollemnes in futurum.</p>
+
+</body></html> \ No newline at end of file
diff --git a/layout/generic/crashtests/323495-1.html b/layout/generic/crashtests/323495-1.html
new file mode 100644
index 0000000000..fcffe0166e
--- /dev/null
+++ b/layout/generic/crashtests/323495-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+
+<style>
+select { width: 1000000px; }
+</style>
+
+</head>
+
+<body>
+
+<select><option>a</option></select>
+
+</body></html> \ No newline at end of file
diff --git a/layout/generic/crashtests/324318-1.html b/layout/generic/crashtests/324318-1.html
new file mode 100644
index 0000000000..c9946caba9
--- /dev/null
+++ b/layout/generic/crashtests/324318-1.html
@@ -0,0 +1,29 @@
+<script>
+
+var tr;
+
+function init() {
+
+ tr = one.document.getElementsByTagName("tr")[0];
+ tr = document.adoptNode(tr);
+ document.getElementsByTagName("html")[0].appendChild(tr);
+
+ setTimeout(
+ function(){
+ var frameset = document.getElementsByTagName("frameset")[0];
+ document.getElementsByTagName("td")[0].appendChild(frameset);
+ document.documentElement.removeAttribute("class");
+ },
+ 100);
+
+}
+
+window.addEventListener("load", init);
+document.documentElement.setAttribute("class", "reftest-wait");
+
+</script>
+
+<frameset resizable="yes" rows="50%,*">
+ <frame name="one" src="file_324318-1.html">
+ <frame name="two" src="empty.html">
+</frameset>
diff --git a/layout/generic/crashtests/328946-1.html b/layout/generic/crashtests/328946-1.html
new file mode 100644
index 0000000000..75345ce5de
--- /dev/null
+++ b/layout/generic/crashtests/328946-1.html
@@ -0,0 +1 @@
+<table> \ No newline at end of file
diff --git a/layout/generic/crashtests/331284-1.xhtml b/layout/generic/crashtests/331284-1.xhtml
new file mode 100644
index 0000000000..43bea83860
--- /dev/null
+++ b/layout/generic/crashtests/331284-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+ <hbox xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+ <ttt style="display: block; float: right;">
+ <img src="../../../testing/crashtest/images/animfish.gif" xmlns="http://www.w3.org/1999/xhtml" />
+ </ttt>
+ </hbox>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/331292.html b/layout/generic/crashtests/331292.html
new file mode 100644
index 0000000000..dfc4cf60be
--- /dev/null
+++ b/layout/generic/crashtests/331292.html
@@ -0,0 +1,258 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en"><head>
+<title>Testcase bug 331292 - Loading page causes freeze, no Talkback, both WindowsXP & Linux</title>
+<style>
+.floatA{
+ width:110px;
+ float: left;
+ border:1px solid red;
+}
+.floatB{
+ width:430px;
+ float: left;
+ border:1px solid green;
+}
+.floatC{
+ width:430px;
+ float: left;
+ border:1px solid blue;
+}
+.floatclear{
+clear: both;
+}
+</style>
+</head>
+<body>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatB"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatC"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear">
+<div class="floatA"></div>
+<div class="floatclear"></div>
+</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
+</body></html>
diff --git a/layout/generic/crashtests/334105-1.xhtml b/layout/generic/crashtests/334105-1.xhtml
new file mode 100644
index 0000000000..6b5c135f89
--- /dev/null
+++ b/layout/generic/crashtests/334105-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<style>
+html { width: 2em; border: 1px solid red; }
+body { display: inline; }
+.padded { padding: 1em; border: 1px solid black; }
+#float1 { background: lightgreen; } /* float is added to this one dynamically */
+#float2 { float: right; background: lightblue; }
+</style>
+
+<script>
+
+function foo()
+{
+ document.getElementById("float1").style.cssFloat = "right";
+ document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", function() { setTimeout(foo, 30); }, false);
+
+</script>
+
+</head>
+
+<body>
+
+ X
+ <span id="float1">FFFFFF</span>
+ <span id="float2">GGGGGG</span>
+ <span class="padded"/>
+
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/334107-1.xhtml b/layout/generic/crashtests/334107-1.xhtml
new file mode 100644
index 0000000000..3e6b25a5c5
--- /dev/null
+++ b/layout/generic/crashtests/334107-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<p style="letter-spacing: -2em;">Foo</p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/334147-1.xhtml b/layout/generic/crashtests/334147-1.xhtml
new file mode 100644
index 0000000000..5490157224
--- /dev/null
+++ b/layout/generic/crashtests/334147-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<style>
+.x:first-letter { }
+.x { direction: rtl; }
+</style>
+
+</head>
+
+<body>
+
+<p class="x">2 3</p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/334148-1.xhtml b/layout/generic/crashtests/334148-1.xhtml
new file mode 100644
index 0000000000..dab5083246
--- /dev/null
+++ b/layout/generic/crashtests/334148-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+* { float: right; }
+* { display: list-item; }
+</style>
+</head>
+
+<body>
+
+<menupopup xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" />
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/334602-1.html b/layout/generic/crashtests/334602-1.html
new file mode 100644
index 0000000000..2bb820ebcf
--- /dev/null
+++ b/layout/generic/crashtests/334602-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<title>Testcase bug 334602 - ASSERTION: Reparenting something that has no usable parent? Shouldn't happen!: 'Not Reached'</title>
+<style>
+html::first-line { }
+html::before { content:"This should not give an assertion in Mozilla";}
+</style>
+</head>
+<body>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/337412-1.html b/layout/generic/crashtests/337412-1.html
new file mode 100644
index 0000000000..14f99c4017
--- /dev/null
+++ b/layout/generic/crashtests/337412-1.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<style>
+
+.columns {
+ column-width: 20em;
+ column-gap: 3em;
+}
+
+
+</style>
+
+</head>
+
+<body>
+
+<div class="columns">
+
+<ul>
+<li>XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX XXX!</li>
+</ul>
+
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/337883-1.html b/layout/generic/crashtests/337883-1.html
new file mode 100644
index 0000000000..b0c280ae2e
--- /dev/null
+++ b/layout/generic/crashtests/337883-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<html class="reftest-wait">
+<head>
+<script>
+
+function foop()
+{
+ document.getElementById("xxx").style.height = "10%";
+ document.getElementById("yyy").style.position = "relative";
+
+ document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", function(){setTimeout(foop, 30)});
+
+</script>
+</head>
+
+<body>--<a id="yyy"><IMG align="right"></a><br id="xxx">==</body></html>
+
diff --git a/layout/generic/crashtests/337883-2.html b/layout/generic/crashtests/337883-2.html
new file mode 100644
index 0000000000..bc9d532908
--- /dev/null
+++ b/layout/generic/crashtests/337883-2.html
@@ -0,0 +1,21 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<html class="reftest-wait">
+<head>
+<style id="s"></style>
+<script>
+
+function foop()
+{
+ var stylesheet = document.getElementById("s");
+ stylesheet.textContent = "#xxx { height: 10%; } #yyy { position: relative; }";
+
+ document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("load", function(){setTimeout(foop, 30)});
+
+</script>
+</head>
+
+<body>--<a id="yyy"><IMG align="right"></a><br id="xxx">==</body></html>
+
diff --git a/layout/generic/crashtests/339769-1.html b/layout/generic/crashtests/339769-1.html
new file mode 100644
index 0000000000..cf445be793
--- /dev/null
+++ b/layout/generic/crashtests/339769-1.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function foo()
+{
+ var div = document.getElementById("div");
+ div.remove();
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(foo, 0);">
+
+ <div id="div" style="display: inline;"><p>x</p></div>
+
+ <iframe src='data:text/html,<html><body><input value="q">'></iframe>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/342322-1.html b/layout/generic/crashtests/342322-1.html
new file mode 100644
index 0000000000..9d0d082616
--- /dev/null
+++ b/layout/generic/crashtests/342322-1.html
@@ -0,0 +1,28 @@
+<html class="reftest-wait">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var q1 = document.getElementById("q1");
+ var q2 = document.getElementById("q2");
+
+ q1.style.cssFloat = "right"
+ q2.style.cssFloat = "right"
+
+ setTimeout(function(){
+ q1.style.cssFloat = "none";
+ document.documentElement.removeAttribute("class");
+ }, 30);
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 30);">
+ <b id="q1">AAA</b>
+ <b id="q2">BBB</b>
+</body>
+</html>
diff --git a/layout/generic/crashtests/343206-1.xhtml b/layout/generic/crashtests/343206-1.xhtml
new file mode 100644
index 0000000000..5be6fc2a6a
--- /dev/null
+++ b/layout/generic/crashtests/343206-1.xhtml
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<style id="sty">
+html::before {
+ content: "before text";
+ float: right;
+}
+</style>
+
+<script>
+function boom()
+{
+ var sty = document.getElementById("sty");
+ sty.appendChild(document.createTextNode(" "));
+ document.documentElement.removeAttribute("class");
+}
+
+setTimeout(boom, 30);
+</script>
+
+</html>
diff --git a/layout/generic/crashtests/344557-1.html b/layout/generic/crashtests/344557-1.html
new file mode 100644
index 0000000000..cb65a67641
--- /dev/null
+++ b/layout/generic/crashtests/344557-1.html
@@ -0,0 +1,32 @@
+<html class="reftest-wait"><head>
+<title>Testcase bug 344557 - [columns] Crash [@ nsLineBox::DeleteLineList] with moz-column-count and generated content</title>
+<script>
+function removestyles(i){
+document.getElementsByTagName('div')[0].removeAttribute('style');
+document.documentElement.removeAttribute("class");
+}
+window.resizeTo(1440, 600);
+setTimeout(removestyles,200);
+</script>
+
+<style>
+ div::first-line, ul::first-line { text-transform: uppercase; font-size:110%;}
+sub::after, div::after { content:"anonymous text"; border:3px solid black;text-transform: uppercase;}
+sub::before, div::before { content:"before text"; font-size: 10px;}
+</style>
+</head>
+<body>
+
+<ul>
+ <sub>t</sub>
+ <div style="column-count: 3;">
+ <sub>t-column-councode&gt;text</sub>
+ <div style="column-count: 3;"><sub>text styletttmoztcolumntcountt 2;ttext</sub>
+ <div>
+ <sub>text</sub>
+ </div>
+ </div>
+ </div>
+</ul>
+
+</body></html>
diff --git a/layout/generic/crashtests/345139-1.xhtml b/layout/generic/crashtests/345139-1.xhtml
new file mode 100644
index 0000000000..1dfbe8f239
--- /dev/null
+++ b/layout/generic/crashtests/345139-1.xhtml
@@ -0,0 +1,53 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head style="display: none ! important;">
+
+<style>
+#a { direction: rtl; }
+#a { position: absolute; }
+#a { right: 5px; }
+#a { left: -10em; }
+#b { direction: ltr; }
+#b { width: 10%; }
+#b { display: -moz-inline-block; }
+#c { display: -moz-inline-block; }
+#e { display: -moz-inline-block; }
+#d { display: -moz-inline-block; }
+#d { padding: 5px 10px; }
+#d dl, #d dt, #d dd { display: inline; }
+#d dt { margin-left: 5px; }
+#d dd { margin-left: 2px; }
+#d dd:before { content: "="; }
+</style>
+
+<style id="newstyle"></style>
+<script>
+function change()
+{
+ document.getElementById("newstyle").appendChild(document.createTextNode("#b { white-space: pre; }"));
+ document.documentElement.removeAttribute("class");
+}
+</script>
+
+</head>
+
+<body onload="setTimeout(change, 1);">
+
+<div id="a"><div id="b">
+
+<div id="c"></div>
+
+<div id="d">
+<dl>
+<dt>0</dt><dd><span id="e">Accessibility Statement</span></dd>
+<dt>1</dt><dd>Main Page</dd>
+<dt>2</dt><dd>Skip to Content</dd>
+<dt>3</dt><dd>List of Posts</dd>
+<dt>4</dt><dd>Search</dd>
+<dt>p</dt><dd>Previous (individual/monthly archive page)</dd>
+</dl>
+</div>
+
+</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/345617-1.html b/layout/generic/crashtests/345617-1.html
new file mode 100644
index 0000000000..03de639582
--- /dev/null
+++ b/layout/generic/crashtests/345617-1.html
@@ -0,0 +1,8 @@
+<html>
+<body style="line-height: 30760827em;">
+
+x
+<p>y
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/348510-1.html b/layout/generic/crashtests/348510-1.html
new file mode 100644
index 0000000000..6e00e71f1b
--- /dev/null
+++ b/layout/generic/crashtests/348510-1.html
@@ -0,0 +1,7 @@
+<marquee>
+<a>
+<object>
+<dd>
+<form>
+</object>
+aaaaaaa
diff --git a/layout/generic/crashtests/348510-2.html b/layout/generic/crashtests/348510-2.html
new file mode 100644
index 0000000000..8f8c998cfd
--- /dev/null
+++ b/layout/generic/crashtests/348510-2.html
@@ -0,0 +1,7 @@
+<listing>
+<marquee>
+<aa>
+<object>
+<fieldset>
+</object>
+a \ No newline at end of file
diff --git a/layout/generic/crashtests/348887-1-inner.html b/layout/generic/crashtests/348887-1-inner.html
new file mode 100644
index 0000000000..ce296666d2
--- /dev/null
+++ b/layout/generic/crashtests/348887-1-inner.html
@@ -0,0 +1,21 @@
+<html><head>
+<style>
+blockquote::first-letter {float: right;}
+</style>
+<title>
+Testcase bug - Crash [@ nsFrameList::DestroyFrames] on reload with column-count, -moz-inline-block and blockquote::first-letter
+</title>
+</head>
+<body>
+This page should not crash on reload
+<div style=" column-count: 2;">
+<span style="display: table;"></span>
+<blockquote style="display: -moz-inline-block;">anonymous text</blockquote>
+</div>
+
+<script>
+document.location.reload();
+</script>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/348887-1.html b/layout/generic/crashtests/348887-1.html
new file mode 100644
index 0000000000..b865b4beb7
--- /dev/null
+++ b/layout/generic/crashtests/348887-1.html
@@ -0,0 +1,9 @@
+<html class="reftest-wait">
+<head>
+<script>
+setTimeout('document.documentElement.className = ""', 1000);
+</script>
+<body>
+<iframe src="348887-1-inner.html"></iframe>
+</body>
+</html>
diff --git a/layout/generic/crashtests/350370.html b/layout/generic/crashtests/350370.html
new file mode 100644
index 0000000000..6ab607e207
--- /dev/null
+++ b/layout/generic/crashtests/350370.html
@@ -0,0 +1,42 @@
+<html><head>
+<title>Testcase bug 350370 - Crash [@ ComputedStyle::FindChildWithRules] with ::first-line, appending rows and table-cells, etc</title>
+<style>
+#b td::first-line { font-size:110%;}
+nobr::first-line { font-size:110%;}
+
+#b td::after { content:"anonymous text"; }
+nobr::after{ content:"anonymous text"; }
+
+#b::before { content:"before text";}
+#b td::before { content:"before text";}
+</style>
+</head>
+<body>
+<table style="display: table-row;"></table><nobr style="display: list-item; column-count: 2;">
+<table id="b" style="display: inline;"></table>
+</nobr>
+<br>
+This page should not crash Mozilla
+<script>
+function doe(){
+ var td = document.createElement('td');;
+ td.setAttribute('height', '50%');
+ var tr = document.createElement('tr');;
+ tr.setAttribute('height', '50%');
+ tr.appendChild(td);
+ document.getElementsByTagName('table')[1].appendChild(tr);
+ document.body.offsetHeight;
+
+ var td = document.createElement('td');;
+ td.setAttribute('height', '50%');
+ document.getElementsByTagName('tr')[0].appendChild(td);
+ document.body.offsetHeight;
+
+ var td = document.createElement('td');;
+ td.setAttribute('height', '50%');
+ document.getElementsByTagName('tr')[0].appendChild(td);
+}
+setTimeout(doe, 60);
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/354458-1.html b/layout/generic/crashtests/354458-1.html
new file mode 100644
index 0000000000..69b8b2dca5
--- /dev/null
+++ b/layout/generic/crashtests/354458-1.html
@@ -0,0 +1,10 @@
+<html>
+
+<body>
+ <div style="height: 5px; column-count: 3;">
+ Text!
+ <span style="float: left">Float!</span>
+ </div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/354458-2.html b/layout/generic/crashtests/354458-2.html
new file mode 100644
index 0000000000..8e1d0a9710
--- /dev/null
+++ b/layout/generic/crashtests/354458-2.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"
+ "http://www.w3.org/TR/html4/strict.dtd">
+<html lang="en-US">
+<head>
+ <title></title>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+ <meta http-equiv="Content-Style-Type" content="text/css">
+ <style type="text/css">
+
+ p { margin: 0; }
+
+ </style>
+</head>
+<body>
+
+<div style="column-width: 10em; height: 2.5em">
+ text
+ <img src="../../../testing/crashtest/images/tree.gif" width="197" height="200" style="float:left">
+ <p>text</p>
+ <p>text</p>
+ <p>text</p>
+ <p>text</p>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/355426-1.html b/layout/generic/crashtests/355426-1.html
new file mode 100644
index 0000000000..87abaae088
--- /dev/null
+++ b/layout/generic/crashtests/355426-1.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+
+<script>
+
+function foo()
+{
+ document.getElementById("navish").style.display = "inline-block";
+}
+</script>
+
+</head>
+
+
+<body onload="foo()">
+
+<div style="column-count: 2;">
+ <ol id="ol1" style="height: 30px;">
+ <li>A</li>
+ <li><p id="p3" style="width: 1em;">Foo Foo Foo Foo Foo Foo Foo Foo Foo Foo Foo</p></li>
+ </ol>
+</div>
+
+<p id="navish">E</p>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/359371-1.html b/layout/generic/crashtests/359371-1.html
new file mode 100644
index 0000000000..8134a36cbb
--- /dev/null
+++ b/layout/generic/crashtests/359371-1.html
@@ -0,0 +1,66 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body {
+ width: 500px;
+}
+
+p {
+ font-family: monospace;
+ font-size: 12px;
+}
+.columns {
+ column-count: 3;
+}
+
+.toppadded
+{
+ padding-top: 20px;
+}
+
+.floatbox {
+ float: left;
+ margin: 3px 10px 0 0;
+ padding: 8px 3px;
+ width: 55px;
+}
+
+</style>
+</head>
+
+<body onload="document.getElementById('foo').appendChild(document.createTextNode('aaaaaaa'));">
+
+<div class="columns">
+
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+
+ <p id="foo">xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx </p>
+
+ <div class="toppadded">
+ T
+ <p class="floatbox">W W W W W W</p>
+ </div>
+
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/359371-2.html b/layout/generic/crashtests/359371-2.html
new file mode 100644
index 0000000000..98e2917c3c
--- /dev/null
+++ b/layout/generic/crashtests/359371-2.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body {
+ width: 500px;
+}
+
+p {
+ font-family: monospace;
+ font-size: 12px;
+}
+.columns {
+ column-count: 3;
+}
+
+.toppadded
+{
+ padding-top: 18px;
+}
+
+.floatbox {
+ float: left;
+ margin: 20px 0px 0 0;
+ width: 90px;
+}
+
+</style>
+</head>
+
+<!-- <body onload="document.getElementById('foo').appendChild(document.createTextNode('aaaaaaa'));"> -->
+<div class="columns">
+
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+ <p>C
+
+ <p id="foo">xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx </p>
+
+ <div class="toppadded">
+ T
+ <p class="floatbox">W W W W W W W W Waaaaaaa</p>
+ </div>
+
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/360599.html b/layout/generic/crashtests/360599.html
new file mode 100644
index 0000000000..210add23d8
--- /dev/null
+++ b/layout/generic/crashtests/360599.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<style>
+#b::first-letter { }
+#c::first-line { }
+</style>
+<title>Testcase bug 360599 - Crash [@ nsFrameList::DestroyFrames] with first-letter/first-line css and position: fixed</title>
+</head>
+<body>
+This page should not crash Mozilla
+<div id="c">
+ <table>
+ <div id="b" style="display:table-header-group;">
+ <q>
+ text
+ <div style="position:fixed;">
+ <q>y</q>
+ </div>
+ </q>
+ </div>
+ <span style="display: table;"></span>
+</div>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/361109.html b/layout/generic/crashtests/361109.html
new file mode 100644
index 0000000000..fef9c6be83
--- /dev/null
+++ b/layout/generic/crashtests/361109.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<title>Testcase bug 361109 - Crash [@ nsBlockBandData::Init] with position:fixed on select</title>
+</head>
+<body>
+This page should not crash Mozilla
+<select style="position: fixed;"><select>
+</body>
+</html>
diff --git a/layout/generic/crashtests/363448.html b/layout/generic/crashtests/363448.html
new file mode 100644
index 0000000000..960aa5445c
--- /dev/null
+++ b/layout/generic/crashtests/363448.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<title>Testcase bug 363448 - Crash [@ nsCachedStyleData::GetStyleData] with testcase, using floating and absolutely positioned iframes</title>
+</head>
+<body>
+This page should not crash Mozilla
+<div style="width:300px;">
+ <span id="b">
+ <iframe style="float: left;" id="a"></iframe>
+ <wbr>text
+ <iframe id="c" style="position: absolute;"></iframe>
+ </span>
+</div>
+
+<script>
+function stirdom(){
+ document.body.appendChild(document.getElementById('a'));
+ document.getElementById('b').appendChild(document.getElementById('c'));
+}
+setTimeout(stirdom,200);
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/363722-1.html b/layout/generic/crashtests/363722-1.html
new file mode 100644
index 0000000000..f83671c5ab
--- /dev/null
+++ b/layout/generic/crashtests/363722-1.html
@@ -0,0 +1,9 @@
+<html>
+<body>
+ <marquee style="background: yellow;">
+ <marquee style="background: lightgreen;">
+ I am a double-marquee.
+ </marquee>
+ </marquee>
+</body>
+</html>
diff --git a/layout/generic/crashtests/363722-2.html b/layout/generic/crashtests/363722-2.html
new file mode 100644
index 0000000000..1a12a227e8
--- /dev/null
+++ b/layout/generic/crashtests/363722-2.html
@@ -0,0 +1,10 @@
+<html>
+<body>
+ <marquee style="background: yellow;">
+ [inside OUTER marquee]
+ <marquee style="background: lightgreen;">
+ [inside INNER marquee]
+ </marquee>
+ </marquee>
+</body>
+</html>
diff --git a/layout/generic/crashtests/364220.html b/layout/generic/crashtests/364220.html
new file mode 100644
index 0000000000..63a927b450
--- /dev/null
+++ b/layout/generic/crashtests/364220.html
@@ -0,0 +1,17 @@
+<html><head>
+<title>Testcase bug 364220 - [reflow branch][columns] Crash [@ nsLineLayout::ReflowFrame] using moz-column-count, floats, generated content and first-line</title>
+<style>
+body > span::first-line { }
+span::before { content:"before text"; border:3px solid black;}
+</style>
+</head>
+<body>
+
+<span style=" float: left; column-count: 2;">
+ <span style="float: right;">
+ <span style=" float: right;column-count: 2;"></span>
+ </span>
+</span>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/364407-1.html b/layout/generic/crashtests/364407-1.html
new file mode 100644
index 0000000000..2ae181886b
--- /dev/null
+++ b/layout/generic/crashtests/364407-1.html
@@ -0,0 +1,44 @@
+<html>
+<body>
+
+<div style="overflow: scroll">
+ <table border="1">
+ <tr>
+ <td>
+ <select style="height: 200%">
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ <option>Option</option>
+ </select>
+ </td>
+ </tr>
+ </table>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/364686-1.xhtml b/layout/generic/crashtests/364686-1.xhtml
new file mode 100644
index 0000000000..93a1eeaa4b
--- /dev/null
+++ b/layout/generic/crashtests/364686-1.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<body>
+
+<math:merror>
+ <img/>
+</math:merror>
+
+</body>
+</html>
+
diff --git a/layout/generic/crashtests/366021-1.xhtml b/layout/generic/crashtests/366021-1.xhtml
new file mode 100644
index 0000000000..5bbc7fe185
--- /dev/null
+++ b/layout/generic/crashtests/366021-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("xulwin").appendChild(document.getElementById("sss"));
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+
+<body onload="setTimeout(boom, 10)">
+
+<span id="sss"><tr><td style="position: absolute;">td</td></tr></span>
+
+<window id="xulwin" xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"></window>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/366667-1.html b/layout/generic/crashtests/366667-1.html
new file mode 100644
index 0000000000..a50ce84e48
--- /dev/null
+++ b/layout/generic/crashtests/366667-1.html
@@ -0,0 +1,6 @@
+<html>
+ <body>
+ <span><span style="display: -moz-inline-box"><img></span></span>
+ </body>
+</html>
+
diff --git a/layout/generic/crashtests/366952-1.html b/layout/generic/crashtests/366952-1.html
new file mode 100644
index 0000000000..c210b77b78
--- /dev/null
+++ b/layout/generic/crashtests/366952-1.html
@@ -0,0 +1,17 @@
+<html>
+
+<head>
+</head>
+
+<body>
+
+<div style="display: -moz-inline-box;">
+ <div style="padding-right: 3%;">
+ <div style="position: fixed;">
+ Foo
+ </div>
+ </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/367246-1.html b/layout/generic/crashtests/367246-1.html
new file mode 100644
index 0000000000..5a5a845650
--- /dev/null
+++ b/layout/generic/crashtests/367246-1.html
@@ -0,0 +1,9 @@
+<html>
+<body>
+
+<div style="direction: rtl">
+ <div style="padding: 10px; width: 1px; overflow: scroll;">Foopy</div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/367360.html b/layout/generic/crashtests/367360.html
new file mode 100644
index 0000000000..21a4f5e750
--- /dev/null
+++ b/layout/generic/crashtests/367360.html
@@ -0,0 +1,30 @@
+<html><head>
+<title>Testcase bug - Crash [@ nsHTMLButtonControlFrame::GetContentInsertionFrame] with column-count and display: list-item</title>
+</head>
+<body>
+<div style="display: table;">
+text
+<listing style="column-count: 2;">
+<dl>
+
+
+
+
+
+
+
+
+tesxt
+
+
+<menu>
+<span style="display: list-item; column-count: 1;">
+<span style="display: list-item; column-count: 1;">
+text
+</span></span>
+</menu>
+<div>text</div>
+</dl>
+</listing>
+</div>
+</body></html>
diff --git a/layout/generic/crashtests/368330-1.html b/layout/generic/crashtests/368330-1.html
new file mode 100644
index 0000000000..1a4c93e39f
--- /dev/null
+++ b/layout/generic/crashtests/368330-1.html
@@ -0,0 +1,15 @@
+<html>
+
+<body>
+
+<div style="width: 1px">
+ <h3 style="float: right;">Foo bar</h3>
+ <ul>
+ <li style="float: right;">E</li>
+ <li style="float: right;">PPP XXXXXX</li>
+ </ul>
+</div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/368461-1.xhtml b/layout/generic/crashtests/368461-1.xhtml
new file mode 100644
index 0000000000..d5baccf523
--- /dev/null
+++ b/layout/generic/crashtests/368461-1.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<head>
+</head>
+
+<body>
+
+<p><math:msubsup><span>Foo bar baz<td></td></span></math:msubsup></p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/368568.html b/layout/generic/crashtests/368568.html
new file mode 100644
index 0000000000..337f84b4bf
--- /dev/null
+++ b/layout/generic/crashtests/368568.html
@@ -0,0 +1,14 @@
+<html><head>
+<style>
+*::first-line { }
+*::after { content:"anonymous text"; }
+*::before { content:"before text"; }
+</style>
+</head>
+<body>
+
+<ol style="overflow: hidden; float: right; column-count: 3;">
+<span style="overflow: auto; float: left;"></span>
+</ol>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/368752.html b/layout/generic/crashtests/368752.html
new file mode 100644
index 0000000000..07d5c7002a
--- /dev/null
+++ b/layout/generic/crashtests/368752.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait"><head>
+<title>Testcase bug - Crash [@ nsIFrame::Invalidate] with display: inherit, large margin and padding and generated content</title>
+<script>
+function addstyle(){
+var x=document.createElementNS('http://www.w3.org/1999/xhtml','style');
+x.innerHTML='body::before {content: "text"; }';
+document.documentElement.appendChild(x);
+document.documentElement.offsetHeight;
+document.documentElement.removeAttribute("class");
+}
+</script>
+
+</head>
+<body onload="setTimeout(addstyle,0);">
+<div style="display: table;">
+<div style="display: inherit;float: left;margin-bottom: -9999999px;padding-top: 9999999999px;">
+<span style="position: fixed;">t</span>
+</div>
+</div>
+</body></html>
diff --git a/layout/generic/crashtests/368860-1.html b/layout/generic/crashtests/368860-1.html
new file mode 100644
index 0000000000..f38b5b3c43
--- /dev/null
+++ b/layout/generic/crashtests/368860-1.html
@@ -0,0 +1,12 @@
+<html>
+
+<head></head>
+
+<body>
+
+<table border="1"><tr><td>
+ <span>&rlm;X</span>
+</td></tr></table>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/368863-1.html b/layout/generic/crashtests/368863-1.html
new file mode 100644
index 0000000000..b4551e41df
--- /dev/null
+++ b/layout/generic/crashtests/368863-1.html
@@ -0,0 +1,5 @@
+<style>
+*::first-line { }
+*::before { content:"before text";}
+</style>
+<object style="position: fixed;column-count: 100;"><ol style="float: right;"> \ No newline at end of file
diff --git a/layout/generic/crashtests/369150-1.html b/layout/generic/crashtests/369150-1.html
new file mode 100644
index 0000000000..b492c0a06d
--- /dev/null
+++ b/layout/generic/crashtests/369150-1.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+
+<script>
+
+function boom()
+{
+ document.getElementById("frameset").appendChild(document.createTextNode(""));
+ document.getElementById("frameset").setAttribute("rows", "100%, *");
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+ <frameset id="frameset" cols="130, *" onload="setTimeout(boom, 30);">
+ <frame src="data:text/html,foo">
+ <frame src="data:text/html,bar">
+ </frameset>
+
+</html>
diff --git a/layout/generic/crashtests/369150-2.html b/layout/generic/crashtests/369150-2.html
new file mode 100644
index 0000000000..59215b14a6
--- /dev/null
+++ b/layout/generic/crashtests/369150-2.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<title>Bug 369150 - Crash [@ nsHTMLFramesetFrame::GetNoResize] with dynamic changes</title>
+<script>
+
+function boom()
+{
+ document.getElementById("frameset").appendChild(document.createElement("frame"));
+ document.getElementById("frameset").setAttribute("rows", "100%, *");
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+ <frameset id="frameset" cols="130, *" onload="setTimeout(boom, 30);">
+ <frame src="data:text/html,foo">
+ <frame src="data:text/html,bar">
+ </frameset>
+
+</html>
diff --git a/layout/generic/crashtests/369227-1.xhtml b/layout/generic/crashtests/369227-1.xhtml
new file mode 100644
index 0000000000..7a61e4c202
--- /dev/null
+++ b/layout/generic/crashtests/369227-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>document.documentElement.offsetHeight</script>
+</head>
+<body>
+
+<div style="height: 3000px; background: lightgreen;"/>
+
+<div style="width: 4px; float: left; background: yellow;">
+ A
+ <span style="padding: 5px">
+ <span style="float: left;" />
+ </span>
+ Z
+</div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/369542-1.html b/layout/generic/crashtests/369542-1.html
new file mode 100644
index 0000000000..ff62a3d05c
--- /dev/null
+++ b/layout/generic/crashtests/369542-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+<style>
+body::first-letter { float: right; }
+body::before { content:"before text"; }
+</style>
+</head><body></body></html>
diff --git a/layout/generic/crashtests/369542-2.html b/layout/generic/crashtests/369542-2.html
new file mode 100644
index 0000000000..b2c2085919
--- /dev/null
+++ b/layout/generic/crashtests/369542-2.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<style>
+html::first-letter { float: right; }
+html::before { content:"before text"; float:right; }
+span::before { content:"before text"; float:right; }
+</style>
+</head>
+<body>
+<span>
+ <div></div>
+</span>
+<button onclick="document.body.style.width='100px'">Click</button>
+</body>
+</html>
diff --git a/layout/generic/crashtests/369547-1.html b/layout/generic/crashtests/369547-1.html
new file mode 100644
index 0000000000..2f7516d350
--- /dev/null
+++ b/layout/generic/crashtests/369547-1.html
@@ -0,0 +1,16 @@
+<html class="reftest-wait"><head><script>
+function doe2() {
+document.getElementById('a').setAttribute('style', 'display: inline-block;');
+document.body.offsetHeight;
+document.getElementById('b').removeAttribute('style');
+document.body.offsetHeight;
+document.documentElement.className = '';
+}
+setTimeout(doe2,200,0);
+</script>
+</head>
+<body style="display: -moz-inline-box;"><span style="display: inline-block;"><span style="display: inline-block;"></span></span><span id="a">
+<iframe></iframe>
+<div id="b" style="display: table-footer-group;"></div>
+</span></body>
+</html>
diff --git a/layout/generic/crashtests/370174-1.html b/layout/generic/crashtests/370174-1.html
new file mode 100644
index 0000000000..57493a7d3d
--- /dev/null
+++ b/layout/generic/crashtests/370174-1.html
@@ -0,0 +1,566 @@
+<html>
+<head>
+<style style="display: none; direction: ltr;">
+<label style="display: table-column-group;direction: rtl;">
+</big>
+</textarea>
+</q>
+<q style="display: table-row;direction: ltr;">
+</span>
+</ol>
+</dir>
+<html style="display: table-row;direction: rtl;">
+</strong>
+<basefont style="display: inline-table;direction: auto;">
+<map style="display: table-footer-group;direction: ltr;">
+<dir="rtl" style="display: inline-block;direction: ltr;">
+<center style="display: none;direction: ltr;">
+<style style="display: block;direction: auto;">
+<samp style="display: -moz-inline-box;direction: rtl;">
+<noframes style="display: inline;direction: rtl;">
+<code style="display: table-header-group;direction: ltr;">
+</li>
+</body>
+</div>
+<embed style="display: table-header-group;direction: auto;">
+</table>
+</fieldset>
+<legend style="display: table-row;direction: auto;">
+</ul>
+<canvas style="display: table;direction: ltr;">
+<font style="display: inline-table;direction: auto;">
+</option>
+</code>
+</menu>
+<thead style="display: inline-table;direction: rtl;">
+</button>
+</div>
+</ol>
+</isindex>
+<code style="display: table-row-group;direction: rtl;">
+<dl style="display: table-row;direction: ltr;">
+<style style="display: table-footer-group;direction: ltr;">
+<marquee style="display: table-row;direction: auto;">
+</object>
+</hx>
+<nobr style="display: table-cell;direction: rtl;">
+<a style="display: table-header-group;direction: ltr;">
+</thead>
+<tr style="display: table-caption;direction: ltr;">
+<tr style="display: table-row;direction: rtl;">
+<base style="display: inline;direction: auto;">
+</input>
+<hx style="display: inline-block;direction: auto;">
+<link style="display: table-column;direction: rtl;">
+<code style="display: inline;direction: ltr;">
+<li style="display: table-column-group;direction: ltr;">
+</dd>
+</spacer>
+<address style="display: table-header-group;direction: auto;">
+</object>
+</hx>
+</th>
+</sup>
+<u style="display: -moz-inline-box;direction: auto;">
+</del>
+<bdo style="display: table-column-group;direction: ltr;">
+<param style="display: block;direction: auto;">
+<td rowspan="5" style="display: inline-table;direction: rtl;">
+<head style="display: none;direction: ltr;">
+</abbr>
+<address style="display: table-row;direction: rtl;">
+</input type="password">
+</li>
+<area style="display: -moz-inline-box;direction: ltr;">
+</noframes>
+</b>
+</input type="image">
+<title style="display: -moz-inline-box;direction: ltr;">
+</font>
+<blockquote style="display: table-column-group;direction: auto;">
+<area style="display: none;direction: auto;">
+</script>
+<colgroup style="display: -moz-inline-box;direction: auto;">
+<font style="display: list-item;direction: auto;">
+<isindex style="display: table-cell;direction: ltr;">
+<sup style="display: table-footer-group;direction: ltr;">
+<abbr style="display: block;direction: auto;">
+<address style="display: table-caption;direction: rtl;">
+</span>
+</code>
+</strong>
+<select style="display: table-cell;direction: auto;">
+<dl style="display: inline-table;direction: rtl;">
+</small>
+</listing>
+<colgroup style="display: table-header-group;direction: rtl;">
+<title style="display: none;direction: auto;">
+</input type="submit">
+<tbody style="display: table-column-group;direction: rtl;">
+</blink>
+<i style="display: table;direction: ltr;">
+</td>
+</dir>
+</tt>
+</a<bgsound style="display: inline;direction: auto;">
+<multicol style="display: -moz-inline-box;direction: auto;">
+</th>
+</font>
+</base>
+<textarea style="display: inline-block;direction: ltr;">
+<frameset style="display: list-item;direction: rtl;">
+</span>
+<blockquote style="display: table-caption;direction: auto;">
+</code>
+<dir style="display: inline-table;direction: rtl;">
+<fieldset style="display: table-column;direction: ltr;">
+</kbd>
+<noframes style="display: none;direction: rtl;">
+</spacer type="block">
+</i>
+<area style="display: table-column-group;direction: ltr;">
+<form style="display: none;direction: rtl;">
+<tt style="display: table-row;direction: auto;">
+</bdo>
+</th>
+<cite style="display: none;direction: auto;">
+</td colspan="5">
+</dir>
+</noscript>
+<spacer style="display: table-caption;direction: rtl;">
+</legend>
+<ins style="display: table-row-group;direction: rtl;">
+</multicol>
+</base>
+</img>
+<nobr style="display: table-header-group;direction: auto;">
+</map>
+<br style="display: none;direction: rtl;">
+</spacer type="block">
+<table style="display: table-row-group;direction: ltr;">
+</td rowspan="5">
+</caption>
+<embed style="display: inline-table;direction: auto;">
+</script>
+<style style="display: list-item;direction: rtl;">
+</nobr>
+<button style="display: table-column;direction: auto;">
+</select>
+</strike>
+<hx style="display: table-header-group;direction: ltr;">
+</bdo>
+<td rowspan="5" style="display: none;direction: ltr;">
+</code>
+<input type="hidden" style="display: table;direction: auto;">
+<spacer type="block" style="display: inline-block;direction: ltr;">
+</marquee>
+</dir="rtl">
+</html>
+<le</i>gend style="display: table-caption;direction: ltr;">
+<sup style="display: table-column-group;direction: ltr;">
+</address>
+<title style="display: none;direction: rtl;">
+<font style="display: table-row;direction: ltr;">
+<ol style="display: inline-table;direction: rtl;">
+</th>
+</link>
+</isindex>
+</iframe>
+<th style="display: table;direction: rtl;">
+</hx>
+<object style="display: table-caption;direction: auto;">
+</embed>
+<small style="display: block;direction: auto;">
+</abbr>
+<object style="display: inline-table;direction: ltr;">
+<div style="display: table-column-group;direction: auto;">
+</i>
+</u>
+</wbr>
+<abbr style="display: inline;direction: ltr;">
+</sub>
+<dir style="display: block;direction: auto;">
+</small>
+</code>
+<style style="display: table-column;direction: ltr;">
+<fieldset style="display: table-cell;direction: rtl;">
+</b>
+<blockquote style="display: table-header-group;direction: rtl;">
+<q style="display: inline;direction: auto;">
+<iframe style="display: block;direction: rtl;">
+<button style="display: table-footer-group;direction: auto;">
+</s>
+</caption>
+<input type="submit" style="display: inline-block;direction: auto;">
+</wbr>
+</link>
+</sub>
+<dt style="display: table-column-group;direction: auto;">
+<noscript style="display: table-cell;direction: ltr;">
+<spacer type="block" style="display: inline-table;direction: rtl;">
+<dl style="display: inline;direction: auto;">
+<thead style="display: table-row;direction: auto;">
+</td>
+</strike>
+<body style="display: inline;direction: auto;">
+<img style="display: table-column;direction: rtl;">
+</input type="hidden">
+</label>
+<img src="fish.gif" style="display: inline-table;direction: auto;">
+</ins>
+<img src="fish.gif" style="display: block;direction: rtl;">
+</caption>
+<abbr style="display: table-header-group;direction: auto;">
+</meta>
+<area style="display: list-item;direction: auto;">
+<ul style="display: table-row-group;direction: rtl;">
+<img style="display: table-cell;direction: rtl;">
+</nobr>
+<blockquote style="display: table;direction: ltr;">
+<a style="display: table-header-group;direction: auto;">
+</basefont>
+</tbody>
+<dt style="display: table-footer-group;direction: auto;">
+</address>
+<strong style="display: table-header-group;direction: auto;">
+<strong style="display: table-row;direction: rtl;">
+<u style="display: table;direction: rtl;">
+</font>
+</dir>gend style="display: ta<samp style="display: table-row-group;direction: rt<kbd style="display: table-column;direction: auto;">
+<acronym style="display: table-footer-group;direction: auto;">
+</html>
+</cite>
+</keygen>
+<kbd style="display: none;direction: ltr;">
+</spacer>
+<div style="display: inline;direction: rtl;">
+</marquee>
+</code>
+<select style="display: table-cell;direction: rtl;">
+<i style="display: none;direction: rtl;">
+<bgsound style="display: table-header-group;direction: ltr;">
+</isindex>
+<table style="display: none;direction: rtl;">
+</td>
+<bgsound style="display: inline-table;direction: rtl;">
+<canvas style="display: inline-table;direction: ltr;">
+<textarea style="display: table-header-group;direction: auto;">
+</tbody>
+</li>
+</th>
+</body>
+<th style="display: inline;direction: ltr;">
+</sub>
+</sup>
+<li style="display: table;direction: ltr;">
+<l<sup style="display: none;direction: ltr;">
+</bgsound>
+<select style="display: table-row;direction: auto;">
+</del>
+</cite>
+</img>
+<abbr style="display: table-row;direction: ltr;">
+<multicol style="display: table;direction: ltr;">
+<style style="display: inline-table;direction: ltr;">
+<code style="display: table-caption;direction: ltr;">
+</tbody>
+<button style="display: -moz-inline-box;direction: rtl;">
+<basefont style="display: table-column-group;direction: auto;">
+<img style="display: inline;direction: auto;">
+<wbr style="display: table-row;direction: rtl;">
+</isindex>
+<html style="display: table-footer-group;direction: rtl;">
+</nobr>
+<col style="display: table-column;direction: ltr;">
+</li>
+<fieldset style="display: table-row-group;direction: auto;">
+<a style="display: inline;direction: rtl;">
+</textarea>
+<input type="hidden" style="display: table;direction: auto;">
+</td rowspan="5">
+</wbr>
+</script>
+</optgroup>
+</noframes>
+<le</i>
+</label>
+</li>
+<frame style="display: table-footer-group;direction: ltr;">
+<noscript style="display: table-column;direction: ltr;">
+<thead style="display: none;direction: rtl;">
+</blink>
+<style style="display: -moz-inline-box;direction: ltr;">
+</strike>
+<noframes style="display: -moz-inline-box;direction: auto;">
+</u>
+</frame>
+</big>
+</strike>
+<label style="display: table-cell;direction: rtl;">
+</p>
+</optgroup>
+<kbd style="display: table-row-group;direction: rtl;">
+<hx style="display: block;direction: ltr;">
+</spacer type="block">
+<strike style="display: -moz-inline-box;direction: rtl;">
+</td>
+<input type="submit" style="display: inline-block;direction: auto;">
+</fieldset>
+</dir="rtl">
+<label style="display: list-item;direction: rtl;">
+<base style="display: -moz-inline-box;direction: ltr;">
+<iframe style="display: table-footer-group;direction: ltr;">
+</link>
+</s>
+<sup style="display: table-row;direction: rtl;">
+</colgroup>
+<map style="display: inline;direction: rtl;">
+<script style="display: -moz-inline-box;direction: auto;">
+<spacer style="display: list-item;direction: auto;">
+</acronym>
+<spacer style="display: none;direction: rtl;">
+</spacer>
+</menu>
+</blockquote>
+<a style="display: table;direction: ltr;">
+</big>
+<script style="display: table-column;direction: auto;">
+</dd>
+<div style="display: table-caption;direction: rtl;">
+</object>
+<label style="display: block;direction: ltr;">
+<colgroup style="display: table;direction: rtl;">
+</cite>
+<ol style="display: inline-table;direction: auto;">
+</cite>
+</small>
+</big>
+<input type="hidden" style="display: inline-table;direction: auto;">
+<big style="display: -moz-inline-box;direction: rtl;">
+<strong style="display: table-row-group;direction: rtl;">
+<dd style="display: block;direction: ltr;">
+</font>
+<dt style="display: list-item;direction: rtl;">
+<cite style="display: table-header-group;direction: rtl;">
+<em style="display: table-row-group;direction: rtl;">
+<basefont style="display: table-column;direction: rtl;">
+<legend style="display: -moz-inline-box;direction: auto;">
+</img>
+<tt style="display: table-row-group;direction: ltr;">
+<link style="display: table-caption;direction: ltr;">
+<q style="display: block;direction: ltr;">
+</title>
+</bdo>
+</meta>
+</iframe>
+<b style="display: table-header-group;direction: rtl;">
+<script style="display: block;direction: auto;">
+</link>
+</embed>
+<code style="display: -moz-inline-box;direction: rtl;">
+</select>
+</label>
+</hx>
+</td>
+</textarea>
+<q style="display: none;direction: rtl;">
+<del style="display: table-cell;direction: auto;">
+<input type="submit" style="display: -moz-inline-box;direction: rtl;">
+<tfoot style="display: inline;direction: rtl;">
+</abbr>
+</tr>
+<strike style="display: inline;direction: rtl;">
+</big>
+<input type="hidden" style="display: inline-block;direction: rtl;">
+</strong>
+<q style="display: table-header-group;direction: rtl;">
+</big>
+<tr style="display: list-item;direction: auto;">
+</object>
+</input type="hidden">
+</bdo>
+</thead>
+</span>
+</tt>
+</listing>
+</blink>
+</dfn>
+</b>
+</a>
+</tt>
+</dir>
+</a<nobr</keygen> styl<sup style="display: -moz-inline-box;direction: ltr<ol style="display: table;direction: auto;">
+</span>
+</ins>
+<div style="display: table-row-group;direction: auto;">
+<pre style="display: -moz-inline-box;direction: rtl;">
+</tfoot>
+<frameset style="display: table-footer-group;direction: auto;">
+</img>
+</keygen>
+<span style="display: table-caption;direction: auto;">
+</samp>
+</object>
+<code style="display: table-row-group;direction: ltr;">
+<sup style="display: table-column-group;direction: ltr;">
+<frame style="display: table-cell;direction: ltr;">
+</spacer type="block">
+<button style="display: table-caption;direction: rtl;">
+<td style="display: table;direction: ltr;">
+<td colspan="5" style="display: inline-table;direction: ltr;">
+<pre style="display: inline-table;direction: ltr;">
+<object style="display: table-row-group;direction: auto;">
+</a>
+</tt>
+</optgroup>
+</span>
+<style style="display: table-footer-group;direction: auto;">
+<hx style="display: block;direction: rtl;">
+<spacer style="display: list-item;direction: auto;">
+</title>
+<ins style="display: table-column;direction: auto;">
+</object>
+</br>
+<frameset style="display: inline-block;direction: rtl;">
+<span style="display: block;direction: auto;">
+<kbd style="display: list-item;direction: auto;">
+<dir style="display: table;direction: rtl;">
+</address>
+</cite>
+</big>
+<optgroup style="display: inline-block;direction: ltr;">
+</fieldset>
+</base>
+<input type="image" style="display: inline-block;direction: ltr;">
+</object>
+<col style="display: table-row-group;direction: auto;">
+<noscript style="display: none;direction: auto;">
+</blink>
+</script>
+<input type="hidden" style="display: -moz-inline-box;direction: rtl;">
+<ul style="display: -moz-inline-box;direction: rtl;">
+</menu>
+<sup style="display: table-row-group;direction: ltr;">
+<tr style="display: table-column;direction: auto;">
+<ul style="display: table-row;direction: ltr;">
+<noscript style="display: table;direction: ltr;">
+</i>
+</dir="rtl">
+</input type="submit">
+</cite>
+</code>
+<title style="display: table-footer-group;direction: rtl;">
+<sub style="display: block;direction: rtl;">
+</code>
+</acronym>
+</caption>
+</code>
+</font>
+</em>
+</optgroup>
+<multicol style="display: table-row-group;direction: auto;">
+<bdo style="display: list-item;direction: auto;">
+<canvas style="display: table-header-group;direction: rtl;">
+</form>
+<tt style="display: table-footer-group;direction: ltr;">
+<frame style="display: -moz-inline-box;direction: rtl;">
+</multicol>
+</acronym>
+<em style="display: -moz-inline-box;direction: ltr;">
+</wbr>
+<legend style="display: inline-block;direction: auto;">
+</samp>
+</var>
+<dir style="display: table-footer-group;direction: auto;">
+</title>
+</input type="submit">
+<spacer style="display: inline-block;direction: auto;">
+<ol style="display: table-header-group;direction: ltr;">
+</option>
+<i style="display: list-item;direction: rtl;">
+</caption>
+</spacer>
+</noframes>
+</sub>
+</tfoot>
+</legend>
+</select>
+<marquee style="display: table-caption;direction: ltr;">
+<script style="display: table-footer-group;direction: rtl;">
+</q>
+</strong>
+</code>
+</div>
+</code>
+</td>
+</optgroup>
+<map style="display: table-row-group;direction: ltr;">
+</marquee>
+<optgroup style="display: none;direction: ltr;">
+<hr style="display: table-row-group;direction: rtl;">
+</br>
+<param style="display: table-row;direction: ltr;">
+</dfn>
+</keygen>
+<param style="display: none;direction: ltr;">
+<legend style="display: list-item;direction: ltr;">
+<b style="display: list-item;direction: ltr;">
+</bdo>
+</dfn>
+</option>
+</input>
+</u>
+</code>
+<ul style="display: table-header-group;direction: ltr;">
+</thead>
+</span>
+</link>
+<img src="fish.gif" style="display: inline-table;direction: auto;">
+</menu>
+<u style="display: table-row;direction: rtl;">
+</cite>
+<listing style="display: inline-block;direction: auto;">
+</style>
+</head>
+<body>
+<code style="display: table-row-group; direction: ltr;">
+<button style="display: list-item; direction: ltr;">
+<kbd style="display: table-row; direction: rtl;">
+<input style="display: list-item; direction: rtl;" type="hidden">
+<iframe style="display: table-column-group;">
+</iframe>gend style="display: ta<samp style="display: table-row-group;" display:="" table-column;direction:="" auto;="">
+</samp>
+</kbd>
+</button>
+</code>
+<script>
+//<![CDATA[
+/*template*/
+var doc = document;
+if (document.getElementById('content'))
+ doc = document.getElementById('content').contentDocument;var tt;
+var l=0;
+function replacestyles(i){
+l++;
+window.status=l+':'+i;
+if (l>70)
+ return;
+var x=doc.getElementsByTagName('*');
+
+if (x[i] && x[i+1])
+ {
+var temp = x[i+1].getAttribute('style');
+x[i+1].setAttribute('style', x[i].getAttribute('style'));
+x[i].setAttribute('style', temp);
+}
+else { i = 0;}
+ i++;
+tt=setTimeout(replacestyles,10,i);
+}
+//window.onmousedown=function(){clearTimeout(tt);}
+tt=setTimeout(replacestyles,100,0);
+/*template*/
+//]]>
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/370174-2.html b/layout/generic/crashtests/370174-2.html
new file mode 100644
index 0000000000..fd96496364
--- /dev/null
+++ b/layout/generic/crashtests/370174-2.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+<title>Bug 370174 – Crash [@ FindBlockFrameOrBR] with unminimised testcase triple-clicking at the bottom of the page</title>
+</head>
+<body>
+<script>
+function doe() {
+document.documentElement.innerHTML = '';
+}
+setTimeout(doe, 300);
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/370174-3.html b/layout/generic/crashtests/370174-3.html
new file mode 100644
index 0000000000..dbcc4595d7
--- /dev/null
+++ b/layout/generic/crashtests/370174-3.html
@@ -0,0 +1,25 @@
+<HTML><HEAD style="display: table-row;"></HEAD>
+<BODY style="display: table-row;">
+<CODE>
+<span>
+<IFRAME style="display:table-column-group;"></IFRAME>
+</span>
+</CODE>
+<span style="display:table-column-group;"></span>
+<SCRIPT>
+function doe2() {
+document.body.setAttribute('style', '');
+document.getElementsByTagName('head')[0].setAttribute('style', '');
+document.body.offsetHeight;
+document.getElementsByTagName('span')[0].setAttribute('style', 'display: table-row;');
+}
+setTimeout(doe2,100);
+
+function tripleclick(){
+var wu = SpecialPowers.DOMWindowUtils;
+wu.sendMouseEvent('mousedown', 500, 500, 0, 3, 0);
+setTimeout(tripleclick,20);
+}
+setTimeout(tripleclick,200);
+</SCRIPT>
+</BODY></HTML>
diff --git a/layout/generic/crashtests/370699-1.html b/layout/generic/crashtests/370699-1.html
new file mode 100644
index 0000000000..d977c937ab
--- /dev/null
+++ b/layout/generic/crashtests/370699-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+</head>
+
+<body style="width: 100px; border: 2px solid yellow;">
+
+<span style="position: relative;">
+ <img width="200" height="100" align="left">
+ <span style="position:absolute; float:left;"></span>
+ Foo
+</span>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/370794-1.html b/layout/generic/crashtests/370794-1.html
new file mode 100644
index 0000000000..d4f489d146
--- /dev/null
+++ b/layout/generic/crashtests/370794-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="overflow: hidden; padding-right: 3%;">
+ <h2 style="position: fixed;">H2</h2>
+</div>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/370884-1.xhtml b/layout/generic/crashtests/370884-1.xhtml
new file mode 100644
index 0000000000..3959d4b178
--- /dev/null
+++ b/layout/generic/crashtests/370884-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+
+<body>
+
+<math:mroot>
+ <div>
+ <div style="position: fixed;">Y</div>
+ </div>
+</math:mroot>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/371348-1.xhtml b/layout/generic/crashtests/371348-1.xhtml
new file mode 100644
index 0000000000..1b2252f11b
--- /dev/null
+++ b/layout/generic/crashtests/371348-1.xhtml
@@ -0,0 +1,41 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ class="reftest-wait">
+
+<head>
+<script>
+
+function boom()
+{
+ var span = document.getElementById("span");
+ var table = document.getElementById("table");
+
+ table.appendChild(span);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+
+<body onload="setTimeout(boom, 20)">
+
+<span id="span"></span>
+
+<table id="table">
+ <tbody>
+ <tr>
+ <td style="float: left">
+ Table
+ <xul:box>
+ <input type="checkbox"/>
+ </xul:box>
+ cell
+ </td>
+ </tr>
+ </tbody>
+</table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/371561-1.html b/layout/generic/crashtests/371561-1.html
new file mode 100644
index 0000000000..bce6075c48
--- /dev/null
+++ b/layout/generic/crashtests/371561-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+ <body>
+ <div style="position: relative; display: inline;">
+ <table style="position: absolute;"><tr><td></td></tr></table>
+ </div>
+ <body>
+</html>
diff --git a/layout/generic/crashtests/371566-1.xhtml b/layout/generic/crashtests/371566-1.xhtml
new file mode 100644
index 0000000000..e85cc9f08d
--- /dev/null
+++ b/layout/generic/crashtests/371566-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+ <div style="display: -moz-inline-box;">
+ <div style="float: left; padding-right: 3%">
+ <div style="position: absolute;"></div>
+ </div>
+ </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/372376-1.xhtml b/layout/generic/crashtests/372376-1.xhtml
new file mode 100644
index 0000000000..ddb7d2d179
--- /dev/null
+++ b/layout/generic/crashtests/372376-1.xhtml
@@ -0,0 +1,39 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+<![CDATA[
+
+var HTML_NS = "http://www.w3.org/1999/xhtml";
+
+function boom()
+{
+ var $table = document.getElementById('table');
+ var $oldtd = document.getElementById('oldtd');
+
+ $table.style.outline = "1px solid green";
+
+ var $tr = document.createElementNS(HTML_NS, 'tr');
+ $tr.style.display = "inherit";
+ $table.insertBefore($tr, $oldtd);
+
+ var $td = document.createElementNS(HTML_NS, 'td');
+ $tr.appendChild($td);
+
+ var $anothertr = document.createElementNS(HTML_NS, 'tr');
+ $table.insertBefore($anothertr, $tr);
+
+ document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30)">
+
+<table border="1" id="table">
+<td id="oldtd"></td>
+</table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/373859-1.html b/layout/generic/crashtests/373859-1.html
new file mode 100644
index 0000000000..f9e4aa0214
--- /dev/null
+++ b/layout/generic/crashtests/373859-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ document.getElementById("k").style.display = "-moz-inline-box";
+}
+</script>
+
+<body onload="boom();">
+
+<div style="display: table;"><div id="k" style="height: 18000000px;">x</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/373868-1.xhtml b/layout/generic/crashtests/373868-1.xhtml
new file mode 100644
index 0000000000..712569386b
--- /dev/null
+++ b/layout/generic/crashtests/373868-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+<span style="float: left; height: 18000000px"/>
+<p style="clear: left;"/>
+<div>
+ <span style="float: right; height: 100px;">a</span>
+ b
+ <span style="float: right; height: 18000000px;"/>
+ <p/>
+ <span style="float: right; height: 18000000px;">c</span>
+ <table style="height: 20000000px;"/>
+ <p style="float: right;"/>
+</div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/375462-1.html b/layout/generic/crashtests/375462-1.html
new file mode 100644
index 0000000000..a0d9dca75d
--- /dev/null
+++ b/layout/generic/crashtests/375462-1.html
@@ -0,0 +1,781 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+
+
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en"
+ lang="en">
+
+ <head>
+ <meta http-equiv="Content-Type"
+ content="text/html;charset=utf-8" />
+
+ <title>Testcase #1 for bug 375462</title>
+
+<!-- Reduced from http://www.bethelmaine.com/events/index_events_bugy -->
+
+
+ </head>
+
+ <body class="section-events" dir="ltr">
+
+
+
+ <div>
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">"Remembering Sis Post"</h3>
+ <h3 style="float: right;">
+ <span>07/01</span>
+
+ </h3>
+ <div style="clear: both;" />
+ <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+ </div>
+ <div style="position: relative;">BHS members and friends will gather to share stories and memories in celebration of the life of the late Persis G. Post, who was an outstanding volunteer at the Society for more than 20 years.</div>
+ <br />
+ <div style="position: relative;" class="stx">1:00 PM, Mason House Exhibit Hall</div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>Dr. Moses Mason House</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>Bethel Historical Society</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:info@bethelhistorical.org"><span>info@bethelhistorical.org</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207-824-2908</span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+ <hr />
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">"An Androscoggin Sampler"</h3>
+ <h3 style="float: right;">
+ <span>07/01</span>
+
+ </h3>
+ <div style="clear: both;" />
+ <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+ </div>
+ <div style="position: relative;">In conjunction with the Society's newest exhibit, "A River's Journey: The Story of the Androscoggin," a series of slides of old photos taken in various locations throughout the Androscoggin valley will be shown. Free and open to the public.</div>
+ <br />
+ <div style="position: relative;" class="stx">2:00 PM, Mason House Exhibit Hall (the exhibit will be open at the Robinson House following the program)</div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>Bethel Historical Society</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>Bethel Historical Society</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:info@bethelhistorical.org"><span>info@bethelhistorical.org</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207-824-2908</span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+ <hr />
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">Summer Season Mason House Period Room Tours</h3>
+ <h3 style="float: right;">
+ <span>07/02</span>
+ <span>- 08/01</span>
+ </h3>
+ <div style="clear: both;" />
+ <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+ </div>
+ <div style="position: relative;">Summer season guided tours of the Mason House period rooms begin (Tuesday through Sunday, 1:00 to 4:00 PM, until Labor Day); tours may be arranged during the remainder of the year by calling 207-824-2908.</div>
+ <br />
+ <div style="position: relative;" class="stx"></div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>Dr. Moses Mason House</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>Bethel Historical Society</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:info@bethelhistorical.org"><span>info@bethelhistorical.org</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207-824-2908</span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+ <hr />
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">4th of July Community Picnic</h3>
+ <h3 style="float: right;">
+ <span>07/04</span>
+
+ </h3>
+ <div style="clear: both;" />
+ <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+ </div>
+ <div style="position: relative;"></div>
+ <br />
+ <div style="position: relative;" class="stx"><p>In the 1850s, Dr. Moses Mason began hosting a Fourth of July community picnic in "the grove" behind his residence. Today, the Bethel Historical Society proudly carries on this tradition. </p><p>This year's event will start at noon on the lawn beside the Mason house, and after the presentation of colors and the National Anthem, a two-hour concert will be presented by the Portland Brass Quintet. </p><p>In case of rain, the picnic and concert will be held in the historic Middle Intervale Meetinghouse (1816) on Intervale Road, approximately four miles down river from Bethel Hill village. Bring your lunch and a lawn chair or blanket. Free and open to the public (donations accepted).</p></div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>14 Broad Street</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>Bethel Historical Society</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:info@bethelhistorical.org"><span>info@bethelhistorical.org</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207-824-2908</span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+ <hr />
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">Mama's Night Out</h3>
+ <h3 style="float: right;">
+ <span>07/05</span>
+
+ </h3>
+ <div style="clear: both;" />
+ <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+ </div>
+ <div style="position: relative;">You don't have to be a mother to enjoy the hilarious comedy of these three finalists in Nick at Nite's “Search for the Funniest Mom in America.†The uproarious views on life and laughter of these ladies’ – a southerner living in Maine, a sassy Brit, and a New Yorker - are for everyone. Okay, perhaps they are not really for children, but that's why it's called a night out. For further information and reservations please call the Deertrees Box Office at 207 583 6747 or visit www.deertreestheatre.org</div>
+ <br />
+ <div style="position: relative;" class="stx"><p>8pm $18 <br /> <br />The Box Office is open from 10 AM until 5 PM Tuesday through Saturday and one hour before performances. <br /> <br />Tickets are also available at: <br />Books-N-Things, Bethel <br />The Cool Moose, Bridgton <br />Center Lovell Market, Lovell <br />The Country Sleigh, Naples <br />Fare Share, Norway <br /> <br />Deertrees Theatre is handicap accessible. <br />Free parking on the grounds.</p></div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>Deertrees Theatre</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>C.Randolph Parker (house manager)</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:deertrees@usa.net"><span>deertrees@usa.net</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207 583 6747</span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+ <hr />
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">The Casco Bay Tummlers</h3>
+ <h3 style="float: right;">
+ <span>07/06</span>
+
+ </h3>
+ <div style="clear: both;" />
+ <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+ </div>
+ <div style="position: relative;">Klezmer music is music that speaks, it's Balkans and blues, ancient Jewish culture and prayer and history, spirit and jazz all mixed together. Emotionally charged and played with abandon by musicians who continue to change, expand, and morph musical and cultural boundaries. For further information and reservations please call the Deertrees Box Office at 207 583 6747 or visit www.deertreestheatre.org
+ </div>
+ <br />
+ <div style="position: relative;" class="stx"><p>8pm $18 <br /> <br />Box Office open, 10 AM until 5 PM, Tuesday through Saturday, and one hour before performances. <br /> <br />Tickets are also available at: <br />Books-N-Things, Bethel <br />The Cool Moose, Bridgton <br />Center Lovell Market, Lovell <br />The Country Sleigh, Naples <br />Fare Share, Norway <br /> <br />Deertrees Theatre is handicapped accessible. <br />Free parking on the grounds.</p></div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>Deertrees Theatre</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>C.Randolph Parker (house manager)</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:deertrees@usa.net"><span>deertrees@usa.net</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207 583 6747</span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+ <hr />
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">18th Annual Bethel Art Fair</h3>
+ <h3 style="float: right;">
+ <span>07/07</span>
+
+ </h3>
+ <div style="clear: both;" />
+ <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+ </div>
+ <div style="position: relative;">Fifty artists &amp; fine artisans display and sell their creations -- </div>
+ <br />
+ <div style="position: relative;" class="stx"><div><div>Scroll down for complete schedule...<br /></div></div></div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>Bethel Town Common</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>Bethel Area Chamber of Commerce</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:info@bethelmaine.com"><span>info@bethelmaine.com</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207.824.2282</span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+ <hr />
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">The Hunger Mountain Boys with The Wiyos</h3>
+ <h3 style="float: right;">
+ <span>07/07</span>
+
+ </h3>
+ <div style="clear: both;" />
+ <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+ </div>
+ <div style="position: relative;">This double dose of traditional music may be resolutely old-school but it is also resolutely eclectic. With their ears tuned to music from the 30’s, 40’s and 50’s, the Massachusetts bluegrass band, The Hunger Mountain Boys, serve up a hard-hittin’, high energy sound that pays homage to the soulfulness and sincerity of old-time country while subtly incorporating rock, jazz and ska influences. The opening set by Brooklyn based “the WIYOS†can only be called Vaudevillian Ragtime-Blues and HillBilly Swing. For further information and reservations please call the Deertrees Box Office at 207 583 6747 or visit www.deertreestheatre.org
+
+</div>
+ <br />
+ <div style="position: relative;" class="stx"><p>8pm $16 <br /> <br />The Box Office is open from 10 AM until 5 PM Tuesday through Saturday and one hour before performances. <br /> <br />Tickets are also available at: <br />Books-N-Things, Bethel <br />The Cool Moose, Bridgton <br />Center Lovell Market, Lovell <br />The Country Sleigh, Naples <br />Fare Share, Norway <br /> <br />Deertrees Theatre is handicap accessible. <br />Free parking on the grounds.</p></div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>Deertrees Theatre</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>C.Randolph Parker (house manager)</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:deertrees@usa.net"><span>deertrees@usa.net</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207 583 6747</span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+ <hr />
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">Summer Piano Festival at Gould Academy</h3>
+ <h3 style="float: right;">
+ <span>07/07</span>
+
+ </h3>
+ <div style="clear: both;" />
+
+ <div style="position: relative;">Free piano recitals, July 1-20, 2007 at Gould Academy, an all-Steinway school!
+</div>
+ <br />
+ <div style="position: relative;" class="stx"><p>
+
+</p><p>Saturday, July 7, 7 p.m.,
+Bingham Hall</p><p>Distinguished Russian pianist and Master Teacher, Tamara
+Poddubnaya, and her students present free public recitals.</p>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+<p>FULL SCHEDULE:<br />Saturday, July 7, 7 p.m.,
+Bingham Hall<br />Wednesday, July 11, 7 p.m.,
+Bingham Hall<br />Friday, July 13, 7 p.m.,
+Bingham Hall<br />Wednesday, July 18, 7 p.m.,
+Bingham Hall<br />Friday, July 20, 7 p.m.,
+<strong>McLaughlin Science Center, Trustees' Auditorium</strong></p><p><br /></p><p><br /></p><br /><p><br />
+</p>
+
+</div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>Bingham Hall, Gould Academy, Bethel, Maine</span>
+ </td>
+ </tr>
+
+
+
+ </table>
+
+ </div>
+ <hr />
+
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">5th Annual Skunk Run</h3>
+ <h3 style="float: right;">
+ <span>07/28</span>
+
+ </h3>
+ <div style="clear: both;" />
+ <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+ </div>
+ <div style="position: relative;">SATURDAY, July 28,2007 -- Benefiting the Sandon A. Morgan Memorial Scholarship Fund awarded exclusively at Telstar Regional High School, Bethel, Maine. The scholarship is awarded each year to a graduating senior at Telstar to attend CMCC in Auburn for 2 full years, all academics are covered. </div>
+ <br />
+ <div style="position: relative;" class="stx"><p>
+
+</p>
+
+<p>MOTORCYCLE RUN</p>
+
+
+
+
+
+
+
+
+
+<p>$10.00 includes run, bottled water, sandwich, chips &amp;
+FUN!<br />Registration 8:30am-9:45am<br />Vertical Outlaws Stunt Team to perform in the morning.<br />Run leaves at 10:00 am </p>
+
+<p>Ride through Bethel to Grafton Notch State Park, into New
+Hampshire and back to Greenwood (Locke Mills). Designated bathroom/rest &amp;
+gas stops. Great scenery and roads! All of our traffic is taken care of by our
+traffic control volunteers, so the run stays together for safety reasons. We
+also have a red Hummer leading the pack of bikes, as well as a tail vehicle.</p>
+
+
+
+<p> </p>
+
+
+
+
+
+
+
+
+
+
+
+<p>PIG ROAST/TURKEY FRY<br />3:00-5:00 PM<br />$10:00<br />Includes pig, turkey, summer salads, bean hole beans, rolls,
+watermelon, homemade desserts, and assorted beverages. BYOB.<br />Music, vendor showcase, Skunk Run T's and assorted items for
+sale. </p>
+
+
+
+<p>Directions:<br />From the south - go north from Gray on Route 26 to Bryant
+Pond, after sharp "S" turn with light, follow Rt. 26 for a few more
+miles. You will see North Pond on your right, take the 2nd right onto Gore
+Road.</p>
+
+
+
+<p>From the north - go west on Route 2 through Rumford to Route
+232 south. Turn right and travel north on Route 26 to Bryant Pond, after sharp
+"S" turn with light, follow Rt. 26 for a few more miles. You will see
+North Pond on your right, take the 2nd right onto Gore Road.</p>
+
+
+
+<p> From the west - take Route 2 east to Route 26 south to
+Greenwood (Locke Mills). Past Mt. Mica Rarities (purple building) take Gore
+Road on left.</p>
+
+
+
+<p>From the east - from Augusta, take Route 202 west to
+Route 133 to Route 219 to Route 26 North to Greenwood (Locke Mills). Past Mt.
+Mica Rarities (purple building) take Gore Road on left.</p><p><br /></p></div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>Gore Road, Greenwood, ME, just off Rt. 26</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>Mark</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:mdmorgandesigns@yahoo.com"><span>mdmorgandesigns@yahoo.com</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207.743.8254 or 207.890.6767</span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+ <hr />
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">The Bill &amp; Bo Winiker Quartet</h3>
+ <h3 style="float: right;">
+ <span>07/28</span>
+
+ </h3>
+ <div style="clear: both;" />
+ <div style="float: right; padding: 1px; margin-left: 1em; margin-bottom: 1em; border: 1px solid black;">
+ </div>
+ <div style="position: relative;">Featuring jazz savant pianist Tony Deblois, this Boston based quartet embarks on an eclectic journey through the many styles of jazz including traditional, swing, bebop, jazzy takes on Broadway classics, world music and even some original compositions. Making music an uplifting and joyous experience. Sponsored by Gordon Dexter and Barbara Grandolfo. For further information and reservations please call the Deertrees Box Office at 207 583 6747 or visit www.deertreestheatre.org </div>
+ <br />
+ <div style="position: relative;" class="stx"><p>Saturday, July 28 at 8:00 pm <br /> <br />$20 <br /> <br />The Box Office is open from 10 AM until 5 PM Tuesday through Saturday and one hour before performances. <br /> <br />Tickets are also available at: <br />Books-N-Things, Bethel <br />The Cool Moose, Bridgton <br />Center Lovell Market, Lovell <br />The Country Sleigh, Naples <br />Fare Share, Norway <br /> <br />Deertrees Theatre is handicap accessible. <br />Free parking on the grounds.</p></div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Location:
+ </td>
+ <td>
+ <span>Deertrees Theatre</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>C.Randolph Parker (house manager)</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:deertrees@usa.net"><span>deertrees@usa.net</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207 583 6747</span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+ <hr />
+
+
+ <div>
+ <div style="clear: both;" />
+ <h3 style="float: left;">Tenth Annual Canoe and Kayak Outdoor Adventure Day Camp </h3>
+ <h3 style="float: right;">
+ <span>07/30</span>
+ <span>- 08/03</span>
+ </h3>
+ <div style="clear: both;" />
+
+ <div style="position: relative;">Designed with young people in mind, all aspects of canoeing and kayaking will be taught, as well as some other adventure activities. This is a hands on active program! June 23rd - July 27th from 9am-3pm for ages 8-13. $175.00 for the week session.</div>
+ <br />
+ <div style="position: relative;" class="stx">Included in the session will be basic canoe and kayak strokes, rescue techniques, expeditioning by canoe, simple camping skills, simple white water techniques and other adventure activities. Participants will learn how to skillfully maneuver canoes and kayaks while exploring the many channels and islands on the river, and develop proficiency and confidence in all types of outdoor skills. Meet at Bethel Outdoor Adventure every morning and travel to local lakes , ponds, islands, and the Androscoggin River. To sign up call 207.824.4224 or info@betheloutdooradventure.com
+Event Starts: July 30, 2007
+Event Ends: August 3, 2007
+
+</div>
+ <table style="border: 1px solid grey; margin-top: 1em; margin-bottom: 1em;" cellspacing="0" cellpadding="2px">
+
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Name:
+ </td>
+ <td>
+ <span>Jeff and Pattie Parsons</span>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact E-mail:
+ </td>
+ <td>
+ <a href="mailto:info@betheloutdooradventure.com"><span>info@betheloutdooradventure.com</span></a>
+ </td>
+ </tr>
+ <tr>
+ <td style="border-right: 1px solid grey;">
+ Contact Phone:
+ </td>
+ <td>
+ <span>207.824.4224 </span>
+ </td>
+ </tr>
+ </table>
+
+ </div>
+
+
+ </div>
+
+ <hr />
+
+ </div>
+
+
+ <div class="discussion">
+
+</div>
+
+
+ </div>
+
+ </div>
+
+
+ </td>
+
+
+
+
+
+ </tr>
+ </tbody>
+ </table>
+
+
+ <div class="visualClear"><!-- --></div>
+
+
+ <hr class="netscape4" />
+
+
+
+ <div id="portal-footer">
+
+<p>
+</p>
+
+</div>
+
+ <div id="portal-colophon">
+ <p>
+ Bethel Area Chamber of Commerce<br />
+ 8 Station Place<br />
+ PO Box 1247<br />
+ Bethel, ME 04217<br />
+ Tel: 207.824.2282 or 800.442.5826 Fax: 207.824.7123<br />
+ Email: info@bethelmaine.com
+ </p>
+
+
+ </div>
+
+
+ </div>
+
+</body>
+</html>
+
+
diff --git a/layout/generic/crashtests/375831.html b/layout/generic/crashtests/375831.html
new file mode 100644
index 0000000000..79c334738a
--- /dev/null
+++ b/layout/generic/crashtests/375831.html
@@ -0,0 +1,11 @@
+<html>
+<head style="overflow: scroll; display: block; float: right; ">
+</head>
+<body>
+
+<script id="script">
+document.documentElement.setAttribute('style', 'overflow: scroll; ');
+document.getElementsByTagName('head')[0].removeAttribute('style');
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/376419.html b/layout/generic/crashtests/376419.html
new file mode 100644
index 0000000000..b5cdca1ed6
--- /dev/null
+++ b/layout/generic/crashtests/376419.html
@@ -0,0 +1,28 @@
+<html><head>
+<style>
+*::first-line { }
+*::after { content:"anonymous text"; border:3px solid black;}
+*::before { content:"before text"; border:3px solid black;font-size: 10px;}
+</style>
+</head>
+<body>
+<div style="column-count: 2; width: 1400px;">
+ &#1593; tesxt
+ <span>
+ &#1593; tesxt &#1593; tesxt &#1593; tesxt
+ <span>
+ &#1593; tesxt &#1593; tesxt &#1593; tesxt &#1593; tesxt
+ </span>
+ </span>
+<div style="column-count: 2;">
+<div style="column-count: 2; white-space: nowrap;">
+<div style="column-count: 2;">
+<span>
+&#1593; tesxt &#1593; tesxt &#1593; tesxt
+</span>
+</div>
+</div>
+</div>
+</div>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/377522.html b/layout/generic/crashtests/377522.html
new file mode 100644
index 0000000000..418fb85521
--- /dev/null
+++ b/layout/generic/crashtests/377522.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+<script>
+
+function boom() {
+ var div = document.getElementById('div');
+ div.appendChild(document.createTextNode(String.fromCharCode(8238)));
+ div.appendChild(document.createTextNode(String.fromCharCode(50377)));
+ div.appendChild(document.createTextNode(String.fromCharCode(50)));
+ div.textContent = div.textContent.slice(1);
+}
+
+</script>
+</head>
+<body onload="boom()">
+<div id="div" style="word-spacing:2px; text-align:right">x</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/37757-1.html b/layout/generic/crashtests/37757-1.html
new file mode 100644
index 0000000000..9a7ddab5d0
--- /dev/null
+++ b/layout/generic/crashtests/37757-1.html
@@ -0,0 +1 @@
+<p style="font-size: 1px">Text</p>
diff --git a/layout/generic/crashtests/379217-1.xhtml b/layout/generic/crashtests/379217-1.xhtml
new file mode 100644
index 0000000000..0614b9a540
--- /dev/null
+++ b/layout/generic/crashtests/379217-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<button style="width: 3em;"><b>aaa<u>bbb<p style="float: left"/></u></b></button>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/379217-2.xhtml b/layout/generic/crashtests/379217-2.xhtml
new file mode 100644
index 0000000000..8a8b32693d
--- /dev/null
+++ b/layout/generic/crashtests/379217-2.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body style="width: 1px;">
+
+<span>x
+<span style="border: 1px dotted red;"><span style="float: left;"></span></span></span>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/379917-1.xhtml b/layout/generic/crashtests/379917-1.xhtml
new file mode 100644
index 0000000000..a99bd7f4ae
--- /dev/null
+++ b/layout/generic/crashtests/379917-1.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:math="http://www.w3.org/1998/Math/MathML"
+ class="reftest-wait">
+<head>
+<script>
+
+// This testcase uses long timeouts to make sure the marquee has a chance to animate.
+
+function boom()
+{
+ var div1 = document.getElementById("div1");
+ var marquee = document.getElementById("marquee");
+
+ div1.parentNode.removeChild(div1);
+ marquee.width = 4;
+
+ setTimeout(done, 100);
+}
+
+function done()
+{
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 100);">
+
+<math:math><div id="div1"/>x&#1506;</math:math>
+<marquee id="marquee">m</marquee>
+<div/>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/380012-1.html b/layout/generic/crashtests/380012-1.html
new file mode 100644
index 0000000000..6cd7e1018e
--- /dev/null
+++ b/layout/generic/crashtests/380012-1.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+
+<style>
+ .fl:first-line { }
+ .inh { position: inherit; }
+ .abs { position: absolute; }
+</style>
+
+<script>
+
+var x, y;
+
+function boom()
+{
+ x = document.getElementById("x");
+ y = document.getElementById("y");
+
+ x.setAttribute('class', "fl abs");
+ y.setAttribute('class', "inh");
+ setTimeout(boom2, 5);
+}
+
+function boom2()
+{
+ y.setAttribute('class', "abs");
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+</head>
+
+<body onload="setTimeout(boom, 5);">
+<div id="x">
+ <p id="y">foo</p>
+</div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/381152-1.html b/layout/generic/crashtests/381152-1.html
new file mode 100644
index 0000000000..23ea97e6c8
--- /dev/null
+++ b/layout/generic/crashtests/381152-1.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+<title>Bug 381152 - Hang with float, large padding and margin</title>
+</head>
+<body>
+<div style="float: left;padding-top: 9999999999px;">
+<div style="float: left;margin-top: 9999999999px;margin-bottom: -9999999px;">
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/382129-1.xhtml b/layout/generic/crashtests/382129-1.xhtml
new file mode 100644
index 0000000000..0d52309f35
--- /dev/null
+++ b/layout/generic/crashtests/382129-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<p style="display: -moz-box;"><img style="-moz-appearance: checkbox" src="../../../testing/crashtest/images/tree.gif"/></p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/382131-1.html b/layout/generic/crashtests/382131-1.html
new file mode 100644
index 0000000000..82941f2cba
--- /dev/null
+++ b/layout/generic/crashtests/382131-1.html
@@ -0,0 +1,25 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function crash()
+{
+ try {
+ window.getSelection().containsNode([], false);
+ } catch(e) { }
+
+ try {
+ window.getSelection().containsNode(null, false);
+ } catch(e) { }
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(crash, 10);">
+Foo
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/382199-1.html b/layout/generic/crashtests/382199-1.html
new file mode 100644
index 0000000000..07aab13813
--- /dev/null
+++ b/layout/generic/crashtests/382199-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+
+<html style="display: table;">
+ <body>
+ <div style="float: left; border: 1px solid blue;">float</div>
+ <div style="position: absolute; border: 1px solid red;">absolute</div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/382208-1.xhtml b/layout/generic/crashtests/382208-1.xhtml
new file mode 100644
index 0000000000..5264b8845d
--- /dev/null
+++ b/layout/generic/crashtests/382208-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<body>
+
+<div><math:mfrac><math:mmultiscripts/><math:mi/></math:mfrac></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/382262-1.html b/layout/generic/crashtests/382262-1.html
new file mode 100644
index 0000000000..67ef591a48
--- /dev/null
+++ b/layout/generic/crashtests/382262-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="column-count: 2;">
+a<span style="float: right">e<select></select></span> r
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/382396-1.xhtml b/layout/generic/crashtests/382396-1.xhtml
new file mode 100644
index 0000000000..f334bbfdf5
--- /dev/null
+++ b/layout/generic/crashtests/382396-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<body>
+
+<p style="text-indent: 0%">a<math:ms/></p>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/383089-1.html b/layout/generic/crashtests/383089-1.html
new file mode 100644
index 0000000000..27d4435adc
--- /dev/null
+++ b/layout/generic/crashtests/383089-1.html
@@ -0,0 +1,85 @@
+<html style="width: 1px;" class="reftest-wait"><head style="float: left; position: fixed; display: initial;" id="head">
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+
+
+
+<script style="display: none;" type="text/javascript">
+
+var iter;
+var interv;
+
+function olo()
+{
+ iter = foo();
+ interv = setInterval(neext, 30);
+}
+
+function neext()
+{
+ let {done} = iter.next();
+ if (done) {
+ clearInterval(interv);
+ }
+}
+
+function* foo()
+{
+ var docElem = document.documentElement;
+ var head = document.getElementById("head");
+ var br1 = document.getElementById("br1");
+ var br2 = document.getElementById("br2");
+ var br3 = document.getElementById("br3");
+ var br4 = document.getElementById("br4");
+ var br5 = document.getElementById("br5");
+ var br6 = document.getElementById("br6");
+ var br7 = document.getElementById("br7");
+ var tableRow = document.getElementById("tableRow");
+
+ br6.style.width = "1px";
+ br1.style.overflow = "visible";
+ head.style.cssFloat = "left";
+ br4.style.position = "static";
+ br7.style.color = "green";
+ br3.style.height = "auto";
+ yield;
+
+ br7.style.width = "2px";
+ yield;
+
+ br5.style.background = "yellow";
+ br7.style.color = "black";
+ yield;
+
+ br7.style.display = "table-cell";
+ head.style.position = "fixed";
+ br5.style.display = "inline";
+ br3.style.clear = "both";
+ br6.style.visibility = "visible";
+ yield;
+
+ tableRow.style.display = "list-item";
+ br3.style.width = "auto";
+ br2.style.clear = "none";
+ head.style.display = "initial"; // doesn't seem to crash when this is "block"!
+ docElem.style.width = "1px";
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<style>
+</style>
+
+</head><body onload="setTimeout(olo, 30);">
+
+<br style="overflow: visible;" id="br1">
+<br style="clear: none;" id="br2">
+<br style="height: auto; clear: both; width: auto;" id="br3">
+<br style="position: static;" id="br4">
+<br style="background: yellow none repeat scroll 0% 0%; background-clip: initial; background-origin: initial; display: inline;" id="br5">
+<br style="width: 1px; visibility: visible;" id="br6">
+<br style="color: black; width: 2px; display: table-cell;" id="br7">
+<table border="1"><tbody><tr style="display: list-item;" id="tableRow"><td>x</td></tr></tbody></table>
+
+</body></html>
diff --git a/layout/generic/crashtests/385265-1.xhtml b/layout/generic/crashtests/385265-1.xhtml
new file mode 100644
index 0000000000..7994653ffa
--- /dev/null
+++ b/layout/generic/crashtests/385265-1.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML" display="block">
+ <mtable>
+ <mtr>
+ <mtd><mi>x</mi></mtd>
+ </mtr>
+ </mtable>
+</math>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/385295-1.xhtml b/layout/generic/crashtests/385295-1.xhtml
new file mode 100644
index 0000000000..734270d756
--- /dev/null
+++ b/layout/generic/crashtests/385295-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="letter-spacing: 1px; -moz-appearance: checkbox;">
+<body onload="document.getElementById('s').style.cssFloat = 'left';">
+<p style="float: left; direction: rtl">zzz yyy <span id="s">foo</span></p>
+</body>
+</html>
diff --git a/layout/generic/crashtests/385344-1.html b/layout/generic/crashtests/385344-1.html
new file mode 100644
index 0000000000..7fbb7a73da
--- /dev/null
+++ b/layout/generic/crashtests/385344-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<style id="script">
+ body::first-letter {float: right; }
+</style>
+</head>
+<body>
+<dd style="white-space: -moz-pre-wrap;">m
+ <dt>m</dt>
+</dd>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/385344-2.html b/layout/generic/crashtests/385344-2.html
new file mode 100644
index 0000000000..f22336d1b3
--- /dev/null
+++ b/layout/generic/crashtests/385344-2.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+<style>body::first-letter {float: right; }
+</style>
+</head>
+<body>
+<span style="direction: rtl; unicode-bidi: embed;">*::first
+m</span>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/385414-1.html b/layout/generic/crashtests/385414-1.html
new file mode 100644
index 0000000000..1b86f7bdcd
--- /dev/null
+++ b/layout/generic/crashtests/385414-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<div style="font-variant: small-caps">&shy;</div>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/385414-2.html b/layout/generic/crashtests/385414-2.html
new file mode 100644
index 0000000000..d2d8c5e285
--- /dev/null
+++ b/layout/generic/crashtests/385414-2.html
@@ -0,0 +1,5 @@
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+</head><body>
+<div style="font-variant: small-caps;">&shy; </div>
+</body></html> \ No newline at end of file
diff --git a/layout/generic/crashtests/385426-1.html b/layout/generic/crashtests/385426-1.html
new file mode 100644
index 0000000000..534e1cef21
--- /dev/null
+++ b/layout/generic/crashtests/385426-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<div><span>&#8238;</span><span>&shy;</span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/385526.html b/layout/generic/crashtests/385526.html
new file mode 100644
index 0000000000..629f7cfe3b
--- /dev/null
+++ b/layout/generic/crashtests/385526.html
@@ -0,0 +1,116 @@
+<html class="reftest-wait"><head>
+<style>
+*::first-line { font-size:310%; }
+</style>
+</head>
+<body style="display: inline; white-space: nowrap;">
+<span>mmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm•mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmÈmmmmmmmmmmmmÞmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm!mmmmmmm
+
+mmmmmmmm mmmmmmmmmmmmmmmm
+m
+ mm mmmmmmm m mmmmmmmm mmmmmm mmmm mmmmmm mmmmmmm m mmmmmmmmmmm mmm m mmmm mmmmmmmmmmm mmmm mmmmmmmmmmmmm mmm mmmm m mmmm m mmmmmmmm
+ mm mmmmmmm mm mm mmmmmm mm mmmm mmmmmm m mmmmmmmmmmmm mmmm
+ mmmmmmmm mmmmmmmmm m
+ mmmm m mmmmmmmmmm m mmmmmm m mmmmmmmmm
+ mmmmmm mmmmmmmmmmmmmmmm
+ mm
+
+ mm mmmmmmm m mmmmmmmm mmmmmm mmmmmmm mm mmm mmmmm mmm mm mm mmmm mmmmmmmmm
+ mmmmmmmm mmmmmmmmmmmmmm m
+ mmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+ mm
+
+ mmmmmm mmmmmmm
+m
+
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmm mmm m mmmmmmmmmmmmmmmmmmmmmmm
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmømmmmmmmmmmmmÍmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmm§mmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmÌmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmŸmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmÃmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmm mmmmmmmmmmm ?mmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm m mmmmmmmmmmmmmmm mmmmmm mmmmmmmmmmmmmmmmmmmmmm mmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm\mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmÍmmmmmmmmmmmmmmmmmùmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmÂmmmmmmmmmmmmÖmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmÞmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmm mmmmmmmmmmm mmmmmm!mmmmmmm
+
+mmmmmmmm mmmmmmmmmmmmmmmm
+m
+ mm mmmmmmm m mmmmmmmm mmmmmm mmmm mmmmmm mmmmmmm m mmmmmmmmmmm mmm m mmmm mmmmmmmmmmm mmmm mmmmmmmmmmmmm mmm mmmm m mmmm m mmmmmmmm
+ mm mmmmmmm mm mm mmmmmm mm mmmm mmmmmm m mmmmmmmmmmmm mmmm
+ mmmmmmmm mmmmmmmmm m
+ mmmm m mmmmmmmmmm m mmmmmm m mmmmmmmmm
+ mmmmmm mmmmmmmmmmmmmmmm
+ mm
+
+ mm mmmmmmm m mmmmmmmm mmmmmm mmmmmmm mm mmm mmmmm mmm mm mm mmmm mmmmmmmmm
+ mmmmmmmm mmmmmmmmmmmmmm m
+ mmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+ mm
+
+ mmmmmm mmmmmmm
+m
+
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmm mmm m mmmmmmmmmmmmmmmmmmmmmmm
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmÔmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmœmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmËmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmÁmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmm m mmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm»mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmÀmmmmmmmmmm½mmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmm mmmmmmmmmmmmm^mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm!mmmmmmm
+
+mmmmmmmm mmmmmmmmmmmmmmmm
+m
+ mm mmmmmmm m mmmmmmmm mmmmmm mmmm mmmmmm mmmmmmm m mmmmmmmmmmm mmm m mmmm mmmmmmmmmmm mmmm mmmmmmmmmmmmm mmm mmmm m mmmm m mmmmmmmm
+ mm mmmmmmm mm mm mmmmmm mm mmmm mmmmmm m mmmmmmmmmmmm mmmm
+ mmmmmmmm mmmmmmmmm m
+ mmmm m mmmmmmmmmm m mmmmmm m mmmmmmmmm
+ mmmmmm mmmmmmmmmmmmmmmm
+ mm
+
+ mm mmmmmmm m mmmmmmmm mmmmmm mmmmmmm mm mmm mmmmm mmm mm mm mmmm mmmmmmmmm
+ mmmmmmmm mmmmmmmmmmmmmm m
+ mmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+ mm
+
+ mmmmmm mmmmmmm
+m
+
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmm mmm m mmmmmmmmmmmmmmmmmmmmmmm
+
+mmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mm
+mmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmm mmmm mmmmmmmmmmmmm mmmmmmmm mmmmmmmmmmmm mmmmmmmmmmmmmÒ°mÞmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmm mmmmmmmmmm mmmm mmmmmmmmmmmmm mmmmmmmmmmmmmmmmm mmmmmmmmmmmm mmmmmmm mmmmmmmmm mmmmmmmmmmmm˜mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmmmmmmmmmmmmmmmmmmmmmmmmm
+</span>
+<script>
+function finish() {
+ document.documentElement.removeAttribute('class');
+}
+function doe(){
+ document.body.removeAttribute('style');
+ setTimeout(finish, 100);
+}
+setTimeout(doe,300,0);
+</script>
+</body></html>
diff --git a/layout/generic/crashtests/385681.html b/layout/generic/crashtests/385681.html
new file mode 100644
index 0000000000..43707f65c5
--- /dev/null
+++ b/layout/generic/crashtests/385681.html
@@ -0,0 +1,34 @@
+<html><head>
+<title></title>
+<style>
+a {
+ font-variant: small-caps;
+}
+a:hover {
+ color: red;
+}
+</style>
+</head>
+<body>
+<a href="#">home</a><br>
+<a href="#">login</a><br>
+<a href="#">signup</a><br>
+
+<script>
+function doe(i) {
+if (!i) {
+ document.links[1].style.color='red';
+ document.links[0].offsetHeight;
+ document.links[0].style.color = 'red';
+ }
+else {
+ document.links[1].style.color='blue';
+ document.links[0].style.color = 'blue';
+ }
+setTimeout(doe, 100, !i);
+}
+setTimeout(doe, 500, true);
+</script>
+</body>
+
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/386799-1.html b/layout/generic/crashtests/386799-1.html
new file mode 100644
index 0000000000..2fd2eb1307
--- /dev/null
+++ b/layout/generic/crashtests/386799-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+ <canvas style="padding: 6px; width: 0px;"></canvas>
+ <div style="overflow: scroll;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/386807-1.html b/layout/generic/crashtests/386807-1.html
new file mode 100644
index 0000000000..af8169d8a5
--- /dev/null
+++ b/layout/generic/crashtests/386807-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ s = document.getElementById("s");
+ document.body.insertBefore(document.createTextNode("\n"), s);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+<span id="s" style="text-transform: uppercase;">
+</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/386812-1.html b/layout/generic/crashtests/386812-1.html
new file mode 100644
index 0000000000..52a4526fef
--- /dev/null
+++ b/layout/generic/crashtests/386812-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom() {
+ document.body.style.textIndent = "0%";
+}
+</script>
+
+<style>
+body { float: left; }
+.c { padding-left: 60%; padding-right: 60%; white-space: pre; }
+.f { float: left; height: 2em; }
+</style>
+</head>
+
+<body onload="boom()">
+
+<div class="c"> <div class="f">a</div>
+ <div class="f">b</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/386827-1.html b/layout/generic/crashtests/386827-1.html
new file mode 100644
index 0000000000..e1f345c6cd
--- /dev/null
+++ b/layout/generic/crashtests/386827-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function boom()
+{
+ document.getElementById("d1").appendChild(document.createElement("span"));
+ document.getElementById("d2").style.direction = "rtl";
+}
+</script>
+</head>
+<body onload="boom()">
+<div id="d1" style="column-width: 1em;">a b c d</div>
+<div id="d2"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387058-1.html b/layout/generic/crashtests/387058-1.html
new file mode 100644
index 0000000000..5a3eebcaa5
--- /dev/null
+++ b/layout/generic/crashtests/387058-1.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+<script>
+function boom()
+{
+ document.getElementById("div").style.letterSpacing = "";
+}
+</script>
+</head>
+<body onload="boom()" style="font-family: monospace; width: 20em;">
+<div id="div" style="white-space: pre-wrap; letter-spacing: 3em;">
+ x x x x x x
+ x x x x x x
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387058-2.html b/layout/generic/crashtests/387058-2.html
new file mode 100644
index 0000000000..eb5087aed4
--- /dev/null
+++ b/layout/generic/crashtests/387058-2.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<script>
+function boom()
+{
+ document.getElementById("div").style.letterSpacing = "";
+}
+</script>
+</head>
+
+<body onload="boom()" style="font-family: monospace; width: 3em;">
+<div id="div" style="white-space: pre-wrap; letter-spacing: 1em;">
+ x
+
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387088-1.html b/layout/generic/crashtests/387088-1.html
new file mode 100644
index 0000000000..a927081885
--- /dev/null
+++ b/layout/generic/crashtests/387088-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<div style="line-height: 30760827em;">x</div>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/387209-1.html b/layout/generic/crashtests/387209-1.html
new file mode 100644
index 0000000000..c6ac101d97
--- /dev/null
+++ b/layout/generic/crashtests/387209-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: table-header-group; overflow: scroll; top: 10%;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387213-1.html b/layout/generic/crashtests/387213-1.html
new file mode 100644
index 0000000000..1b3fd1041d
--- /dev/null
+++ b/layout/generic/crashtests/387213-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+ <div style="position: fixed; overflow: scroll;">
+ <div style="position: fixed;"></div>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387215-1.xhtml b/layout/generic/crashtests/387215-1.xhtml
new file mode 100644
index 0000000000..ba14e67668
--- /dev/null
+++ b/layout/generic/crashtests/387215-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body>
+<div style="float: left; height: 18000000px"></div>
+<p style="clear: left;"/>
+<div>
+ <div style="float: right; height: 100px;">a</div>
+ <div style="float: right; height: 18000000px;"></div>
+ <p/>
+</div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/387219-1.xhtml b/layout/generic/crashtests/387219-1.xhtml
new file mode 100644
index 0000000000..0439324079
--- /dev/null
+++ b/layout/generic/crashtests/387219-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+<style id="s"></style>
+</head>
+<body onload="document.getElementById('s').appendChild(document.createTextNode('#sb { display: list-item; }'));">
+<xul:scrollbox id="sb"/>
+</body>
+</html>
diff --git a/layout/generic/crashtests/387233-1.html b/layout/generic/crashtests/387233-1.html
new file mode 100644
index 0000000000..3ea2c05443
--- /dev/null
+++ b/layout/generic/crashtests/387233-1.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="display: -moz-inline-box;">
+ <table style="height: 200%;">
+ <tr>
+ <td></td>
+ </tr>
+ </table>
+ <div>
+ c
+ <div style="height: 200%;">
+ </div>
+ </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/387233-2.html b/layout/generic/crashtests/387233-2.html
new file mode 100644
index 0000000000..fdad7e872a
--- /dev/null
+++ b/layout/generic/crashtests/387233-2.html
@@ -0,0 +1,18 @@
+<html>
+<body>
+
+<div style="display: -moz-inline-box; background: yellow;">
+ <table style="height: 101%; background: lightgreen;">
+ <tr>
+ <td></td>
+ </tr>
+ </table>
+ <div>
+ c
+ <div style="height: 100%; background: lightblue;">
+ </div>
+ </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/387282-1.html b/layout/generic/crashtests/387282-1.html
new file mode 100644
index 0000000000..a82983d091
--- /dev/null
+++ b/layout/generic/crashtests/387282-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<div id="b" style="float: left; height: 18000000px; overflow: scroll;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/388049.html b/layout/generic/crashtests/388049.html
new file mode 100644
index 0000000000..c324dc225b
--- /dev/null
+++ b/layout/generic/crashtests/388049.html
@@ -0,0 +1,43 @@
+<html>
+ <head>
+ <style type="text/css">
+ p:first-line { color: teal; }
+ p:first-letter { color: aqua; }
+ .one:first-line { font-size: 300%; }
+ .one:first-letter { font-size: 300%; }
+ p.two:first-letter { font-size: 200%; }
+ p.two:first-line { font-variant: small-caps; }
+ /* three uses the default styles */
+ </style>
+ </head>
+ <body>
+ <p class="one">
+ The <strong>first letter of this paragraph, and only that
+ one, should be 600% bigger than the normal text
+ (300% bigger than the rest of first line of this paragraph) and
+ aqua, while the entire first line
+ should be 300% bigger than normal and teal. If this precise combination does not occur,
+ then the user agent has failed this test. Remember that in order to
+ ensure a complete test, the paragraph must be displayed on more
+ than one line. (TEST1)
+ </p>
+ <p class="two">
+ The first two characters in this paragraph
+ (a double-quote mark and a capital 'T') should be 200%
+ bigger than the rest of the paragraph, and
+ aqua. In addition, the entire first
+ line should be in a small-caps font and
+ teal. Remember that in order to ensure a complete test,
+ the paragraph must be displayed on more than one line. (TEST2)
+ </p>
+ <p>
+ The first letter of this paragraph, and only that
+ one, should be aqua, while the entire
+ <strong>first line should be teal. If
+ this precise combination does not occur, then the user agent has
+ failed this test. Remember that in order to ensure a complete test,
+ the paragraph must be displayed on more than one line. (TEST3)
+ </p>
+
+ </body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/388175-1.html b/layout/generic/crashtests/388175-1.html
new file mode 100644
index 0000000000..9e9a2879f0
--- /dev/null
+++ b/layout/generic/crashtests/388175-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script>
+function boom()
+{
+ document.getElementById("tr").focus();
+ document.getElementById("b").focus();
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(boom, 30);">
+
+<table border="1">
+ <tbody dir="rtl">
+ <tr id="tr" contenteditable="true"><td>a</td><td contenteditable="false">
+ <div id="b" contenteditable="true">b</div>
+ </td></tr>
+ </tbody>
+</table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/388367-1.html b/layout/generic/crashtests/388367-1.html
new file mode 100644
index 0000000000..6c368fcc4b
--- /dev/null
+++ b/layout/generic/crashtests/388367-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<pre style="direction: rtl;">&#12;</pre>
+</body>
+</html>
diff --git a/layout/generic/crashtests/388709-1.html b/layout/generic/crashtests/388709-1.html
new file mode 100644
index 0000000000..29d01955ba
--- /dev/null
+++ b/layout/generic/crashtests/388709-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<style>
+#d:after { content: 'a'; }
+#d:first-letter { float: right; }
+</style>
+</head>
+
+<body>
+<div id="d"></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/389635-1.html b/layout/generic/crashtests/389635-1.html
new file mode 100644
index 0000000000..dffd61a4a5
--- /dev/null
+++ b/layout/generic/crashtests/389635-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="position: fixed; overflow-x: scroll;">
+ <div style="padding: 0%;">
+ <div style="position: fixed;"></div>
+ </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/390050-1.html b/layout/generic/crashtests/390050-1.html
new file mode 100644
index 0000000000..1a1f34e550
--- /dev/null
+++ b/layout/generic/crashtests/390050-1.html
@@ -0,0 +1,48 @@
+<html>
+<head>
+<style type="text/css">
+/*<![CDATA[*/
+
+body {
+ font-size: 62.5%; /* Resets 1em to 10px */
+}
+
+#content { font-size: 1.2em; }
+
+.entry p { font-size: 1.05em; }
+
+.entry {
+ column-width: 25em;
+ column-gap: 3em;
+}
+
+.entry img {
+ float: left;
+ margin: 3px 10px;
+}
+
+.alt {
+ padding: 10px;
+}
+
+#content {
+ margin-left: 20px;
+ margin-right: 260px;
+ padding: 0 17px 20px 17px;
+}
+
+
+/*]]>*/
+</style>
+</head>
+<body>
+<div id="content" class="entry">
+
+<img width="222" height="164">
+
+ <p class="alt">
+, .You can follow any responses the
+ </p>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/390050-2.html b/layout/generic/crashtests/390050-2.html
new file mode 100644
index 0000000000..f22b55e343
--- /dev/null
+++ b/layout/generic/crashtests/390050-2.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html>
+<head>
+<style type="text/css">
+.entry {
+ column-width: 25em;
+ column-gap: 3em;
+}
+</style>
+
+</script>
+
+</head>
+<body><div class="entry">
+<p>Edit: Wow, quick response there! Thanks for the pointers guys, looks like the dbginfo
+packages are there, just take a bit to get to. I had installed the dbg packages (or at
+least some of them, the ones that I saw with apt-cache search dbg that were relevant), but
+there wasn&#8217;t coverage for some packages &#8212; in particular the x server. I&#8217;m
+going to try Travis&#8217;s suggestion, thanks!</p>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/390050-3.html b/layout/generic/crashtests/390050-3.html
new file mode 100644
index 0000000000..99f6455da3
--- /dev/null
+++ b/layout/generic/crashtests/390050-3.html
@@ -0,0 +1,4 @@
+<div class="entry" style="margin-right: 260px; padding: 0 17px; column-width: 25em; column-gap: 3em">
+<img width="222" style="float: left; margin: 3px 10px;">
+<p style="padding: 10px; font-size: 1.05em;">ABCDEF GHI JKLMNOPQR</p>
+</div>
diff --git a/layout/generic/crashtests/390052.html b/layout/generic/crashtests/390052.html
new file mode 100644
index 0000000000..bf5b4e20ad
--- /dev/null
+++ b/layout/generic/crashtests/390052.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+ <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+ <title>Testcase for bug 390052</title>
+</head>
+<body>
+
+'¡''i''ǃ''!''α''a'' '' ''­''''Û''''Ü''''á †''''á Ž''''​''''‌''''â€''''
''''
''''â ''''â¡''''â¢''''â£''''âª''''â«''''â¬''''â­''''â®''''â¯''''''''''''''''ï¿»''''''''ð…³''''ð…´''''ð…µ''''ð…¶''''ð…·''''ð…¸''''ð…¹''''ð…º''''Û¬''ÛŸ''̓''Ì“''Ù''Ì“''Öœ''Ì''Í''Ì''݇''Ì''॔''Ì''Í€''Ì€''॓''Ì€''ÌŒ''̆''Ì‘''Ì‚''Ö¯''ÌŠ''ஂ''ÌŠ''à¹''ÌŠ''à»''ÌŠ''ံ''ÌŠ''ំ''ÌŠ''៓''ÌŠ''ã‚š''ÌŠ''゚''ÌŠ''ͦ''ÌŠ''Í‚''̃''ׄ''̇''Ö¹''̇''ׂ''̇''×''̇''Ý''̇''ं''̇''ਂ''̇''ં''̇''à¯''̇''Ì…''Ì„''〬''̉''̱''Ì ''॒''Ì ''̧''Ì¡''̦''Ì¡''̨''Ì¢''़''Ì£''়''Ì£''਼''Ì£''઼''Ì£''଼''Ì£''͇''̳''̶''̵''ﱞ''ï¹²Ù‘''ﱟ''ï¹´Ù‘''ï³²''ï¹·Ù‘''ï± ''ﹶّ''ï³³''ï¹¹Ù‘''ﱡ''ﹸّ''ï³´''ï¹»Ù‘''ï±¢''ﹺّ''ï±£''ï¹¼Ù°''Ù´''Ù”''Ý‚''ܼ''౦''o''೦''o''゙''ã‚™'' '' '' '' ''â€'' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' '' ''âŸ'' '' '' '' '' '' '' ''`''`''ï½€''`''á¿€''Ëœ''ï¼¾''^''︿''^''_''_''ï¹''_''﹎''_''ï¹''_''⌇''︴''ï¼''-''â€''-''‑''-''‒''-''–''-''﹘''-''∼''â“''ï½¥''・''•''・'','',''‚'',''Ù¬''ØŒ''、''ã€'';'';''ï¼›'';'':'':''Ö‰'':''︰'':''׃'':''â©´''::=''.''.''․''.''Ü‚''.''‥''..''…''...''。''。''·''·''‧''·''∙''·''â‹…''·''á§''·''ᔯ''·4''áŒ''·á''áŽ''·áƒ''á''·á„''á’''·á…''á”''·á†''á—''·áŠ''á™''·á‹''á·''·á³''á‘€''·á³''á‘‚''·á´''á‘„''·á¸''ᑆ''·á¹''á‘—''·ᑌ''á‘™''·ᑎ''á‘›''·á‘''á‘”''·á‘''á‘''·á‘''á‘Ÿ''·ᑑ''á‘¡''·ᑕ''á‘£''·ᑖ''á‘´''·ᑫ''ᑸ''·ᑮ''ᑼ''·ᑰ''ᑾ''·ᑲ''á’€''·ᑳ''á’’''·ᒉ''á’”''·ᒋ''á’–''·ᒌ''á’š''·ᒎ''á’œ''·á’''á’ž''·ᒑ''á’¬''·ᒣ''á’®''·ᒥ''á’°''·ᒦ''á’²''·ᒧ''á’´''·ᒨ''á’¶''·L''á’¸''·ᒫ''ᓉ''·ᓀ''á“‹''·ᓇ''á“''·ᓈ''á“œ''·ᓓ''á“ž''·ᓕ''á“ ''·ᓖ''á“¢''·ᓗ''ᓤ''·ᓘ''ᓦ''·ᓚ''ᓨ''·ᓛ''ᓶ''·ᓭ''ᓸ''·ᓯ''ᓺ''·ᓰ''ᓼ''·ᓱ''ᓾ''·ᓲ''ᔀ''·ᓴ''ᔂ''·ᓵ''á”—''·á”''á”™''·ᔑ''á”›''·ᔒ''á”''·ᔓ''ᔟ''·ᔔ''ᔡ''·ᔕ''ᔣ''·ᔖ''á”±''·ᔨ''ᔳ''·ᔩ''ᔵ''·ᔪ''á”·''·ᔫ''ᔹ''·ᔭ''á”»''·ᔮ''á•Ž''·ᕌ''á•›''·ᕚ''ᕨ''·ᕧ''(''(''â‘´''(1)''â’§''(l)''⑽''(10)''⑾''(11)''â‘¿''(12)''â’€''(13)''â’''(14)''â’‚''(15)''â’ƒ''(16)''â’„''(17)''â’…''(18)''â’†''(19)''⑵''(2)''â’‡''(20)''⑶''(3)''â‘·''(4)''⑸''(5)''⑹''(6)''⑺''(7)''â‘»''(8)''⑼''(9)''â’œ''(a)''â’''(b)''â’ž''(c)''â’Ÿ''(d)''â’ ''(e)''â’¡''(f)''â’¢''(g)''â’£''(h)''â’¤''(i)''â’¥''(j)''â’¦''(k)''â’¨''(m)''â’©''(n)''â’ª''(o)''â’«''(p)''â’¬''(q)''â’­''(r)''â’®''(s)''â’¯''(t)''â’°''(u)''â’±''(v)''â’²''(w)''â’³''(x)''â’´''(y)''â’µ''(z)''㈀''(á„€)''㈎''(ê°€)''ãˆ''(á„‚)''ãˆ''(나)''㈂''(ᄃ)''ãˆ''(다)''㈃''(á„…)''㈑''(ë¼)''㈄''(ᄆ)''㈒''(마)''㈅''(ᄇ)''㈓''(ë°”)''㈆''(ᄉ)''㈔''(사)''㈇''(á„‹)''㈕''(ì•„)''ãˆ''(오전)''㈞''(오후)''㈈''(á„Œ)''㈖''(ìž)''㈜''(주)''㈉''(á„Ž)''㈗''(ì°¨)''㈊''(á„)''㈘''(ì¹´)''㈋''(á„)''㈙''(타)''㈌''(á„‘)''㈚''(파)''ãˆ''(á„’)''㈛''(하)''㈠''(一)''㈦''(七)''㈢''(三)''㈨''(ä¹)''㈡''(二)''㈤''(五)''㈹''(代)''㈽''(ä¼)''ã‰''(休)''㈧''(å…«)''㈥''(å…­)''㈸''(労)''㈩''(å)''㈿''(å”)''㈴''(å)''㈺''(呼)''㈣''(å››)''㈯''(土)''㈻''(å­¦)''㈰''(æ—¥)''㈪''(月)''㈲''(有)''㈭''(木)''㈱''(æ ª)''㈬''(æ°´)''㈫''(ç«)''㈵''(特)''㈼''(監)''㈳''(社)''㈷''(ç¥)''㉀''(祭)''㉂''(自)''㉃''(至)''㈶''(財)''㈾''(資)''㈮''(金)'')'')''ï¼»''[''〔''[''ï¼½'']''〕'']''ï½›''{''ï½''}''⦅''⦅''ï½ ''⦆''ï½¢''「''ï½£''ã€''ï¼ ''&#64;''*''*''ï¼''/''â„''/''∕''/''ï¼¼''\\''&''&amp;''#''#''ï¼…''%''‶''‵‵''‷''‵‵‵''༌''་''´''ʹ''΄''ʹ''´''ʹ''\'''ʹ'''''ʹ''′''ʹ''׳''ʹ''Í´''ʹ''ËŠ''ʹ''&quot;''ʹʹ''"''ʹʹ''″''ʹʹ''〃''ʹʹ''×´''ʹʹ''ʺ''ʹʹ''‴''ʹʹʹ''â—''ʹʹʹʹ''¯''ˉ''ï¿£''ˉ''‾''ˉ''﹉''ˉ''﹊''ˉ''﹋''ˉ''﹌''ˉ''Ëš''°''௵''௳''ï¿©''â†''ï¿«''→''↑''↑''↓''↓''↵''↲''⨡''↾''ð›Â›''∂''ðœÂ•''∂''ðÂ''∂''ðžÂ‰''∂''ðŸÂƒ''∂''ð›Â''∇''ð›»''∇''ðœµ''∇''ð¯''∇''ðž©''∇''+''+''﬩''+''‹''&lt;''<''&lt;''ï¼''=''⩵''==''⩶''===''›''&gt;''>''&gt;''ï¿¢''¬''¦''¦''〜''~''~''~''﹨''∖''â‹€''∧''â‹''∨''â‹‚''∩''⋃''∪''∯''∮∮''∰''∮∮∮''≣''≡''â™''⊕''☉''⊙''⟂''⊥''â–·''⊲''â¨''⋈''⨽''⌙''☸''⎈''⎮''⎥''│''│''â–''â–Œ''ï¿­''â– ''â˜''â–¡''ï¿®''â—‹''⦾''â—Ž''〛''⟧''〈''⟨''〈''⟨''〉''⟩''〉''⟩''⧙''⦚''〶''〒''ï½°''ー''ï¿ ''¢''$''$''ï¿¡''£''ï¿¥''Y̵''₩''W̵''ï¼''0''ðŸÂŽ''0''ðŸÂ˜''0''ðŸ¢''0''ðŸ¬''0''ðŸ¶''0''০''0''à­¦''0''௦''0''á ''0''〇''0''ðÂŽ''0''ð‘‚''0''ð‘¶''0''ð’ª''0''ð“ž''0''ð”Â’''0''ð•Â†''0''ð•º''0''ð–®''0''ð—¢''0''ð˜Â–''0''ð™ÂŠ''0''ð™¾''0''ðš¶''0''ð›°''0''ðœª''0''ð¤''0''ðžÂž''0''âµ”''0''à´ ''0''⊖''0̵''ðš¯''0̵''ðš¹''0̵''ð›©''0̵''ð›³''0̵''ðœ£''0̵''ðœ­''0̵''ðÂ''0̵''ð§''0̵''ðžÂ—''0̵''ðž¡''0̵''â´±''0̵''Ꮎ''0̵''Û°''Ù ''á­œ''á­''ã˜''0点''1''1''ðŸÂ''1''ðŸÂ™''1''ðŸ£''1''ðŸ­''1''ðŸ·''1''â„''1''â„‘''1''ðˆ''1''ð¼''1''ð‘°''1''ð“˜''1''ð•Â€''1''ð•´''1''ð–¨''1''ð—Âœ''1''ð˜Â''1''ð™Â„''1''ð™¸''1''l''l''l''l''â…¼''1''â„“''l''ð¥''l''ð‘™''l''ð’Â''l''ð“Â''l''ð“µ''l''ð”©''l''ð•Â''l''ð–‘''l''ð—Â…''l''ð—¹''l''ð˜­''l''ð™¡''l''ðšÂ•''l''ðš°''l''ð›ª''l''ðœ¤''l''ðž''l''ðžÂ˜''l''â‘ ''➀''É­''lÌ¢''É«''lÌ´''Æš''l̵''Å‚''lÌ·''Û±''Ù¡''â’ˆ''1.''Å€''l·''á’·''1·''â‘©''➉''â’‘''10.''ã©''10æ—¥''㋉''10月''ã¢''10点''â’’''11.''ãª''11æ—¥''ã‹Š''11月''ã£''11点''â’“''12.''ã«''12æ—¥''ã‹‹''12月''ã¤''12点''â’”''13.''ã¬''13æ—¥''ã¥''13点''â’•''14.''ã­''14æ—¥''ã¦''14点''â’–''15.''ã®''15æ—¥''ã§''15点''â’—''16.''ã¯''16æ—¥''ã¨''16点''â’˜''17.''ã°''17æ—¥''ã©''17点''â’™''18.''ã±''18æ—¥''ãª''18点''â’š''19.''ã²''19æ—¥''ã«''19点''lj''lj''ã ''1æ—¥''ã‹€''1月''ã™''1点''ï¼’''2''ðŸÂ''2''ðŸÂš''2''ðŸ¤''2''ðŸ®''2''ðŸ¸''2''á’¿''2''â‘¡''âž''Û²''Ù¢''â’‰''2.''â’›''20.''ã³''20æ—¥''ã¬''20点''ã´''21æ—¥''ã­''21点''ãµ''22æ—¥''ã®''22点''ã¶''23æ—¥''ã¯''23点''ã·''24æ—¥''ã°''24点''ã¸''25æ—¥''ã¹''26æ—¥''ãº''27æ—¥''ã»''28æ—¥''ã¼''29æ—¥''ã¡''2æ—¥''ã‹''2月''ãš''2点''3''3''ðŸÂ‘''3''ðŸÂ›''3''ðŸ¥''3''ðŸ¯''3''ðŸ¹''3''â‘¢''âž‚''Û³''Ù£''â’Š''3.''ã½''30æ—¥''ã¾''31æ—¥''ã¢''3æ—¥''ã‹‚''3月''ã›''3点''ï¼”''4''ðŸÂ’''4''ðŸÂœ''4''ðŸ¦''4''ðŸ°''4''ðŸº''4''áŽ''4''â‘£''➃''â’‹''4.''á”°''4·''ã£''4æ—¥''㋃''4月''ãœ''4点''5''5''ðŸÂ“''5''ðŸÂ''5''ðŸ§''5''ðŸ±''5''ðŸ»''5''⑤''âž„''â’Œ''5.''ã¤''5æ—¥''ã‹„''5月''ã''5点''ï¼–''6''ðŸÂ”''6''ðŸÂž''6''ðŸ¨''6''ðŸ²''6''ðŸ¼''6''б''6''â‘¥''âž…''â’''6.''ã¥''6æ—¥''ã‹…''6月''ãž''6点''ï¼—''7''ðŸÂ•''7''ðŸÂŸ''7''ðŸ©''7''ðŸ³''7''ðŸ½''7''⑦''➆''Û·''Ù§''â’Ž''7.''ã¦''7æ—¥''㋆''7月''ãŸ''7点''ଃ''8''৪''8''੪''8''8''8''ðŸÂ–''8''ðŸ ''8''ðŸª''8''ðŸ´''8''ðŸ¾''8''È£''8''⑧''➇''Û¸''Ù¨''â’''8.''ã§''8æ—¥''㋇''8月''ã ''8点''੧''9''à­¨''9''৭''9''ï¼™''9''ðŸÂ—''9''ðŸ¡''9''ðŸ«''9''ðŸµ''9''ðŸ¿''9''⑨''➈''Û¹''Ù©''â’''9.''ã¨''9æ—¥''㋈''9月''ã¡''9点''ï½''a''ðš''a''ð‘ÂŽ''a''ð’‚''a''ð’¶''a''ð“ª''a''ð”ž''a''ð•Â’''a''ð–†''a''ð–º''a''ð—®''a''ð˜¢''a''ð™Â–''a''ðšÂŠ''a''â„€''a/c''â„''a/s''æ''ae''b''b''ð›''b''ð‘Â''b''ð’ƒ''b''ð’·''b''ð“«''b''ð”Ÿ''b''ð•Â“''b''ð–‡''b''ð–»''b''ð—¯''b''ð˜£''b''ð™Â—''b''ðšÂ‹''b''É“''bÌ”''ƃ''bÌ„''Æ€''b̵''c''c''â…½''c''ðÂœ''c''ð‘Â''c''ð’„''c''ð’¸''c''ð“¬''c''ð” ''c''ð•Â”''c''ð–ˆ''c''ð–¼''c''ð—°''c''ð˜¤''c''ð™Â˜''c''ðšÂŒ''c''ð›Â“''c''ðœÂ''c''ð‡''c''ðžÂ''c''ðž»''c''â„…''c/o''℆''c/u''d''d''â…¾''d''â…†''d''ðÂ''d''ð‘‘''d''ð’Â…''d''ð’¹''d''ð“­''d''ð”¡''d''ð•Â•''d''ð–‰''d''ð–½''d''ð—±''d''ð˜¥''d''ð™Â™''d''ðšÂ''d''É—''dÌ”''ÆŒ''dÌ„''É–''dÌ¢''Ä‘''d̵''dz''dz''dž''dž''ï½…''e''ℯ''e''â…‡''e''ðž''e''ð‘Â’''e''ð’†''e''ð“®''e''ð”¢''e''ð•Â–''e''ð–Š''e''ð–¾''e''ð—²''e''ð˜¦''e''ð™Âš''e''ðšÂŽ''e''â´¹''E''É™''Ç''Éš''ÇËž''â‹´''É›''ð›Â†''É›''ð›Âœ''É›''ðœÂ€''É›''ðœÂ–''É›''ðœº''É›''ðÂ''É›''ð´''É›''ðžÂŠ''É›''ðž®''É›''ðŸÂ„''É›''f''f''ðŸ''f''ð‘“''f''ð’‡''f''ð’»''f''ð“¯''f''ð”£''f''ð•Â—''f''ð–‹''f''ð–¿''f''ð—³''f''ð˜§''f''ð™Â›''f''ðšÂ''f''Æ’''fÌ¡''g''g''â„Š''g''ð ''g''ð‘”''g''ð’ˆ''g''ð“°''g''ð”¤''g''ð•Â˜''g''ð–ÂŒ''g''ð—€''g''ð—´''g''ð˜¨''g''ð™Âœ''g''ðšÂ''g''É¡''g''É ''gÌ”''Ç¥''g̵''h''h''â„Ž''h''ð¡''h''ð’‰''h''ð’½''h''ð“±''h''ð”¥''h''ð•Â™''h''ð–Â''h''ð—Â''h''ð—µ''h''ð˜©''h''ð™Â''h''ðšÂ‘''h''ɦ''hÌ”''ħ''h̵''â„''h̵''῾''Ê»''‘''Ê»''‛''Ê»''ʽ''Ê»''â³''i''i''i''â…°''i''ℹ''i''â…ˆ''i''ð¢''i''ð‘–''i''ð’Š''i''ð’¾''i''ð“²''i''ð”¦''i''ð•Âš''i''ð–ÂŽ''i''ð—‚''i''ð—¶''i''ð˜ª''i''ð™Âž''i''ðšÂ’''i''ı''i''ðš¤''i''ɪ''i''É©''i''ð›ÂŠ''i''ðœÂ„''i''ðœ¾''i''ð¸''i''ðž²''i''ɨ''i̵''â…±''ii''â…²''iii''ij''ij''â…³''iv''â…¸''ix''j''j''â…‰''j''ð£''j''ð‘—''j''ð’‹''j''ð’¿''j''ð“³''j''ð”§''j''ð•Â›''j''ð–Â''j''ð—ƒ''j''ð—·''j''ð˜«''j''ð™ÂŸ''j''ðšÂ“''j''ϳ''j''ðš¥''È·''k''k''ð¤''k''ð‘˜''k''ð’ÂŒ''k''ð“€''k''ð“´''k''ð”¨''k''ð•Âœ''k''ð–Â''k''ð—„''k''ð—¸''k''ð˜¬''k''ð™ ''k''ðšÂ”''k''Æ™''kÌ”''ï½''m''â…¿''m''ð¦''m''ð‘š''m''ð’ÂŽ''m''ð“‚''m''ð“¶''m''ð”ª''m''ð•Âž''m''ð–Â’''m''ð—†''m''ð—º''m''ð˜®''m''ð™¢''m''ðšÂ–''m''ɱ''mÌ¡''n''n''ð§''n''ð‘›''n''ð’Â''n''ð“ƒ''n''ð“·''n''ð”«''n''ð•ÂŸ''n''ð–“''n''ð—‡''n''ð—»''n''ð˜¯''n''ð™£''n''ðšÂ—''n''ðÂ''N''ð‘Â''N''ð‘µ''N''ð’©''N''ð“Â''N''ð”‘''N''ð•¹''N''ð–­''N''ð—¡''N''ð˜Â•''N''ð™Â‰''N''ð™½''N''ðš´''N''ð›®''N''ðœ¨''N''ð¢''N''ðžÂœ''N''ɲ''ņ''ɳ''nÌ¢''Æž''nÌ©''ð›Âˆ''nÌ©''ðœÂ‚''nÌ©''ðœ¼''nÌ©''ð¶''nÌ©''ðž°''nÌ©''ÇŒ''nj''ï½''o''â„´''o''ð¨''o''ð‘Âœ''o''ð’Â''o''ð“¸''o''ð”¬''o''ð• ''o''ð–”''o''ð—ˆ''o''ð—¼''o''ð˜°''o''ð™¤''o''ðšÂ˜''o''á´''o''ð›Â''o''ðœÂŠ''o''ð„''o''ð¾''o''ðž¸''o''ɵ''o̵''Ç¿''o̵Ì''ø''oÌ·''Å“''oe''Æ¡''oʼ''â´''p''ï½''p''ð©''p''ð‘Â''p''ð’‘''p''ð“Â…''p''ð“¹''p''ð”­''p''ð•¡''p''ð–•''p''ð—‰''p''ð—½''p''ð˜±''p''ð™¥''p''ðšÂ™''p''ð›Â’''p''ð› ''p''ðœÂŒ''p''ðœÂš''p''ð†''p''ð”''p''ðžÂ€''p''ðžÂŽ''p''ðžº''p''ðŸÂˆ''p''Æ¥''pÌ”''q''q''ðª''q''ð‘ž''q''ð’Â’''q''ð“†''q''ð“º''q''ð”®''q''ð•¢''q''ð––''q''ð—Š''q''ð—¾''q''ð˜²''q''ð™¦''q''ðšÂš''q''ðÂ''Q''ð‘„''Q''ð‘¸''Q''ð’¬''Q''ð“ ''Q''ð””''Q''ð•¼''Q''ð–°''Q''ð—¤''Q''ð˜Â˜''Q''ð™ÂŒ''Q''ðšÂ€''Q''Ê ''qÌ”''ð›Â‹''ĸ''ð›Âž''ĸ''ðœÂ…''ĸ''ðœÂ˜''ĸ''ðœ¿''ĸ''ðÂ’''ĸ''ð¹''ĸ''ðžÂŒ''ĸ''ðž³''ĸ''ðŸÂ†''ĸ''ï½’''r''ð«''r''ð‘Ÿ''r''ð’“''r''ð“‡''r''ð“»''r''ð”¯''r''ð•£''r''ð–—''r''ð—‹''r''ð—¿''r''ð˜³''r''ð™§''r''ðšÂ›''r''ɽ''rÌ¢''ɼ''rÌ©''s''s''ð¬''s''ð‘ ''s''ð’”''s''ð“ˆ''s''ð“¼''s''ð”°''s''ð•¤''s''ð–˜''s''ð—ÂŒ''s''ð˜Â€''s''ð˜´''s''ð™¨''s''ðšÂœ''s''ƽ''s''Ê‚''sÌ¢''∫''ʃ''∬''ʃʃ''∭''ʃʃʃ''⨌''ʃʃʃʃ''ï½”''t''ð­''t''ð‘¡''t''ð’•''t''ð“‰''t''ð“½''t''ð”±''t''ð•¥''t''ð–™''t''ð—Â''t''ð˜Â''t''ð˜µ''t''ð™©''t''ðšÂ''t''ð‘‡''T''ð‘»''T''ð’¯''T''ð“£''T''ð”—''T''ð•Â‹''T''ð•¿''T''ð–³''T''ð—§''T''ð˜Â›''T''ð™Â''T''ðšÂƒ''T''ðš»''T''ð›µ''T''ðœ¯''T''ð©''T''ðž£''T''Æ­''tÌ”''È›''Å£''Æ«''Å£''ŧ''t̵''u''u''ð®''u''ð‘¢''u''ð’–''u''ð“Š''u''ð“¾''u''ð”²''u''ð•¦''u''ð–š''u''ð—ÂŽ''u''ð˜Â‚''u''ð˜¶''u''ð™ª''u''ðšÂž''u''ÊŠ''u''Ê‹''u''ð›Â–''u''ðœÂ''u''ðŠ''u''ðžÂ„''u''ðž¾''u''ð‘ˆ''U''ð‘¼''U''ð’°''U''ð“¤''U''ð”˜''U''ð•ÂŒ''U''ð–€''U''ð–´''U''ð—¨''U''ð˜Âœ''U''ð™Â''U''ðšÂ„''U''ï½–''v''â…´''v''ð¯''v''ð‘£''v''ð’—''v''ð“‹''v''ð“¿''v''ð”³''v''ð•§''v''ð–›''v''ð—Â''v''ð˜Âƒ''v''ð˜·''v''ð™«''v''ðšÂŸ''v''ð›ÂŽ''v''ðœÂˆ''v''ð‚''v''ð¼''v''ðž¶''v''â…µ''vi''â…¶''vii''â…·''viii''ɯ''w''ï½—''w''ð°''w''ð‘¤''w''ð’˜''w''ð“ÂŒ''w''ð”€''w''ð”´''w''ð•¨''w''ð–Âœ''w''ð—Â''w''ð˜Â„''w''ð˜¸''w''ð™¬''w''ðš ''w''ð‘Š''W''ð‘¾''W''ð’²''W''ð“¦''W''ð”š''W''ð•ÂŽ''W''ð–‚''W''ð–¶''W''ð—ª''W''ð˜Âž''W''ð™Â’''W''ðšÂ†''W''×''x''x''x''â…¹''x''ð±''x''ð‘¥''x''ð’™''x''ð“Â''x''ð”Â''x''ð”µ''x''ð•©''x''ð–Â''x''ð—‘''x''ð˜Â…''x''ð˜¹''x''ð™­''x''ðš¡''x''á™­''X''ð‘‹''X''ð‘¿''X''ð’³''X''ð“§''X''ð”›''X''ð•Â''X''ð–ƒ''X''ð–·''X''ð—«''X''ð˜ÂŸ''X''ð™Â“''X''ðšÂ‡''X''ðš¾''X''ð›¸''X''ðœ²''X''ð¬''X''ðž¦''X''â…º''xi''â…»''xii''ï½™''y''ð²''y''ð‘¦''y''ð’š''y''ð“ÂŽ''y''ð”‚''y''ð”¶''y''ð•ª''y''ð–ž''y''ð—Â’''y''ð˜Â†''y''ð˜º''y''ð™®''y''ðš¢''y''Æ´''yÌ”''z''z''ð³''z''ð‘§''z''ð’›''z''ð“Â''z''ð”ƒ''z''ð”·''z''ð•«''z''ð–Ÿ''z''ð—“''z''ð˜Â‡''z''ð˜»''z''ð™¯''z''ðš£''z''È¥''zÌ¡''Ê''zÌ¢''ƶ''z̵''È''Ê’''?''Ê”''?''Ê”''â‡''ʔʔ''âˆ''ʔǃ''á¾½''ʼ''᾿''ʼ''’''ʼ''ʾ''ʼ''!''ǃ''ï¼''ǃ''â‰''ǃʔ''‼''ǃǃ''âº''α''ð›Â‚''α''ð›¼''α''ðœ¶''α''ð°''α''ðžª''α''ð›Âƒ''β''ð›½''β''ðœ·''β''ð±''β''ðž«''β''ℽ''γ''ð›Â„''γ''ð›¾''γ''ðœ¸''γ''ð²''γ''ðž¬''γ''ð›Â…''δ''ð›¿''δ''ðœ¹''δ''ð³''δ''ðž­''δ''ðŸÂ‹''Ï''ð›Â‡''ζ''ðœÂ''ζ''ðœ»''ζ''ðµ''ζ''ðž¯''ζ''â¬''θ''ð›Â‰''θ''ð›Â''θ''ðœÂƒ''θ''ðœÂ—''θ''ðœ½''θ''ð‘''θ''ð·''θ''ðžÂ‹''θ''ðž±''θ''ðŸÂ…''θ''ð›ÂŒ''λ''ðœÂ†''λ''ð€''λ''ðº''λ''ðž´''λ''ð›¬''Λ''ðœ¦''Λ''ð ''Λ''ðžÂš''Λ''ð›Â''μ''ðœÂ‡''μ''ðÂ''μ''ð»''μ''ðžµ''μ''ð›Â''ξ''ðœÂ‰''ξ''ðƒ''ξ''ð½''ξ''ðž·''ξ''ð›¯''Ξ''ðœ©''Ξ''ð£''Ξ''ðžÂ''Ξ''ℼ''Ï€''ð›Â‘''Ï€''ð›¡''Ï€''ðœÂ‹''Ï€''ðœÂ›''Ï€''ðÂ…''Ï€''ð•''Ï€''ð¿''Ï€''ðžÂ''Ï€''ðž¹''Ï€''ðŸÂ‰''Ï€''á´¨''Ï€''âˆ''Π''ðš·''Π''ð›±''Π''ðœ«''Π''ð¥''Π''ðžÂŸ''Π''ð›Â”''σ''ðœÂŽ''σ''ðˆ''σ''ðžÂ‚''σ''ðž¼''σ''ð›Â•''Ï„''ðœÂ''Ï„''ð‰''Ï„''ðžÂƒ''Ï„''ðž½''Ï„''ð˜''Y''ð‘ÂŒ''Y''ð’€''Y''ð’´''Y''ð“¨''Y''ð”Âœ''Y''ð•Â''Y''ð–„''Y''ð–¸''Y''ð—¬''Y''ð˜ ''Y''ð™Â”''Y''ðšÂˆ''Y''ðš¼''Y''ð›¶''Y''ðœ°''Y''ðª''Y''ðž¤''Y''ð›Â—''φ''ð›ÂŸ''φ''ðœÂ‘''φ''ðœÂ™''φ''ð‹''φ''ð“''φ''ðžÂ…''φ''ðžÂ''φ''ðž¿''φ''ðŸÂ‡''φ''ð›·''Φ''ðœ±''Φ''ð«''Φ''ðž¥''Φ''ð›Â˜''χ''ðœÂ’''χ''ðÂŒ''χ''ðžÂ†''χ''ðŸÂ€''χ''ð›Â™''ψ''ðœÂ“''ψ''ðÂ''ψ''ðžÂ‡''ψ''ðŸÂ''ψ''ð›¹''Ψ''ðœ³''Ψ''ð­''Ψ''ðž§''Ψ''âµ''ω''ð›Âš''ω''ðœÂ”''ω''ðÂŽ''ω''ðžÂˆ''ω''ðŸÂ‚''ω''Ó•''ae''Ò“''r̵''Ò‘''rá‘Š''Ò—''ж̩''Ò™''з̡''Ó''i''Ò‹''й̡''Ò›''ĸ̩''ÒŸ''ĸ̵''á´«''л''Ó†''л̡''ÓŽ''м̡''ÓŠ''н̡''Óˆ''н̡''Ò£''н̩''Ó©''o̵''ѳ''o̵''Ò«''cÌ¡''Ò­''Ñ‚Ì©''Ò¯''y''Ò±''y̵''Ñ›''h̵''ѽ''Ñ¡Òƒ''ÓŒ''Ò·''Ò¿''ҽ̢''Ò''Ь̵''Õ¦''q''Õ¼''n''ℵ''×''ﬡ''×''אָ''אַ''אּ''אַ''ï­''×ל''ℶ''ב''â„·''×’''ℸ''ד''ﬢ''ד''ﬣ''×”''ﬤ''×›''ﬥ''ל''ﬦ''×''ﬠ''×¢''ﬧ''ר''ﬨ''ת''ﺀ''Ø¡''ﺂ''Ø¢''ïº''Ø¢''ﺄ''Ø£''ﺃ''Ø£''Ùµ''أ''ï­‘''Ù±''ï­''Ù±''ﺆ''ؤ''ﺅ''ؤ''Ù¶''ÙˆÙ”''ﺈ''Ø¥''ﺇ''Ø¥''ﺋ''ئ''ﺌ''ئ''ﺊ''ئ''ﺉ''ئ''ﯫ''ئا''ﯪ''ئا''ﯸ''ئٻ''ﯷ''ئٻ''ﯶ''ئٻ''ï²—''ئج''ï°€''ئج''ﲘ''ئح''ï°''ئح''ï²™''ئخ''ﱤ''ئر''ï±¥''ئز''ﲚ''ئم''ﳟ''ئم''ﱦ''ئم''ï°‚''ئم''ﱧ''ئن''ï²›''ئه''ï³ ''ئه''ﯭ''ئه''ﯬ''ئه''ﯯ''ئو''ﯮ''ئو''ﯳ''ئۆ''ﯲ''ئۆ''ﯱ''ئۇ''ﯰ''ئۇ''ﯵ''ئۈ''ﯴ''ئۈ''ﯻ''ئى''ﯺ''ئى''ﱨ''ئى''ﯹ''ئى''ï°ƒ''ئى''ﱩ''ئى''ï°„''ئى''ﺎ''ا''ïº''ا''ï´¼''اً''ï´½''اً''ï·³''اكبر''ï·²''الله''ﺑ''ب''ﺒ''ب''ïº''ب''ïº''ب''ﲜ''بج''ï°…''بج''ï²''بح''ï°†''بح''ï·‚''بحى''ﲞ''بخ''ï°‡''بخ''ﶞ''بخى''ﱪ''بر''ﱫ''بز''ﲟ''بم''ﳡ''بم''ﱬ''بم''ï°ˆ''بم''ï±­''بن''ï² ''به''ï³¢''به''ï±®''بى''ï°‰''بى''ﱯ''بى''ï°Š''بى''ï­”''Ù»''ï­•''Ù»''ï­“''Ù»''ï­’''Ù»''Û''Ù»''ﯦ''Ù»''ﯧ''Ù»''ﯥ''Ù»''ﯤ''Ù»''ï­˜''Ù¾''ï­™''Ù¾''ï­—''Ù¾''ï­–''Ù¾''ï­œ''Ú€''ï­''Ú€''ï­›''Ú€''ï­š''Ú€''ﺔ''Ø©''ﺓ''Ø©''ﺗ''ت''ﺘ''ت''ﺖ''ت''ﺕ''ت''ﲡ''تج''ï°‹''تج''ïµ''تجم''ﶠ''تجى''ﶟ''تجى''ï²¢''تح''ï°Œ''تح''ïµ’''تحج''ﵑ''تحج''ﵓ''تحم''ï²£''تخ''ï°''تخ''ïµ”''تخم''ﶢ''تخى''ﶡ''تخى''ï±°''تر''ï±±''تز''ﲤ''تم''ï³£''تم''ï±²''تم''ï°Ž''تم''ﵕ''تمج''ïµ–''تمح''ïµ—''تمخ''ﶤ''تمى''ﶣ''تمى''ï±³''تن''ï²¥''ته''ﳤ''ته''ï±´''تى''ï°''تى''ï±µ''تى''ï°''تى''ﺛ''Ø«''ﺜ''Ø«''ﺚ''Ø«''ﺙ''Ø«''ï°‘''ثج''ﱶ''ثر''ï±·''ثز''ﲦ''ثم''ï³¥''ثم''ﱸ''ثم''ï°’''ثم''ï±¹''ثن''ﳦ''ثه''ﱺ''ثى''ï°“''ثى''ï±»''ثى''ï°”''ثى''ï­¨''Ù¹''ï­©''Ù¹''ï­§''Ù¹''ï­¦''Ù¹''Ú»''Ù¹''ﮢ''Ù¹''ﮣ''Ù¹''ﮡ''Ù¹''ï® ''Ù¹''ï­ ''Ùº''ï­¡''Ùº''ï­Ÿ''Ùº''ï­ž''Ùº''ï­¤''Ù¿''ï­¥''Ù¿''ï­£''Ù¿''ï­¢''Ù¿''ﺟ''ج''ﺠ''ج''ﺞ''ج''ïº''ج''ﲧ''جح''ï°•''جح''ﶦ''جحى''ﶾ''جحى''ï·»''جل جلاله''ﲨ''جم''ï°–''جم''ïµ™''جمح''ﵘ''جمح''ﶧ''جمى''ﶥ''جمى''ï´''جى''ï´''جى''ï´ž''جى''ï´‚''جى''ï­¸''Úƒ''ï­¹''Úƒ''ï­·''Úƒ''ï­¶''Úƒ''ï­´''Ú„''ï­µ''Ú„''ï­³''Ú„''ï­²''Ú„''ï­¼''Ú†''ï­½''Ú†''ï­»''Ú†''ï­º''Ú†''ﮀ''Ú‡''ï®''Ú‡''ï­¿''Ú‡''ï­¾''Ú‡''ﺣ''Ø­''ﺤ''Ø­''ﺢ''Ø­''ﺡ''Ø­''ﲩ''حج''ï°—''حج''ﶿ''حجى''ﲪ''حم''ï°˜''حم''ïµ›''حمى''ﵚ''حمى''ï´›''حى''ﳿ''حى''ï´œ''حى''ï´€''حى''ﺧ''Ø®''ﺨ''Ø®''ﺦ''Ø®''ﺥ''Ø®''ﲫ''خج''ï°™''خج''ï°š''خح''ﲬ''خم''ï°›''خم''ï´Ÿ''خى''ï´ƒ''خى''ï´ ''خى''ï´„''خى''ﺪ''د''ﺩ''د''ﺬ''Ø°''ﺫ''Ø°''ï±›''ذٰ''ﮉ''Úˆ''ﮈ''Úˆ''ï®…''ÚŒ''ﮄ''ÚŒ''ﮃ''Ú''ﮂ''Ú''ﮇ''ÚŽ''ﮆ''ÚŽ''ﺮ''ر''ﺭ''ر''ﱜ''رٰ''ï·¶''رسول''ï·¼''رىال''ﺰ''ز''ﺯ''ز''ï®''Ú‘''ﮌ''Ú‘''ﮋ''Ú˜''ﮊ''Ú˜''ﺳ''س''ﺴ''س''ﺲ''س''ﺱ''س''ï²­''سج''ï´´''سج''ï°œ''سج''ïµ''سجح''ﵞ''سجى''ï²®''سح''ï´µ''سح''ï°''سح''ﵜ''سحج''ﲯ''سخ''ï´¶''سخ''ï°ž''سخ''ﶨ''سخى''ï·†''سخى''ï´ª''سر''ï´Ž''سر''ï²°''سم''ﳧ''سم''ï°Ÿ''سم''ﵡ''سمج''ïµ ''سمح''ﵟ''سمح''ïµ£''سمم''ïµ¢''سمم''ï´±''سه''ﳨ''سه''ï´—''سى''ï³»''سى''ï´˜''سى''ï³¼''سى''ﺷ''Ø´''ﺸ''Ø´''ﺶ''Ø´''ﺵ''Ø´''ï´­''شج''ï´·''شج''ï´¥''شج''ï´‰''شج''ﵩ''شجى''ï´®''شح''ï´¸''شح''ï´¦''شح''ï´Š''شح''ﵨ''شحم''ﵧ''شحم''ﶪ''شحى''ï´¯''شخ''ï´¹''شخ''ï´§''شخ''ï´‹''شخ''ï´©''شر''ï´''شر''ï´°''شم''ﳩ''شم''ï´¨''شم''ï´Œ''شم''ﵫ''شمخ''ﵪ''شمخ''ïµ­''شمم''ﵬ''شمم''ï´²''شه''ﳪ''شه''ï´™''شى''ï³½''شى''ï´š''شى''ï³¾''شى''ﺻ''ص''ﺼ''ص''ﺺ''ص''ﺹ''ص''ï²±''صح''ï° ''صح''ïµ¥''صحح''ﵤ''صحح''ﶩ''صحى''ï²²''صخ''ï´«''صر''ï´''صر''ï·µ''صلعم''ï·¹''صلى''ï·º''صلى الله علىه وسلم''ï·°''صلے''ï²³''صم''ï°¡''صم''ï·…''صمم''ﵦ''صمم''ï´¡''صى''ï´…''صى''ï´¢''صى''ï´†''صى''ﺿ''ض''ﻀ''ض''ﺾ''ض''ﺽ''ض''ï²´''ضج''ï°¢''ضج''ï²µ''ضح''ï°£''ضح''ïµ®''ضحى''ﶫ''ضحى''ﲶ''ضخ''ï°¤''ضخ''ïµ°''ضخم''ﵯ''ضخم''ï´¬''ضر''ï´''ضر''ï²·''ضم''ï°¥''ضم''ï´£''ضى''ï´‡''ضى''ï´¤''ضى''ï´ˆ''ضى''ﻃ''Ø·''ﻄ''Ø·''ﻂ''Ø·''ï»''Ø·''ﲸ''طح''ï°¦''طح''ï´³''طم''ï´º''طم''ï°§''طم''ïµ²''طمح''ïµ±''طمح''ïµ³''طمم''ïµ´''طمى''ï´‘''طى''ï³µ''طى''ï´’''طى''ﳶ''طى''ﻇ''ظ''ﻈ''ظ''ﻆ''ظ''ï»…''ظ''ï²¹''ظم''ï´»''ظم''ï°¨''ظم''ﻋ''ع''ﻌ''ع''ﻊ''ع''ﻉ''ع''ﲺ''عج''ï°©''عج''ï·„''عجم''ïµµ''عجم''ï··''علىه''ï²»''عم''ï°ª''عم''ïµ·''عمم''ﵶ''عمم''ﵸ''عمى''ﶶ''عمى''ï´“''عى''ï³·''عى''ï´”''عى''ﳸ''عى''ï»''غ''ï»''غ''ﻎ''غ''ï»''غ''ï²¼''غج''ï°«''غج''ï²½''غم''ï°¬''غم''ïµ¹''غمم''ïµ»''غمى''ﵺ''غمى''ï´•''غى''ï³¹''غى''ï´–''غى''ﳺ''غى''ﻓ''Ù''ï»”''Ù''ï»’''Ù''ﻑ''Ù''ï²¾''Ùج''ï°­''Ùج''ﲿ''ÙØ­''ï°®''ÙØ­''ï³€''ÙØ®''ï°¯''ÙØ®''ïµ½''Ùخم''ïµ¼''Ùخم''ï³''ÙÙ…''ï°°''ÙÙ…''ï·''Ùمى''ï±¼''ÙÙ‰''ï°±''ÙÙ‰''ï±½''ÙÙ‰''ï°²''ÙÙ‰''ï­¬''Ú¤''ï­­''Ú¤''ï­«''Ú¤''ï­ª''Ú¤''ï­°''Ú¦''ï­±''Ú¦''ï­¯''Ú¦''ï­®''Ú¦''ï»—''Ù‚''ﻘ''Ù‚''ï»–''Ù‚''ﻕ''Ù‚''ﳂ''قح''ï°³''قح''ï·±''قلے''ﳃ''قم''ï°´''قم''ﶴ''قمح''ïµ¾''قمح''ﵿ''قمم''ﶲ''قمى''ï±¾''قى''ï°µ''قى''ﱿ''قى''ï°¶''قى''ï»›''Ùƒ''ﻜ''Ùƒ''ﻚ''Ùƒ''ï»™''Ùƒ''Ú©''Ùƒ''ï®''Ùƒ''ﮑ''Ùƒ''ï®''Ùƒ''ﮎ''Ùƒ''ï²€''كا''ï°·''كا''ﳄ''كج''ï°¸''كج''ï³…''كح''ï°¹''كح''ﳆ''كخ''ï°º''كخ''ﳇ''كل''ﳫ''كل''ï²''كل''ï°»''كل''ﳈ''كم''ﳬ''كم''ﲂ''كم''ï°¼''كم''ï·ƒ''كمم''ﶻ''كمم''ﶷ''كمى''ﲃ''كى''ï°½''كى''ﲄ''كى''ï°¾''كى''ﯕ''Ú­''ﯖ''Ú­''ﯔ''Ú­''ﯓ''Ú­''ï®”''Ú¯''ﮕ''Ú¯''ﮓ''Ú¯''ï®’''Ú¯''ﮜ''Ú±''ï®''Ú±''ï®›''Ú±''ﮚ''Ú±''ﮘ''Ú³''ï®™''Ú³''ï®—''Ú³''ï®–''Ú³''ﻟ''Ù„''ï» ''Ù„''ﻞ''Ù„''ï»''Ù„''ﻶ''لآ''ﻵ''لآ''ﻸ''لأ''ï»·''لأ''ﻺ''لإ''ﻹ''لإ''ﻼ''لا''ï»»''لا''ﳉ''لج''ï°¿''لج''ﶃ''لجج''ﶄ''لجج''ﶺ''لجم''ﶼ''لجم''ﶬ''لجى''ﳊ''لح''ï±€''لح''ﶵ''لحم''ﶀ''لحم''ﶂ''لحى''ï¶''لحى''ﳋ''لخ''ï±''لخ''ﶆ''لخم''ﶅ''لخم''ﳌ''لم''ï³­''لم''ï²…''لم''ﱂ''لم''ﶈ''لمح''ﶇ''لمح''ﶭ''لمى''ï³''له''ﲆ''لى''ﱃ''لى''ﲇ''لى''ﱄ''لى''ﻣ''Ù…''ﻤ''Ù…''ﻢ''Ù…''ﻡ''Ù…''ﲈ''ما''ﳎ''مج''ï±…''مج''ﶌ''مجح''ﶒ''مجخ''ï¶''مجم''ï·€''مجى''ï³''مح''ﱆ''مح''ﶉ''محج''ﶊ''محم''ï·´''محمد''ﶋ''محى''ï³''مخ''ﱇ''مخ''ﶎ''مخج''ï¶''مخم''ﶹ''مخى''ﳑ''مم''ﲉ''مم''ﱈ''مم''ﶱ''ممى''ﱉ''مى''ﱊ''مى''ﻧ''Ù†''ﻨ''Ù†''ﻦ''Ù†''ﻥ''Ù†''ï³’''نج''ﱋ''نج''ﶸ''نجح''ﶽ''نجح''ﶘ''نجم''ﶗ''نجم''ﶙ''نجى''ï·‡''نجى''ﳓ''نح''ﱌ''نح''ﶕ''نحم''ﶖ''نحى''ﶳ''نحى''ï³”''نخ''ï±''نخ''ﲊ''نر''ﲋ''نز''ﳕ''نم''ï³®''نم''ﲌ''نم''ﱎ''نم''ﶛ''نمى''ﶚ''نمى''ï²''نن''ï³–''نه''ﳯ''نه''ﲎ''نى''ï±''نى''ï²''نى''ï±''نى''ﮟ''Úº''ﮞ''Úº''ﻫ''Ù‡''ﻬ''Ù‡''ﻪ''Ù‡''ﻩ''Ù‡''Ú¾''Ù‡''ﮬ''Ù‡''ï®­''Ù‡''ﮫ''Ù‡''ﮪ''Ù‡''Û''Ù‡''ﮨ''Ù‡''ﮩ''Ù‡''ﮧ''Ù‡''ﮦ''Ù‡''Û•''Ù‡''ï³™''هٰ''ï³—''هج''ﱑ''هج''ﳘ''هم''ï±’''هم''ﶓ''همج''ﶔ''همم''ﱓ''هى''ï±”''هى''ﮥ''Û€''ﮤ''Û€''ï»®''Ùˆ''ï»­''Ùˆ''ï·¸''وسلم''ﯡ''Û…''ﯠ''Û…''ﯚ''Û†''ﯙ''Û†''ﯘ''Û‡''ﯗ''Û‡''Ù·''Û‡Ù”''ï¯''Û‡Ù”''ﯜ''Ûˆ''ﯛ''Ûˆ''ﯣ''Û‰''ﯢ''Û‰''ﯟ''Û‹''ﯞ''Û‹''ﯨ''Ù‰''ﯩ''Ù‰''ï»°''Ù‰''ﻯ''Ù‰''ÙŠ''Ù‰''ﻳ''Ù‰''ï»´''Ù‰''ﻲ''Ù‰''ï»±''Ù‰''ÛŒ''Ù‰''ﯾ''Ù‰''ﯿ''Ù‰''ﯽ''Ù‰''ﯼ''Ù‰''Ù¸''Ù‰Ù”''ï²''ىٰ''ï±''ىٰ''ﳚ''ىج''ﱕ''ىج''ﶯ''ىجى''ï³›''ىح''ï±–''ىح''ﶮ''ىحى''ﳜ''ىخ''ï±—''ىخ''ﲑ''ىر''ï²’''ىز''ï³''ىم''ï³°''ىم''ﲓ''ىم''ﱘ''ىم''ï¶''ىمم''ﶜ''ىمم''ﶰ''ىمى''ï²”''ىن''ﳞ''ىه''ï³±''ىه''ﲕ''ىى''ï±™''ىى''ï²–''ىى''ﱚ''ىى''Û§''Û¦''ﮯ''Û’''ï®®''Û’''ï®±''Û“''ï®°''Û“''∃''â´º''आ''अा''ऒ''अाॆ''ओ''अाे''औ''अाै''ऄ''अॆ''ऑ''अॉ''à¤''à¤à¥…''ऎ''à¤à¥†''à¤''à¤à¥‡''ई''रà¥à¤‡''আ''অা''ৠ''ঋৃ''ৡ''ঌৢ''ਉ''ੳà©''ਊ''ੳੂ''ਆ''ਅਾ''à¨''ਅੈ''ਔ''ਅੌ''ਇ''ੲਿ''ਈ''ੲੀ''à¨''ੲੇ''આ''અા''ઑ''અાૅ''ઓ''અાે''ઔ''અાૈ''àª''અૅ''àª''અે''àª''અૈ''ଆ''ଅା''௮''à®…''à®°''ஈ''ா''ஈ''௫''ஈà¯''௨''உ''ஊ''உள''௭''எ''௷''எவ''ஜ''à®''௧''க''௪''ச''௬''சà¯''௲''சூ''௺''நீ''ை''ன''௴''மீ''௰''ய''ௗ''ள''௸''à®·''ொ''ெஈ''ௌ''ெள''ோ''ேஈ''à± ''à°‹à°¾''ౡ''ఌా''à°”''ఒౌ''à°“''ఒౕ''à°¢''à°¡Ì£''à°­''బ̣''à°·''వ̣''à°¹''వా''à°®''à°µà±''ూ''à±à°¾''ౄ''ృా''ೡ''ಌಾ''ಔ''ఒౌ''à´ˆ''ഇൗ''à´Š''உൗ''à´''എെ''à´“''à´’à´¾''à´”''ഒൗ''ൡ''à´ž''൫''à´¦àµà´°''à´Œ''നூ''à´™''നூ''൯''à´¨àµ''à´±''à´°''൪''à´°àµ''൮''à´µàµ''ീ''ி''ൂ''ூ''ൃ''ூ''ൈ''െെ''ฃ''ข''ด''ค''ต''ค''ม''ฆ''ซ''ช''à¸''ฎ''ท''ฑ''ๅ''า''ำ''̊า''à¹''เเ''ໜ''ຫນ''à»''ຫມ''ຳ''̊າ''ཷ''ྲཱྀ''ཹ''ླཱྀ''á€''o''ឣ''អ''á§''ᦞ''á­’''á¬''á­“''ᬑ''á­˜''ᬨ''ᢖ''á¡œ''á¡•''á µ''á’''Ꭱ''Ꮍ''y''ð€''A''ð´''A''ð‘¨''A''ð’Âœ''A''ð“Â''A''ð”„''A''ð”¸''A''ð•¬''A''ð– ''A''ð—”''A''ð˜Âˆ''A''ð˜¼''A''ð™°''A''ðš¨''A''ð›¢''A''ðœÂœ''A''ð–''A''ðžÂ''A''ð‰''J''ð½''J''ð‘±''J''ð’¥''J''ð“™''J''ð”Â''J''ð•Â''J''ð•µ''J''ð–©''J''ð—Â''J''ð˜Â‘''J''ð™Â…''J''ð™¹''J''á§''J''â‹¿''E''â„°''E''ð„''E''ð¸''E''ð‘¬''E''ð“”''E''ð”ˆ''E''ð”¼''E''ð•°''E''ð–¤''E''ð—˜''E''ð˜ÂŒ''E''ð™Â€''E''ð™´''E''ðš¬''E''ð›¦''E''ðœ ''E''ðš''E''ðžÂ”''E''ℾ''Ꮁ''ðšª''Ꮁ''ð›¤''Ꮁ''ðœÂž''Ꮁ''ð˜''Ꮁ''ðžÂ’''Ꮁ''á”''w''ℳ''M''ðÂŒ''M''ð‘€''M''ð‘´''M''ð“Âœ''M''ð”Â''M''ð•Â„''M''ð•¸''M''ð–¬''M''ð— ''M''ð˜Â”''M''ð™Âˆ''M''ð™¼''M''ðš³''M''ð›­''M''ðœ§''M''ð¡''M''ðžÂ›''M''â„‹''H''â„Œ''H''â„''H''ð‡''H''ð»''H''ð‘¯''H''ð“—''H''ð•³''H''ð–§''H''ð—›''H''ð˜Â''H''ð™Âƒ''H''ð™·''H''ðš®''H''ð›¨''H''ðœ¢''H''ðÂœ''H''ðžÂ–''H''ð†''G''ðº''G''ð‘®''G''ð’¢''G''ð“–''G''ð”Š''G''ð”¾''G''ð•²''G''ð–¦''G''ð—š''G''ð˜ÂŽ''G''ð™Â‚''G''ð™¶''G''á³''G''ℤ''Z''ℨ''Z''ð™''Z''ð‘Â''Z''ð’Â''Z''ð’µ''Z''ð“©''Z''ð–Â…''Z''ð–¹''Z''ð—­''Z''ð˜¡''Z''ð™Â•''Z''ðšÂ‰''Z''ðš­''Z''ð›§''Z''ðœ¡''Z''ð›''Z''ðžÂ•''Z''ðÂ’''S''ð‘†''S''ð‘º''S''ð’®''S''ð“¢''S''ð”–''S''ð•ÂŠ''S''ð•¾''S''ð–²''S''ð—¦''S''ð˜Âš''S''ð™ÂŽ''S''ðšÂ‚''S''áš''S''ð•''V''ð‘‰''V''ð‘½''V''ð’±''V''ð“¥''V''ð”™''V''ð•Â''V''ð–Â''V''ð–µ''V''ð—©''V''ð˜Â''V''ð™Â‘''V''ðšÂ…''V''â„’''L''ð‹''L''ð¿''L''ð‘³''L''ð“›''L''ð”Â''L''ð•Âƒ''L''ð•·''L''ð–«''L''ð—Ÿ''L''ð˜Â“''L''ð™Â‡''L''ð™»''L''∑''C''â…€''C''â„‚''C''â„­''C''ð‚''C''ð¶''C''ð‘ª''C''ð’ž''C''ð“Â’''C''ð•®''C''ð–¢''C''ð—–''C''ð˜ÂŠ''C''ð˜¾''C''ð™²''C''ðšº''C''ð›´''C''ðœ®''C''ð¨''C''ðž¢''C''â„™''P''ðÂ''P''ð‘ƒ''P''ð‘·''P''ð’«''P''ð“Ÿ''P''ð”“''P''ð•»''P''ð–¯''P''ð—£''P''ð˜Â—''P''ð™Â‹''P''ð™¿''P''ðš¸''P''ð›²''P''ðœ¬''P''ð¦''P''ðž ''P''ðŠ''K''ð¾''K''ð‘²''K''ð’¦''K''ð“š''K''ð”ÂŽ''K''ð•Â‚''K''ð•¶''K''ð–ª''K''ð—ž''K''ð˜Â’''K''ð™Â†''K''ð™º''K''ðš±''K''ð›«''K''ðœ¥''K''ðŸ''K''ðžÂ™''K''ℬ''B''ðÂ''B''ðµ''B''ð‘©''B''ð“‘''B''ð”Â…''B''ð”¹''B''ð•­''B''ð–¡''B''ð—•''B''ð˜Â‰''B''ð˜½''B''ð™±''B''ðš©''B''ð›£''B''ðœÂ''B''ð—''B''ðžÂ‘''B''á''á·''∆''áƒ''ðš«''áƒ''ð›¥''áƒ''ðœÂŸ''áƒ''ð™''áƒ''ðžÂ“''áƒ''á''áƒÂ·''á‘''á„·''á“''á…·''á•''á†Â·''á˜''áŠÂ·''áš''á‹Â·''á“‘''á¡''ᑶ''·P''ᑺ''·d''á’˜''·J''á‘''á³Â·''ᑃ''á´Â·''á‘…''á¸Â·''ᑇ''á¹Â·''ˈ''á‘Š''ᑘ''ᑌ·''ᑧ''ᑌᑊ''á‘š''ᑎ·''ᑨ''á‘Žá‘Š''á‘œ''á‘·''á‘ž''á‘·''á‘©''á‘á‘Š''á‘ ''ᑑ·''á‘¢''ᑕ·''ᑪ''á‘•á‘Š''ᑤ''ᑖ·''ᑵ''ᑫ·''á’…''á‘«á‘Š''á‘·''P·''á’†''Pá‘Š''ᑹ''ᑮ·''á‘»''d·''á’‡''dá‘Š''ᑽ''ᑰ·''á‘¿''ᑲ·''á’ˆ''ᑲᑊ''á’''ᑳ·''ᘃ''á’‰''á’“''ᒉ·''á’•''ᒋ·''á’—''ᒌ·''á’™''J·''á’›''ᒎ·''ᘂ''á’''á’''á’·''á’Ÿ''ᒑ·''á’­''ᒣ·''á’¯''ᒥ·''á’±''ᒦ·''á’³''ᒧ·''á’µ''ᒨ·''á’¹''ᒫ·''á“Š''ᓀ·''á“Œ''ᓇ·''á“Ž''ᓈᒫ''ᘄ''á““''á“''ᓓ·''á“Ÿ''ᓕ·''á“¡''ᓖ·''á“£''ᓗ·''á“¥''ᓘ·''ᘇ''á“š''ᓧ''ᓚ·''á“©''ᓛ·''á“·''ᓭ·''ᓹ''ᓯ·''á“»''ᓰ·''ᓽ''ᓱ·''á“¿''ᓲ·''á”''ᓴ·''ᔃ''ᓵ·''ᔌ''ᔋá¸''á”''ᔋᑕ''ᔎ''ᔋᑲ''á”''ᔋá’''ᔘ''á”·''ᔚ''ᔑ·''ᔜ''ᔒ·''ᔞ''ᔓ·''á” ''ᔔ·''ᔢ''ᔕ·''ᔤ''ᔖ·''ᔲ''ᔨ·''á”´''ᔩ·''ᔶ''ᔪ·''ᔸ''ᔫ·''ᔺ''ᔭ·''ᔼ''ᔮ·''á™®''x''ᕽ''x''ᘢ''ᕃ''ᘣ''ᕆ''ᘤ''á•Š''á•''ᕌ·''ᙯ''á•á‘«''ᕾ''á•á‘¬''á•¿''á•P''á–€''á•á‘®''á–''á•d''á–‚''á•á‘°''á–ƒ''á•á‘²''á–„''á•á‘³''á–…''á•á’ƒ''á•œ''ᕚ·''á•©''ᕧ·''â„›''R''â„œ''R''â„''R''ð‘''R''ð‘Â…''R''ð‘¹''R''ð“¡''R''ð•½''R''ð–±''R''ð—¥''R''ð˜Â™''R''ð™Â''R''ðšÂ''R''á™°''á–•á’‰''á–Ž''á–•á’Š''á–''á–•á’‹''á–''á–•á’Œ''á–‘''á–•J''á–’''á–•á’Ž''á–“''á–•á’''á–”''á–•á’‘''á™±''á––á’‹''ᙲ''á––á’Œ''ᙳ''á––J''á™´''á––á’Ž''ᙵ''á––á’''ᙶ''á––á’‘''ℱ''F''ðÂ…''F''ð¹''F''ð‘­''F''ð“•''F''ð”‰''F''ð”½''F''ð•±''F''ð–¥''F''ð—™''F''ð˜Â''F''ð™Â''F''ð™µ''F''ðŸÂŠ''F''â……''D''ðƒ''D''ð·''D''ð‘«''D''ð’Ÿ''D''ð““''D''ð”‡''D''ð”»''D''ð•¯''D''ð–£''D''ð——''D''ð˜Â‹''D''ð˜¿''D''ð™³''D''á—ª''D''℧''ᘮ''ᘴ''ᘮ''ð›Â€''ᘯ''ð›º''ᘯ''ðœ´''ᘯ''ð®''ᘯ''ðž¨''ᘯ''ᘵ''ᘯ''ㄱ''á„€''ᄀ''á„€''ᆨ''á„€''ㄲ''á„''ï¾¢''á„''ᆩ''á„''ã„´''á„‚''ᄂ''á„‚''ᆫ''á„‚''ã„·''ᄃ''ᄃ''ᄃ''ᆮ''ᄃ''ㄸ''á„„''ᄄ''á„„''ㄹ''á„…''ᄅ''á„…''ᆯ''á„…''ã…''ᄆ''ï¾±''ᄆ''ᆷ''ᄆ''ã…‚''ᄇ''ï¾²''ᄇ''ᆸ''ᄇ''ã…ƒ''ᄈ''ï¾³''ᄈ''ã……''ᄉ''ï¾µ''ᄉ''ᆺ''ᄉ''ã…†''á„Š''ᄊ''á„Š''ᆻ''á„Š''ã…‡''á„‹''ï¾·''á„‹''ᆼ''á„‹''ã…ˆ''á„Œ''ᄌ''á„Œ''ᆽ''á„Œ''ã…‰''á„''ï¾¹''á„''ã…Š''á„Ž''ᄎ''á„Ž''ᆾ''á„Ž''ã…‹''á„''ï¾»''á„''ᆿ''á„''ã…Œ''á„''ï¾¼''á„''ᇀ''á„''ã…''á„‘''ï¾½''á„‘''á‡''á„‘''ã…Ž''á„’''ï¾¾''á„’''ᇂ''á„’''ᇅ''á„“''ã…¥''á„”''ã…¦''á„•''ᇆ''á„•''ᇊ''á„—''á‡''ᄘ''á‡''á„™''ã…€''á„š''ï¾°''á„š''á„»''á„š''ᆶ''á„š''ã…®''á„œ''ᇜ''á„œ''ã…±''á„''ᇢ''á„''ã…²''á„ž''ã…³''á„ ''ã…„''á„¡''ï¾´''á„¡''ᆹ''á„¡''ã…´''á„¢''ã…µ''á„£''ã…¶''ᄧ''ã…·''á„©''ã…¸''á„«''ᇦ''á„«''ã…¹''ᄬ''ã…º''á„­''ᇧ''á„­''ã…»''á„®''ã…¼''ᄯ''ᇨ''ᄯ''ᇩ''á„°''ã…½''ᄲ''ᇪ''ᄲ''ã…¾''ᄶ''ã…¿''á…€''ᇫ''á…€''ᇬ''á…''ᇱ''á……''ㆂ''á……''ᇲ''á…†''ㆃ''á…†''ㆀ''á…‡''ᇮ''á…‡''ã†''á…Œ''ᇰ''á…Œ''ᇳ''á…–''ㆄ''á…—''ᇴ''á…—''ㆅ''á…˜''ㆆ''á…™''ᇹ''á…™''ã…¤''á… ''ï¾ ''á… ''ã…''á…¡''ï¿‚''á…¡''ã…''á…¢''ᅢ''á…¢''ã…‘''á…£''ï¿„''á…£''ã…’''á…¤''ï¿…''á…¤''ã…“''á…¥''ᅥ''á…¥''ã…”''á…¦''ᅦ''á…¦''ã…•''á…§''ï¿Š''á…§''ã…–''á…¨''ï¿‹''á…¨''ã…—''á…©''ï¿Œ''á…©''ã…˜''á…ª''ï¿''á…ª''ã…™''á…«''ï¿Ž''á…«''ã…š''á…¬''ï¿''á…¬''ã…›''á…­''ï¿’''á…­''ã…œ''á…®''ï¿“''á…®''ã…''á…¯''ï¿”''á…¯''ã…ž''á…°''ï¿•''á…°''ã…Ÿ''á…±''ï¿–''á…±''ã… ''á…²''ï¿—''á…²''ã…¡''一''ï¿š''一''ã…¢''á…´''ï¿›''á…´''ã…£''丨''ï¿œ''丨''ㆇ''ᆄ''ᆆ''ᆄ''ㆈ''ᆅ''ㆉ''ᆈ''ㆊ''ᆑ''ㆋ''ᆒ''ㆌ''ᆔ''ã†''ᆞ''ㆎ''ᆡ''ㄳ''ᆪ''ï¾£''ᆪ''ㄵ''ᆬ''ï¾¥''ᆬ''ㄶ''ᆭ''ᆭ''ᆭ''ㄺ''ᆰ''ᆰ''ᆰ''ã„»''ᆱ''ᆱ''ᆱ''ㄼ''ᆲ''ᆲ''ᆲ''ㄽ''ᆳ''ï¾­''ᆳ''ㄾ''ᆴ''ï¾®''ᆴ''ã„¿''ᆵ''ᆵ''ᆵ''ã…§''ᇇ''ã…¨''ᇈ''ã…©''ᇌ''ã…ª''ᇎ''ã…«''ᇓ''ã…¬''ᇗ''ã…­''ᇙ''ã…¯''á‡''ã…°''ᇟ''ァ''ã‚¡''ï½±''ã‚¢''ィ''ã‚£''ï½²''イ''ゥ''ã‚¥''ï½³''ウ''ェ''ェ''ï½´''エ''ォ''ã‚©''ï½µ''オ''カ''ã‚«''ï½·''ã‚­''ク''ク''ï½¹''ケ''コ''コ''ï½»''サ''ï½¼''ã‚·''ï½½''ス''ï½¾''ã‚»''ソ''ソ''ï¾€''ã‚¿''ï¾''ãƒ''ッ''ッ''ツ''ツ''テ''テ''ト''ト''ï¾…''ナ''ニ''ニ''ヌ''ヌ''ネ''ãƒ''ノ''ノ''ハ''ãƒ''ヒ''ヒ''フ''フ''ï¾''ã¸''ホ''ホ''ï¾''マ''⧄''〼''ï¾''ミ''ム''ム''ï¾’''メ''モ''モ''ャ''ャ''ï¾”''ヤ''ï½­''ュ''ユ''ユ''ï½®''ョ''ï¾–''ヨ''ï¾—''ラ''リ''リ''ï¾™''ル''レ''レ''ï¾›''ロ''ワ''ワ''ヲ''ヲ''ï¾''ン''ê’ž''êŠ''ê’¬''ê''ê’œ''ꃀ''ê’¿''ꉙ''ê’¾''ꊱ''ê“€''ꎫ''ê“‚''ꎵ''ê’º''ꎿ''ê’°''ê‚''ð’ ''ð’†''—''一''―''一''−''一''─''一''â¼€''一''不''ä¸''ï©°''並''|''丨''|''丨''∣''丨''â¼''丨''‖''丨丨''∥''丨丨''串''串''⼂''丶''ð¯ Â''丸''丹''丹''ð¯ Â€''丽''⼃''丿''ð¯ Â‚''ä¹''⼄''ä¹™''亂''亂''â¼…''亅''了''了''⼆''二''⼇''亠''亮''亮''⼈''人''什''什''ð¯ Â™''仌''令''令''ð¯ Â„''ä½ ''倂''ä½µ''ð¯ Â‡''ä½µ''侀''ä¾€''來''來''例''例''侮''ä¾®''ð¯ Â…''ä¾®''ð¯ Â†''ä¾»''便''便''值''値''倫''倫''ð¯ Âˆ''åº''ð¯ Â‰''å‚™''ð¯ Â‹''åƒ''僚''僚''僧''僧''ð¯ ÂŠ''僧''⼉''å„¿''兀''å…€''ï©´''å……''免''å…''ð¯ ÂŽ''å…''ð¯ Â''å…”''ð¯ Â''å…¤''⼊''å…¥''ð¯ Â”''å…§''全''å…¨''兩''å…©''⼋''å…«''六''å…­''ð¯ Â‘''å…·''冀''冀''⼌''冂''ð¯ Â•''å†''ð¯£Â’''冒''ð¯£Â“''冕''â¼''冖''ð¯ Â—''冗''ð¯ Â˜''冤''⼎''冫''ð¯ Âš''冬''况''况''ð¯ Â›''况''冷''冷''凉''凉''凌''凌''凜''凜''凞''凞''â¼''几''ð¯ Â''凵''â¼''凵''⼑''刀''ð¯ Âž''刃''切''切''ð¯¡Â''切''列''列''ï§''利''刺''刺''刻''刻''剆''剆''割''割''剷''剷''劉''劉''力''力''â¼’''力''ï¦''劣''ð¯¦Â’''劳''勇''勇''勇''勇''勉''勉''勉''勉''勒''å‹’''勞''å‹ž''勤''勤''勤''勤''勵''勵''⼓''勹''ï©·''勺''勺''勺''包''包''匆''匆''â¼”''匕''北''北''北''北''⼕''匚''â¼–''匸''匿''匿''â¼—''å''〸''å''〹''å„''〺''å…''卉''å‰''卑''å‘''卑''å‘''博''åš''⼘''åœ''â¼™''å©''即''å³''卵''åµ''卽''å½''卿''å¿''卿''å¿''卿''å¿''⼚''厂''â¼›''厶''參''åƒ''⼜''åˆ''及''åŠ''叟''åŸ''â¼''å£''句''å¥''叫''å«''叱''å±''吆''å†''吏''å''吝''å''吸''å¸''呂''å‘‚''呈''呈''周''周''咞''å’ž''ð¯¡Â€''å’¢''咽''å’½''ð¯¡Â''哶''ð¯¡Â‚''å”''ð¯¡Âƒ''å•“''å•Ÿ''å•“''啕''å••''ð¯¡Â„''å•£''ð¯¡Â…''å–„''ð¯¡Â†''å–„''喇''å–‡''喙''å–™''ð¯¡Â‡''å–™''喝''å–''喝''å–''ð¯¡Âˆ''å–«''ð¯¡Â‰''å–³''ï¨''å—€''ð¯¡ÂŠ''å—‚''ï©»''å—¢''嘆''嘆''ð¯¡ÂŒ''嘆''ð¯¡ÂŽ''噑''器''器''ð¯¡Â''å™´''⼞''å›—''囹''囹''ð¯¡Â‹''圖''ð¯¡Â''圗''⼟''土''ð¯¡Â•''åž‹''ð¯¡Â’''城''ð¯¡Â“''埴''ð¯¡Â”''å ''ð¯¡Â—''å ±''ð¯¡Â–''å ²''塀''å¡€''ï¨''å¡š''塚''å¡š''塞''å¡ž''å¡«''å¡¡''墨''墨''壿''墫''ð¯¡Â˜''墬''墳''墳''壘''壘''壟''壟''â¼ ''士''ð¯¡Â‘''壮''ð¯¡Âš''売''ð¯¡Â›''壷''⼡''夂''ð¯¡Âœ''夆''â¼¢''夊''â¼£''夕''ð¯¡Â''多''ð¯¡Âž''夢''⼤''大''奄''奄''奈''奈''契''契''ï©¿''奔''ð¯¡ÂŸ''奢''ï¦''女''â¼¥''女''姘''姘''姬''姬''娛''娛''娧''娧''婢''å©¢''婦''婦''嬀''媯''ð¯¦Â†''媵''嬈''嬈''ïª''嬨''嬾''嬾''嬾''嬾''⼦''å­''⼧''宀''宅''å®…''寃''寃''寘''寘''寧''寧''寧''寧''寧''寧''寮''寮''寳''寳''⼨''寸''寿''寿''将''å°†''⼩''å°''尢''å°¢''⼪''å°¢''⼫''å°¸''尿''å°¿''屠''å± ''屢''å±¢''層''層''履''å±¥''屮''å±®''屮''å±®''⼬''å±®''â¼­''å±±''岍''å²''峀''å³€''崙''å´™''嵃''嵃''嵐''åµ''嵫''嵫''嵮''åµ®''ð¯¢Â€''åµ¼''嶲''嶲''嶺''嶺''â¼®''å·›''ð¯¢Â''å·¡''ð¯¢Â‚''å·¢''⼯''å·¥''â¼°''å·±''ð¯¢Â„''å·½''â¼±''å·¾''帲''帡''ð¯¢Â…''帨''ð¯¢Â†''帽''ð¯¢Â‡''幩''â¼²''å¹²''年''å¹´''â¼³''幺''â¼´''广''ï¨''度''ð¯¢Â‹''庰''ð¯¢ÂŒ''庳''ð¯¢Â''庶''廉''廉''廊''廊''ð¯¢ÂŽ''廊''廒''å»’''廓''廓''廙''å»™''廬''廬''â¼µ''å»´''ð¯¢Â''廾''⼶''廾''弄''弄''â¼·''弋''⼸''弓''ð¯¢Â”''å¼¢''ð¯¢Â•''å¼¢''â¼¹''å½''当''当''⼺''彡''ð¯¢Â™''å½¢''彩''彩''ð¯¢Âš''彫''â¼»''å½³''律''律''ð¯¢Âœ''徚''復''復''徭''å¾­''â¼¼''心''ð¯¢Â''å¿''ð¯¢Âž''å¿—''念''念''ð¯¢ÂŸ''忹''怒''怒''怜''怜''悁''æ‚''悔''æ‚”''悔''æ‚”''惇''惇''惘''惘''惡''惡''愈''愈''慄''æ…„''慈''æ…ˆ''慌''æ…Œ''慌''æ…Œ''慎''æ…Ž''慎''æ…Ž''慠''æ… ''慨''æ…¨''慺''æ…º''憎''憎''憎''憎''憎''憎''ï¦''æ†''憤''憤''憯''憯''憲''憲''懞''懞''ï©€''懲''懲''懲''懲''懲''ï¤''懶''懶''懶''ï¦''戀''â¼½''戈''成''æˆ''戛''戛''戮''戮''戴''戴''â¼¾''戶''⼿''手''扝''æ‰''抱''抱''拉''拉''拏''æ‹''拓''æ‹“''拔''æ‹”''拼''拼''拾''拾''挽''挽''捐''æ''捨''æ¨''捻''æ»''掃''掃''掠''掠''ð¯£Â''掩''ïª''æ„''ð¯£Â€''æ…''揤''æ¤''ã©''æ‰''搜''æœ''搢''æ¢''ïª''æ‘’''ð¯£Âƒ''æ‘©''ð¯£Â†''æ‘·''ð¯£Â„''摾''撚''æ’š''ð¯£Â…''æ’''擄''æ“„''â½€''支''â½''æ”´''ï©''æ•''ð¯£Âˆ''æ•''ïª''æ•–''ð¯£Â‰''敬''數''數''⽂''æ–‡''⽃''æ–—''料''æ–™''⽄''æ–¤''â½…''æ–¹''旅''æ—…''⽆''æ— ''ï©‚''æ—¢''ð¯£Â‹''æ—£''⽇''æ—¥''易''易''ð¯£Â''晉''晩''晚''䀿''晣''晴''æ™´''晴''æ™´''暈''暈''暑''æš‘''ð¯£Â''æš‘''ð¯£Â•''æšœ''暴''æš´''曆''曆''⽈''æ›°''ï¤''æ›´''ã«š''曶''ð¯£ÂŒ''書''ð¯£Â”''最''⽉''月''肦''朌''èƒ''æœ''胊''æœ''è„''朓''朗''朗''朗''朗''ð¯£Â˜''朗''脧''朘''望''望''ð¯£Â™''望''ð¯£Âš''朡''膧''朣''⽊''木''李''æŽ''ð¯£Âœ''æ“''杖''æ–''ð¯£Â›''æž''柿''æ®''杻''æ»''枅''æž…''林''æž—''柳''柳''ð¯£ÂŸ''柺''栗''æ —''栟''æ Ÿ''桒''æ¡’''梁''æ¢''ï©„''梅''梅''梅''梎''梎''梨''梨''椔''椔''楂''楂''樧''æ¦''榣''榣''槪''槪''樂''樂''樂''樂''樂''樂''樓''樓''檨''檨''櫓''æ«“''櫛''æ«›''ï¤''欄''⽋''欠''次''次''歔''æ­”''⽌''æ­¢''歲''æ­²''歷''æ­·''歹''æ­¹''â½''æ­¹''殟''殟''殮''æ®®''⽎''殳''殺''殺''殺''殺''殺''殺''殻''æ®»''â½''毋''⺟''æ¯''â½''比''⽑''毛''â½’''æ°''⽓''æ°”''â½”''æ°´''汎''汎''汧''汧''沈''沈''沿''沿''泌''泌''泍''æ³''泥''æ³¥''洖''æ´–''洛''æ´›''洞''æ´ž''ð¯¤Â‡''æ´´''ð¯¤Â€''æ´¾''流''æµ''流''æµ''ð¯¤Â‚''æµ''ð¯¤Âƒ''浩''浪''浪''ï©…''æµ·''ð¯¤Â''æµ·''ð¯¤Â„''浸''ð¯¤Â…''涅''淋''æ·‹''ï¥''æ·š''淪''æ·ª''ð¯¤ÂŽ''æ·¹''渚''渚''ð¯¤Âˆ''港''ð¯¤Â‰''æ¹®''æ½™''溈''溜''溜''溺''溺''ð¯¤ÂŒ''滇''滋''滋''ð¯¤Â‹''滋''滑''滑''滛''æ»›''漏''æ¼''漢''æ¼¢''漢''æ¼¢''漣''æ¼£''ð¯¤Â''æ½®''ð¯¤Â’''濆''濫''æ¿«''濾''濾''ð¯¤Â•''瀛''瀞''瀞''ð¯¤Â”''瀞''ð¯¤Â“''瀹''ð¯¤Â—''çŠ''⽕''ç«''灰''ç°''ð¯¤Â™''ç·''ð¯¤Â˜''ç½''炙''ç‚™''ð¯¤Âš''ç‚­''烈''烈''烙''烙''ð¯¤Âœ''ç……''煉''ç…‰''煮''ç…®''煮''ç…®''ð¯¤Âž''熜''燎''燎''燐''ç‡''爐''çˆ''爛''爛''爨''爨''â½–''爪''爫''爫''⺤''爫''爵''爵''爵''爵''â½—''父''⽘''爻''â½™''爿''⽚''片''牐''ç‰''â½›''牙''⽜''牛''牢''牢''犀''犀''犕''犕''â½''犬''犯''犯''狀''ç‹€''狼''狼''猪''猪''猪''猪''獵''çµ''獺''çº''⽞''玄''率''率''率''率''⽟''玉''王''王''玥''玥''玲''玲''珞''çž''理''ç†''琉''ç‰''ï©Š''ç¢''瑇''瑇''瑜''ç‘œ''瑩''ç‘©''瑱''瑱''瑱''瑱''璅''ç’…''璉''ç’‰''璘''ç’˜''瓊''ç“Š''â½ ''ç“œ''⽡''瓦''甆''甆''â½¢''甘''â½£''生''甤''甤''⽤''用''â½¥''ç”°''画''ç”»''甾''甾''ï§''ç•™''略''ç•¥''異''ç•°''異''ç•°''⽦''ç–‹''⽧''ç–’''痢''ç—¢''瘐''ç˜''瘝''ç˜''瘟''瘟''ï§''療''癩''癩''⽨''癶''⽩''白''⽪''çš®''⽫''çš¿''益''益''益''益''盛''ç››''盧''盧''⽬''ç›®''直''ç›´''ð¯¥Â€''ç›´''省''çœ''ð¯¥Â…''眞''ð¯¥Â†''真''ð¯¥Â‡''真''着''ç€''睊''çŠ''ð¯¥Âˆ''çŠ''ð¯¥ÂŠ''çž‹''ïª''瞧''â½­''矛''â½®''矢''⽯''石''ç¡''ç ”''ð¯¥ÂŽ''ç¡Ž''硫''ç¡«''碌''碌''ð¯¥Â''碌''ï©‹''碑''磊''磊''磌''磌''ð¯¥Â''磌''磻''磻''礪''礪''â½°''示''礼''礼''ï©Œ''社''ï©Ž''祈''ï©''祉''ï©''ç¥''ï©''祖''ð¯¥Â“''祖''ï©‘''ç¥''神''神''祥''祥''祿''祿''ï©’''ç¦''ï©“''禎''福''ç¦''ð¯¥Â–''ç¦''禮''禮''â½±''禸''â½²''禾''秊''秊''ð¯¥Â—''秫''稜''稜''ï©”''ç©€''ð¯¥Â™''ç©€''ð¯¥Âš''ç©Š''ð¯¥Â›''ç©''â½³''ç©´''ï©•''çª''窱''窱''立''ç«‹''â½´''ç«‹''ð¯¥ÂŸ''ç«®''â½µ''竹''笠''笠''ï©–''節''節''節''篆''篆''築''築''簾''ç°¾''籠''ç± ''⽶''ç±³''类''ç±»''粒''ç²’''ï¨''ç²¾''糒''ç³’''糖''ç³–''糣''ç³£''糧''糧''糨''糨''â½·''糸''紀''ç´€''ï§''ç´''索''ç´¢''ï¥''ç´¯''絶''絕''絛''çµ›''絣''çµ£''綠''綠''綾''綾''緇''ç·‡''練''ç·´''ï©—''ç·´''練''ç·´''縂''縂''縉''縉''ï¥''縷''ï©™''ç¹''繅''ç¹…''⽸''缶''缾''ç¼¾''â½¹''网''⺫''ç½’''ï©š''ç½²''罹''ç½¹''罺''罺''ï¤''ç¾…''⽺''羊''羕''羕''羚''羚''羽''ç¾½''â½»''ç¾½''翺''翺''老''è€''â½¼''è€''ï©›''者''者''者''者''者''â½½''而''â½¾''耒''⽿''耳''聆''è†''聠''è ''聯''è¯''聰''è°''聾''è¾''â¾€''è¿''â¾''肉''肋''è‚‹''ð¯£Â–''è‚­''ð¯¦Â‚''育''㬵''胶''è…''胼''ð¯¦Âƒ''脃''ð¯¦Â…''脾''臘''臘''⾂''臣''臨''臨''⾃''自''ï©œ''臭''⾄''至''â¾…''臼''ð¯¢Â“''èˆ''ð¯¦Â‹''èˆ''ð¯¦ÂŒ''舄''⾆''舌''⾇''舛''⾈''舟''⾉''艮''良''良''⾊''色''⾋''艸''ï©''艹''ï©ž''艹''ð¯¦Â''芋''ð¯¦Â''芑''ð¯¦Â‘''èŠ''ð¯¦Â“''花''ð¯¦Â”''芳''ð¯¦Â•''芽''若''è‹¥''ð¯¦Â˜''è‹¥''ð¯¦Â–''苦''ð¯¦Â™''èŒ''ð¯¦Âœ''茣''茶''茶''荒''è’''荓''è“''ð¯¦Âš''è£''ð¯¦Â›''莭''ð¯¦Â''莽''菉''è‰''菊''èŠ''菌''èŒ''菜''èœ''ð¯¦Âž''è§''華''è¯''菱''è±''落''è½''葉''葉''ï©Ÿ''è‘—''ð¯¦ÂŸ''è‘—''蔿''è’''蓮''è“®''蓱''蓱''蓳''蓳''蓼''蓼''蔖''è”–''蕤''蕤''藍''è—''藺''è—º''蘆''蘆''蘒''蘒''蘭''蘭''è™''蘷''ï¤''蘿''⾌''è™''虐''è™''虜''虜''虜''虜''虧''虧''虩''虩''â¾''虫''蚈''蚈''蚩''èš©''蛢''蛢''蜎''蜎''蜨''蜨''蝫''è«''蝹''è¹''蝹''è¹''螆''螆''螺''螺''ð¯§Â€''蟡''ð¯§Â''è ''蠟''è Ÿ''⾎''è¡€''行''è¡Œ''â¾''è¡Œ''ð¯§Âƒ''è¡ ''ð¯§Â„''è¡£''â¾''è¡£''裂''裂''裏''è£''ð¯§Â†''裗''ð¯§Â‡''裞''裡''裡''裸''裸''ð¯§Â‰''裺''ï© ''è¤''襁''è¥''襤''襤''⾑''襾''覆''覆''見''見''â¾’''見''ï©¡''視''視''視''⾓''角''â¾”''言''䚶''訞''詽''訮''ð¯§Â''誠''說''說''說''說''調''調''請''è«‹''諒''è«’''ï¥''è«–''諭''è«­''ð¯§Â''è«­''諸''諸''諸''諸''ï¥''諾''諾''諾''ï©¢''è¬''謁''è¬''ï©£''謹''謹''謹''識''è­˜''讀''讀''è®''讆''ï«€''變''ð¯§Â‘''變''⾕''è°·''â¾–''豆''豈''豈''ð¯§Â’''豕''â¾—''豕''⾘''豸''â¾™''è²''ð¯§Â”''貫''ð¯§Â•''è³''賂''賂''賈''賈''賓''賓''ï©¥''è´ˆ''ï«''è´ˆ''ð¯§Â–''è´›''⾚''赤''â¾›''èµ°''ð¯§Â—''èµ·''趆''赿''⾜''足''ð¯§Â›''趼''ð¯§Âš''è·‹''è·º''è·¥''路''è·¯''ð¯§Âœ''è·°''躛''躗''â¾''身''車''車''⾞''車''ð¯§Âž''è»”''輧''軿''輦''輦''輪''輪''ï«‚''輸''ð¯§ÂŸ''輸''輻''è¼»''ï¦''è½¢''⾟''è¾›''ð¯¦Â''辞''辰''è¾°''â¾ ''è¾°''⾡''è¾µ''辶''辶''⻌''辶''連''連''逸''逸''逸''逸''遲''é²''遼''é¼''邏''é‚''â¾¢''é‚‘''邔''é‚”''郎''郎''郱''郱''都''都''鄑''é„‘''鄛''é„›''â¾£''é…‰''酪''é…ª''ï«„''醙''醴''醴''⾤''釆''里''里''â¾¥''里''量''é‡''金''金''⾦''金''鈴''鈴''鈸''鈸''ï«…''鉶''鉼''鉼''鋗''é‹—''鋘''鋘''錄''錄''鍊''éŠ''鎮''鎭''鏹''é¹''鐕''é•''⾧''é•·''⾨''é–€''開''é–‹''閭''é–­''閷''é–·''⾩''阜''阮''阮''陋''陋''降''é™''陵''陵''陸''陸''陼''陼''隆''隆''隣''隣''⾪''隶''隸''隸''⾫''éš¹''雃''雃''離''離''難''難''難''難''⾬''雨''零''零''雷''é›·''霣''霣''露''露''靈''éˆ''â¾­''é‘''靖''é–''靖''é–''â¾®''éž''⾯''é¢''â¾°''é©''â¾±''韋''韛''韛''韠''韠''â¾²''韭''â¾³''音''ï©©''響''ï«Š''響''â¾´''é ''ï«‹''é ‹''頋''é ‹''頋''é ‹''領''é ˜''ð¯¨Â€''é ©''頻''é »''ï«Œ''é »''ï§''é¡ž''â¾µ''風''⾶''飛''â»''食''â¾·''食''ð¯¨Â‚''飢''飯''飯''飼''飼''館''館''ð¯¨Â„''餩''⾸''首''â¾¹''香''ð¯¨Â…''馧''⾺''馬''ð¯¨Â†''駂''駱''駱''ð¯¨Â‡''駾''驪''驪''â¾»''骨''â¾¼''高''â¾½''é«Ÿ''ï«''鬒''ð¯¨ÂŠ''鬒''â¾¾''鬥''⾿''鬯''â¿€''鬲''â¿''鬼''â¿‚''é­š''魯''é­¯''ð¯¨Â‹''é±€''鱗''é±—''⿃''é³¥''ð¯¨ÂŒ''é³½''ð¯¨Â''鵧''鶴''鶴''鷺''é·º''鸞''鸞''鹃''鹂''â¿„''é¹µ''鹿''鹿''â¿…''鹿''麗''麗''麟''麟''⿆''麥''ð¯¨Â•''麻''⿇''麻''⿈''黃''⿉''é»''黎''黎''â¿Š''黑''ð¯¨Â—''黹''â¿‹''黹''â¿Œ''黽''ð¯¨Â˜''黾''ð¯¨Â™''é¼…''â¿''鼎''ð¯¨Âš''é¼''â¿Ž''鼓''ð¯¨Â›''é¼–''â¿''é¼ ''ð¯¨Âœ''é¼»''â¿''é¼»''齃''齃''â¿‘''齊''â¿’''é½’''龍''é¾''â¿“''é¾''ï«™''龎''龜''龜''龜''龜''ï«Ž''龜''â¿”''龜''⻳''龟''â¿•''é¾ ''ð¯ ÂŒ''ã’ž''ð¯ Â“''ã’¹''ð¯§ÂŠ''ã’»''ð¯ ÂŸ''ã“Ÿ''㔕''㔕''䎛''ã–ˆ''㛮''ã›®''㛼''㛼''㞁''ãž''ð¯¢Âƒ''ã ¯''ð¯¢Âˆ''ã¡¢''ð¯¢ÂŠ''㡼''ð¯¢Â–''㣇''ð¯¢Â›''㣣''㤜''㤜''㤺''㤺''ð¯£Â‚''㨮''ð¯£Â‡''㩬''ð¯£Â‘''㫤''ð¯£Â''㬈''ð¯£ÂŽ''㬙''ä ''㬻''ð¯£Âž''ã­‰''ï«’''ã®''㮝''ã®''㰘''ã°˜''㱎''㱎''ð¯¤ÂŠ''ã´³''ð¯¤Â–''㶖''㺬''㺬''㺸''㺸''㺸''㺸''㼛''ã¼›''㿼''㿼''䀈''䀈''ï«“''䀘''ï«”''䀹''ð¯¥Â‰''䀹''ð¯¥Â‹''ä†''ð¯¥ÂŒ''ä‚–''ð¯¥Â‘''䃣''ð¯¥Â˜''䄯''䈂''䈂''䈧''䈧''䊠''䊠''䌁''äŒ''䌴''䌴''䍙''ä™''ð¯¦Â''ä•''ð¯£Â—''ä™''ð¯¦Â„''ä‹''ð¯¦ÂŽ''ä‘«''䔫''䔫''䕝''ä•''䕡''ä•¡''䕫''ä•«''䗗''ä——''ð¯§Â‚''ä—¹''ð¯§Âˆ''䘵''ð¯§Â''äš¾''ð¯§ÂŽ''䛇''䦕''䦕''䧦''䧦''䩮''ä©®''䩶''䩶''䪲''䪲''ð¯¨Âƒ''䬳''ð¯¨Âˆ''䯎''ð¯¨Â''䳎''ð¯¨ÂŽ''ä³­''ð¯¨Â‘''䳸''ð¯¨Â–''äµ–''ð¯ Âƒ''ð „¢''ð¯ Â’''ð ”Âœ''ð¯¤Â›''𠔥''ð¯ Â–''ð •Â‹''ð¯ Â''𠘺''ð¯§Â™''ð  Â„''ð¯§Â''ð £Âž''𠨬''𠨬''𠭣''ð ­£''ð¯¡Â™''𡓤''𡚨''𡚨''𡛪''𡛪''𡧈''ð¡§Âˆ''𡬘''ð¡¬Â˜''𡴋''ð¡´Â‹''𡷤''ð¡·¤''𡷦''ð¡·¦''ð¯¢Â‰''ð¢†Âƒ''𢆟''ð¢†ÂŸ''ð¯¢Â‘''𢌱''ð¯¢Â’''𢌱''𢛔''ð¢›Â”''ï«''ð¢¡Â„''ï«''ð¢¡ÂŠ''𢬌''ð¢¬ÂŒ''𢯱''𢯱''ð¯£ÂŠ''ð£€ÂŠ''ð¯¢Â—''𣊸''ð¯¦Â€''ð£ÂŸ''ð¯¦Â‰''ð£ŽÂ“''ð¯¦ÂŠ''ð£ŽÂœ''ð¯£Â''ð£Âƒ''ï«‘''ð£Â•''𣑭''𣑭''𣚣''𣚣''𣢧''𣢧''𣪍''ð£ªÂ''𣫺''𣫺''𣲼''𣲼''ð¯¤Â†''ð£´Âž''ð¯¤Â''ð£»Â‘''ð¯¤Â''ð£½Âž''ð¯¤Â‘''ð£¾ÂŽ''ð¯¤Â''𤉣''ð¯¤ÂŸ''𤎫''𤘈''ð¤˜Âˆ''𤜵''𤜵''𤠔''ð¤ Â”''𤰶''𤰶''𤲒''ð¤²Â’''𤾡''𤾡''𤾸''𤾸''𥁄''ð¥Â„''ð¯¥Â‚''𥃲''ð¯¥Â''𥃳''ð¯¥Âƒ''𥄙''ð¯¥Â„''𥄳''ï«•''ð¥‰Â‰''ð¯¥Â''ð¥Â''ð¯¥Â’''𥘦''ð¯¥Â”''ð¥šÂš''ð¯¥Â•''ð¥›Â…''ð¯¥Âœ''𥥼''ð¯¥Â''𥪧''ð¯¥Âž''𥪧''𥮫''𥮫''𥲀''ð¥²Â€''ï«–''ð¥³Â''𥾆''ð¥¾Â†''ð¯¢Â˜''ð¦‡Âš''𦈨''𦈨''𦉇''ð¦‰Â‡''𦋙''ð¦‹Â™''𦌾''𦌾''𦓚''𦓚''𦔣''𦔣''𦖨''𦖨''ð¯¦Â‡''𦞧''ð¯¦Âˆ''𦞵''ð¯¦Â—''𦬼''𦰶''𦰶''𦳕''ð¦³Â•''𦵫''𦵫''𦼬''𦼬''𦾱''𦾱''𧃒''ð§ƒÂ’''𧏊''ð§ÂŠ''ð¯§Â…''𧙧''ð¯§Â‹''𧢮''ð¯§ÂŒ''𧥦''ð¯§Â“''𧲨''ï«—''ð§»Â“''ð¯§Â˜''𧼯''𨗒''ð¨—Â’''𨗭''𨗭''𨜮''𨜮''𨯺''𨯺''𨵷''𨵷''𩅅''ð©…Â…''ð¯ Âœ''ð©‡ÂŸ''𩈚''ð©ˆÂš''𩐊''ð©ÂŠ''𩒖''ð©’–''ð¯¨Â''ð©–¶''ð¯¨Â‰''𩬰''ð¯¨Â''ðªƒÂŽ''ð¯¨Â’''ðª„Â…''ð¯¨Â“''ðªˆÂŽ''ð¯¨Â”''ðªŠÂ‘''ð¯¢Â''ðªŽÂ’''ð¯¨Â''ðª˜Â€''℃''°C''℉''°F''ℇ''Æ''â„»''FAX''â„•''N''â„–''No''â„š''Q''₨''Rs''ð“''T''â„¡''TEL''ð”''U''ð–''W''â‚©''W̵''ð—''X''Â¥''Y̵''ðš²''Λ''ðšµ''Ξ''â„¿''Π''ϲ''c''Ï’''Y''ðš½''Φ''ðš¿''Ψ''Ñ£''Ь̵''ਃ''ঃ''ಃ''à°ƒ''່''่''់''่''້''้''໊''๊''໋''๋''៕''๚''៚''๛''ÑŠ''ˉb''៙''à¹''೧''౧''૨''२''೨''౨''à«©''३''૪''४''à«®''८''೯''౯''а''a''á''b''á–¯''b''Ñ''c''Ô''d''ᑯ''d''е''e''Ó™''Ç''ε''É›''Ñ”''É›''Ö„''f''Ö''g''Ò»''h''Õ°''h''á‚''h''á²''hÌ”''ι''i''Ñ–''i''Ꭵ''i''ј''j''Õµ''j''á—°''m''Õ¸''n''η''nÌ©''à°‚''o''ಂ''o''à´‚''o''०''o''੦''o''૦''o''à¹''o''à»''o''ο''o''о''o''Ö…''o''á€''o''Ï''p''Ñ€''p''á´©''á´˜''Õ£''q''κ''ĸ''к''ĸ''á´¦''r''г''r''Ñ•''s''Ï…''u''Õ½''u''ν''v''ѵ''v''Ꮃ''w''á—¯''w''Ñ…''x''á•''x''у''y''Ꭹ''y''Ó¡''Ê’''ჳ''Ê’''Ï©''ƨ''ÑŒ''Æ…''Ñ‹''Æ…i''É‘''α''Õ®''δ''á•·''δ''п''Ï€''ɸ''φ''Ñ„''φ''Ê™''в''Éœ''з''á´''м''Êœ''н''É¢''Ô''á´›''Ñ‚''á´™''Ñ''ઽ''ऽ''à«''à¥''à«‚''ू''à©‹''ॆ''à©''à¥''à«''à¥''à´‰''உ''à´œ''à®''à´£''ண''à´´''à®´''à´¿''ி''àµ''ூ''ಅ''à°…''ಆ''à°†''ಇ''à°‡''ಒ''à°’''ಓ''ఒౕ''ಜ''à°œ''ಞ''à°ž''ಣ''à°£''à°¥''à°§Ö¼''ಯ''à°¯''à° ''à°°Ö¼''ಱ''à°±''ಲ''à°²''ඌ''à´¨àµà´¨''ஶ''à´¶''ຈ''จ''ບ''บ''ປ''ป''àº''à¸''ພ''พ''ຟ''ฟ''àº''ย''។''ฯ''áž·''ิ''ី''ี''áž¹''ึ''ឺ''ื''ຸ''ุ''ູ''ู''á—…''A''á’''J''ᕼ''H''á¯''V''á‘­''P''á—·''B''ヘ''ã¸''ð‘''ðŽÂ‚''ð“''ðŽÂ“''𒀸''ðŽÂš''á…³''一''Ç€''丨''á…µ''丨''Ꭺ''A''á´''B''áŸ''C''á—ž''D''Ꭼ''E''á–´''F''á€''G''Ꮋ''H''Ꭻ''J''á¦''K''áž''L''Ꮇ''M''á¢''P''á–‡''R''á•''S''á™''V''áƒ''Z');
+
+</body>
+</html>
+
diff --git a/layout/generic/crashtests/390417.html b/layout/generic/crashtests/390417.html
new file mode 100644
index 0000000000..1e95cbd310
--- /dev/null
+++ b/layout/generic/crashtests/390417.html
@@ -0,0 +1,17 @@
+<html>
+<head><style>
+ div:first-line {}
+</style></head>
+<body>
+<div>
+a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a
+b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b
+a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a
+b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b
+a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a
+b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b a b
+a b a b a b a b a b
+
+</div>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/390762-1.html b/layout/generic/crashtests/390762-1.html
new file mode 100644
index 0000000000..d4b218d1ad
--- /dev/null
+++ b/layout/generic/crashtests/390762-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<script>
+function boom()
+{
+ var s = document.getElementById("s");
+ var t = document.getElementById("t");
+
+ s.remove();
+ t.style.display = "none";
+}
+</script>
+
+<style id="s">
+.float { float: right; height: 1em; }
+</style>
+
+<style>
+#t { border: 1px solid green; }
+</style>
+
+</head>
+
+<body onload="boom();">
+<div style="column-count: 2;"><div id="t" class="float"></div></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/391053-1.xhtml b/layout/generic/crashtests/391053-1.xhtml
new file mode 100644
index 0000000000..7a971bcd1b
--- /dev/null
+++ b/layout/generic/crashtests/391053-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<div>
+ <select>
+ <option style="margin: 100%;">A</option>
+ <optgroup label="outgroup" style="padding: 10%;">
+ <option style="padding: 10%;">M</option>
+ </optgroup>
+ </select>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/391894-1.html b/layout/generic/crashtests/391894-1.html
new file mode 100644
index 0000000000..d69a95573b
--- /dev/null
+++ b/layout/generic/crashtests/391894-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style>
+
+#q:first-line { }
+
+</style>
+
+</head>
+<body style="column-width: 0em">
+
+<div id="q">a b c<span style="float: right;"></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/392698-1.html b/layout/generic/crashtests/392698-1.html
new file mode 100644
index 0000000000..9a2d4f237f
--- /dev/null
+++ b/layout/generic/crashtests/392698-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script type="application/javascript">
+window.onload = function()
+{
+ document.getElementById("i")
+ .setAttribute("width", 100);
+};
+ </script>
+</head>
+<body>
+<iframe src="data:text/html,&lt;div style='position:fixed'&gt;foo&lt;/div&gt;"
+ id="i" width="75" height="150"></iframe>
+</body>
+</html>
diff --git a/layout/generic/crashtests/393758-1.xhtml b/layout/generic/crashtests/393758-1.xhtml
new file mode 100644
index 0000000000..4c90a55f2e
--- /dev/null
+++ b/layout/generic/crashtests/393758-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+span { letter-spacing: 1em; unicode-bidi: bidi-override; }
+</style>
+</head>
+<body>
+<table><tbody><tr><td><span>×”G</span></td></tr></tbody></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/393906-1.html b/layout/generic/crashtests/393906-1.html
new file mode 100644
index 0000000000..22fcfa387f
--- /dev/null
+++ b/layout/generic/crashtests/393906-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<script>
+function boom()
+{
+ document.getElementById("div").setAttribute("dir", "rtl");
+}
+</script>
+<body onload="boom()">
+<div id="div" style="width: 0;"> Foo a bar baz</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/393923-1.html b/layout/generic/crashtests/393923-1.html
new file mode 100644
index 0000000000..44c886d7db
--- /dev/null
+++ b/layout/generic/crashtests/393923-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+ div::first-letter { color: magenta; }
+</style>
+</head>
+
+<body style="direction: rtl;">
+
+<div>
+ AB</div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/393956-1.html b/layout/generic/crashtests/393956-1.html
new file mode 100644
index 0000000000..b9d79489f6
--- /dev/null
+++ b/layout/generic/crashtests/393956-1.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<style>
+body {
+ column-count: 2;
+}
+#x {
+ height: 20px;
+}
+#y {
+ height: 80px;
+}
+</style>
+
+<script>
+function boom()
+{
+ document.getElementById("x").style.content = "'0'";
+}
+</script>
+</head>
+
+<body onload="boom();"><div id="x"><div id="y"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/393956-2.html b/layout/generic/crashtests/393956-2.html
new file mode 100644
index 0000000000..9162e2a6d6
--- /dev/null
+++ b/layout/generic/crashtests/393956-2.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<style>
+body {
+ height: 40px;
+ column-count: 2;
+}
+#x {
+ height: 20px;
+}
+#y {
+ height: 80px;
+}
+</style>
+
+<script>
+function boom()
+{
+ document.getElementById("x").style.content = "'0'";
+}
+</script>
+</head>
+
+<body onload="boom();"><div id="x"><div id="y"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/393956-3.html b/layout/generic/crashtests/393956-3.html
new file mode 100644
index 0000000000..c63f0024f3
--- /dev/null
+++ b/layout/generic/crashtests/393956-3.html
@@ -0,0 +1,11 @@
+<html>
+<head><style>
+body { column-count: 1; }
+#x { height: 1px; }
+#y { height: 2px; }
+
+</style></head>
+
+<body><div id="x"><div id="y"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/393956-4.html b/layout/generic/crashtests/393956-4.html
new file mode 100644
index 0000000000..ea88513a8c
--- /dev/null
+++ b/layout/generic/crashtests/393956-4.html
@@ -0,0 +1,11 @@
+<html>
+<head><style>
+body { column-count: 2; }
+#x { height: 1px; }
+#y { height: 2px; }
+
+</style></head>
+
+<body><div id="x"><div id="y"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/394237-1.html b/layout/generic/crashtests/394237-1.html
new file mode 100644
index 0000000000..8fc1bc8b09
--- /dev/null
+++ b/layout/generic/crashtests/394237-1.html
@@ -0,0 +1,38 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+
+body {
+ height: 50px;
+ column-count: 2;
+}
+.container {
+ height: 10px;
+}
+.overflow {
+ height: 100px;
+}
+.bb {
+ border-bottom: solid 4px magenta;
+}
+
+</style>
+
+<script>
+
+function boom()
+{
+ document.getElementById("x").setAttribute("class", "");
+ document.getElementById("y").setAttribute("class", "bb");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+ <div class="container"><div class="overflow" id="x"></div></div>
+ <div id="y"></div>
+ <div class="container"><div class="overflow"></div></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/394818-1.html b/layout/generic/crashtests/394818-1.html
new file mode 100644
index 0000000000..a6a6fdba8e
--- /dev/null
+++ b/layout/generic/crashtests/394818-1.html
@@ -0,0 +1,13 @@
+<html class="reftest-wait"><head>
+</head><body>
+<iframe></iframe><iframe></iframe>
+<script>
+window.frames[0].focus();
+function doe() {
+document.body.setAttribute('onbeforecopy','document.removeChild(document.documentElement)');
+document.body.setAttribute('style','display:none');
+document.documentElement.removeAttribute("class");
+}
+setTimeout(doe, 100);
+</script>
+</body></html>
diff --git a/layout/generic/crashtests/394818-2.html b/layout/generic/crashtests/394818-2.html
new file mode 100644
index 0000000000..6aa00e2753
--- /dev/null
+++ b/layout/generic/crashtests/394818-2.html
@@ -0,0 +1,16 @@
+<html class="reftest-wait"><head><script>
+ function load() {
+ window.frames[0].focus();
+ setTimeout("load2();", 100);
+ }
+ function load2() {
+ document.body.setAttribute('style','display: inline');
+ document.documentElement.removeAttribute("class");
+ }
+ function beforeCopy() {
+ document.removeChild(document.documentElement);
+ }
+</script></head>
+<body onload="load();"
+ onbeforecopy="beforeCopy();"><iframe></iframe></body>
+</html>
diff --git a/layout/generic/crashtests/394820-1.html b/layout/generic/crashtests/394820-1.html
new file mode 100644
index 0000000000..0c012877ce
--- /dev/null
+++ b/layout/generic/crashtests/394820-1.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var d = document.getElementById("d");
+ d.style.direction = "rtl";
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id=d style="white-space: pre;">
+e
+
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/395316-1.html b/layout/generic/crashtests/395316-1.html
new file mode 100644
index 0000000000..bf3929ab2b
--- /dev/null
+++ b/layout/generic/crashtests/395316-1.html
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+ document.getElementById("float").style.cssFloat = "";
+}
+</script>
+</head>
+<body onload="boom();">
+<div style="column-count: 2; width: 3ch;"><span><span id="float" style="float: right;">za za za za za za za za</span></span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/395450-1.xhtml b/layout/generic/crashtests/395450-1.xhtml
new file mode 100644
index 0000000000..79510267ba
--- /dev/null
+++ b/layout/generic/crashtests/395450-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+
+<head>
+<style>
+
+/*
+ This testcase uses [class~="foo"] instead of .foo to work around bug 276267
+ (see bug 379178 comment 78)
+*/
+
+[class~="abs"] { position: absolute; }
+[class~="marg"] { margin: 1em; }
+[class="noheight"] { height: 0; }
+
+</style>
+</head>
+
+<body>
+
+<math:mrow class="noheight">
+ <span class="abs">
+ <math:mroot class="abs marg" />
+ <span class="abs" />
+ </span>
+</math:mrow>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/397007-1.html b/layout/generic/crashtests/397007-1.html
new file mode 100644
index 0000000000..1af30383fe
--- /dev/null
+++ b/layout/generic/crashtests/397007-1.html
@@ -0,0 +1,37 @@
+<html>
+<head>
+<script type="text/javascript">
+function boom()
+{
+ var img = document.createElement("img");
+ document.getElementById("g").appendChild(img);
+ img.width = 1;
+}
+
+</script>
+
+<style type="text/css">
+
+.margin {
+ margin: 1em 0;
+}
+
+.dd:before {
+ white-space: pre;
+ line-height: 0;
+ content: "b";
+}
+
+</style>
+
+</head>
+
+<body onload="boom();">
+<div style="column-count: 2;">
+ X
+ <div class="margin">y</div>
+ <span><span id="g"></span>&shy;<div class="margin"></div><span class="dd"><div></div></span></span>
+</div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/397187-1.html b/layout/generic/crashtests/397187-1.html
new file mode 100644
index 0000000000..7227a48238
--- /dev/null
+++ b/layout/generic/crashtests/397187-1.html
@@ -0,0 +1,32 @@
+<html class="reftest-wait">
+<head>
+<style type="text/css">
+
+.a:first-letter { float: right; }
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+ document.body.style.overflow = "auto";
+ document.body.className = "a";
+
+ setTimeout(boom2, 30);
+}
+
+function boom2()
+{
+ var span = document.createElement("span");
+ document.body.appendChild(span);
+
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();">&#65207;
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/397844-1.xhtml b/layout/generic/crashtests/397844-1.xhtml
new file mode 100644
index 0000000000..3ad9b8464b
--- /dev/null
+++ b/layout/generic/crashtests/397844-1.xhtml
@@ -0,0 +1,55 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<style type="text/css">
+.pad { padding: 3ch; }
+.fl:first-letter { }
+</style>
+
+
+<style id="s" type="text/css"></style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("td").nextSibling.splitText(11);
+ document.getElementById("td").style.padding = "11px";
+
+ setTimeout(boom2, 10);
+}
+
+function boom2()
+{
+ document.body.style.counterReset = "chicken";
+
+ setTimeout(boom3, 10);
+}
+
+function boom3()
+{
+ document.getElementById("s").textContent = "#xxx { }";
+
+ setTimeout(boom4, 10);
+}
+
+function boom4()
+{
+ document.getElementById("td").style.padding = "";
+ setTimeout(boom5, 10);
+}
+
+function boom5()
+{
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body style="width: 10em;" dir="rtl" onload="boom();">
+
+<div class="pad fl"><span><td class="pad fl" id="td"><span>abcd</span></td>ghi jklmnop 2 qrs tuvwxy</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/397844-2.xhtml b/layout/generic/crashtests/397844-2.xhtml
new file mode 100644
index 0000000000..d97600812c
--- /dev/null
+++ b/layout/generic/crashtests/397844-2.xhtml
@@ -0,0 +1,55 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<style type="text/css">
+.pad { padding: 3ch; }
+.fl:first-letter { }
+td { border: 1px solid green }
+</style>
+
+<style id="s" type="text/css"></style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("td").nextSibling.splitText(6);
+ document.getElementById("td").style.padding = "2px";
+
+ setTimeout(boom2, 10);
+}
+
+function boom2()
+{
+ document.body.style.counterReset = "chicken";
+
+ setTimeout(boom3, 10);
+}
+
+function boom3()
+{
+ document.getElementById("s").textContent = "#xxx { }";
+
+ setTimeout(boom4, 10);
+}
+
+function boom4()
+{
+ document.getElementById("td").style.padding = "";
+ setTimeout(boom5, 10);
+}
+
+function boom5()
+{
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body style="font-family: monospace; width: 14ch; border: 1px solid orange;" dir="rtl" onload="boom();">
+
+<div class="pad fl"><span><td class="pad fl" id="td"><span>abcd</span></td>ghi jk 2</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/397852-1.xhtml b/layout/generic/crashtests/397852-1.xhtml
new file mode 100644
index 0000000000..cafb82d9c4
--- /dev/null
+++ b/layout/generic/crashtests/397852-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.getElementById('o').style.overflow = 'auto';">
+
+<td></td><div id="o"><table style="margin: 100%;"></table></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/398181-1.html b/layout/generic/crashtests/398181-1.html
new file mode 100644
index 0000000000..59df1ced21
--- /dev/null
+++ b/layout/generic/crashtests/398181-1.html
@@ -0,0 +1,10 @@
+<html style="min-width: max-content;">
+ <head>
+ </head>
+ <body>
+ <div>
+ <span style="margin: 0 100%; display: inline-block;"></span>
+ t
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/398181-2.html b/layout/generic/crashtests/398181-2.html
new file mode 100644
index 0000000000..a281c0e983
--- /dev/null
+++ b/layout/generic/crashtests/398181-2.html
@@ -0,0 +1,11 @@
+<html style="min-width: max-content;">
+ <head>
+ </head>
+ <body>
+ <div>
+ <span style="margin: 0 100%; display: inline-block;"></span>
+ t
+ <div style="float: left">foo</div>
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/398322-1.html b/layout/generic/crashtests/398322-1.html
new file mode 100644
index 0000000000..b70051695d
--- /dev/null
+++ b/layout/generic/crashtests/398322-1.html
@@ -0,0 +1,17 @@
+<html class="reftest-paged">
+<head>
+<title>Testcase bug - Crash [@ nsFrameList::InsertFrame] on print preview with positioned elements and page-break-before</title>
+</head>
+
+<body>
+<div style="position: relative; page-break-before: always;">
+ <div style="display: list-item;"></div>
+ <div style="position: absolute;">
+ <div style=" position: absolute;">
+ <div style="page-break-before: always; height: 100px;"></div>
+ </div>
+ </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/398322-2.html b/layout/generic/crashtests/398322-2.html
new file mode 100644
index 0000000000..9d2f13199e
--- /dev/null
+++ b/layout/generic/crashtests/398322-2.html
@@ -0,0 +1,12 @@
+<html class="reftest-paged">
+<head>
+<style>
+q::after { content:"anonymous text"; text-transform: uppercase;}
+</style>
+</head>
+<body>
+<div style="position: absolute; width: 50px; column-count: 2;">
+ <div style="position: absolute;"> <q> </q> </div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/398332-1.html b/layout/generic/crashtests/398332-1.html
new file mode 100644
index 0000000000..3c15ad9d4c
--- /dev/null
+++ b/layout/generic/crashtests/398332-1.html
@@ -0,0 +1,19 @@
+<html><head>
+<title>Testcase bug - Crash [@ nsHTMLReflowState::GetNearestContainingBlock] with display: -moz-box, generated content, positioning and fieldset</title>
+<style>
+small::before { content: "m m";}
+strike::before { content: "m m";}
+</style>
+</head>
+<body>
+<div style="display: -moz-box;">
+ <strike style="overflow: clip; position: absolute;"></strike>
+ <fieldset style="position: relative;">
+ <strike style="overflow: clip; position: absolute;"><small style="position: relative;">
+ <span style="position: absolute;"></span>
+ </small>
+ </strike>
+</fieldset>
+</div>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/398332-2.html b/layout/generic/crashtests/398332-2.html
new file mode 100644
index 0000000000..93ca863c88
--- /dev/null
+++ b/layout/generic/crashtests/398332-2.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+<script>
+function removestyles(i){
+document.getElementsByTagName('*')[5].removeAttribute('style');
+document.body.offsetHeight;
+document.getElementsByTagName('*')[6].removeAttribute('style');
+document.body.offsetHeight;
+document.getElementsByTagName('*')[7].removeAttribute('style');
+}
+
+setTimeout(removestyles,300);
+</script>
+
+</head>
+<body>
+<div style="position: relative; width: 500px;">
+ <span style="position: absolute; column-count: 2;">
+ <span style=" position: absolute;">
+ <span style=" display: inline-block; ">m</span>
+ <input>
+ <input style="position: fixed;">m
+ </span>
+ </span>
+</div>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/398332-3.html b/layout/generic/crashtests/398332-3.html
new file mode 100644
index 0000000000..991aa6d3dd
--- /dev/null
+++ b/layout/generic/crashtests/398332-3.html
@@ -0,0 +1,4 @@
+<marquee style="position: relative; right: 20%;">"Ë”Öqü®Û;<span style="position: relative; word-spacing: -100px;"><span style="position: absolute;">
+<style>span::before { content:"before textbefore textbefore textbefore textbefore textbefore text"; }</style>
+
+
diff --git a/layout/generic/crashtests/399407-1.xhtml b/layout/generic/crashtests/399407-1.xhtml
new file mode 100644
index 0000000000..77808f66dc
--- /dev/null
+++ b/layout/generic/crashtests/399407-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<style id="s">
+ .container {
+ height: 20px;
+ }
+ .overflow {
+ height: 30px;
+ }
+ body {
+ width: 300px;
+ column-width: 100px;
+ }
+ </style>
+
+<body>
+ <div class="container">
+ <div class="overflow"></div>
+ </div>
+ <div class="container">
+ <div class="overflow"></div>
+ </div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/399412-1.html b/layout/generic/crashtests/399412-1.html
new file mode 100644
index 0000000000..1b3bb889a2
--- /dev/null
+++ b/layout/generic/crashtests/399412-1.html
@@ -0,0 +1,32 @@
+<html>
+<head>
+
+<style id="s">
+.container {
+ height: 30px;
+}
+</style>
+
+<style>
+.overflow {
+ height: 150px;
+ border: 1px silver solid;
+}
+body {
+ height: 60px;
+ width: 300px;
+ column-width: 50px;
+ column-gap: 1px;
+ column-fill: auto;
+}
+</style>
+
+</head>
+
+<body onload="s=document.getElementById('s'); s.parentNode.removeChild(s);">
+
+<div class="container"><div class="overflow"></div></div>
+<div class="container"><div class="overflow"></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/399843-1.html b/layout/generic/crashtests/399843-1.html
new file mode 100644
index 0000000000..429f9bc9f9
--- /dev/null
+++ b/layout/generic/crashtests/399843-1.html
@@ -0,0 +1,64 @@
+<html class="reftest-wait">
+<head>
+<style>
+
+ #colset {
+ width: 300pt;
+ height: 2in;
+ column-count: 3;
+ }
+
+ .container {
+ height: 1in;
+ }
+
+ .b6 {
+ height: 10in;
+ }
+
+ .c3 {
+ position: absolute;
+ }
+
+ .c4 {
+ height: 3in;
+ }
+
+</style>
+
+<script>
+
+function boom()
+{
+ document.getElementById("x").setAttribute("class", "c4");
+ setTimeout(boom2, 10);
+}
+
+function boom2()
+{
+ document.getElementById("x").setAttribute("class", "");
+ setTimeout(boom3, 10);
+}
+
+function boom3()
+{
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div id="colset">
+ <div id="x"></div>
+ <div class="container">
+ <div class="b6"></div>
+ <div>
+ <div class="c3"></div>
+ </div>
+ </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/400078-1.html b/layout/generic/crashtests/400078-1.html
new file mode 100644
index 0000000000..21c00f0395
--- /dev/null
+++ b/layout/generic/crashtests/400078-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+html, body, table, tbody, tr, td, #colset, #e, #s { height: 100%; }
+
+#colset { column-count: 2; column-width: 200px; border: 2px solid black; text-indent: 500px; }
+
+#s { display: inline-block; width: 30px; border: 1px solid red; }
+
+</style>
+</head>
+
+<body>
+
+<table><tbody><tr><td><div id="colset">XXX<span id="s"></span><div id="e"></div></div></td></tr></tbody></table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/400190.html b/layout/generic/crashtests/400190.html
new file mode 100644
index 0000000000..716c053efe
--- /dev/null
+++ b/layout/generic/crashtests/400190.html
@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+body {
+ position: fixed;
+ font-family: monospace;
+ column-width: 10px;
+ border: 2px solid #aaa;
+}
+
+#padded {
+ padding-top: 40px;
+ padding-bottom: 40px;
+}
+
+#x {
+ position: absolute;
+ top: 0;
+ left: 0;
+ margin-top: 20px;
+ margin-bottom: 20px;
+}
+
+</style>
+</head>
+
+<body>
+
+<div id="padded"></div>
+
+<div id="x">
+
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+x
+
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/400223-1.html b/layout/generic/crashtests/400223-1.html
new file mode 100644
index 0000000000..022d7a6d71
--- /dev/null
+++ b/layout/generic/crashtests/400223-1.html
@@ -0,0 +1,24 @@
+<html>
+<head>
+<style type="text/css">
+
+ #colset {
+ height: 2in;
+ column-count: 3;
+ }
+ #container {
+ position: relative;
+ }
+ #overflow {
+ position: absolute;
+ height: 5in;
+ }
+
+</style>
+</head>
+
+<body onload="document.getElementById('container').style.counterIncrement = 'foo';">
+<div id="colset"><div id="container"><div id="overflow"></div></div></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/400232-1.html b/layout/generic/crashtests/400232-1.html
new file mode 100644
index 0000000000..7373dd55f6
--- /dev/null
+++ b/layout/generic/crashtests/400232-1.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+</head>
+
+<body>
+
+<div style="column-count: 2; overflow: auto; height: 10px;"><br><div style="float: right; height: 15px;"></div></div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/400244-1.html b/layout/generic/crashtests/400244-1.html
new file mode 100644
index 0000000000..b8d91d6edc
--- /dev/null
+++ b/layout/generic/crashtests/400244-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+ #colset {
+ column-count: 2;
+ column-gap: 0;
+ border: 2px solid black;
+ height: 12em;
+ }
+
+ #b {
+ margin: 10em 0pt;
+ }
+
+ #i {
+ margin: 12em 0pt;
+ float: left;
+ -moz-appearance: radio-small;
+ }
+
+</style>
+</head>
+
+<body onload="document.getElementById('i').style.padding = '1em 0';">
+
+<div id="colset"><br id="b"><div id="i"></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/400768-1.xhtml b/layout/generic/crashtests/400768-1.xhtml
new file mode 100644
index 0000000000..1b390a291e
--- /dev/null
+++ b/layout/generic/crashtests/400768-1.xhtml
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ onload="document.getElementById('pp').contentHeight;">
+
+<foreignObject>
+ <xul:prefpane id="pp"/>
+</foreignObject>
+
+</svg>
diff --git a/layout/generic/crashtests/400768-2.xhtml b/layout/generic/crashtests/400768-2.xhtml
new file mode 100644
index 0000000000..e7e5a51697
--- /dev/null
+++ b/layout/generic/crashtests/400768-2.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+ xmlns:svg="http://www.w3.org/2000/svg"
+ xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body onload="document.getElementById('pp').contentHeight;">
+<svg:svg><svg:foreignObject xmlns="http://www.w3.org/2000/svg"><xul:prefpane id="pp"/></svg:foreignObject></svg:svg>
+</body>
+</html>
diff --git a/layout/generic/crashtests/401042-2.html b/layout/generic/crashtests/401042-2.html
new file mode 100644
index 0000000000..ba4bb12e48
--- /dev/null
+++ b/layout/generic/crashtests/401042-2.html
@@ -0,0 +1,5 @@
+<!doctype html>
+<style>
+pre::first-letter { float: left; }
+</style>
+<pre><span>//</span></pre>
diff --git a/layout/generic/crashtests/402380-1.html b/layout/generic/crashtests/402380-1.html
new file mode 100644
index 0000000000..3f9e21ec00
--- /dev/null
+++ b/layout/generic/crashtests/402380-1.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+<style type="text/css">
+
+div::first-letter { color: magenta; }
+span:before { content: "\"" "This "; }
+
+</style>
+</head>
+<body style="width: 1em;" onload="document.getElementById('div').style.direction = 'rtl';">
+<div id="div"><span>is text</span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/402380-2.html b/layout/generic/crashtests/402380-2.html
new file mode 100644
index 0000000000..f3b0217404
--- /dev/null
+++ b/layout/generic/crashtests/402380-2.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+<style type="text/css">
+
+div::first-letter { color: green; }
+span:before { content: open-quote "This "; }
+span:after { content: close-quote; }
+
+</style>
+</head>
+
+<body style="font-family: monospace; width: 7ch; border: 1px solid orange;"
+ onload="document.getElementById('div').style.direction = 'rtl';">
+
+<div id="div"><span>is text</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/402872-1.html b/layout/generic/crashtests/402872-1.html
new file mode 100644
index 0000000000..f23a470600
--- /dev/null
+++ b/layout/generic/crashtests/402872-1.html
@@ -0,0 +1,3 @@
+<table>
+<thead style="float: left; margin-top: 100px; margin-bottom: 9999999999px;">
+
diff --git a/layout/generic/crashtests/402872-2.html b/layout/generic/crashtests/402872-2.html
new file mode 100644
index 0000000000..e2a6026ff8
--- /dev/null
+++ b/layout/generic/crashtests/402872-2.html
@@ -0,0 +1,2 @@
+<fieldset style="float: left;">
+<legend style="min-height: 999999999px;">
diff --git a/layout/generic/crashtests/403004.html b/layout/generic/crashtests/403004.html
new file mode 100644
index 0000000000..a1d04dff32
--- /dev/null
+++ b/layout/generic/crashtests/403004.html
@@ -0,0 +1,3 @@
+<meta http-equiv="Content-Type" content="text/html; charset=windows-1256" />
+<div style="text-transform: uppercase;">
+<a href="httpdisabled://news.maktoob.com"> ÃÎÈÇÑ ãßÊæÈ</a></div>
diff --git a/layout/generic/crashtests/403143-1.html b/layout/generic/crashtests/403143-1.html
new file mode 100644
index 0000000000..972d887687
--- /dev/null
+++ b/layout/generic/crashtests/403143-1.html
@@ -0,0 +1,19 @@
+<html>
+
+<head>
+<script>
+function boom()
+{
+ document.getElementById("i1").style.counterIncrement = "chicken";
+ document.getElementById("i3").style.counterIncrement = "chicken";
+}
+</script>
+</head>
+
+<body onload="boom();" style="overflow: auto; display: -moz-box;">
+<img id="i1" style="width: 30px; float: right;">
+<img id="i2" style="margin: 0 100%; padding: 0 60px;">
+<img id="i3" style="margin: 100% 0; float: right;">
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/403576-1.html b/layout/generic/crashtests/403576-1.html
new file mode 100644
index 0000000000..4b376af6a1
--- /dev/null
+++ b/layout/generic/crashtests/403576-1.html
@@ -0,0 +1,5 @@
+<html>
+<body style="width: 11px;">
+<fieldset style="display: table-column-group;"></fieldset>
+</body>
+</html>
diff --git a/layout/generic/crashtests/404140-1.html b/layout/generic/crashtests/404140-1.html
new file mode 100644
index 0000000000..b3d6e9d2d8
--- /dev/null
+++ b/layout/generic/crashtests/404140-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE HTML>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+
+</head><body onload="document.body.style.height = '2px';" style="float: right; height: 2px; column-width: 0pt;">
+<div style="overflow: clip;">a b</div>
+</body></html>
diff --git a/layout/generic/crashtests/404146-1.html b/layout/generic/crashtests/404146-1.html
new file mode 100644
index 0000000000..ad5bc53e99
--- /dev/null
+++ b/layout/generic/crashtests/404146-1.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+<style>
+
+.colset {
+ column-count: 2;
+ column-width: 50px;
+ float: left;
+ border: 2px solid black;
+ height: 10em;
+ font: 12px monospace;
+}
+
+#t {
+ display: inline-block;
+ background: lightgreen;
+ height: 7em;
+ width: 29px;
+}
+
+</style>
+</head>
+
+<body onload="document.getElementById('t').style.width = '30px';">
+
+<div class="colset">The quick <span><div id="t"></div>brown</span></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/404204-1.html b/layout/generic/crashtests/404204-1.html
new file mode 100644
index 0000000000..2437f4c529
--- /dev/null
+++ b/layout/generic/crashtests/404204-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+
+<body style="font-variant: small-caps;">&#x202B; </body>
+
+</html>
diff --git a/layout/generic/crashtests/404215-1.html b/layout/generic/crashtests/404215-1.html
new file mode 100644
index 0000000000..583395b7e1
--- /dev/null
+++ b/layout/generic/crashtests/404215-1.html
@@ -0,0 +1,29 @@
+<html>
+<head>
+<style>
+
+#colset {
+ column-count: 3;
+}
+.a {
+ height: 3in;
+}
+.b {
+ height: 24pt;
+}
+.c {
+ height: 336pt;
+}
+.d {
+ position: absolute;
+}
+
+</style>
+</head>
+
+<body onload="document.getElementById('a').className = '';">
+
+<div id="colset"><div><div class="a" id="a"></div><div class="b"><div class="c"></div><div class="d"></div></div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/404215-2.html b/layout/generic/crashtests/404215-2.html
new file mode 100644
index 0000000000..486255ca11
--- /dev/null
+++ b/layout/generic/crashtests/404215-2.html
@@ -0,0 +1,37 @@
+<html>
+<head><style>
+/* Sets of heights that trigger crash:
+ 100px/50px/51+px
+ 100px/30px/74+px
+ Get only an assert unless you set ".d { position: absolute; }".
+
+ Trigger hang (separate issue, absolute not needed):
+ 10px/10px/9999px
+ 10px/10px/999999px --> "bad height" notreached
+*/
+#colset { width: 200px;
+ column-count: 3; }
+#a { height: 100px; }
+#b { height: 50px; }
+#c { height: 51px; }
+#d { position: absolute; }
+</style>
+<script>
+ function boom() {
+ document.getElementById('a').style.height = 'auto';
+ }
+</script>
+</head>
+<!-- Removing whitespace in body for simpler frame trees -->
+<body onload="setTimeout('boom()', 1000)"
+ ><div id="colset"
+ ><div
+ ><div id="a"></div
+ ><div id="b"
+ ><div id="c"></div
+ ><div id="d"></div
+ ></div
+ ></div
+ ></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/404215-3.html b/layout/generic/crashtests/404215-3.html
new file mode 100644
index 0000000000..0ebf68131a
--- /dev/null
+++ b/layout/generic/crashtests/404215-3.html
@@ -0,0 +1,32 @@
+<html>
+<head><style>
+/* Sets of heights that trigger crash:
+ 100px/50px/51+px
+ 100px/30px/74+px
+ Get only an assert unless you set ".d { position: absolute; }".
+
+ Trigger hang (separate issue, absolute not needed):
+ 10px/10px/9999px
+ 10px/10px/999999px --> "bad height" notreached
+*/
+#colset { width: 200px;
+ column-count: 3; }
+#a { height: 10px; }
+#b { height: 10px; }
+#c { height: 999999px; }
+
+</style>
+</head>
+<!-- Removing whitespace in body for simpler frame trees -->
+<body
+ ><div id="colset"
+ ><div
+ ><div id="a"></div
+ ><div id="b"
+ ><div id="c"></div
+ ><div id="d"></div
+ ></div
+ ></div
+ ></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/404219-1.html b/layout/generic/crashtests/404219-1.html
new file mode 100644
index 0000000000..6dcb2707a4
--- /dev/null
+++ b/layout/generic/crashtests/404219-1.html
@@ -0,0 +1,30 @@
+<html>
+<head>
+<style>
+ body {
+ /* Standize line-height, because the default varies by platform */
+ line-height: 50px;
+ }
+ div#a {
+ width: 3em;
+ column-count: 2;
+ column-gap: 0px;
+ background: lightgreen;
+ }
+ div#b {
+ float: left;
+ background: lightblue;
+ }
+ div#c {
+ height: 100px;
+ background: orange;
+ }
+</style>
+</head>
+<body>
+ <div id="a">
+ <div id="b"><br/><br/>b</div>
+ <div id="c">c c c</div>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/404219-2.html b/layout/generic/crashtests/404219-2.html
new file mode 100644
index 0000000000..8ce12b4ccd
--- /dev/null
+++ b/layout/generic/crashtests/404219-2.html
@@ -0,0 +1,31 @@
+<html>
+<head>
+<style>
+ body {
+ /* Standize line-height, because the default varies by platform */
+ line-height: 50px;
+ }
+ div#a {
+ width: 3em;
+ column-count: 2;
+ column-gap: 0px;
+ background: lightgreen;
+ }
+ div#b {
+ height: 100px;
+ float: left;
+ background: lightblue;
+ }
+ div#c {
+ height: 100px;
+ background: orange;
+ }
+</style>
+</head>
+<body>
+ <div id="a">
+ <div id="b"><br/><br/>b</div>
+ <div id="c">c c c</div>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/404624.html b/layout/generic/crashtests/404624.html
new file mode 100644
index 0000000000..0e6bae1133
--- /dev/null
+++ b/layout/generic/crashtests/404624.html
@@ -0,0 +1,7 @@
+<html><head>
+<style>div::first-letter { letter-spacing: 20px;}</style>
+</head>
+<body>
+<div>mm</div>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/406137.html b/layout/generic/crashtests/406137.html
new file mode 100644
index 0000000000..75337de72c
--- /dev/null
+++ b/layout/generic/crashtests/406137.html
@@ -0,0 +1,16 @@
+<html>
+ <head>
+ <title>redhat.com | Home</title>
+ <style>
+ #navWrap:after { content: "."; display: block; clear: both; }
+ </style>
+ </head>
+ <body>
+ <div id="navWrap">
+ <div style="float: left;">
+ foo
+ </div>
+ </div>
+ <img src="../../../testing/crashtest/images/tree.gif" style="float: right;">
+ </body>
+</html>
diff --git a/layout/generic/crashtests/406380.html b/layout/generic/crashtests/406380.html
new file mode 100644
index 0000000000..278ddec9c8
--- /dev/null
+++ b/layout/generic/crashtests/406380.html
@@ -0,0 +1,12 @@
+<html style="direction: rtl;">
+<body onload="document.getElementById('i').style.fontSize = '10em';">
+
+<div style="column-width: 60px;">
+a
+<div style="overflow: clip; white-space: pre;" id="i">
+b
+</div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/406902-1.html b/layout/generic/crashtests/406902-1.html
new file mode 100644
index 0000000000..13c96e6ae1
--- /dev/null
+++ b/layout/generic/crashtests/406902-1.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style type="text/css">
+
+ .container {
+ position: relative;
+ }
+ #colset {
+ column-count: 3;
+ column-gap: 0;
+ border: silver 2pt;
+ border-style: none solid;
+ }
+ .b1 {
+ position: absolute;
+ height: 336pt;
+ margin-left: 20pt;
+ }
+ .b2 {
+ position: absolute;
+ height: 192pt;
+ width: 25pt;
+ margin-left: 50pt;
+ }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ newDiv = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ newDiv.setAttribute("class", "b1");
+ document.getElementById("f").appendChild(newDiv);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div id="colset"><div class="container"><div class="b2"></div><div id="f"></div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/407009-1.xhtml b/layout/generic/crashtests/407009-1.xhtml
new file mode 100644
index 0000000000..62ded15624
--- /dev/null
+++ b/layout/generic/crashtests/407009-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<body onload="document.getElementById('tree').removeAttribute('hidevscroll');">
+
+<select><xul:tree id="tree"/></select>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/408304-1.xhtml b/layout/generic/crashtests/408304-1.xhtml
new file mode 100644
index 0000000000..e0e09801d0
--- /dev/null
+++ b/layout/generic/crashtests/408304-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<fieldset><span><fieldset><legend><div ><div style="margin: 0pt 100%;"></div></div></legend></fieldset></span></fieldset>
+</body>
+</html>
diff --git a/layout/generic/crashtests/408602-1.html b/layout/generic/crashtests/408602-1.html
new file mode 100644
index 0000000000..66082d093b
--- /dev/null
+++ b/layout/generic/crashtests/408602-1.html
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+
+<body style="position: fixed;">
+
+<div style="position: absolute; column-width: 20em;"><div style="white-space: pre; float: right; height: 50px;"><div style="width: 100px; height: 12em;"></div>
+</div></div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/408737-1.html b/layout/generic/crashtests/408737-1.html
new file mode 100644
index 0000000000..30e7ecd6b3
--- /dev/null
+++ b/layout/generic/crashtests/408737-1.html
@@ -0,0 +1,14 @@
+<html>
+<head><style>
+#colset { column-count: 1; }
+#short { height: 0px; }
+#tall { height: 10000px; }
+</style></head>
+<body>
+ <div id="colset">
+ <div id="short">
+ <div id="tall"></div>
+ </div>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/408737-2.html b/layout/generic/crashtests/408737-2.html
new file mode 100644
index 0000000000..4aff259302
--- /dev/null
+++ b/layout/generic/crashtests/408737-2.html
@@ -0,0 +1,14 @@
+<html>
+<head><style>
+#colset { column-count: 1; }
+#short { height: 10px; }
+#tall { height: 100000px; }
+</style></head>
+<body>
+ <div id="colset">
+ <div id="short">
+ <div id="tall"></div>
+ </div>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/408749-1.xhtml b/layout/generic/crashtests/408749-1.xhtml
new file mode 100644
index 0000000000..6f190c11bb
--- /dev/null
+++ b/layout/generic/crashtests/408749-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body style="column-count: 2;"><caption><div>foo<td></td></div></caption></body></html>
diff --git a/layout/generic/crashtests/408883-1.html b/layout/generic/crashtests/408883-1.html
new file mode 100644
index 0000000000..fab50fbf08
--- /dev/null
+++ b/layout/generic/crashtests/408883-1.html
@@ -0,0 +1,39 @@
+<html>
+<head>
+
+<style type="text/css">
+
+body {
+ column-count: 2;
+ column-width: 100px;
+ height: 200px;
+ width: 400px;
+}
+.b {
+ height: 300px;
+}
+.f {
+ float: left;
+}
+.p {
+ padding: 0pt 200px;
+}
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var newDiv = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ var a = document.getElementById("a");
+ a.appendChild(newDiv);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();"><div class="f"><span class="p"></span></div><div id="a"><div class="b f"><input></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/410198.html b/layout/generic/crashtests/410198.html
new file mode 100644
index 0000000000..f423fb32b5
--- /dev/null
+++ b/layout/generic/crashtests/410198.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN">
+<title>Gecko 1.9 crash with a.p. and inline c.b.</title>
+
+<p>- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+<span style="position: relative; background-color: #ddd;">- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+<span style="position: absolute; top: 0; left: 0; background-color: #f00;">AP</span>
+</span>
+</p>
diff --git a/layout/generic/crashtests/410228-1.html b/layout/generic/crashtests/410228-1.html
new file mode 100644
index 0000000000..b1bd3e0d04
--- /dev/null
+++ b/layout/generic/crashtests/410228-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+
+<body style="text-transform: uppercase; font-family: arial;">&zwnj;&szlig;</body>
+
+</html>
diff --git a/layout/generic/crashtests/410232-1.html b/layout/generic/crashtests/410232-1.html
new file mode 100644
index 0000000000..26a9c2c84c
--- /dev/null
+++ b/layout/generic/crashtests/410232-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+</head>
+
+<body>
+
+<div style="height: 17895694px;"></div>
+
+<div style="float: left; border: 2px solid red;"></div>
+
+<div style="float: left; border: 2px solid green;"></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/410595-1.html b/layout/generic/crashtests/410595-1.html
new file mode 100644
index 0000000000..0ee6e36c97
--- /dev/null
+++ b/layout/generic/crashtests/410595-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+
+<body><div style="padding: 12em 0; position: absolute; font-size: 10000000px;"><div style="position: absolute;"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/411213-1.html b/layout/generic/crashtests/411213-1.html
new file mode 100644
index 0000000000..5fc38ec84c
--- /dev/null
+++ b/layout/generic/crashtests/411213-1.html
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="direction: rtl;">
+<body onload="document.getElementById('i').style.fontSize = '10em';">
+
+<div style="column-width: 60px;"><div id="i" style="overflow: clip; white-space: pre;">
+ b
+</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/411213-2.xml b/layout/generic/crashtests/411213-2.xml
new file mode 100644
index 0000000000..e32b0525c6
--- /dev/null
+++ b/layout/generic/crashtests/411213-2.xml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="direction: rtl;">
+<body onload="document.getElementById('i').style.fontSize = '10em';">
+
+<div style="column-width: 60px;"><div id="i" style="overflow: clip; white-space: pre;">
+ b</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/411835.html b/layout/generic/crashtests/411835.html
new file mode 100644
index 0000000000..433030fb31
--- /dev/null
+++ b/layout/generic/crashtests/411835.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div { position: absolute; height: 10px; width: 10px; }
+
+</style>
+</head>
+
+<body onload="document.getElementById('c').style.counterIncrement = 'z';">
+
+<div style="column-count: 2;"><div id="c" style="white-space: pre;">
+
+<div>
+<div></div></div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/411851-1.html b/layout/generic/crashtests/411851-1.html
new file mode 100644
index 0000000000..c7ba0965f0
--- /dev/null
+++ b/layout/generic/crashtests/411851-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html style="padding: 17895704px;">
+<head>
+</head>
+<body>
+<div style="float: left;">Foo</div>Bar<span style="margin: 10em; height: 17895697px; float: left;"></span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/412014-1.html b/layout/generic/crashtests/412014-1.html
new file mode 100644
index 0000000000..f985448124
--- /dev/null
+++ b/layout/generic/crashtests/412014-1.html
@@ -0,0 +1,17 @@
+<html style="white-space: pre; column-count: 2;">
+<head></head>
+
+<body onload="document.body.style.MozFloatEdge = 'margin-box'" style="column-width: 20em;">
+
+<div style="position: relative; height: 80px; margin: 10px;">
+
+
+
+
+<div style="position: absolute; height: 11px; top: 19px;"></div>
+</div>
+
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/412201-1.xhtml b/layout/generic/crashtests/412201-1.xhtml
new file mode 100644
index 0000000000..29b3369f8c
--- /dev/null
+++ b/layout/generic/crashtests/412201-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="padding: 17895704px;"><body style="margin: 0pt 100% 0pt 96%; display: table; float: right; height: 0pt;"><li style="list-style-position: inside;"></li></body><body style="margin: -1px; padding: 17895704px; display: table-caption; float: right; height: 0pt;"></body></html>
diff --git a/layout/generic/crashtests/412543-1.html b/layout/generic/crashtests/412543-1.html
new file mode 100644
index 0000000000..7009a00288
--- /dev/null
+++ b/layout/generic/crashtests/412543-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+.c { column-width: 1px; width: 93px; }
+.c:first-letter { }
+
+</style>
+</head>
+
+<body>
+
+<div class="c"><small>a b . d e f h i , k ; m n o p q</small></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/413048-1.html b/layout/generic/crashtests/413048-1.html
new file mode 100644
index 0000000000..bd2280d815
--- /dev/null
+++ b/layout/generic/crashtests/413048-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="column-count: 15; width: 16px; height: 16px;"><span><div style="display: inline-block;">a</div><div style="float: left;"></div>
+</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/413079-1.xhtml b/layout/generic/crashtests/413079-1.xhtml
new file mode 100644
index 0000000000..9f1dcc44e0
--- /dev/null
+++ b/layout/generic/crashtests/413079-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body onload='document.getElementById("x").style.letterSpacing = "20px";'>
+
+<div style="column-count: 15;" id="x"><span>AAA
+<div style="float: left;">BBBB<div>CCCC</div></div></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/413079-2.xhtml b/layout/generic/crashtests/413079-2.xhtml
new file mode 100644
index 0000000000..93f21d5987
--- /dev/null
+++ b/layout/generic/crashtests/413079-2.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ </head>
+ <body >
+ <div style="column-count: 12; border: 1px solid green">
+ <span>AAAA
+ <div style="float: left;border: 1px solid blue">BBBB
+ </div>
+ </span>
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/413079-3.xhtml b/layout/generic/crashtests/413079-3.xhtml
new file mode 100644
index 0000000000..c6591612ef
--- /dev/null
+++ b/layout/generic/crashtests/413079-3.xhtml
@@ -0,0 +1,12 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ </head>
+ <body >
+ <div style="column-count: 2; border: 1px solid green">
+ <span>AAAA
+ <div style="float: left;border: 1px solid blue">BBBB
+ </div>
+ </span>
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/413085-1.html b/layout/generic/crashtests/413085-1.html
new file mode 100644
index 0000000000..edb752d5b5
--- /dev/null
+++ b/layout/generic/crashtests/413085-1.html
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+
+body:first-letter { float: right; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.body.firstChild.remove();
+ document.body.appendChild(document.createTextNode('x'));
+}
+
+</script>
+</head>
+
+<body onload="boom();">&#xFEB7;
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/413085-2.html b/layout/generic/crashtests/413085-2.html
new file mode 100644
index 0000000000..6128304abd
--- /dev/null
+++ b/layout/generic/crashtests/413085-2.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<style>
+ body:first-letter { float: right; }
+</style>
+<script>
+ function boom() {
+ document.body.firstChild.remove();
+ }
+</script>
+</head>
+<body onload="boom();">abc&#x05DB;d
+<div>This sentence should be the only text on the page.</div></body>
+</html>
diff --git a/layout/generic/crashtests/413582-1.xhtml b/layout/generic/crashtests/413582-1.xhtml
new file mode 100644
index 0000000000..7e7b8dab19
--- /dev/null
+++ b/layout/generic/crashtests/413582-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<div style="column-count: 2; text-indent: 11px;"> <div style="float: right;"></div><select style="float: right;"></select></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/413582-2.html b/layout/generic/crashtests/413582-2.html
new file mode 100644
index 0000000000..0e756c2bea
--- /dev/null
+++ b/layout/generic/crashtests/413582-2.html
@@ -0,0 +1,9 @@
+<html>
+<head></head>
+<body>
+<div style="column-count: 2;">r
+<span style="float: right;"></span>
+<textarea style="float: left;"></textarea>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/413712-1.xhtml b/layout/generic/crashtests/413712-1.xhtml
new file mode 100644
index 0000000000..5de0511d1d
--- /dev/null
+++ b/layout/generic/crashtests/413712-1.xhtml
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="display: table">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var tr = document.getElementById("tr");
+ tr.contentEditable = "true";
+ tr.focus();
+ document.execCommand("selectAll", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><tr id="tr"><td></td></tr></body>
+
+</html>
diff --git a/layout/generic/crashtests/414061-1.html b/layout/generic/crashtests/414061-1.html
new file mode 100644
index 0000000000..43398d9199
--- /dev/null
+++ b/layout/generic/crashtests/414061-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body style="width: 1px; white-space: pre; column-width: 1px;">
+
+x
+
+<div style="margin: -200em;"></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/414180-1.xhtml b/layout/generic/crashtests/414180-1.xhtml
new file mode 100644
index 0000000000..c4db5ae2ec
--- /dev/null
+++ b/layout/generic/crashtests/414180-1.xhtml
@@ -0,0 +1,7 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<grid style="margin: -1px; display: inline;" />
+
+</window>
diff --git a/layout/generic/crashtests/414719-1.html b/layout/generic/crashtests/414719-1.html
new file mode 100644
index 0000000000..23ccac7902
--- /dev/null
+++ b/layout/generic/crashtests/414719-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var newDiv = document.createElement("div");
+ var ispan = document.getElementById("ispan");
+ ispan.parentNode.insertBefore(newDiv, ispan);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div style="column-count: 1; position: fixed;"><div style="overflow: clip; display: table-header-group; white-space: pre; position: absolute;">
+ <span id="ispan">
+</span></div></div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/415685-1.html b/layout/generic/crashtests/415685-1.html
new file mode 100644
index 0000000000..c474d482b0
--- /dev/null
+++ b/layout/generic/crashtests/415685-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+<style type="text/css">
+
+div { height: 10px; margin: 1em; outline: 1px inset black; }
+
+</style>
+</head>
+
+<body onload="document.getElementById('a').style.padding = '12em 0';" style="column-count: 2; width: 1px;"><div id="a">aaaa aaaa aaaa</div><div style="border: medium solid blue;"></div><div style="border: medium solid green; margin: 10em 0pt;"></div><div style="border: medium solid magenta;"></div>xxxx xxxx xxxx</body>
+
+</html>
diff --git a/layout/generic/crashtests/415818.xhtml b/layout/generic/crashtests/415818.xhtml
new file mode 100644
index 0000000000..6cf4754889
--- /dev/null
+++ b/layout/generic/crashtests/415818.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body onload="document.getElementById('a').setAttribute('rquote', 'q');">
+
+<ms id="a" xmlns="http://www.w3.org/1998/Math/MathML" rquote="abcdef ghijkl"><mrow></mrow></ms>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/416165.html b/layout/generic/crashtests/416165.html
new file mode 100644
index 0000000000..9bbdee641c
--- /dev/null
+++ b/layout/generic/crashtests/416165.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+function replacestyles(){
+document.getElementById('a').setAttribute('style', 'border: 1px solid black; -moz-border-radius: 2em;');
+document.body.offsetHeight;
+}
+</script>
+</head>
+<body style="direction: rtl; column-count: 2;" onload="document.body.offsetHeight; setTimeout(replacestyles,0);">
+
+<div id="a">
+<pre style="overflow: clip;">
+
+
+text
+
+
+
+</pre>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/416264-1.html b/layout/generic/crashtests/416264-1.html
new file mode 100644
index 0000000000..7a2dd83f10
--- /dev/null
+++ b/layout/generic/crashtests/416264-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+
+<body style="display: -moz-box;"><div style="column-count: 2;"><div style="height: 200px;"></div><span style="display: inline-block; width: 100px;"></span></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/416476-1.html b/layout/generic/crashtests/416476-1.html
new file mode 100644
index 0000000000..f90b154ff5
--- /dev/null
+++ b/layout/generic/crashtests/416476-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><head></head><body></body><body style="width: 800px; column-count: 4;"><div style="height: 80px; outline-color: blue; outline-style: solid; outline-width: 1px;"></div><div style="height: 80px; outline-color: green; outline-style: solid; outline-width: 1px;"><div style="float: left; height: 10px; width: 10px; outline-color: red; outline-style: solid; outline-width: 1px;"></div><div style="padding: 180px; column-count: 1; clear: right; outline-color: magenta; outline-style: solid; outline-width: 1px;"></div></div></body></html>
diff --git a/layout/generic/crashtests/417848-1.xhtml b/layout/generic/crashtests/417848-1.xhtml
new file mode 100644
index 0000000000..6e5ac0535a
--- /dev/null
+++ b/layout/generic/crashtests/417848-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head></head>
+ <body style="column-count: 15; font-size: 144em;">
+ <svg xmlns="http://www.w3.org/2000/svg" style="min-width: 10em;"></svg>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/417902-1.html b/layout/generic/crashtests/417902-1.html
new file mode 100644
index 0000000000..ea393d0222
--- /dev/null
+++ b/layout/generic/crashtests/417902-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body { width: 500px; column-count: 2; }
+body:first-letter { float: right; }
+#s { padding: 0pt 200px; }
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("s").appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+
+<body onload="boom();">x <span id="s"></span></body>
+
+</html>
diff --git a/layout/generic/crashtests/417902-2.html b/layout/generic/crashtests/417902-2.html
new file mode 100644
index 0000000000..da19da232f
--- /dev/null
+++ b/layout/generic/crashtests/417902-2.html
@@ -0,0 +1,28 @@
+<html>
+<head>
+ <style>
+ div:first-letter {
+ float: left;
+ background: orange;
+ }
+ /* Note: there's an upper-bound on widths that trigger a crash.
+ This bound depends on the width of the characters in the div. */
+ div#v {
+ column-count: 2;
+ width: 30px;
+ height: 1em;
+ background: lightblue;
+ }
+ </style>
+ <script>
+ function boom() {
+ var v = document.getElementById("v");
+ // Note: This seems to crash regardless of what the text node is;
+ // e.g. it can be the empty string, a space character, or any number of
+ // other characters.
+ v.appendChild(document.createTextNode("CRASH"));
+ }
+ </script>
+</head>
+<body onload="boom();"><div id="v">a b</div></body>
+</html>
diff --git a/layout/generic/crashtests/418532-1.html b/layout/generic/crashtests/418532-1.html
new file mode 100644
index 0000000000..89b8ecd7d4
--- /dev/null
+++ b/layout/generic/crashtests/418532-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+div:first-line { font-size: 80%; color: green; }
+</style>
+</head>
+<body style="column-width: 1px"><div id="div" style="column-width: 1px"> <span>Foo bar</span></div></body>
+</html>
diff --git a/layout/generic/crashtests/418932-1.html b/layout/generic/crashtests/418932-1.html
new file mode 100644
index 0000000000..154977506c
--- /dev/null
+++ b/layout/generic/crashtests/418932-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><head></head><body><div style="column-width: 2880000em;"></div></body></html>
diff --git a/layout/generic/crashtests/419352.html b/layout/generic/crashtests/419352.html
new file mode 100644
index 0000000000..70b3edba7f
--- /dev/null
+++ b/layout/generic/crashtests/419352.html
@@ -0,0 +1,3 @@
+<html>
+<body dir="rtl">&#x2028;&#x200C;</body>
+</html>
diff --git a/layout/generic/crashtests/420000-1.html b/layout/generic/crashtests/420000-1.html
new file mode 100644
index 0000000000..c794c61a06
--- /dev/null
+++ b/layout/generic/crashtests/420000-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="column-gap: 24000000em; column-count: 5;"></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/420718.html b/layout/generic/crashtests/420718.html
new file mode 100644
index 0000000000..9626c5cf2d
--- /dev/null
+++ b/layout/generic/crashtests/420718.html
@@ -0,0 +1 @@
+<span style="float: left; margin-top: 99999999px;">t</span> \ No newline at end of file
diff --git a/layout/generic/crashtests/421404-1.html b/layout/generic/crashtests/421404-1.html
new file mode 100644
index 0000000000..634209849b
--- /dev/null
+++ b/layout/generic/crashtests/421404-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="width: -moz-fit-content; width: fit-content; clear: both">
+<div style="float: left; width: 20px; padding: 100%"></div>
+<div style="float: left; width: 20px"></div>
+<div style="float: left; width: 20px"></div>
+</div>
+<div style="width: -moz-fit-content; width: fit-content; clear: both">
+<div style="float: right; width: 20px; padding: 100%"></div>
+<div style="float: right; width: 20px"></div>
+<div style="float: right; width: 20px"></div>
+</div>
+<div style="width: -moz-fit-content; width: fit-content; clear: both">
+<div style="float: left; width: 20px; padding: 100%"></div>
+<div style="float: right; width: 20px; padding: 100%; clear: right"></div>
+<div style="float: right; width: 20px; clear: right"></div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/421671.html b/layout/generic/crashtests/421671.html
new file mode 100644
index 0000000000..3a6421d18b
--- /dev/null
+++ b/layout/generic/crashtests/421671.html
@@ -0,0 +1,202 @@
+<marquee>
+<xmp style="column-count: 99999999">
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+
+<a>
+<a>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+<a>
+<a>
+<a>
+<a>
+
+<a>
+<a>
+
+<a>
+<a> \ No newline at end of file
diff --git a/layout/generic/crashtests/422283-1.html b/layout/generic/crashtests/422283-1.html
new file mode 100644
index 0000000000..3b50140acd
--- /dev/null
+++ b/layout/generic/crashtests/422283-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+
+<body style="column-width: 1px;"><div style="padding: 150px 0; height: 80px;"><span>
+</span>x<div></div><span>
+</span>a ! b c<div></div>
+</div></body>
+
+</html>
diff --git a/layout/generic/crashtests/422301-1.html b/layout/generic/crashtests/422301-1.html
new file mode 100644
index 0000000000..24d577ea31
--- /dev/null
+++ b/layout/generic/crashtests/422301-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style type="text/css">
+
+div { height: .5em; margin: 1em; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("b").style.padding = "";
+ document.getElementById("a").style.padding = "12em";
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="column-width: 2em;"><div id="a"></div><div></div><div></div><div id="b" style="padding: 12em;">This is text</div>This is textThis is text<div>This is text</div></body>
+
+</html>
diff --git a/layout/generic/crashtests/423055-1.html b/layout/generic/crashtests/423055-1.html
new file mode 100644
index 0000000000..4b881d6fb4
--- /dev/null
+++ b/layout/generic/crashtests/423055-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html>
+<head></head>
+<body>
+
+<div style="white-space: pre; position: relative; column-count: 2;">
+<div style="position: absolute;"></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/423098.html b/layout/generic/crashtests/423098.html
new file mode 100644
index 0000000000..cdaf8ddb22
--- /dev/null
+++ b/layout/generic/crashtests/423098.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("b").style.position = "static";
+ document.body.offsetHeight;
+ document.getElementById("a").style.fontSize = "110%";
+}
+
+</script>
+</head>
+
+<body style="column-count: 1;" onload="boom();">
+ <div id="a" style="float: right; height: 80px;">
+ <div id="b" style="position: absolute; height: 10px;"></div>
+ <div style="height: 100px; width: 11px;"></div>
+ </div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/423264-1.html b/layout/generic/crashtests/423264-1.html
new file mode 100644
index 0000000000..9a64867950
--- /dev/null
+++ b/layout/generic/crashtests/423264-1.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<script type="text/javascript">
+
+function boom()
+{
+ var y = document.createTextNode(' Y ');
+ document.getElementById("a").appendChild(y);
+ document.body.offsetHeight;
+ var z = document.createTextNode('Z');
+ document.body.insertBefore(z, document.body.lastChild);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div style="column-count: 2; width: 1px;"><div id="a">M N矋<span>م</span></div></div>H</body>
+</html>
diff --git a/layout/generic/crashtests/424629.html b/layout/generic/crashtests/424629.html
new file mode 100644
index 0000000000..d142897ce5
--- /dev/null
+++ b/layout/generic/crashtests/424629.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("o").appendChild(document.createTextNode('d'));
+ document.body.offsetHeight;
+ document.getElementById("b").firstChild.data = "\u202E";
+ document.getElementById("a").firstChild.data = "ZZZZZZZ";
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="font-family: monospace; width: 8ch;">
+
+<div><span id="o"><span id="a">a</span><span id="b">b&#x202E;</span><span> c </span></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/425253-1.html b/layout/generic/crashtests/425253-1.html
new file mode 100644
index 0000000000..74c78570d5
--- /dev/null
+++ b/layout/generic/crashtests/425253-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+ <span style="border:10px solid blue; text-decoration:underline;">Hello</span>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/426040-1.html b/layout/generic/crashtests/426040-1.html
new file mode 100644
index 0000000000..e8a4ea4e5e
--- /dev/null
+++ b/layout/generic/crashtests/426040-1.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div { height: 1px; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var a = document.getElementById("a");
+ a.firstChild.remove();
+ document.documentElement.style.outline = "none";
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<div style="column-count: 2;" id="a"><div><div style="float: right;"><div></div><span><div></div></span></div></div></div>
+
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/426272-1.html b/layout/generic/crashtests/426272-1.html
new file mode 100644
index 0000000000..6075deb936
--- /dev/null
+++ b/layout/generic/crashtests/426272-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var y = document.createTextNode('Y');
+ document.body.insertBefore(y, document.getElementById("v").nextSibling);
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="column-count: 2; width: 10ch; letter-spacing: 1px; font-family: monospace;">
+<div style="background: lightblue; float: right; height: 14em; width: 1ch;" id="v"></div>a bcd<span>&#x202B;X</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/428263-1.html b/layout/generic/crashtests/428263-1.html
new file mode 100644
index 0000000000..fd7e332a50
--- /dev/null
+++ b/layout/generic/crashtests/428263-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html style="display: table;">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.documentElement.appendChild(document.body);
+ document.documentElement.offsetHeight;
+ document.documentElement.appendChild(document.body);
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="column-count: 2;"><div style="height: 1px;"></div><span style="display: inline-block;"></span></body>
+
+</html>
diff --git a/layout/generic/crashtests/429960-1.html b/layout/generic/crashtests/429960-1.html
new file mode 100644
index 0000000000..37e99deb52
--- /dev/null
+++ b/layout/generic/crashtests/429960-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html style="direction: rtl;" contenteditable="true">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.body.firstChild.style.columnCount = "3";
+}
+
+</script>
+</head>
+
+<body style="width: 1px;" onload="boom();"><div>examination<span style="font-family: verdana;">x x x x </span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/429960-2.html b/layout/generic/crashtests/429960-2.html
new file mode 100644
index 0000000000..17ea3c6245
--- /dev/null
+++ b/layout/generic/crashtests/429960-2.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html style="direction: rtl;" contenteditable="true">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.body.firstChild.style.columnCount = "3";
+}
+
+</script>
+</head>
+
+<body style="width: 1px;" onload="boom();"><div>examination<span style="font-family: verdana;">x x x x
+</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/429969-1.html b/layout/generic/crashtests/429969-1.html
new file mode 100644
index 0000000000..4b4b567f0c
--- /dev/null
+++ b/layout/generic/crashtests/429969-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+#inner:first-letter { }
+#outer { direction: rtl; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.documentElement.style.whiteSpace = "pre";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div id="outer"><div id="inner"><span id="s"><span>
+
+</span>AB</span></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/429981-1.html b/layout/generic/crashtests/429981-1.html
new file mode 100644
index 0000000000..57041bc871
--- /dev/null
+++ b/layout/generic/crashtests/429981-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+ body {
+ height: 100px;
+ width: 300pt;
+ column-width: 100pt;
+ column-gap: 0;
+ }
+
+ #x {
+ padding: 100px;
+ }
+
+ #overflow {
+ height: 400px;
+ float: left;
+ }
+
+</style>
+</head>
+
+<body><div id="x"><div id="overflow"></div>K</div></body>
+
+</html>
diff --git a/layout/generic/crashtests/430332-1.html b/layout/generic/crashtests/430332-1.html
new file mode 100644
index 0000000000..c9ba002299
--- /dev/null
+++ b/layout/generic/crashtests/430332-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<body style="font-family:monospace; width:6ch;">
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd
+<b>ab</b> cd<span id="s">ef</span>
+<script>
+document.body.clientWidth;
+document.getElementById("s").style.fontSize = "200%";
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/430344-1.html b/layout/generic/crashtests/430344-1.html
new file mode 100644
index 0000000000..e793020927
--- /dev/null
+++ b/layout/generic/crashtests/430344-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="width: 1px;"><span>e</span> <br style="clear: both;"></body>
+</html>
diff --git a/layout/generic/crashtests/430352-1.html b/layout/generic/crashtests/430352-1.html
new file mode 100644
index 0000000000..e22d641299
--- /dev/null
+++ b/layout/generic/crashtests/430352-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html style="border: 1px dotted red; font-size: 0; -moz-appearance: scrollbartrack-horizontal; width: 12em;">
+<head></head>
+<body style="position: absolute;"></body>
+</html>
diff --git a/layout/generic/crashtests/430744-1.html b/layout/generic/crashtests/430744-1.html
new file mode 100644
index 0000000000..190609294a
--- /dev/null
+++ b/layout/generic/crashtests/430744-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('x').appendChild(document.createTextNode('b'));">
+
+<div style="display: -moz-box;"><div style="column-count: 2;">a<div id="x" style="padding: 1em;"></div><wbr></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/430991.html b/layout/generic/crashtests/430991.html
new file mode 100644
index 0000000000..844e9c1a53
--- /dev/null
+++ b/layout/generic/crashtests/430991.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var li = document.getElementById("li");
+ li.removeChild(li.lastChild);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<ul id="ul">
+<li id="li" style="column-count: -1; white-space: pre-wrap;"><span>A</span><span>B</span><span style="float: right;"></span>
+
+</li>
+</ul>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/431260-1.html b/layout/generic/crashtests/431260-1.html
new file mode 100644
index 0000000000..0e4bfb812e
--- /dev/null
+++ b/layout/generic/crashtests/431260-1.html
@@ -0,0 +1,34 @@
+<html class="reftest-wait"><head><style>
+title::first-letter {font-size:600%;}
+</style><title style="display: table-column-group; position: absolute;">
+mmmmmmmmmmmmmmm mmmmmmmmmmmmmmmm mmmmmmmmmm mmmmmmmmmmmmmmmmmmmmm mmmmmmmmmm6mmmmm
+mmmm mmmmMmmmmmmmm=mmmmmmmmm mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
+mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmm mmmmm mmmmmmmmmmmmmm mmmmmmmmmmmmmmmmmmm mmmmmmmmmmmmmmm mmmmmmmm mmmmmmm
+&#1593m
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm mmmmm
+&#1593m ­&#1593m&#1593m&#1593m­­­&#1593m­&#1593m­&#1593m­&#1593m­&#1593m­&#1593m­&#1593
+&#1593m ­&#1593m&#1593m&#1593m­­­&#1593m­&#1593m­&#1593m­&#1593m­&#1593m­&#1593m­&#1593
+</title></head>
+<script>
+function innerhtml(i){
+ if (i > 0) {
+ document.documentElement.innerHTML = document.documentElement.innerHTML;
+ setTimeout(innerhtml,0,i-1);
+ } else {
+ document.documentElement.removeAttribute("class");
+ }
+}
+setTimeout(innerhtml,0,30);
+</script>
+</html>
diff --git a/layout/generic/crashtests/431260-2.html b/layout/generic/crashtests/431260-2.html
new file mode 100644
index 0000000000..7fc9204c20
--- /dev/null
+++ b/layout/generic/crashtests/431260-2.html
@@ -0,0 +1,26 @@
+<html class="reftest-wait"><head><style>
+ title::first-letter {}
+ title {
+ display: inline;
+ float: left;
+ font-size: 16px;
+ }
+</style>
+<script>
+ function boom() {
+ document.documentElement.innerHTML = document.documentElement.innerHTML;
+ document.documentElement.removeAttribute("class");
+ }
+</script>
+<title>
+a
+b
+&#1593
+c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
+c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
+c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c c
+</title></head>
+<script>
+setTimeout(boom, 0);
+</script>
+</html>
diff --git a/layout/generic/crashtests/435529.html b/layout/generic/crashtests/435529.html
new file mode 100644
index 0000000000..99d75fb98c
--- /dev/null
+++ b/layout/generic/crashtests/435529.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+ div {
+ column-count: 2;
+ white-space: pre;
+ }
+
+ div:first-letter {
+ float: right;
+ }
+
+</style>
+</head>
+
+<body><div> <span>AB</span></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/436194-1.html b/layout/generic/crashtests/436194-1.html
new file mode 100644
index 0000000000..739b6483cc
--- /dev/null
+++ b/layout/generic/crashtests/436194-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+#colset { column-count: 2; outline: 1px solid orange; }
+.ib { height: 100px; display: inline-block; outline: 1px solid blue; }
+div { outline: 1px solid green; }
+span { outline: 1px solid magenta; }
+
+</style>
+</head>
+<body>
+
+<div id="colset"><div></div><div style="width: 10px; float: left;"><span> <span class="ib" style="width: 30px;"></span> <br> </span></div><span class="ib"></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/436602-1.html b/layout/generic/crashtests/436602-1.html
new file mode 100644
index 0000000000..c8f731c680
--- /dev/null
+++ b/layout/generic/crashtests/436602-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="column-width: 1px;"><span>A B C D E</span> <span style="float: right;"></span> <br> </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/436822-1.html b/layout/generic/crashtests/436822-1.html
new file mode 100644
index 0000000000..b1b99977e2
--- /dev/null
+++ b/layout/generic/crashtests/436822-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body { font-size: 1600000px; }
+body * { font-size: 10em; }
+
+</style>
+</head>
+
+<body>
+ <div>
+ <div style="margin-top: 1em; margin-bottom: 1em;">A</div>
+ </div>
+ <div>
+ <div style="margin-top: 1em; margin-bottom: 1em;">B<div style="display: list-item; padding-left: 3px; float: left;"></div></div>
+ </div>
+ <div style="float: left;"></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/436823.html b/layout/generic/crashtests/436823.html
new file mode 100644
index 0000000000..8ab756af25
--- /dev/null
+++ b/layout/generic/crashtests/436823.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="column-count: -1;"><div style="float: left;"><div><div style="float: left;">A B</div><div style="clear: both; height: 1px;"></div></div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/436969-1.html b/layout/generic/crashtests/436969-1.html
new file mode 100644
index 0000000000..7dab5fa39e
--- /dev/null
+++ b/layout/generic/crashtests/436969-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.documentElement.style.zIndex = 2;">
+
+<div style="direction: rtl; text-transform: uppercase; width: 1px;"><div style="position: absolute; column-count: 2;"><span style="padding: 6em 0pt; position: absolute; height: 1.2em;">A !BB CCC D,</span></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/437156-1.html b/layout/generic/crashtests/437156-1.html
new file mode 100644
index 0000000000..1e87ca3b53
--- /dev/null
+++ b/layout/generic/crashtests/437156-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('c').style.counterIncrement = 'c';">
+
+<div style="column-width: 1px;"><div id="c"><div style="float: right;">T<iframe></iframe></div></div></div>
+
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/437565-1.xhtml b/layout/generic/crashtests/437565-1.xhtml
new file mode 100644
index 0000000000..4b2dd1067a
--- /dev/null
+++ b/layout/generic/crashtests/437565-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<!-- no body -->
+<div/>
+<div style="float: right;"><span><svg xmlns="http://www.w3.org/2000/svg" style="display: table-row;"/></span> von qlikworld runterladen. Alle RSS News aus dem Artikelkicker immer sofort und kostenlos auf den Bildschirm. Pressemitteilungen lesen und unbegrenzt viele Feeds gratis abonieren. </div><div style="float: right; text-indent: 20em;">artikelkicker.de</div><div><div style="float: right; width: 75px; height: 33px;"/><div style="clear: both;"/></div>
+</html>
diff --git a/layout/generic/crashtests/437565-2.xhtml b/layout/generic/crashtests/437565-2.xhtml
new file mode 100644
index 0000000000..9213a65df9
--- /dev/null
+++ b/layout/generic/crashtests/437565-2.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+ <style>
+ /* Note: The height here is almost nscoord_MAX in app-units */
+ /* Note: The width here needs to be wider than the viewport in order
+ to trigger a crash. */
+ div.tall {
+ height: 17895687px;
+ width: 3000px;
+ background: pink;
+ }
+ div.float { float: left; }
+ div.clear { clear: left; }
+ div.square { width: 10px; height: 10px; }
+ div.blue { background: blue; }
+ div.green { background: green; }
+ div.orange { background: orange; }
+ </style>
+</head>
+<!-- no body (adding a body prevents the crash, for some reason) -->
+ <div class="float"><div class="tall"/><div class="square blue"/></div>
+ <div class="float square green"/>
+ <div><div class="float square orange"/><div class="clear"/></div>
+</html>
diff --git a/layout/generic/crashtests/437565-3.xhtml b/layout/generic/crashtests/437565-3.xhtml
new file mode 100644
index 0000000000..dbcf3f84fb
--- /dev/null
+++ b/layout/generic/crashtests/437565-3.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml"
+><head>
+ <style>
+ /* Note: The height here is almost nscoord_MAX in app-units */
+ /* Note: The width here needs to be wider than the viewport in order
+ to trigger a crash. */
+ div.tall {
+ height: 17895687px;
+ width: 580px;
+ background: pink;
+ }
+ div.float { float: left; }
+ div.clear { clear: left; }
+ div.square { width: 10px; height: 10px; }
+ div.blue { background: blue; }
+ div.green { background: green; }
+ div.orange { background: orange; }
+ </style>
+</head
+><div class="float"><div class="tall"/><div class="square blue"/></div
+><div class="float square green"></div
+><div><div class="float square orange"/><div class="clear"/></div
+></html>
diff --git a/layout/generic/crashtests/438259-1.html b/layout/generic/crashtests/438259-1.html
new file mode 100644
index 0000000000..232531cce5
--- /dev/null
+++ b/layout/generic/crashtests/438259-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div:first-letter { font-size: 7em; }
+
+</style>
+</head>
+
+<body style="width: 3px; float: left;" onload="document.body.style.direction = 'rtl';"><div><br> A B</div></body>
+
+</html>
diff --git a/layout/generic/crashtests/438266-1.html b/layout/generic/crashtests/438266-1.html
new file mode 100644
index 0000000000..1e7bdb84be
--- /dev/null
+++ b/layout/generic/crashtests/438266-1.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("hr").removeAttribute("width");
+
+ document.documentElement.offsetHeight;
+
+ var newTR = document.createElement("tr");
+ document.getElementById("table").appendChild(newTR);
+}
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<table id="table">
+ <tbody>
+ <tr>
+ <td>
+ <div><hr width="7000" id="hr"></div>
+ <div style="column-width: 100px;">x<li></li></div>
+ </td>
+ </tr>
+ </tbody>
+</table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/438509-1.html b/layout/generic/crashtests/438509-1.html
new file mode 100644
index 0000000000..00096020fc
--- /dev/null
+++ b/layout/generic/crashtests/438509-1.html
@@ -0,0 +1,80 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+<style type="text/css">
+
+ div.wrapper { height: 400px; }
+ table { height: 100%; }
+
+</style>
+</head>
+<body>
+ <div class="wrapper">
+ <!-- NOTE: Every layer of "table/td" seems to double the load-time -->
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ <table><td>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </td></table>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/443528-1.html b/layout/generic/crashtests/443528-1.html
new file mode 100644
index 0000000000..524be097f5
--- /dev/null
+++ b/layout/generic/crashtests/443528-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var s = document.getElementById("s");
+ document.body.insertBefore(document.createTextNode("\n "), s);
+ document.body.offsetHeight;
+ s.appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="column-count: 2; font-size: 1500px; white-space: pre-wrap;"><span id="s" style="display: inline-block"></span><div style="height: 100px;"></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/444230-1.html b/layout/generic/crashtests/444230-1.html
new file mode 100644
index 0000000000..5e01623536
--- /dev/null
+++ b/layout/generic/crashtests/444230-1.html
@@ -0,0 +1 @@
+<html><body><span style="padding: 200%; vertical-align: top;">x<br></span></body></html>
diff --git a/layout/generic/crashtests/444484-1.html b/layout/generic/crashtests/444484-1.html
new file mode 100644
index 0000000000..7edc2f6eb5
--- /dev/null
+++ b/layout/generic/crashtests/444484-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style type="text/css">
+
+body:first-letter { float: right; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var t = document.body.firstChild;
+ var se = document.getElementById("se");
+ se.appendChild(t); // !!!
+ document.body.appendChild(se);
+ se.appendChild(document.createTextNode(" "));
+}
+
+</script>
+</head>
+
+<body onload="boom();">&#xFEB7;
+<div id="se" style="display: none;"></div></body>
+</html>
diff --git a/layout/generic/crashtests/444726-1.xhtml b/layout/generic/crashtests/444726-1.xhtml
new file mode 100644
index 0000000000..a266aa7b87
--- /dev/null
+++ b/layout/generic/crashtests/444726-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+</body>
+
+<!-- Intentionally outside of <body> -->
+<div style="margin: 7224850px 0pt; padding-bottom: 6px;"></div><div style="float: right; padding-top: 6px; width: 194px;"></div><div style="float: left; width: 525px;"><li style="margin: 7224850px 0pt;"></li><div>x<div style="margin: 7224850px 0pt;"></div></div>y</div>
+
+</html>
diff --git a/layout/generic/crashtests/444861-1.html b/layout/generic/crashtests/444861-1.html
new file mode 100644
index 0000000000..a11b801156
--- /dev/null
+++ b/layout/generic/crashtests/444861-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("a").style.padding = "4643853%";
+ document.getElementById("a").style.counterIncrement = "a";
+ document.documentElement.offsetHeight;
+ document.getElementById("a").style.width = "1px";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div style="width: 430px;"><div id="a"><img style="float: left; margin-right: 15px; margin-top: 5px;">A B</div><div><li style="width: 45%; float: left;"></li><div style="float: left;"><span style="padding-left: 22px;"></span></div></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/445288.html b/layout/generic/crashtests/445288.html
new file mode 100644
index 0000000000..f183a34cda
--- /dev/null
+++ b/layout/generic/crashtests/445288.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var s = document.createElement("span");
+ document.getElementById("k").appendChild(s);
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="margin: 381500067712% 0pt;">a<div><div style="font-size: 4611686018427388000in;"><hr></div><div style="float: left;">b</div>c</div><div style="height: 197678in;"></div><div id="k" style="float: left;"></div></body>
+</html>
diff --git a/layout/generic/crashtests/448903-1.html b/layout/generic/crashtests/448903-1.html
new file mode 100644
index 0000000000..9a6cad1346
--- /dev/null
+++ b/layout/generic/crashtests/448903-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="padding-left: 33554433em; padding-bottom: 33554433em; width: 20000px; text-decoration: underline; text-shadow: 2px 0px 158.33px green; text-indent: -33554433em;">Z</body>
+</html>
diff --git a/layout/generic/crashtests/448996-1.html b/layout/generic/crashtests/448996-1.html
new file mode 100644
index 0000000000..45dd534b7a
--- /dev/null
+++ b/layout/generic/crashtests/448996-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body { font-family: monospace; width: 10ch; outline: 1px solid black; }
+div { column-width: 0.4px; column-gap: 3ch; }
+b { font-weight: inherit; display: inline-block; }
+#r { border: 1px solid red; }
+#r:before { content: ""; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("r").style.counterReset = "c";
+}
+</script>
+
+</head>
+
+<body onload="boom();"><div>a b c d <span> <b>m</b><span id="r"><b>x</b><span></span></span></span> </div></body>
+
+</html>
diff --git a/layout/generic/crashtests/451315-1.html b/layout/generic/crashtests/451315-1.html
new file mode 100644
index 0000000000..ca2cfeb31f
--- /dev/null
+++ b/layout/generic/crashtests/451315-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="float: right; height: 2px;" onload="document.body.style.width = '0';"><div style="column-count: 3;"><div style="padding: 268435457mm;">A B C D</div></div></body>
+</html>
diff --git a/layout/generic/crashtests/451317-1.html b/layout/generic/crashtests/451317-1.html
new file mode 100644
index 0000000000..d6286b55a6
--- /dev/null
+++ b/layout/generic/crashtests/451317-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div:first-line { }
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("a").style.columnWidth = "21120690815in";
+ document.getElementById("s").style.cursor = "pointer";
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<div id="a">A<div style="padding-top: 1px"> <input> <span id="s"></span></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/451334-1.html b/layout/generic/crashtests/451334-1.html
new file mode 100644
index 0000000000..afd28bc25e
--- /dev/null
+++ b/layout/generic/crashtests/451334-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body onload="document.body.style.columnWidth = '1px';">
+
+<div style="display: inline-block;"></div><div style="float: left;"><div style="height: 32px;"></div></div><div>
+<div style="clear: both;"><br></div><div style="float: left;"></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/452157-1.html b/layout/generic/crashtests/452157-1.html
new file mode 100644
index 0000000000..c1bb428f84
--- /dev/null
+++ b/layout/generic/crashtests/452157-1.html
@@ -0,0 +1,8 @@
+<html>
+<head></head>
+<body>
+
+<div style="float: left; column-count: 3;"><div><div style="margin: 1em 0pt; float: left;"><span style="display: inline-block; width: 16px; height: 16px;"></span></div><div style="margin: 1em 0pt; float: left;"></div><br style="display: inherit; clear: both;"> </div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/452157-2.html b/layout/generic/crashtests/452157-2.html
new file mode 100644
index 0000000000..0dee3e6292
--- /dev/null
+++ b/layout/generic/crashtests/452157-2.html
@@ -0,0 +1,39 @@
+<html>
+<head>
+<style>
+ div.a {
+ column-count: 2;
+ float: left;
+ background: lightblue;
+ }
+ div.b {}
+ div.c {
+ float: left;
+ height: 23px;
+ width: 10px;
+ background: orange;
+ }
+ div.d {
+ float: left;
+ height: 22px;
+ width: 10px;
+ background: green;
+ }
+ div.e {
+ clear: left;
+ }
+</style>
+</head>
+<body
+ ><div class="a"
+ ><div class="b"
+ ><div class="c"
+ ></div
+ ><div class="d"
+ ></div
+ ><div class="e"
+ ></div
+ > <!-- whitespace --></div
+ ></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/452157-3.html b/layout/generic/crashtests/452157-3.html
new file mode 100644
index 0000000000..0e0341c3a0
--- /dev/null
+++ b/layout/generic/crashtests/452157-3.html
@@ -0,0 +1,39 @@
+<html>
+<head>
+<style>
+ div.a {
+ column-count: 2;
+ position: absolute;
+ background: lightblue;
+ }
+ div.b {}
+ div.c {
+ float: left;
+ height: 23px;
+ width: 10px;
+ background: orange;
+ }
+ div.d {
+ float: left;
+ height: 22px;
+ width: 10px;
+ background: green;
+ }
+ div.e {
+ clear: left;
+ }
+</style>
+</head>
+<body
+ ><div class="a"
+ ><div class="b"
+ ><div class="c"
+ ></div
+ ><div class="d"
+ ></div
+ ><div class="e"
+ ></div
+ > <!-- whitespace --></div
+ ></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/453762-1.html b/layout/generic/crashtests/453762-1.html
new file mode 100644
index 0000000000..f7d302b5f7
--- /dev/null
+++ b/layout/generic/crashtests/453762-1.html
@@ -0,0 +1,4 @@
+<html style="text-indent: 3700px;">
+<head></head>
+<body><span style="position: relative;"> <div style="position: absolute;"></div></span></body>
+</html>
diff --git a/layout/generic/crashtests/455171-1.html b/layout/generic/crashtests/455171-1.html
new file mode 100644
index 0000000000..97bc98c7a7
--- /dev/null
+++ b/layout/generic/crashtests/455171-1.html
@@ -0,0 +1,5 @@
+<html style="-moz-transform: translate(50px);">
+<head>
+<style>html::after { content:"b"; position: fixed;}</style>
+</head>
+<body></body></html>
diff --git a/layout/generic/crashtests/455171-2.html b/layout/generic/crashtests/455171-2.html
new file mode 100644
index 0000000000..a8a11ad4cc
--- /dev/null
+++ b/layout/generic/crashtests/455171-2.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body>
+<div style="-moz-transform: translate(50px, 50px);"><div style="position: fixed;"></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/455171-3.html b/layout/generic/crashtests/455171-3.html
new file mode 100644
index 0000000000..e463d2b607
--- /dev/null
+++ b/layout/generic/crashtests/455171-3.html
@@ -0,0 +1,2 @@
+<div style="-moz-transform: scale(2);">
+<iframe style="position: fixed;">
diff --git a/layout/generic/crashtests/455643-1.xhtml b/layout/generic/crashtests/455643-1.xhtml
new file mode 100644
index 0000000000..f60e6cddef
--- /dev/null
+++ b/layout/generic/crashtests/455643-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("k").style.position = "fixed";
+ document.documentElement.offsetHeight;
+ document.getElementById("g").style.textAlign = "";
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<div style="text-align: right;" id="g"><div style="direction: rtl; max-width: -moz-fit-content;"><div style="column-width: 1px;">A B<hr/>C D <input/><hr/></div><div id="k"><div style="width: 150px; float: right;"/><div style="width: 100px; float: right;"/></div><div style="padding-left: 40px;"/></div></div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/457375.html b/layout/generic/crashtests/457375.html
new file mode 100644
index 0000000000..ccf7fc86a1
--- /dev/null
+++ b/layout/generic/crashtests/457375.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="column-width: 1px;" onload="document.getElementById('v').style.height = '0';"><div id="v"><span>A B&#0;</span><span>C</span><span> D</span></div></body>
+</html>
diff --git a/layout/generic/crashtests/457380-1.html b/layout/generic/crashtests/457380-1.html
new file mode 100644
index 0000000000..9029618ae1
--- /dev/null
+++ b/layout/generic/crashtests/457380-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.documentElement.style.columnCount = '3';
+ document.documentElement.offsetHeight;
+ document.documentElement.style.columnCount = '';
+}
+
+</script>
+
+<style type="text/css">
+
+html:before { content: '0'; }
+
+</style>
+
+</head>
+
+<frameset onload="boom();"></frameset>
+
+</html>
diff --git a/layout/generic/crashtests/459968.html b/layout/generic/crashtests/459968.html
new file mode 100644
index 0000000000..1028e0e857
--- /dev/null
+++ b/layout/generic/crashtests/459968.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+body {
+ white-space: pre;
+ word-spacing: 511pc;
+}
+
+#a {
+ float: right;
+}
+
+#b {
+ position: fixed;
+ white-space: pre-line;
+ direction: rtl;
+ letter-spacing: 0pt;
+}
+
+</style>
+</head>
+
+<body onload="document.body.style.letterSpacing = '';" style="letter-spacing: 1152921504606847000em;"><div id="a"><div id="b">
+
+. .
+ 0. 0.
+.
+
+ </div>
+ </div></body>
+</html>
diff --git a/layout/generic/crashtests/460910-1.xml b/layout/generic/crashtests/460910-1.xml
new file mode 100644
index 0000000000..268deef64f
--- /dev/null
+++ b/layout/generic/crashtests/460910-1.xml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<style type="text/css">
+
+[class~='t'] { display: table; }
+
+</style>
+</head>
+<body>
+
+<m:math><m:math class="t"/></m:math>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/461294-1.html b/layout/generic/crashtests/461294-1.html
new file mode 100644
index 0000000000..9d6c7145cc
--- /dev/null
+++ b/layout/generic/crashtests/461294-1.html
@@ -0,0 +1 @@
+<html style="display: inline-table;"><body style="margin: 381500067712% 0pt;">T<div><span style="font-size: 4611686018427388000in;"><hr></span><span style="float: left;">P</span>,</div><div style="min-height: 197678in;"></div><span style="float: left;"></span></body></html>
diff --git a/layout/generic/crashtests/462968.xhtml b/layout/generic/crashtests/462968.xhtml
new file mode 100644
index 0000000000..f4303593b5
--- /dev/null
+++ b/layout/generic/crashtests/462968.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body onload="var td = document.getElementById('td'); td.parentNode.removeChild(td);">
+
+<div style="column-count: 2;"><div style="padding: 881977875840684in 0pt;"><span style="padding: 0pt 881977875840684in;"><div style="padding-top: 881977875840684in; clear: both;"></div><span><div><td id="td"></td></div></span></span></div></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/463350-1.html b/layout/generic/crashtests/463350-1.html
new file mode 100644
index 0000000000..08df71fdd0
--- /dev/null
+++ b/layout/generic/crashtests/463350-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("select").appendChild(document.createElement("span"));
+ document.documentElement.offsetHeight;
+ document.getElementById("z").appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="column-count: 2; height: 72496331mm;"><fieldset><span id="z"><div><div></div></div><select id="select"></select></span></fieldset></body>
+</html>
diff --git a/layout/generic/crashtests/463350-2.html b/layout/generic/crashtests/463350-2.html
new file mode 100644
index 0000000000..ec457eb8cc
--- /dev/null
+++ b/layout/generic/crashtests/463350-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("select").appendChild(document.createElement("span"));
+ document.documentElement.offsetHeight;
+ document.getElementById("z").appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="column-count: 2; height: 0;"><fieldset><span id="z"><div><div></div></div><select id="select"></select></span></fieldset></body>
+</html>
diff --git a/layout/generic/crashtests/463350-3.html b/layout/generic/crashtests/463350-3.html
new file mode 100644
index 0000000000..cd3b1c8c1c
--- /dev/null
+++ b/layout/generic/crashtests/463350-3.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("select").appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+
+<body onload="setTimeout('boom()', 500);" style="column-count: 2; height: 0;"><fieldset><span id="z"><div><div></div></div><select id="select"></select></span></fieldset></body>
+</html>
diff --git a/layout/generic/crashtests/463741-1.html b/layout/generic/crashtests/463741-1.html
new file mode 100644
index 0000000000..9a7931cf32
--- /dev/null
+++ b/layout/generic/crashtests/463741-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html style="width: 1px;">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.documentElement.appendChild(document.body);
+ document.documentElement.offsetHeight;
+ var v = document.getElementById("v");
+ v.remove();
+ var w = document.createElement("span");
+ document.body.insertBefore(w, document.body.lastChild);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div></div><div style="height: 1px;"><span><div id="v"></div></span><div style="column-count: 2;">A<div style="margin: 67108863ch 0pt;">B</div><div>C</div></div></div><span></span></body>
+</html>
diff --git a/layout/generic/crashtests/465651-1.html b/layout/generic/crashtests/465651-1.html
new file mode 100644
index 0000000000..0df38394d7
--- /dev/null
+++ b/layout/generic/crashtests/465651-1.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+<head>
+
+<style type="text/css">
+
+.contain {
+ height: 10px;
+ margin: 2px 3px;
+ padding-top: 1px;
+}
+.fl {
+ float: left;
+ width: 4px;
+ height: 5px;
+}
+.fr {
+ float: right;
+ width: 5px;
+ height: 5px;
+}
+
+</style>
+
+</head>
+
+<body>
+ <div style="width: 41px; column-count: 3;">
+ <div class="contain"></div>
+ <div class="contain"></div>
+ <div class="fl"></div>
+ <div class="fl"></div>
+ <div class="fr"></div>
+ <div></div>
+ <div class="fr"></div>
+ <div class="contain"><div class="fl"></div></div>
+ <div class="contain" style="float: left;"></div>
+ <div class="fl"></div>
+ <div class="fr"></div>
+ <div class="contain"><div class="fl"></div><div class="fr"></div></div>
+ <div class="fl"></div>
+ <div class="fr"></div>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/467137-1.html b/layout/generic/crashtests/467137-1.html
new file mode 100644
index 0000000000..0414baccd2
--- /dev/null
+++ b/layout/generic/crashtests/467137-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function z()
+{
+ var q = document.getElementById("q");
+
+ for (var r = 0; r < 100; ++r) {
+ // dump(r + "\n");
+ q.style.width = r + "px";
+ document.documentElement.offsetHeight;
+ }
+}
+
+</script>
+</head>
+<body onload="z();">
+
+<div style="font-family: monospace;" id="q"><div id="w" style="word-spacing: 1px">AAA <span style="white-space: pre-line; font-weight: 500;">BB C
+ </span></div></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/467213-1.html b/layout/generic/crashtests/467213-1.html
new file mode 100644
index 0000000000..b9ea48e08b
--- /dev/null
+++ b/layout/generic/crashtests/467213-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body>
+
+<div style="direction: rtl;"><span style="direction: ltr;"><div></div><span style="position: absolute;"></span><span style="display: -moz-box;"></span></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/467487-1.html b/layout/generic/crashtests/467487-1.html
new file mode 100644
index 0000000000..f6830a4a14
--- /dev/null
+++ b/layout/generic/crashtests/467487-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('y').style.width = '8000px';">
+
+<div style="white-space: pre-line;"><div id="y"><div style="text-align: justify; font-size: 3300%;">AB CDEF
+ </div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/467493-1.html b/layout/generic/crashtests/467493-1.html
new file mode 100644
index 0000000000..1dc7d3cec9
--- /dev/null
+++ b/layout/generic/crashtests/467493-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body>
+<div style="column-count: 15; overflow-y: hidden;"><div><div style="clear: both; margin: 144115188075855870cm"><li></li></div><div style="position: fixed;"></div></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/467493-2.html b/layout/generic/crashtests/467493-2.html
new file mode 100644
index 0000000000..bb4d9d10da
--- /dev/null
+++ b/layout/generic/crashtests/467493-2.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head><style>
+ div.a {
+ column-count: 2;
+ overflow-y: hidden;
+ background: yellow;
+ }
+ div.b {
+ background: orange;
+ clear: both;
+ margin-top: 946982.46874999995cm;
+ }
+ div.c {
+ position: fixed;
+ background: red;
+ }
+</style></head>
+<body
+ ><div class="a"><div
+ ><div class="b"><li></li></div
+ ><div class="c"></div
+ ></div></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/467875-1.xhtml b/layout/generic/crashtests/467875-1.xhtml
new file mode 100644
index 0000000000..b805a30a97
--- /dev/null
+++ b/layout/generic/crashtests/467875-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+<span style="direction: rtl;">
+ <span style="display: -moz-box"/>
+ <span style="position: fixed;"/>
+ <span style="display: -moz-box"/>
+</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/467914-1.html b/layout/generic/crashtests/467914-1.html
new file mode 100644
index 0000000000..1066a6c8a7
--- /dev/null
+++ b/layout/generic/crashtests/467914-1.html
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML">
+<mathml:munder style="-moz-transform: translate(50px);clip-path: url(#h);"/>
+</window>
diff --git a/layout/generic/crashtests/468207-1.html b/layout/generic/crashtests/468207-1.html
new file mode 100644
index 0000000000..d462211011
--- /dev/null
+++ b/layout/generic/crashtests/468207-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body><div style="column-width: 1px;"><div style="height: 5em;"><div style="height: 1em;"></div><div style="height: 5em; float: right;"></div></div><div style="height: 1em;"></div><div style="float: right;"></div><div style="float: left; height: 5em;"></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/468771-1.xhtml b/layout/generic/crashtests/468771-1.xhtml
new file mode 100644
index 0000000000..9f4462f922
--- /dev/null
+++ b/layout/generic/crashtests/468771-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var newTD = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+ newTD.setAttribute("rowspan", 3);
+ document.getElementById("tr1").appendChild(newTD);
+
+ document.documentElement.offsetHeight;
+
+ var newTR = document.createElementNS("http://www.w3.org/1999/xhtml", "tr");
+ document.getElementById("table").appendChild(newTR);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<table id="table">AAAA<tr id="tr1"></tr><tr><td><div style="column-width: 1px;">B C</div></td></tr></table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/468771-2.xhtml b/layout/generic/crashtests/468771-2.xhtml
new file mode 100644
index 0000000000..f81560e4bd
--- /dev/null
+++ b/layout/generic/crashtests/468771-2.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var newTD = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+ newTD.setAttribute("rowspan", 3);
+ document.getElementById("tr1").appendChild(newTD);
+}
+
+</script>
+
+</head>
+
+<body onload="boom();">
+
+<table id="table" border="1">AAAA<tr id="tr1"></tr><tr><td><div style="column-width: 1px;">B C</div></td></tr></table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/469859-1.xhtml b/layout/generic/crashtests/469859-1.xhtml
new file mode 100644
index 0000000000..b23eb7f688
--- /dev/null
+++ b/layout/generic/crashtests/469859-1.xhtml
@@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style id="ss" type="text/css">
+
+#o {
+ height: 65px;
+}
+
+</style>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("ss").disabled = true;
+ document.documentElement.offsetHeight;
+ document.getElementById("ss").disabled = false;
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<div style="column-width: 0;">
+ <colgroup></colgroup>
+ <div>
+ <div id="o" style="float: left;"></div>
+ <div style="clear: both;">A B<div style="float: left;"></div></div>
+ </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/471360.html b/layout/generic/crashtests/471360.html
new file mode 100644
index 0000000000..6beb5e5c80
--- /dev/null
+++ b/layout/generic/crashtests/471360.html
@@ -0,0 +1,61 @@
+<html>
+<head>
+<script type="text/javascript">
+
+var ta, f, tb, s, tc;
+var i = 0;
+
+// This test loops repeatedly through its "boom" functions. We place an upper
+// bound on how many loops we'll allow, in case the repeated mutations/paints
+// block the test harness from considering the test to be done.
+var loopCount = 0;
+const maxLoopCount = 20;
+
+function boom1()
+{
+ var r = document.body;
+ while(r.firstChild)
+ r.removeChild(r.firstChild);
+
+ ta = document.createTextNode("A \u06cc");
+ (document.body).appendChild(ta);
+ f = document.createElement("IFRAME");
+ f.style.height = "15em";
+ f.src = "data:text/html," + "Iteration " + ++i;
+ (document.body).appendChild(f);
+ tb = document.createTextNode(" B ");
+ (document.body).appendChild(tb);
+ s = document.createElement("span");
+ s.id = "s";
+ tc = document.createTextNode(" C ");
+ (document.body).appendChild(s);
+ s.appendChild(tc);
+
+ setTimeout(boom2, 10);
+}
+
+function boom2()
+{
+ var w = document.createElement("style");
+ w.setAttribute("type", "text/css");
+ w.appendChild(document.createTextNode("body { column-gap: 1px; column-width: 1px; }"));
+ document.body.appendChild(w);
+
+ setTimeout(boom3, 10);
+}
+
+function boom3()
+{
+ ta.data = " E " + ta.data;
+ document.body.removeChild(s);
+
+ if (++loopCount < maxLoopCount) {
+ setTimeout(boom1, 10);
+ }
+}
+
+</script>
+</head>
+
+<body onload="boom1();"></body>
+</html>
diff --git a/layout/generic/crashtests/472587-1.xhtml b/layout/generic/crashtests/472587-1.xhtml
new file mode 100644
index 0000000000..aa29f93fff
--- /dev/null
+++ b/layout/generic/crashtests/472587-1.xhtml
@@ -0,0 +1,28 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var m = document.getElementById("m");
+ m.parentNode.removeChild(m);
+ document.getElementById("s").appendChild(document.createTextNode("c"));
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<m:mrow>
+ <span>
+ <m:msup id="m"/>
+ <div style="column-width: 1px;">
+ <m:munderover/>
+ <m:msqrt/>
+ </div>
+ </span>
+ <span id="s"></span>
+</m:mrow>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/472617-1.xhtml b/layout/generic/crashtests/472617-1.xhtml
new file mode 100644
index 0000000000..98af731c6f
--- /dev/null
+++ b/layout/generic/crashtests/472617-1.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head></head>
+<body style="column-width: 2351490cm;"><div style="height: 0;"><xul:hbox/><xul:button/><span style="float: right;"/></div><xul:button/><div/><span style="float: right;"/></body>
+</html>
diff --git a/layout/generic/crashtests/472774-1.html b/layout/generic/crashtests/472774-1.html
new file mode 100644
index 0000000000..5899593d53
--- /dev/null
+++ b/layout/generic/crashtests/472774-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<style id="ss" type="text/css">
+
+div div:first-letter { font-size: 0%; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("ss").textContent = "div div { height: 1px; }";
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<div style="column-width: 1px; word-wrap: break-word;"><div>ABCDE</div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/472776-1.html b/layout/generic/crashtests/472776-1.html
new file mode 100644
index 0000000000..be9a6a92d6
--- /dev/null
+++ b/layout/generic/crashtests/472776-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var v = document.getElementById("v");
+ v.childNodes[1].firstChild.data = "";
+ document.documentElement.offsetHeight;
+ v.appendChild(document.createTextNode("D"));
+ v.firstChild.remove();
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="v"><span>A</span><span>&#x06CC;C</span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/472950-1.html b/layout/generic/crashtests/472950-1.html
new file mode 100644
index 0000000000..cd2a49aa3d
--- /dev/null
+++ b/layout/generic/crashtests/472950-1.html
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>div::first-letter { color: green; }</style>
+<script>
+
+function boom()
+{
+ var e = document.getElementById("e");
+ document.documentElement.style.direction = "rtl";
+ e.style.whiteSpace = "pre";
+}
+
+</script>
+</head>
+<body onload="boom();">
+
+<div><span style="direction: rtl;" id="e"><span>
+
+ </span>A B</span></div>
+
+</body></html></html>
diff --git a/layout/generic/crashtests/473278-1.xhtml b/layout/generic/crashtests/473278-1.xhtml
new file mode 100644
index 0000000000..c4aa34d6bc
--- /dev/null
+++ b/layout/generic/crashtests/473278-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head></head><body><mmultiscripts xmlns="http://www.w3.org/1998/Math/MathML" style="clip-path: url(#q); -moz-transform: translate(100px, 100px);"/></body></html>
diff --git a/layout/generic/crashtests/473894-1.html b/layout/generic/crashtests/473894-1.html
new file mode 100644
index 0000000000..dd4561d6fb
--- /dev/null
+++ b/layout/generic/crashtests/473894-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="margin: -10000px">X</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/476241-1.html b/layout/generic/crashtests/476241-1.html
new file mode 100644
index 0000000000..bb20efcb9f
--- /dev/null
+++ b/layout/generic/crashtests/476241-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><body><div style="column-gap: 1px; column-width: 1px;"><div style="column-width: 1px;"><div><div style="margin: 15000px 0pt; column-width: 1px;"><div style="height: 1px;">G P X<br style="margin: 15000px 0pt;"></div></div><div style="padding: 10px; height: 200px;"></div></div> </div><br style="margin: 15000px 0pt;"></div></body></html>
diff --git a/layout/generic/crashtests/477731-1.html b/layout/generic/crashtests/477731-1.html
new file mode 100644
index 0000000000..99b02b8657
--- /dev/null
+++ b/layout/generic/crashtests/477731-1.html
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">body:first-letter { float: left; }</style>
+</head>
+<body style="column-width: 100000px;" onload="document.body.style.columnWidth='';"> &#x08D9;</body>
+</html>
diff --git a/layout/generic/crashtests/477928.html b/layout/generic/crashtests/477928.html
new file mode 100644
index 0000000000..b412178520
--- /dev/null
+++ b/layout/generic/crashtests/477928.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("a").appendChild(document.createTextNode("\n"));
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="a" style="max-width: max-content; column-count: 2;"><span style="white-space: pre-line;"><span>
+</span>
+</span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/478131-1.html b/layout/generic/crashtests/478131-1.html
new file mode 100644
index 0000000000..adce95284b
--- /dev/null
+++ b/layout/generic/crashtests/478131-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style id="s"></style>
+</head>
+<body onload="document.getElementById('s').textContent = '* { font-size: 8193%; }';" style="column-count: 2;"><div><div>A B C</div></div><div><p>D E F</p></div><p>G H I</p><div><p>.</p></div> <p>J K L</p></body>
+</html>
diff --git a/layout/generic/crashtests/478170-1.html b/layout/generic/crashtests/478170-1.html
new file mode 100644
index 0000000000..1c5a3ed3f7
--- /dev/null
+++ b/layout/generic/crashtests/478170-1.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<script type="text/javascript">
+function bounce()
+{
+ var b = document.body;
+ var dE = document.documentElement;
+ dE.removeChild(b);
+ dE.offsetHeight;
+ dE.appendChild(b)
+}
+</script>
+</head>
+<body onload="bounce();">
+<table><tbody><tr><td><div style="column-count: 2;"><div><span style="font-size: 91735350in;"><table><tbody><tr><td></td></tr></tbody></table><div><p><select></select></p><table><tbody><tr><td></td></tr></tbody></table></div></span></div><div style="height: 300px;"></div></div></td></tr></tbody><thead></thead></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/478185-1.html b/layout/generic/crashtests/478185-1.html
new file mode 100644
index 0000000000..708447edfe
--- /dev/null
+++ b/layout/generic/crashtests/478185-1.html
@@ -0,0 +1,61 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+#v {
+ column-count: 2;
+ direction: rtl;
+ white-space: pre-wrap;
+ word-wrap: break-word;
+ text-transform: capitalize;
+ letter-spacing: 163851344580570600em;
+}
+
+#v:first-letter { }
+
+</style>
+</head>
+
+<body>
+<div id="v">
+
+#xxx {
+ xxxxxxxx: xxxxxxxx;
+ xxxxxxxxxx-xxxxx: xxxx;
+ xxx: xxxx;
+ xxxx: xxxx;
+ xxxxx: xxxxx;
+ xxxxxx: xxxxx;
+}
+
+#xxxxx {
+ xxxxxxxx: xxxxxxxx;
+ xxxxxxxxxx-xxxxx: xxxx;
+ xxx: xxxx;
+ xxxxx: xxxx;
+ xxxxx: xxxx;
+ xxxxxx: xxxxx;
+}
+
+#xxxx {
+ xxxxxxxx: xxxxxxxx;
+ xxxxxxxxxx-xxxxx: xxxx;
+ xxxx: xxxx;
+ xxxxxx: xxxx;
+ xxxxx: xxxxx;
+ xxxxxx: xxxx;
+}
+
+#xxxxxx {
+ xxxxxxxx: xxxxxxxx;
+ xxxxxxxxxx-xxxxx: xxxx;
+ xxxxx: xxxx;
+ xxxxx: xxxx;
+ xxxxxx: xxxx;
+ xxxxxx: xxxx;
+}
+
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/478504.html b/layout/generic/crashtests/478504.html
new file mode 100644
index 0000000000..549c4cf443
--- /dev/null
+++ b/layout/generic/crashtests/478504.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+var t;
+
+function a()
+{
+ if (t) document.body.removeChild(t);
+
+ t = document.createTextNode("");
+ document.body.appendChild(t);
+ t.data += "ab\u06CD";
+
+ setTimeout(b, 1);
+}
+
+function b()
+{
+ document.documentElement.offsetHeight;
+ t.data = "d";
+ t.data += " ";
+
+ setTimeout(a, 1);
+}
+
+
+</script>
+</head>
+<body onload="a();">
+</body>
+</html>
diff --git a/layout/generic/crashtests/479938-1.html b/layout/generic/crashtests/479938-1.html
new file mode 100644
index 0000000000..d92fd193fa
--- /dev/null
+++ b/layout/generic/crashtests/479938-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("x").style.padding = "67108863pc";
+ setTimeout(boom2, 0);
+}
+
+function boom2()
+{
+ document.body.removeChild(document.getElementById("colset"));
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();"> <div style="column-count: 2;" id="colset"><div style="height: 1px;"><div id="x"><div style="width: 1px;">A B C D</div></div></div></div> </body>
+
+</html>
diff --git a/layout/generic/crashtests/480345-1.html b/layout/generic/crashtests/480345-1.html
new file mode 100644
index 0000000000..187467d618
--- /dev/null
+++ b/layout/generic/crashtests/480345-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged">
+<body style="background:url(solidblue.png); position:absolute; height:40in;">
+</body>
+</html>
diff --git a/layout/generic/crashtests/481921-iframe.html b/layout/generic/crashtests/481921-iframe.html
new file mode 100644
index 0000000000..d83310d6f0
--- /dev/null
+++ b/layout/generic/crashtests/481921-iframe.html
@@ -0,0 +1,12 @@
+<html>
+ <body onload="dotest(); setTimeout('location.reload()', 200)">
+ <script language="javascript">
+ var count=0;
+ var fileloc = "481921.ogg";
+ function dotest(){
+ oggenv.innerHTML = "video test for " + fileloc + "<br><video src=\"" + fileloc + "\" autoplay=\"true\" height=100></video>";
+ }
+ </script>
+ <span id="oggenv"></span><br>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/481921.html b/layout/generic/crashtests/481921.html
new file mode 100644
index 0000000000..60dd53169c
--- /dev/null
+++ b/layout/generic/crashtests/481921.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function done()
+{
+ document.documentElement.removeAttribute("class");
+ document.body.innerHTML=''
+}
+
+setTimeout(done,800)
+</script>
+</head>
+
+<body>
+
+<iframe id="iframe" src="481921-iframe.html"></iframe>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/481921.ogg b/layout/generic/crashtests/481921.ogg
new file mode 100644
index 0000000000..0c41c3cd6b
--- /dev/null
+++ b/layout/generic/crashtests/481921.ogg
Binary files differ
diff --git a/layout/generic/crashtests/489462-1.html b/layout/generic/crashtests/489462-1.html
new file mode 100644
index 0000000000..5a57647ece
--- /dev/null
+++ b/layout/generic/crashtests/489462-1.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.body.style.whiteSpace = "";
+ document.getElementById("b").style.direction = "";
+}
+
+</script>
+
+<style type="text/css">
+
+#c:first-letter { font-size-adjust: 8388609; }
+
+</style>
+</head>
+
+<body onload="boom();" style="white-space: pre;"><div id="b" style="direction: rtl;"><div id="c">Qqq Rrr Sss.</div></div></body>
+</html>
diff --git a/layout/generic/crashtests/489477.html b/layout/generic/crashtests/489477.html
new file mode 100644
index 0000000000..6af934204d
--- /dev/null
+++ b/layout/generic/crashtests/489477.html
@@ -0,0 +1,21 @@
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.execCommand("selectAll", false, null);
+ document.execCommand("formatBlock", false, "<h5>");
+ document.execCommand("justifyfull", false, null);
+ document.execCommand("indent", false, null);
+ document.execCommand("outdent", false, null);
+ document.getElementById("q").appendChild(document.createTextNode('v'));
+ document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="width: 800px; column-count: 4;"><div contenteditable="true" style="height: 80px;"><div><div><hr><span> </span></div></div></div><div id="q" style="height: 80px;"><div style="float: left; height: 10px; width: 10px;"></div><div style="padding: 180px; column-count: 1; column-count: 1; clear: right;"></div></div></body>
+</html>
+
diff --git a/layout/generic/crashtests/489480-1.xhtml b/layout/generic/crashtests/489480-1.xhtml
new file mode 100644
index 0000000000..c7d48ec3e8
--- /dev/null
+++ b/layout/generic/crashtests/489480-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="column-count: 2; width: 0pt;"><body style="height: 5003810179.579391in;"><br/><div style="direction: rtl;"><select style="float: right;"></select><option style="width: 0.6600934846211504px; margin: 22367196.5776782cm;"><option style="column-count: 2;"></option></option></div></body></html>
diff --git a/layout/generic/crashtests/489647-1.html b/layout/generic/crashtests/489647-1.html
new file mode 100644
index 0000000000..aa048d364b
--- /dev/null
+++ b/layout/generic/crashtests/489647-1.html
@@ -0,0 +1,13 @@
+<html class="reftest-wait"><head><title> Bug 489647 - New 1.9.0.9 topcrash [@nsTextFrame::ClearTextRun()]</title></head>
+<body>
+<div id="a" style="white-space: pre;">
+m</div>
+<script>
+function doe() {
+ document.getElementById('a').childNodes[0].splitText(1);
+ document.documentElement.className = "";
+}
+setTimeout(doe, 100);
+</script>
+</body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/493111-1.html b/layout/generic/crashtests/493111-1.html
new file mode 100644
index 0000000000..f851074d65
--- /dev/null
+++ b/layout/generic/crashtests/493111-1.html
@@ -0,0 +1,22 @@
+<!DOCTYPE HTML>
+<html>
+ <head>
+ <script type="application/javascript">
+ function onLoad() {
+ var text = document.getElementById("text").firstChild;
+ var sel = window.getSelection();
+ var r1 = document.createRange();
+ r1.setStart(text, 0);
+ r1.setEnd(text, 5);
+ sel.addRange(r1);
+ var r2 = document.createRange();
+ r2.setStart(text, 4);
+ r2.setEnd(text, 9);
+ sel.addRange(r2);
+ }
+ </script>
+ </head>
+ <body onload="onLoad();">
+ <p id="text">Adding overlapping ranges to a selection shouldn't assert</p>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/493118-1.html b/layout/generic/crashtests/493118-1.html
new file mode 100644
index 0000000000..257fcf8478
--- /dev/null
+++ b/layout/generic/crashtests/493118-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml" style="column-count: 2;">
+<body style="padding: 731563462617733px; height: 10px;">
+<div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/493649.html b/layout/generic/crashtests/493649.html
new file mode 100644
index 0000000000..65ce723dde
--- /dev/null
+++ b/layout/generic/crashtests/493649.html
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="position: fixed; column-count: 3; white-space: pre;"><body style="height: 0pt;">
+
+
+
+</body></html>
diff --git a/layout/generic/crashtests/494283-1.xhtml b/layout/generic/crashtests/494283-1.xhtml
new file mode 100644
index 0000000000..68a2406b38
--- /dev/null
+++ b/layout/generic/crashtests/494283-1.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="position: absolute; display: table;">
+<head><style>span:before { content: '1' }</style></head>
+<body onload="document.documentElement.style.display = '';document.documentElement.offsetHeight;"><div style="position: absolute;"></div><span></span></body>
+</html>
diff --git a/layout/generic/crashtests/494283-2.html b/layout/generic/crashtests/494283-2.html
new file mode 100644
index 0000000000..86fc1e7908
--- /dev/null
+++ b/layout/generic/crashtests/494283-2.html
@@ -0,0 +1,6 @@
+<body>
+ <fieldset id="x"><legend>longlonglong</legend></fieldset>
+ <script>
+ var x = document.getElementById("x");
+ x.insertBefore(document.createTextNode("aa"), x.firstChild);
+ </script>
diff --git a/layout/generic/crashtests/494332-1.html b/layout/generic/crashtests/494332-1.html
new file mode 100644
index 0000000000..3ab4b71c07
--- /dev/null
+++ b/layout/generic/crashtests/494332-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+<body>
+<div style="width: 1ch;"><div style="height: 2em;">1 2<div style="float: left; padding: 0pt 1px; display: list-item;"></div></div><span></span> g h i</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/495875-1.html b/layout/generic/crashtests/495875-1.html
new file mode 100644
index 0000000000..054475464b
--- /dev/null
+++ b/layout/generic/crashtests/495875-1.html
@@ -0,0 +1,7 @@
+<html>
+<head></head>
+<body style="column-count: 2; white-space: pre-wrap; font-size-adjust: 4294967297; text-transform: uppercase;"
+ onload="document.body.style.fontSizeAdjust = '';"
+>&#xD558;A B C&#x0643;&#x5599;D
+
+</body></html>
diff --git a/layout/generic/crashtests/495875-2.html b/layout/generic/crashtests/495875-2.html
new file mode 100644
index 0000000000..72dd9f733c
--- /dev/null
+++ b/layout/generic/crashtests/495875-2.html
@@ -0,0 +1,7 @@
+<html>
+<head></head>
+<body style="column-count: 2; white-space: pre-wrap; font-size-adjust: 4294967297; text-transform: uppercase;"
+ onload="document.body.style.fontSizeAdjust = '';"
+>&#xD558;A B C<b>&#x0443;</b>&#x5599;D
+
+</body></html>
diff --git a/layout/generic/crashtests/496742.html b/layout/generic/crashtests/496742.html
new file mode 100644
index 0000000000..e693b2663f
--- /dev/null
+++ b/layout/generic/crashtests/496742.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+<title>Crash [@ nsHTMLReflowState::GetHypotheticalBoxContainer] with position: fixed, float right</title>
+</head>
+<body>
+<iframe src="data:text/html;charset=utf-8,%3Cspan%3E%0Am%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20%0Am%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20%0Am%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20%0Am%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20m%20%0A%3Cspan%20style%3D%22position%3A%20fixed%3B%20float%3A%20right%3B%22%3E%3C/span%3E%0A%3C/span%3E%0A%0A%3Cscript%3E%0Afunction%20toggleIframe%28%29%7B%0Avar%20x%3Dwindow.frameElement%3B%0Ax.style.display%20%3D%20x.style.display%20%3D%3D%20%27none%27%20%3F%20x.style.display%20%3D%20%27%27%20%3A%20x.style.display%20%3D%20%27none%27%3B%0AsetTimeout%28toggleIframe%2C100%29%3B%0A%7D%0AsetTimeout%28toggleIframe%2C100%29%3B%0A%3C/script%3E"></iframe>
+<script>
+
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/499138-iframe.html b/layout/generic/crashtests/499138-iframe.html
new file mode 100644
index 0000000000..6dc03dfdbd
--- /dev/null
+++ b/layout/generic/crashtests/499138-iframe.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+
+</head>
+<body onload="document.getElementById('a').removeAttribute('style');setTimeout(function() {window.location.reload()}, 500);">
+<div style="overflow: scroll; position: absolute; column-count: 2;">
+
+<div style="position: absolute;">
+<input id="a" style="position: absolute;" type="radio">
+<object>
+ &#1593; m &#1593; m &#1593; m &#1593; m &#1593; m &#1593; m
+<ul> &#1593; m &#1593; m &#1593; m</ul>
+</object>
+</div>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/499138.html b/layout/generic/crashtests/499138.html
new file mode 100644
index 0000000000..7e7d84dfa0
--- /dev/null
+++ b/layout/generic/crashtests/499138.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+ <meta charset="utf-8">
+ <title>Testcase for bug 499138</title>
+<script>
+function done()
+{
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<body onload="setTimeout(done,1000)">
+
+<iframe src="499138-iframe.html"></iframe>
+
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/499857-1.html b/layout/generic/crashtests/499857-1.html
new file mode 100644
index 0000000000..458154c5a8
--- /dev/null
+++ b/layout/generic/crashtests/499857-1.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+<head>
+<style type="text/css">
+
+#relleft {
+ float: left;
+ width: 290px;
+ margin: 15px 0 0 0;
+}
+
+#fl:first-line { }
+
+#cols { column-width: 4503599627370497mm; }
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ document.getElementById("x").setAttribute("id", "cols");
+ document.getElementById("fl").firstChild.splitText(1);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<div id="x"><div id="relleft"></div><div id="fl">
+a b c d</div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/499862-1.html b/layout/generic/crashtests/499862-1.html
new file mode 100644
index 0000000000..eb614cbd07
--- /dev/null
+++ b/layout/generic/crashtests/499862-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<style>
+body::first-letter { float: left; }
+</style>
+</head>
+<body style="text-transform: capitalize;">T</body>
+</html>
diff --git a/layout/generic/crashtests/501535-1.html b/layout/generic/crashtests/501535-1.html
new file mode 100644
index 0000000000..8daabfb0d6
--- /dev/null
+++ b/layout/generic/crashtests/501535-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE HTML>
+<html>
+<body onload="document.getElementById('a').setAttribute('poster', '#');">
+<audio controls id="a">
+</body>
+</html>
diff --git a/layout/generic/crashtests/503961-1.xhtml b/layout/generic/crashtests/503961-1.xhtml
new file mode 100644
index 0000000000..a3a3f0d926
--- /dev/null
+++ b/layout/generic/crashtests/503961-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+ #colset { column-count: 3; }
+ #a { height: 0px; }
+ #b { height: 2px; }
+ #c { height: 1px; }
+ #d { height: 2px; }
+ #e { height: 2px; }
+</style>
+<script type="text/javascript">
+function boom()
+{
+ document.getElementById("a").style.height = "auto";
+ document.getElementById("d").style.height = "auto";
+}
+</script>
+</head>
+<body onload="boom();"
+ ><div id="colset"
+ ><div id="a"><div id="b"/></div
+ ><div id="c"><div id="d"/><div id="e"/></div
+ ></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/503961-2.html b/layout/generic/crashtests/503961-2.html
new file mode 100644
index 0000000000..a2ff11c742
--- /dev/null
+++ b/layout/generic/crashtests/503961-2.html
@@ -0,0 +1,32 @@
+<html>
+<head>
+ <style>
+ #colset { column-count: 3; }
+ #a { height: 0; }
+ #x { height: 3px; }
+ #b { height: 0; }
+ #c { height: 2px; }
+ #d { height: 2px; }
+
+ /* Following style is just for visualization -- doesn't affect assertion */
+ #colset { column-gap: 0px; width: 18px; }
+ div { width: 5px; }
+ #a { background: purple; }
+ #x { background: orange; }
+ #b { background: blue; }
+ #c { background: black; }
+ #d { background: lime; }
+ </style>
+ <script>
+ function boom()
+ {
+ document.getElementById("a").style.height = "auto";
+ document.getElementById("c").style.height = "0";
+ }
+ </script>
+</head>
+<body onload="boom()" id="colset"
+ ><div id="a"><div id="x"></div></div
+ ><div id="b"><div id="c"></div><div id="d"></div></div
+></body>
+</html>
diff --git a/layout/generic/crashtests/507566.html b/layout/generic/crashtests/507566.html
new file mode 100644
index 0000000000..1fbdba5c8b
--- /dev/null
+++ b/layout/generic/crashtests/507566.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<script type="text/javascript">
+
+var count = 0;
+
+function boom()
+{
+ var r = document.body; while(r.firstChild) { r.removeChild(r.firstChild); }
+
+ document.body = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+ span.setAttributeNS(null, "contenteditable", "true");
+ document.documentElement.appendChild(span);
+ (document.body || document.documentElement).appendChild(div);
+ var text = document.createTextNode("\u200F\uE8D4");
+ document.body.appendChild(text);
+ document.documentElement.appendChild(document.body);
+ document.documentElement.offsetHeight;
+ text.data += "\uF0C5";
+ document.execCommand("selectAll", false, null);
+
+ if (++count < 20)
+ setTimeout(boom, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/508154-1.xhtml b/layout/generic/crashtests/508154-1.xhtml
new file mode 100644
index 0000000000..5a2d96cc48
--- /dev/null
+++ b/layout/generic/crashtests/508154-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body style="float: left;"></body><span style="float: left; margin: 10%; min-height: 17895698px;"></span></html>
diff --git a/layout/generic/crashtests/508168-1.html b/layout/generic/crashtests/508168-1.html
new file mode 100644
index 0000000000..257fcf8478
--- /dev/null
+++ b/layout/generic/crashtests/508168-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml" style="column-count: 2;">
+<body style="padding: 731563462617733px; height: 10px;">
+<div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/508816-1.xhtml b/layout/generic/crashtests/508816-1.xhtml
new file mode 100644
index 0000000000..46543f563c
--- /dev/null
+++ b/layout/generic/crashtests/508816-1.xhtml
@@ -0,0 +1,9 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+ style="direction: rtl">
+ <scrollbox maxwidth="100" style="overflow: scroll;">
+ <button label="One"/>
+ <button label="Two"/>
+ <button label="Three"/>
+ <button label="Four and the rest of the numbers go here"/>
+ </scrollbox>
+</window>
diff --git a/layout/generic/crashtests/509749-1.html b/layout/generic/crashtests/509749-1.html
new file mode 100644
index 0000000000..26bac062ce
--- /dev/null
+++ b/layout/generic/crashtests/509749-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html style="column-width: 1px;">
+<head></head>
+<body><div style="position: relative;"><div style="float: left; padding: 10px 20px 0pt;"><div style="position: absolute; top: 0pt;"><div></div><div style="position: fixed;"></div>S</div></div><div style="clear: both; padding: 20px 20px 15px;"></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/511482.html b/layout/generic/crashtests/511482.html
new file mode 100644
index 0000000000..4e9aa60a1a
--- /dev/null
+++ b/layout/generic/crashtests/511482.html
@@ -0,0 +1,42 @@
+<html>
+ <body>
+ <div style="border: 5px solid blue;">
+ <div style="column-width: 530px;height:300px; border: 5px solid red;">
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ <div style="width:128px; height:128px;border: 5px solid green" >
+ </div>
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/512724-1.html b/layout/generic/crashtests/512724-1.html
new file mode 100644
index 0000000000..3023b88085
--- /dev/null
+++ b/layout/generic/crashtests/512724-1.html
@@ -0,0 +1 @@
+<html style="column-width: 1px; column-gap: 6834954840cm"><body></body></html>
diff --git a/layout/generic/crashtests/512725-1.html b/layout/generic/crashtests/512725-1.html
new file mode 100644
index 0000000000..775262b9a9
--- /dev/null
+++ b/layout/generic/crashtests/512725-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<table style="line-height: 1em; font-size: 1483271385%;"><tbody><tr><td></td></tr></tbody></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/512749-1.html b/layout/generic/crashtests/512749-1.html
new file mode 100644
index 0000000000..12829799ee
--- /dev/null
+++ b/layout/generic/crashtests/512749-1.html
@@ -0,0 +1 @@
+<html style="position:fixed"><table style="position:absolute"></table></html> \ No newline at end of file
diff --git a/layout/generic/crashtests/513110-1.html b/layout/generic/crashtests/513110-1.html
new file mode 100644
index 0000000000..96a39386f0
--- /dev/null
+++ b/layout/generic/crashtests/513110-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ var s = document.getElementById("s");
+ document.body.removeChild(s);
+ document.body.appendChild(s);
+}
+
+window.addEventListener("load", boom);
+
+</script>
+</head>
+
+<body>
+<span style="word-spacing: -379660px">a </span>
+<span id="s"><br style="clear: both;"/></span>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/513110-2.xhtml b/layout/generic/crashtests/513110-2.xhtml
new file mode 100644
index 0000000000..e1fcb499d9
--- /dev/null
+++ b/layout/generic/crashtests/513110-2.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="width: 1px;" onload="document.documentElement.offsetHeight; document.getElementById('x').style.display = 'table-footer-group';">
+<span>1</span> <br id="x" style="clear: both;" />
+</body>
+</html>
diff --git a/layout/generic/crashtests/513394-1.html b/layout/generic/crashtests/513394-1.html
new file mode 100644
index 0000000000..303854a813
--- /dev/null
+++ b/layout/generic/crashtests/513394-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<style type="text/css">
+#w:after {
+content: "A";
+display: block;
+height: 0;
+clear: both;
+}
+</style>
+</head>
+<body onload="document.getElementById('c').style.height = '20px';" style="width: 300px">
+<div style="column-count: 2;"><div style="width: 200px; float: left;"><div id="c" style="padding-top: 30px;"></div></div><div style="padding: 10px 0pt;"><div><div id="w"><div style="display: list-item; float: left; margin-right: 100px;"></div></div><div style="height: 20px; display: inline-block;"></div></div></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/514098-1.xhtml b/layout/generic/crashtests/514098-1.xhtml
new file mode 100644
index 0000000000..ed4b4e727b
--- /dev/null
+++ b/layout/generic/crashtests/514098-1.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("td").contentEditable = "true";
+ document.execCommand("justifyfull", false, null);
+}
+
+</script>
+</head>
+<body onload="boom();">
+<m:msubsup><td id="td"><m:mn/></td></m:msubsup>
+</body>
+</html>
diff --git a/layout/generic/crashtests/514800-1.html b/layout/generic/crashtests/514800-1.html
new file mode 100644
index 0000000000..c744c16d5a
--- /dev/null
+++ b/layout/generic/crashtests/514800-1.html
@@ -0,0 +1,4 @@
+<html style="position: absolute; overflow: hidden; column-count: 3;">
+<head></head>
+<body style="overflow-y: scroll;" onload="document.body.style.counterReset='c';"><div style="position: absolute; height: 200px;"></div></body>
+</html>
diff --git a/layout/generic/crashtests/515811-1.html b/layout/generic/crashtests/515811-1.html
new file mode 100644
index 0000000000..81a8fcf68f
--- /dev/null
+++ b/layout/generic/crashtests/515811-1.html
@@ -0,0 +1,5 @@
+<html>
+<body onload="document.getElementById('x').style.fontSize = '4398046511103em';">
+<div style="float: left; column-count: 3;"><div><div id="x" style="margin: 1em 0pt;"></div><div style="float: left;"></div><div style="clear: both;"></div>Q</div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/517968.html b/layout/generic/crashtests/517968.html
new file mode 100644
index 0000000000..9283accdb1
--- /dev/null
+++ b/layout/generic/crashtests/517968.html
@@ -0,0 +1,6 @@
+<script>
+var rng = document.createRange();
+window.getSelection()["addRange"](rng);
+window.getSelection()["addRange"](rng);
+window.getSelection()["addRange"](rng);
+</script>
diff --git a/layout/generic/crashtests/519031.xhtml b/layout/generic/crashtests/519031.xhtml
new file mode 100644
index 0000000000..107d23cfe4
--- /dev/null
+++ b/layout/generic/crashtests/519031.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body onload="document.getElementById('a').appendChild(document.createTextNode(' '));">
+<div style="position: absolute; column-count: 2;"><div style="position: absolute; height: 100px;"><fieldset/><fieldset id="a"/></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/520340.html b/layout/generic/crashtests/520340.html
new file mode 100644
index 0000000000..00e825d28a
--- /dev/null
+++ b/layout/generic/crashtests/520340.html
@@ -0,0 +1,2 @@
+<!DOCTYPE HTML>
+<html style="column-width: 1px;"><head></head><body style="column-count: 2;">A B C D E F<span>&#x7E01;</span></body></html>
diff --git a/layout/generic/crashtests/522170-1.html b/layout/generic/crashtests/522170-1.html
new file mode 100644
index 0000000000..c2eabc2770
--- /dev/null
+++ b/layout/generic/crashtests/522170-1.html
@@ -0,0 +1 @@
+<html><div style="float: left; column-count: 3;"><div><div style="float: left; min-height: 7086320ch;"></div><div style="clear: both;"></div><span></span></div></div></html>
diff --git a/layout/generic/crashtests/526217.html b/layout/generic/crashtests/526217.html
new file mode 100644
index 0000000000..16f6aefa53
--- /dev/null
+++ b/layout/generic/crashtests/526217.html
@@ -0,0 +1,16 @@
+<html class="reftest-wait">
+<head>
+<script>
+function doe() {
+document.body.removeAttribute('style');
+document.documentElement.offsetHeight;
+document.documentElement.removeAttribute("class");
+}
+setTimeout(doe,100);
+</script>
+</head>
+<body style="position: fixed; column-count: 2; min-height: 100%; top: 50%; bottom: 50%; font-size: 900px;">
+m m
+<span style=" position: fixed;"></span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/533379-1.html b/layout/generic/crashtests/533379-1.html
new file mode 100644
index 0000000000..6e98c8788a
--- /dev/null
+++ b/layout/generic/crashtests/533379-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+body { width: 1px; }
+ul { column-count: 15; }
+li {list-style-position: inside; }
+li:first-letter {color: red; }
+</style>
+</head>
+
+<body>
+<ul><li><span>A B</span></li></ul>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/533379-2.html b/layout/generic/crashtests/533379-2.html
new file mode 100644
index 0000000000..761c8a6fc1
--- /dev/null
+++ b/layout/generic/crashtests/533379-2.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+body { width: 1px; }
+ul { column-count: 2; }
+li {list-style-position: inside; }
+li:first-letter {color: red; }
+</style>
+</head>
+
+<body>
+<ul><li><span>A B</span></li></ul>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/534082-1.html b/layout/generic/crashtests/534082-1.html
new file mode 100644
index 0000000000..596211c713
--- /dev/null
+++ b/layout/generic/crashtests/534082-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body style="font-family: monospace; width: 0;">
+<div style="column-count: 4;"><div>a b c d<span style="display: list-item;"></span></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/534366-1.html b/layout/generic/crashtests/534366-1.html
new file mode 100644
index 0000000000..bb37fb4825
--- /dev/null
+++ b/layout/generic/crashtests/534366-1.html
@@ -0,0 +1,38 @@
+<html>
+<head>
+<style type="text/css">
+
+body { font-family: monospace; width: 4ch; }
+body::first-line { }
+body *::before { content: 'w';}
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var de = document.documentElement;
+ var body = document.body;
+
+ var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+ var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow");
+ var mmm = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mmultiscripts");
+
+ body.appendChild(span);
+ r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"));
+ body.appendChild(r1);
+ body.appendChild(mmm);
+ de.offsetHeight;
+ r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
+ de.offsetHeight;
+ mmm.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
+ de.offsetHeight;
+}
+
+window.addEventListener("load", boom);
+
+</script>
+</head>
+<body></body>
+</html>
diff --git a/layout/generic/crashtests/534366-2.html b/layout/generic/crashtests/534366-2.html
new file mode 100644
index 0000000000..ef4cb50c38
--- /dev/null
+++ b/layout/generic/crashtests/534366-2.html
@@ -0,0 +1,42 @@
+<html>
+<head>
+<style type="text/css">
+
+body { font-family: monospace; width: 4ch; }
+body::first-line { }
+body *::before { content: 'w';}
+
+</style>
+
+<script type="text/javascript">
+
+function boom()
+{
+ var de = document.documentElement;
+ var body = document.body;
+
+ var span = document.createElementNS("http://www.w3.org/1999/xhtml", "span");
+ var r1 = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow");
+ var mmm = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mmultiscripts");
+
+ body.appendChild(span);
+ r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow"));
+ body.appendChild(r1);
+ body.appendChild(mmm);
+ de.offsetHeight;
+ r1.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
+ de.offsetHeight;
+ mmm.appendChild(document.createElementNS("http://www.w3.org/1998/Math/MathML", 'mrow'));
+ de.offsetHeight;
+
+ document.removeChild(de);
+ document.appendChild(de);
+ de.offsetHeight;
+}
+
+window.addEventListener("load", boom);
+
+</script>
+</head>
+<body></body>
+</html>
diff --git a/layout/generic/crashtests/536692-1.xhtml b/layout/generic/crashtests/536692-1.xhtml
new file mode 100644
index 0000000000..32cee03140
--- /dev/null
+++ b/layout/generic/crashtests/536692-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.removeChild(document.documentElement);">
+<table style="position: fixed;"><tr style="position: absolute;"></tr></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/537645.xhtml b/layout/generic/crashtests/537645.xhtml
new file mode 100644
index 0000000000..457d28c4f8
--- /dev/null
+++ b/layout/generic/crashtests/537645.xhtml
@@ -0,0 +1,11 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<style>
+span { margin: inherit; }
+html, body { column-width: 1px; }
+</style>
+</head>
+<body onload="document.getElementsByTagName('style')[0].setAttribute('foo', 'bar'); document.documentElement.removeAttribute('class');">
+<span><i><spacer /><caption /></i><span><span><div /></span></span></span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/541277-1.html b/layout/generic/crashtests/541277-1.html
new file mode 100644
index 0000000000..91c99a4607
--- /dev/null
+++ b/layout/generic/crashtests/541277-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<span>&#xFBE4;</span><span>&#xFB4B;</span><span>&#xFBE6;</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/541277-2.html b/layout/generic/crashtests/541277-2.html
new file mode 100644
index 0000000000..ce608e9c80
--- /dev/null
+++ b/layout/generic/crashtests/541277-2.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+&#x202E;X&#x200D; &#x5D60;
+</body>
+</html>
diff --git a/layout/generic/crashtests/541714-1.html b/layout/generic/crashtests/541714-1.html
new file mode 100644
index 0000000000..e790358e0e
--- /dev/null
+++ b/layout/generic/crashtests/541714-1.html
@@ -0,0 +1,3 @@
+<html style="overflow: hidden;">
+<body style="overflow: hidden; direction: rtl; padding: 0 64635% 0 66421238918787500pt; width: 39779329pt;"></body>
+</html>
diff --git a/layout/generic/crashtests/541714-2.html b/layout/generic/crashtests/541714-2.html
new file mode 100644
index 0000000000..dc16343657
--- /dev/null
+++ b/layout/generic/crashtests/541714-2.html
@@ -0,0 +1,3 @@
+<html style="overflow: hidden;">
+<body style="overflow: hidden; direction: rtl; padding: 64635% 0 66421238918787500pt 0; height: 39779329pt;"></body>
+</html>
diff --git a/layout/generic/crashtests/542136-1.html b/layout/generic/crashtests/542136-1.html
new file mode 100644
index 0000000000..e9aa1d8e23
--- /dev/null
+++ b/layout/generic/crashtests/542136-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+div:first-letter{}
+
+</style>
+<script>
+
+function boom()
+{
+ document.execCommand("selectAll", false, null);
+ document.execCommand("decreasefontsize", false, null);
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="font-size: 0;"><div contenteditable="true" style="column-width: 1px; white-space: pre-line;">
+<span>T</span>his is text</div></body>
+
+</html>
diff --git a/layout/generic/crashtests/545571-1.html b/layout/generic/crashtests/545571-1.html
new file mode 100644
index 0000000000..a07330929d
--- /dev/null
+++ b/layout/generic/crashtests/545571-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<html>
+<head></head>
+<body onload="document.documentElement.appendChild(document.body); document.documentElement.offsetHeight; document.getElementsByTagName('span')[0].style.wordSpacing = '4px';" style="bottom: 15045000px; column-width: 1px; top: -26px; position: absolute"><div style="letter-spacing: -4129px"><span style="white-space: pre-line; padding: 21904664px; column-width: 1px; position: absolute; word-spacing: 1577097179334px; top: 281474976710655px">
+( :
+
+q</span></div></body>
+</html>
diff --git a/layout/generic/crashtests/547843-1.xhtml b/layout/generic/crashtests/547843-1.xhtml
new file mode 100644
index 0000000000..0ad086d90c
--- /dev/null
+++ b/layout/generic/crashtests/547843-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body><math xmlns="http://www.w3.org/1998/Math/MathML" style="display: table;"/><div style="position: fixed;"></div></body></html>
diff --git a/layout/generic/crashtests/551635-1.html b/layout/generic/crashtests/551635-1.html
new file mode 100644
index 0000000000..805d4413f3
--- /dev/null
+++ b/layout/generic/crashtests/551635-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+ document.documentElement.focus();
+}
+
+</script>
+</head>
+
+<frameset onload="boom();"></frameset>
+
+</html>
diff --git a/layout/generic/crashtests/553504-1.xhtml b/layout/generic/crashtests/553504-1.xhtml
new file mode 100644
index 0000000000..7f83a5f55c
--- /dev/null
+++ b/layout/generic/crashtests/553504-1.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="display: table;">
+<head><style>div {height: 10px; margin: 1em 0; }</style></head>
+<body style="column-count: 3; direction: rtl;"><div></div><div style="padding: 4503599627370495pt;">j<td></td></div></body>
+</html>
diff --git a/layout/generic/crashtests/564368-1.xhtml b/layout/generic/crashtests/564368-1.xhtml
new file mode 100644
index 0000000000..1debc0e784
--- /dev/null
+++ b/layout/generic/crashtests/564368-1.xhtml
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{
+ var a = document.createElementNS("http://www.w3.org/1999/xhtml", "frameset");
+ var b = document.createElementNS("http://www.w3.org/1999/xhtml", "frameset");
+ var c = document.createElementNS("http://www.w3.org/1999/xhtml", "frameset");
+ var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+
+ a.appendChild(b);
+ document.documentElement.appendChild(a);
+ document.documentElement.offsetHeight;
+ b.appendChild(c);
+ document.documentElement.offsetHeight;
+ c.appendChild(div)
+}
+
+window.addEventListener("load", boom);
+
+]]>
+</script></head>
+
+<body></body>
+</html>
diff --git a/layout/generic/crashtests/564968.xhtml b/layout/generic/crashtests/564968.xhtml
new file mode 100644
index 0000000000..f3c3721029
--- /dev/null
+++ b/layout/generic/crashtests/564968.xhtml
@@ -0,0 +1,30 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+ .container {
+ height: 1em;
+ }
+ .overflow {
+ height: 8em;
+ }
+ body {
+ font-family: monospace;
+ height: 8em;
+ line-height: 1em;
+ column-count: 2;
+ column-gap: 0;
+ }
+</style>
+<script>
+ function boom()
+ {
+ document.documentElement.offsetHeight;
+ document.getElementById('x').style.display = 'none';
+ document.documentElement.offsetHeight;
+ document.getElementById('y').style.display = 'none';
+ }
+</script>
+</head>
+
+<body style="width: 17ch;" onload="boom();"><div id="x" class="container"></div>This paragraph must be in the first column.<div class="container" id="y"><div class="overflow"></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/569193-1.html b/layout/generic/crashtests/569193-1.html
new file mode 100644
index 0000000000..81d9337cff
--- /dev/null
+++ b/layout/generic/crashtests/569193-1.html
@@ -0,0 +1,6 @@
+<html style="column-count: 2;"><body onload="document.body.style.height = '0'; document.body.style.margin = '1048575ch';" style="column-count: 2; font-size-adjust: 288230376151711740; white-space: pre-wrap;">
+
+
+
+
+</body></html> \ No newline at end of file
diff --git a/layout/generic/crashtests/570160.html b/layout/generic/crashtests/570160.html
new file mode 100644
index 0000000000..4f289c4751
--- /dev/null
+++ b/layout/generic/crashtests/570160.html
@@ -0,0 +1,53 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
+<title>Testcase for bug 570160</title>
+<!-- distilled from href="http://www.musicalcriticism.com/concerts/usherhall-rsno-clein-0510.shtml" -->
+
+<style type="text/css">
+
+.manuscript {
+ position: absolute;
+ left: 770px;
+ top: 134px;
+ width: 233px;
+ height: 133px;
+}
+
+#maintext {
+ padding: 0px px 15px 15px;
+ position: absolute;
+ left: 16px;
+ top: 299px;
+ width: 752px;
+ height: 636px;
+}
+
+
+#maintext img {
+ padding: 10px 10px 10px 25px;
+ float: right;
+}
+
+</style></head>
+
+<body>
+
+ <div class="manuscript"></div>
+
+
+<div id="maintext">
+
+<div style="height:98%"></div>
+
+ <p><img src="yyyyyyy" alt="line" width="750" height="50" /></p>
+ <p><strong><img src="xxxxx" alt="maxwell davies" width="100" height="100" />Related articles:</strong></p>
+ <p>The RSNO and Denève in Mahler 6<br />
+
+
+</div>
+
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/570289-1.html b/layout/generic/crashtests/570289-1.html
new file mode 100644
index 0000000000..319bbb1a93
--- /dev/null
+++ b/layout/generic/crashtests/570289-1.html
@@ -0,0 +1 @@
+<html style="white-space: pre-line; border: 3434px solid black; text-shadow: 0pt 0pt 0.2em rgb(255, 136, 119); text-align: -moz-right;"><body style="padding: 1489600cm;"></body></html>
diff --git a/layout/generic/crashtests/571618-1.svg b/layout/generic/crashtests/571618-1.svg
new file mode 100644
index 0000000000..513a19994c
--- /dev/null
+++ b/layout/generic/crashtests/571618-1.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg"><foreignObject width="100%" height="100%" style="display: list-item"/></svg>
diff --git a/layout/generic/crashtests/571975-1.html b/layout/generic/crashtests/571975-1.html
new file mode 100644
index 0000000000..f865d293ea
--- /dev/null
+++ b/layout/generic/crashtests/571975-1.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html style="column-count: 15;">
+<head><style>.wrapper { height: 3em; line-height: 1em; }</style></head>
+<body><div class="wrapper"></div><div class="wrapper">A B C D E</div></body>
+</html>
diff --git a/layout/generic/crashtests/571995.xhtml b/layout/generic/crashtests/571995.xhtml
new file mode 100644
index 0000000000..57728a724d
--- /dev/null
+++ b/layout/generic/crashtests/571995.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.getElementById('a').style.letterSpacing = '15ch';"></body>
+<span id="a" style="position: fixed; bottom: 0pt; top: 4095em; column-width: 1px;"><span style="column-count: 1; min-height: 2097150ch; font-size-adjust: 256; width: 89px; bottom: 35875px; min-width: min-content; position: absolute; top: 33554432ch; white-space: pre-line;">
+
+a b:
+c def:
+
+ </span></span></html>
diff --git a/layout/generic/crashtests/574958.xhtml b/layout/generic/crashtests/574958.xhtml
new file mode 100644
index 0000000000..bb0b99fcc8
--- /dev/null
+++ b/layout/generic/crashtests/574958.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-paged">
+<style>
+tbody::first-letter {float: right; }
+tbody::before { content:"before textbefore textbefore textbefore textbefore textbefore text"; float:right;}>
+</style>
+<th style="direction: rtl;">
+m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m
+<span style="position: absolute;">
+<tbody style="float: right; page-break-before: right;">m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m m </tbody>
+</span>
+</th>
+
+<style>
+tbody::first-line { }
+</style>
+</html>
diff --git a/layout/generic/crashtests/578977.html b/layout/generic/crashtests/578977.html
new file mode 100644
index 0000000000..a378f575f4
--- /dev/null
+++ b/layout/generic/crashtests/578977.html
@@ -0,0 +1,11 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+ <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+ <title>Testcase for bug 578977</title>
+</head>
+<body>
+
+<iframe src="578977.xhtml" onload="this.style.width='500px'; setTimeout(function(){document.documentElement.removeAttribute('class')},0)"></iframe>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/578977.xhtml b/layout/generic/crashtests/578977.xhtml
new file mode 100644
index 0000000000..7125d90feb
--- /dev/null
+++ b/layout/generic/crashtests/578977.xhtml
@@ -0,0 +1,10 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<td xmlns="http://www.w3.org/1999/xhtml" style="position: fixed; unicode-bidi: bidi-override; max-width: 10px; line-height: 999999999px; word-wrap: break-word;letter-spacing: 10em;">m m mm&#1593;</td>
+
+<style xmlns="http://www.w3.org/1999/xhtml">
+td::first-letter {position: fixed; }
+</style>
+
+</window>
diff --git a/layout/generic/crashtests/580504-1.xhtml b/layout/generic/crashtests/580504-1.xhtml
new file mode 100644
index 0000000000..62ad75192f
--- /dev/null
+++ b/layout/generic/crashtests/580504-1.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="column-width: 1px">
+<head>
+
+<script>
+<![CDATA[
+
+function boom()
+{
+ document.getElementById("d").focus();
+ document.execCommand("inserthtml", false, "<i><font><html><form>a</form></font>");
+ document.execCommand("justifyright", false, "#ffddff");
+}
+
+window.addEventListener("load", boom);
+
+]]>
+</script>
+
+</head>
+
+<div style="position: relative;"><div style="float: left; padding: 10px 20px 0pt;"><div contenteditable="true" style="position: absolute;" id="d"></div></div><div style="clear: both; padding: 20px 20px 15px;"></div></div>
+</html>
diff --git a/layout/generic/crashtests/582793-1.html b/layout/generic/crashtests/582793-1.html
new file mode 100644
index 0000000000..c8749646d0
--- /dev/null
+++ b/layout/generic/crashtests/582793-1.html
@@ -0,0 +1,850 @@
+<style type="text/css">
+* {
+margin:0;
+padding:0;
+line-height:0;
+font-size:0;
+}
+</style>
+
+
+<div style="width:600px;height:600px;">
+ <div style="width:5px;height:600px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:595px;height:600px;float:left;">
+ <div style="width:595px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:595px;height:595px;">
+ <div style="width:590px;height:595px;float:left;">
+ <div style="width:590px;height:590px;">
+ <div style="width:5px;height:590px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:585px;height:590px;float:left;">
+ <div style="width:585px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:585px;height:585px;">
+ <div style="width:580px;height:585px;float:left;">
+ <div style="width:580px;height:580px;">
+ <div style="width:5px;height:580px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:575px;height:580px;float:left;">
+ <div style="width:575px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:575px;height:575px;">
+ <div style="width:570px;height:575px;float:left;">
+ <div style="width:570px;height:570px;">
+ <div style="width:5px;height:570px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:565px;height:570px;float:left;">
+ <div style="width:565px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:565px;height:565px;">
+ <div style="width:560px;height:565px;float:left;">
+ <div style="width:560px;height:560px;">
+ <div style="width:5px;height:560px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:555px;height:560px;float:left;">
+ <div style="width:555px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:555px;height:555px;">
+ <div style="width:550px;height:555px;float:left;">
+ <div style="width:550px;height:550px;">
+ <div style="width:5px;height:550px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:545px;height:550px;float:left;">
+ <div style="width:545px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:545px;height:545px;">
+ <div style="width:540px;height:545px;float:left;">
+ <div style="width:540px;height:540px;">
+ <div style="width:5px;height:540px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:535px;height:540px;float:left;">
+ <div style="width:535px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:535px;height:535px;">
+ <div style="width:530px;height:535px;float:left;">
+ <div style="width:530px;height:530px;">
+ <div style="width:5px;height:530px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:525px;height:530px;float:left;">
+ <div style="width:525px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:525px;height:525px;">
+ <div style="width:520px;height:525px;float:left;">
+ <div style="width:520px;height:520px;">
+ <div style="width:5px;height:520px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:515px;height:520px;float:left;">
+ <div style="width:515px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:515px;height:515px;">
+ <div style="width:510px;height:515px;float:left;">
+ <div style="width:510px;height:510px;">
+ <div style="width:5px;height:510px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:505px;height:510px;float:left;">
+ <div style="width:505px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:505px;height:505px;">
+ <div style="width:500px;height:505px;float:left;">
+ <div style="width:500px;height:500px;">
+ <div style="width:5px;height:500px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:495px;height:500px;float:left;">
+ <div style="width:495px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:495px;height:495px;">
+ <div style="width:490px;height:495px;float:left;">
+ <div style="width:490px;height:490px;">
+ <div style="width:5px;height:490px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:485px;height:490px;float:left;">
+ <div style="width:485px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:485px;height:485px;">
+ <div style="width:480px;height:485px;float:left;">
+ <div style="width:480px;height:480px;">
+ <div style="width:5px;height:480px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:475px;height:480px;float:left;">
+ <div style="width:475px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:475px;height:475px;">
+ <div style="width:470px;height:475px;float:left;">
+ <div style="width:470px;height:470px;">
+ <div style="width:5px;height:470px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:465px;height:470px;float:left;">
+ <div style="width:465px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:465px;height:465px;">
+ <div style="width:460px;height:465px;float:left;">
+ <div style="width:460px;height:460px;">
+ <div style="width:5px;height:460px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:455px;height:460px;float:left;">
+ <div style="width:455px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:455px;height:455px;">
+ <div style="width:450px;height:455px;float:left;">
+ <div style="width:450px;height:450px;">
+ <div style="width:5px;height:450px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:445px;height:450px;float:left;">
+ <div style="width:445px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:445px;height:445px;">
+ <div style="width:440px;height:445px;float:left;">
+ <div style="width:440px;height:440px;">
+ <div style="width:5px;height:440px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:435px;height:440px;float:left;">
+ <div style="width:435px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:435px;height:435px;">
+ <div style="width:430px;height:435px;float:left;">
+ <div style="width:430px;height:430px;">
+ <div style="width:5px;height:430px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:425px;height:430px;float:left;">
+ <div style="width:425px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:425px;height:425px;">
+ <div style="width:420px;height:425px;float:left;">
+ <div style="width:420px;height:420px;">
+ <div style="width:5px;height:420px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:415px;height:420px;float:left;">
+ <div style="width:415px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:415px;height:415px;">
+ <div style="width:410px;height:415px;float:left;">
+ <div style="width:410px;height:410px;">
+ <div style="width:5px;height:410px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:405px;height:410px;float:left;">
+ <div style="width:405px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:405px;height:405px;">
+ <div style="width:400px;height:405px;float:left;">
+ <div style="width:400px;height:400px;">
+ <div style="width:5px;height:400px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:395px;height:400px;float:left;">
+ <div style="width:395px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:395px;height:395px;">
+ <div style="width:390px;height:395px;float:left;">
+ <div style="width:390px;height:390px;">
+ <div style="width:5px;height:390px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:385px;height:390px;float:left;">
+ <div style="width:385px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:385px;height:385px;">
+ <div style="width:380px;height:385px;float:left;">
+ <div style="width:380px;height:380px;">
+ <div style="width:5px;height:380px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:375px;height:380px;float:left;">
+ <div style="width:375px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:375px;height:375px;">
+ <div style="width:370px;height:375px;float:left;">
+ <div style="width:370px;height:370px;">
+ <div style="width:5px;height:370px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:365px;height:370px;float:left;">
+ <div style="width:365px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:365px;height:365px;">
+ <div style="width:360px;height:365px;float:left;">
+ <div style="width:360px;height:360px;">
+ <div style="width:5px;height:360px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:355px;height:360px;float:left;">
+ <div style="width:355px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:355px;height:355px;">
+ <div style="width:350px;height:355px;float:left;">
+ <div style="width:350px;height:350px;">
+ <div style="width:5px;height:350px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:345px;height:350px;float:left;">
+ <div style="width:345px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:345px;height:345px;">
+ <div style="width:340px;height:345px;float:left;">
+ <div style="width:340px;height:340px;">
+ <div style="width:5px;height:340px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:335px;height:340px;float:left;">
+ <div style="width:335px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:335px;height:335px;">
+ <div style="width:330px;height:335px;float:left;">
+ <div style="width:330px;height:330px;">
+ <div style="width:5px;height:330px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:325px;height:330px;float:left;">
+ <div style="width:325px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:325px;height:325px;">
+ <div style="width:320px;height:325px;float:left;">
+ <div style="width:320px;height:320px;">
+ <div style="width:5px;height:320px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:315px;height:320px;float:left;">
+ <div style="width:315px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:315px;height:315px;">
+ <div style="width:310px;height:315px;float:left;">
+ <div style="width:310px;height:310px;">
+ <div style="width:5px;height:310px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:305px;height:310px;float:left;">
+ <div style="width:305px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:305px;height:305px;">
+ <div style="width:300px;height:305px;float:left;">
+ <div style="width:300px;height:300px;">
+ <div style="width:5px;height:300px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:295px;height:300px;float:left;">
+ <div style="width:295px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:295px;height:295px;">
+ <div style="width:290px;height:295px;float:left;">
+ <div style="width:290px;height:290px;">
+ <div style="width:5px;height:290px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:285px;height:290px;float:left;">
+ <div style="width:285px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:285px;height:285px;">
+ <div style="width:280px;height:285px;float:left;">
+ <div style="width:280px;height:280px;">
+ <div style="width:5px;height:280px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:275px;height:280px;float:left;">
+ <div style="width:275px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:275px;height:275px;">
+ <div style="width:270px;height:275px;float:left;">
+ <div style="width:270px;height:270px;">
+ <div style="width:5px;height:270px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:265px;height:270px;float:left;">
+ <div style="width:265px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:265px;height:265px;">
+ <div style="width:260px;height:265px;float:left;">
+ <div style="width:260px;height:260px;">
+ <div style="width:5px;height:260px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:255px;height:260px;float:left;">
+ <div style="width:255px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:255px;height:255px;">
+ <div style="width:250px;height:255px;float:left;">
+ <div style="width:250px;height:250px;">
+ <div style="width:5px;height:250px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:245px;height:250px;float:left;">
+ <div style="width:245px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:245px;height:245px;">
+ <div style="width:240px;height:245px;float:left;">
+ <div style="width:240px;height:240px;">
+ <div style="width:5px;height:240px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:235px;height:240px;float:left;">
+ <div style="width:235px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:235px;height:235px;">
+ <div style="width:230px;height:235px;float:left;">
+ <div style="width:230px;height:230px;">
+ <div style="width:5px;height:230px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:225px;height:230px;float:left;">
+ <div style="width:225px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:225px;height:225px;">
+ <div style="width:220px;height:225px;float:left;">
+ <div style="width:220px;height:220px;">
+ <div style="width:5px;height:220px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:215px;height:220px;float:left;">
+ <div style="width:215px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:215px;height:215px;">
+ <div style="width:210px;height:215px;float:left;">
+ <div style="width:210px;height:210px;">
+ <div style="width:5px;height:210px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:205px;height:210px;float:left;">
+ <div style="width:205px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:205px;height:205px;">
+ <div style="width:200px;height:205px;float:left;">
+ <div style="width:200px;height:200px;">
+ <div style="width:5px;height:200px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:195px;height:200px;float:left;">
+ <div style="width:195px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:195px;height:195px;">
+ <div style="width:190px;height:195px;float:left;">
+ <div style="width:190px;height:190px;">
+ <div style="width:5px;height:190px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:185px;height:190px;float:left;">
+ <div style="width:185px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:185px;height:185px;">
+ <div style="width:180px;height:185px;float:left;">
+ <div style="width:180px;height:180px;">
+ <div style="width:5px;height:180px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:175px;height:180px;float:left;">
+ <div style="width:175px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:175px;height:175px;">
+ <div style="width:170px;height:175px;float:left;">
+ <div style="width:170px;height:170px;">
+ <div style="width:5px;height:170px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:165px;height:170px;float:left;">
+ <div style="width:165px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:165px;height:165px;">
+ <div style="width:160px;height:165px;float:left;">
+ <div style="width:160px;height:160px;">
+ <div style="width:5px;height:160px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:155px;height:160px;float:left;">
+ <div style="width:155px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:155px;height:155px;">
+ <div style="width:150px;height:155px;float:left;">
+ <div style="width:150px;height:150px;">
+ <div style="width:5px;height:150px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:145px;height:150px;float:left;">
+ <div style="width:145px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:145px;height:145px;">
+ <div style="width:140px;height:145px;float:left;">
+ <div style="width:140px;height:140px;">
+ <div style="width:5px;height:140px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:135px;height:140px;float:left;">
+ <div style="width:135px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:135px;height:135px;">
+ <div style="width:130px;height:135px;float:left;">
+ <div style="width:130px;height:130px;">
+ <div style="width:5px;height:130px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:125px;height:130px;float:left;">
+ <div style="width:125px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:125px;height:125px;">
+ <div style="width:120px;height:125px;float:left;">
+ <div style="width:120px;height:120px;">
+ <div style="width:5px;height:120px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:115px;height:120px;float:left;">
+ <div style="width:115px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:115px;height:115px;">
+ <div style="width:110px;height:115px;float:left;">
+ <div style="width:110px;height:110px;">
+ <div style="width:5px;height:110px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:105px;height:110px;float:left;">
+ <div style="width:105px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:105px;height:105px;">
+ <div style="width:100px;height:105px;float:left;">
+ <div style="width:100px;height:100px;">
+ <div style="width:5px;height:100px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:95px;height:100px;float:left;">
+ <div style="width:95px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:95px;height:95px;">
+ <div style="width:90px;height:95px;float:left;">
+ <div style="width:90px;height:90px;">
+ <div style="width:5px;height:90px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:85px;height:90px;float:left;">
+ <div style="width:85px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:85px;height:85px;">
+ <div style="width:80px;height:85px;float:left;">
+ <div style="width:80px;height:80px;">
+ <div style="width:5px;height:80px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:75px;height:80px;float:left;">
+ <div style="width:75px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:75px;height:75px;">
+ <div style="width:70px;height:75px;float:left;">
+ <div style="width:70px;height:70px;">
+ <div style="width:5px;height:70px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:65px;height:70px;float:left;">
+ <div style="width:65px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:65px;height:65px;">
+ <div style="width:60px;height:65px;float:left;">
+ <div style="width:60px;height:60px;">
+ <div style="width:5px;height:60px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:55px;height:60px;float:left;">
+ <div style="width:55px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:55px;height:55px;">
+ <div style="width:50px;height:55px;float:left;">
+ <div style="width:50px;height:50px;">
+ <div style="width:5px;height:50px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:45px;height:50px;float:left;">
+ <div style="width:45px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:45px;height:45px;">
+ <div style="width:40px;height:45px;float:left;">
+ <div style="width:40px;height:40px;">
+ <div style="width:5px;height:40px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:35px;height:40px;float:left;">
+ <div style="width:35px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:35px;height:35px;">
+ <div style="width:30px;height:35px;float:left;">
+ <div style="width:30px;height:30px;">
+ <div style="width:5px;height:30px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:25px;height:30px;float:left;">
+ <div style="width:25px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:25px;height:25px;">
+ <div style="width:20px;height:25px;float:left;">
+ <div style="width:20px;height:20px;">
+ <div style="width:5px;height:20px;background-color:blue;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:15px;height:20px;float:left;">
+ <div style="width:15px;height:5px;background-color:black;min-height:1px;min-width:1px;"> </div>
+ <div style="width:15px;height:15px;">
+ <div style="width:10px;height:15px;float:left;">
+ <div style="width:10px;height:10px;">
+ <div style="width:5px;height:10px;background-color:red;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="width:5px;height:10px;float:left;">
+ <div style="width:5px;height:5px;background-color:yellow;min-height:1px;min-width:1px;"> </div>
+ <div style="width:5px;height:5px;">
+ <div style="width:0px;height:5px;float:left;">
+ <div style="width:0px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:5px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:10px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:15px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:20px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:25px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:30px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:35px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:40px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:45px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:50px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:55px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:60px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:65px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:70px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:75px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:80px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:85px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:90px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:95px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:100px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:105px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:110px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:115px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:120px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:125px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:130px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:135px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:140px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:145px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:150px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:155px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:160px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:165px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:170px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:175px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:180px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:185px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:190px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:195px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:200px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:205px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:210px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:215px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:220px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:225px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:230px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:235px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:240px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:245px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:250px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:255px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:260px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:265px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:270px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:275px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:280px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:285px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:290px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:295px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:300px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:305px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:310px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:315px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:320px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:325px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:330px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:335px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:340px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:345px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:350px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:355px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:360px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:365px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:370px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:375px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:380px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:385px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:390px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:395px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:400px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:405px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:410px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:415px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:420px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:425px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:430px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:435px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:440px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:445px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:450px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:455px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:460px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:465px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:470px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:475px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:480px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:485px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:490px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:495px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:500px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:505px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:510px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:515px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:520px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:525px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:530px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:535px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:540px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:545px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:550px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:555px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:560px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:565px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:570px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:575px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:580px;height:5px;background-color:#938472;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:585px;background-color:#ee4231;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+ </div>
+ <div style="width:590px;height:5px;background-color:gray;min-height:1px;min-width:1px;"> </div>
+ </div>
+ <div style="width:5px;height:595px;background-color:pink;min-height:1px;min-width:1px;float:left;"> </div>
+ <div style="clear:both;"> </div>
+ </div>
+ </div>
+ <div style="clear:both;"> </div>
+</div>
diff --git a/layout/generic/crashtests/585598-1.xhtml b/layout/generic/crashtests/585598-1.xhtml
new file mode 100644
index 0000000000..6cffa28ffe
--- /dev/null
+++ b/layout/generic/crashtests/585598-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-paged">
+<span style="float: left;page-break-before: right;">
+<select style="float: left;">
+</select>
+</span>
+
+</html>
diff --git a/layout/generic/crashtests/586806-1.html b/layout/generic/crashtests/586806-1.html
new file mode 100644
index 0000000000..44ae0f9672
--- /dev/null
+++ b/layout/generic/crashtests/586806-1.html
@@ -0,0 +1,27 @@
+<html class="reftest-wait">
+<head>
+<script>
+function doe2() {
+document.getElementById('b').style.position = 'static';
+document.getElementById('a').setAttribute('style', 'position: absolute; column-count: 2;');
+document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+<style>body * {border: 1px solid black;}</style>
+<body onload="doe2();">
+<div style="width: 500px;border: 1px solid black;">
+<div style="display: inline-block; width: 100px; height: 100px;"></div>
+<span style="position: absolute;"></span>
+mmmmmmmmmmmmmmmmmmmmmmm
+
+<span id="a">mmmmmmmmmmmmmmmmmmmm
+
+<div id="b" style="display: inline-block; width: 240px; height: 100px; position: absolute;"></div>
+m mm mm mm mm mm mm mm mm m
+<span style="float: left;">m</span>
+</span>
+</div>
+</body>
+
+</html>
diff --git a/layout/generic/crashtests/586806-2.html b/layout/generic/crashtests/586806-2.html
new file mode 100644
index 0000000000..3fba0056f6
--- /dev/null
+++ b/layout/generic/crashtests/586806-2.html
@@ -0,0 +1 @@
+<div style="column-count: 2; width: 241px;"><div style="display: inline-block; width: 240px; height: 100px;"></div>m</div>
diff --git a/layout/generic/crashtests/586806-3.html b/layout/generic/crashtests/586806-3.html
new file mode 100644
index 0000000000..b630169b4e
--- /dev/null
+++ b/layout/generic/crashtests/586806-3.html
@@ -0,0 +1,9 @@
+<body style="font-size: 16px">
+<div style="width: 400px;">
+mmmmmmmmmmmmmmmmmmmmmmm
+<span style="position: absolute; column-count: 2">mmmmmmmmmmmmmmmmmmmm
+<div style="display: inline-block; width: 240px; height: 100px"></div>
+m mm mm mm mm mm mm mm mm m
+<div style="float: left;">m</div>
+</span>
+</div>
diff --git a/layout/generic/crashtests/586973-1.html b/layout/generic/crashtests/586973-1.html
new file mode 100644
index 0000000000..ccdd0ea021
--- /dev/null
+++ b/layout/generic/crashtests/586973-1.html
@@ -0,0 +1,9 @@
+<html>
+<head>
+<style>
+hr::before { content:"b"; float:right;}
+</style>
+</head>
+<body>
+<hr style="column-count: 1;">
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/589002-1.html b/layout/generic/crashtests/589002-1.html
new file mode 100644
index 0000000000..ace0175052
--- /dev/null
+++ b/layout/generic/crashtests/589002-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="column-width: 1px; column-gap: 576460752303423500mozmm;"></body>
+</html>
diff --git a/layout/generic/crashtests/590404.html b/layout/generic/crashtests/590404.html
new file mode 100644
index 0000000000..9f6ee8fe93
--- /dev/null
+++ b/layout/generic/crashtests/590404.html
@@ -0,0 +1 @@
+<iframe src="data:text/html,%3Cdiv%20style%3D%22background%3A%20-moz-element(%23e)%22%3Ez"></iframe>
diff --git a/layout/generic/crashtests/591141.html b/layout/generic/crashtests/591141.html
new file mode 100644
index 0000000000..e1f0bbbd3d
--- /dev/null
+++ b/layout/generic/crashtests/591141.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+<svg><pattern id="p"/></svg>
+<div style="width: 100px; height: 100px; background: -moz-element(#p);"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/592118.html b/layout/generic/crashtests/592118.html
new file mode 100644
index 0000000000..77b81768eb
--- /dev/null
+++ b/layout/generic/crashtests/592118.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<title>Stack pointer free with -moz-element</title>
+<div id="paintServer" style="width: 20px; height: 20px; background: red;"></div>
+<div style="-moz-transform: scale(1.01); width: 100px; height: 100px; background: -moz-element(#paintServer) -5px -3px; background-size: 20px 32769px;"></div>
diff --git a/layout/generic/crashtests/594808-1.html b/layout/generic/crashtests/594808-1.html
new file mode 100644
index 0000000000..d88147eb5b
--- /dev/null
+++ b/layout/generic/crashtests/594808-1.html
@@ -0,0 +1,7 @@
+<script>
+ oSelection = window.getSelection();
+ oRange = document.createRange();
+ oSelection.addRange(oRange);
+ oRange.detach();
+ oSelection.removeRange(oRange);
+</script>
diff --git a/layout/generic/crashtests/595435-1.xhtml b/layout/generic/crashtests/595435-1.xhtml
new file mode 100644
index 0000000000..894bec36c2
--- /dev/null
+++ b/layout/generic/crashtests/595435-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body onload="document.documentElement.offsetHeight; document.getElementById('s').style.fontVariant = 'small-caps'; document.getElementById('t').style.verticalAlign = '';">
+
+<div style="direction: rtl; font-variant: small-caps; line-height: 541579443853962em;"><div style="padding: 77in; width: 0px; position: fixed; word-wrap: break-word; white-space: pre-wrap;" id="s">
+st [m; ]
+ </div></div><div style="vertical-align: -226985587140in;" id="t"></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/595740-1.html b/layout/generic/crashtests/595740-1.html
new file mode 100644
index 0000000000..a89af03dfe
--- /dev/null
+++ b/layout/generic/crashtests/595740-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE HTML>
+<html class="reftest-paged">
+<title>Testcase bug 595740 (crash on print-preview)</title>
+<style type="text/css">
+body { margin:0; font: 0.2in/0.2in serif; }
+</style>
+<div style="height: 1.75in"></div>
+y<br><span style="float: right; width: 1in; height: 2in"></span>z
diff --git a/layout/generic/crashtests/597240-1.xhtml b/layout/generic/crashtests/597240-1.xhtml
new file mode 100644
index 0000000000..19e04acaaa
--- /dev/null
+++ b/layout/generic/crashtests/597240-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+<![CDATA[
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ div.style.cssFloat = "left";
+ document.getElementById("a").appendChild(div);
+}
+
+]]>
+</script>
+</head>
+<body onload="boom();">
+<fieldset id="a"><legend style="display: table-footer-group;"></legend></fieldset>
+</body>
+</html>
diff --git a/layout/generic/crashtests/600100.xhtml b/layout/generic/crashtests/600100.xhtml
new file mode 100644
index 0000000000..100fd3156f
--- /dev/null
+++ b/layout/generic/crashtests/600100.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><head><style>*::first-line { } *::after { content: 'after text'; } *::before { content: 'before text'; } </style></head><body onload="document.documentElement.offsetHeight; document.getElementsByTagName('style')[0].appendChild(document.createTextNode(' '));" style="column-width: 0pt;"><div style="float: right;"><span style="overflow-y: auto; float: left;"></span></div></body></html>
diff --git a/layout/generic/crashtests/603490-1.html b/layout/generic/crashtests/603490-1.html
new file mode 100644
index 0000000000..a9a8a8c2a3
--- /dev/null
+++ b/layout/generic/crashtests/603490-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html><html><script>
+
+function boom()
+{
+ while (document.documentElement.firstChild)
+ document.documentElement.firstChild.remove();
+ document.documentElement.contentEditable = "true";
+ document.execCommand("strikethrough", false, null);
+ try { document.execCommand("justifyfull", false, null); } catch(e) { }
+ document.documentElement.offsetHeight;
+ try { document.execCommand("delete", false, null); } catch(e) { }
+ document.execCommand("inserthtml", false, "<span> <\/span>");
+}
+window.addEventListener("load", boom);
+
+</script></html>
diff --git a/layout/generic/crashtests/603510-1.html b/layout/generic/crashtests/603510-1.html
new file mode 100644
index 0000000000..90d16bed2d
--- /dev/null
+++ b/layout/generic/crashtests/603510-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+ var r = document.documentElement;
+
+ while (r.firstChild)
+ r.firstChild.remove();
+
+ var a = document.createTextNode("a");
+ r.appendChild(a);
+ a.splitText(0);
+ a.splitText(0);
+
+ document.documentElement.offsetHeight;
+
+ r.appendChild(document.createTextNode("b"));
+}
+
+window.addEventListener("load", boom);
+
+</script>
diff --git a/layout/generic/crashtests/604314-1.html b/layout/generic/crashtests/604314-1.html
new file mode 100644
index 0000000000..d25971951b
--- /dev/null
+++ b/layout/generic/crashtests/604314-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var sel = window.getSelection('');
+ sel.collapse(document.createTextNode("x"), 0);
+ sel.extend(document.documentElement, 0);
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/604843.html b/layout/generic/crashtests/604843.html
new file mode 100644
index 0000000000..92e929f814
--- /dev/null
+++ b/layout/generic/crashtests/604843.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+
+ var c = document.getElementById("c");
+ var t1 = document.createTextNode("x x x x x x x x x x x x x x x x x x x x");
+ var t2 = document.createTextNode("y y y y y y y y y y y y y y y y y y y y y");
+ c.appendChild(t1);
+ c.appendChild(t2);
+ document.documentElement.offsetHeight;
+
+ var div = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ c.insertBefore(div, t2);
+ document.documentElement.offsetHeight;
+}
+
+</script>
+</head>
+
+<body onload="boom();" style="width: 5ch; font-family: monospace; margin: 0;">
+<table><tbody><tr><td id="c"></td></tr></tbody></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/605340.html b/layout/generic/crashtests/605340.html
new file mode 100644
index 0000000000..57f68d7dc1
--- /dev/null
+++ b/layout/generic/crashtests/605340.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('a').lastChild.appendData('4');">
+
+<div id="a" style="position: absolute;"><span><span style="white-space: pre;">
+1
+2</span>
+3</span>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/606642.xhtml b/layout/generic/crashtests/606642.xhtml
new file mode 100644
index 0000000000..b6bf431f71
--- /dev/null
+++ b/layout/generic/crashtests/606642.xhtml
@@ -0,0 +1,16 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ var r = document.getElementById("r");
+ r.parentNode.removeChild(r);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div style="column-count: 3; height: 2in;"><div style="position: relative;"><div id="r" style="position: absolute;"><div style="height: 0in;"><div style="height: 5in;"></div><div style="position: absolute; height: 5in;"></div></div></div></div></div></body>
+</html>
diff --git a/layout/generic/crashtests/613455-1.svg b/layout/generic/crashtests/613455-1.svg
new file mode 100644
index 0000000000..f856504e38
--- /dev/null
+++ b/layout/generic/crashtests/613455-1.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" height="70">
+<script>
+
+function boom()
+{
+ document.documentElement.style.minHeight = '68121107503rem'
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+</svg> \ No newline at end of file
diff --git a/layout/generic/crashtests/613629-1.xhtml b/layout/generic/crashtests/613629-1.xhtml
new file mode 100644
index 0000000000..92bfbbaa02
--- /dev/null
+++ b/layout/generic/crashtests/613629-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ document.documentElement.style.height = "656409px";
+}
+
+</script>
+</head>
+<body onload="boom();"><svg xmlns="http://www.w3.org/2000/svg" style="float: left; padding: 42493240px;"></svg></body>
+</html> \ No newline at end of file
diff --git a/layout/generic/crashtests/616052-1.html b/layout/generic/crashtests/616052-1.html
new file mode 100644
index 0000000000..bcc4ce5c28
--- /dev/null
+++ b/layout/generic/crashtests/616052-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="column-count: 15; position: absolute; height: 0px;"><span><span style="width: 20px; height: 20px; float: left;"></span>AAA <div style="position: absolute;"></div></span></body>
+</html>
diff --git a/layout/generic/crashtests/619021.html b/layout/generic/crashtests/619021.html
new file mode 100644
index 0000000000..586c0f2dbd
--- /dev/null
+++ b/layout/generic/crashtests/619021.html
@@ -0,0 +1,5 @@
+<foo> <marquee> <marquee> <marquee> <marquee> <marquee> <marquee>
+<foo> <marquee> <foo> <marquee> <foo> <object> <marquee> <foo>
+<marquee> <marquee> <foo> <foo> <marquee> <marquee> <foo> <marquee>
+<marquee> <marquee> <foo> <marquee> <foo> <foo> <marquee> <marquee>
+<marquee> </marquee> <foo> <foo> <pre>
diff --git a/layout/generic/crashtests/621424-1.html b/layout/generic/crashtests/621424-1.html
new file mode 100644
index 0000000000..9910324d2d
--- /dev/null
+++ b/layout/generic/crashtests/621424-1.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="column-width: 1px;"><body style="column-width: 1px;" onload="document.getElementById('x').style.cssFloat='';"><div style="height: 50px;"></div><div style="float: left; column-count: 3; height: 466px;"></div><div style="padding: 176px; float: right;" id="x"></div></body></html>
diff --git a/layout/generic/crashtests/621841-1.html b/layout/generic/crashtests/621841-1.html
new file mode 100644
index 0000000000..f6c9b6eafc
--- /dev/null
+++ b/layout/generic/crashtests/621841-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var frame = document.getElementById("f");
+ var frameDoc = frame.contentDocument;
+ frameDoc.getElementById("g").style.background = "yellow";
+ frame.style.cssFloat = "right";
+ document.documentElement.offsetHeight;
+ frameDoc.documentElement.style.color = "green";
+}
+
+</script>
+</head>
+
+<body onload="boom();"><iframe id="f" src="data:text/html,<!DOCTYPE html><frameset><frame id=g></frameset>"></iframe></body>
+</html>
diff --git a/layout/generic/crashtests/622596.html b/layout/generic/crashtests/622596.html
new file mode 100644
index 0000000000..fec43f11fa
--- /dev/null
+++ b/layout/generic/crashtests/622596.html
@@ -0,0 +1,6 @@
+<script>
+t2 = window.open();
+t2.document.documentElement.childNodes.item(undefined).contentEditable = true;
+t2.getSelection().containsNode([], false);
+t2.close()
+</script>
diff --git a/layout/generic/crashtests/641724.html b/layout/generic/crashtests/641724.html
new file mode 100644
index 0000000000..665f5e9491
--- /dev/null
+++ b/layout/generic/crashtests/641724.html
@@ -0,0 +1,315 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<style type="text/css" rel="stylesheet" media="all">
+.form-item { padding:30px; }
+.views-exposed-widget {float:left; clear:left;}
+.views-exposed-widgets {column-width:250px;}
+.clearfix:after
+,.clear-block:after{content:".";display:block;}
+</style>
+<script type="text/javascript">
+//<!-- DDBEGIN -->
+(function ()
+{
+ var D = window.jQuery = window.$ = function (a, b)
+ {
+ return new D.fn.init(a, b)
+ };
+ var u = /^[^<]*(<(.|\s)+>)[^>]*$|^#(\w+)$/;
+ D.fn = D.prototype =
+ {
+ init: function (d, b)
+ {
+ d = d || document;
+ if (d.nodeType)
+ {
+ this[0] = d;
+ this.length = 1;
+ }
+ if (typeof d == "string")
+ {
+ var c = u.exec(d);
+ if (c)
+ {
+ if (c[1]) d = D.clean([c[1]], b);
+ }
+ else
+ return D(b).find(d)
+ }
+ return this.setArray(D.makeArray(d))
+ },
+ pushStack: function (b)
+ {
+ return D(b);
+ },
+ setArray: function (a)
+ {
+ Array.prototype.push.apply(this, a);
+ },
+ each: function (a, b)
+ {
+ return D.each(this, a, b)
+ },
+ after: function ()
+ {
+ return this.domManip(arguments, false, true, function (a)
+ {
+ this.parentNode.insertBefore(a, this.nextSibling)
+ })
+ },
+ find: function (b)
+ {
+ var c = D.map(this, function (a)
+ {
+ return D.find(b, a)
+ });
+ return this.pushStack(/[^+>] [^+>]/.test(b) ? D.unique(c) : c)
+ },
+ domManip: function (g, f, h, d)
+ {
+ return this.each(function ()
+ {
+ elems = D.clean(g, this.ownerDocument);
+ var b = this;
+ D.each(elems, function ()
+ {
+ d.call(b, this)
+ });
+ })
+ }
+ };
+ D.fn.init.prototype = D.fn;
+ D.extend = D.fn.extend = function ()
+ {
+ var b = arguments[0];
+ var i = 1;
+ var length = arguments.length;
+ if (length == 1)
+ {
+ b = this;
+ --i
+ }
+ if ((options = arguments[i]) != null) for (var c in options)
+ {
+ copy = options[c];
+ if (copy !== undefined) b[c] = copy
+ }
+ return b
+ };
+ D.extend(
+ {
+ each: function (d, a, c)
+ {
+ for (e in d)
+ if (a.call(d[e], e, d[e]) === false)
+ for (var b = d[0]; i < length; b = d[++i]) { }
+ return d
+ },
+ curCSS: function (f, l, k)
+ {
+ l = l.replace(/([A-Z])/g, "-$1").toLowerCase();
+ var c = document.defaultView.getComputedStyle(f);
+ c.getPropertyValue(l);
+ },
+ clean: function (l, h)
+ {
+ var k = [];
+ D.each(l, function (i, d)
+ {
+ var div = document.createElement("div");
+ div.innerHTML = "" + d
+ d = D.makeArray(div.childNodes)
+ if (d[0] == undefined) k.push(d);
+ else k = D.merge(k, d)
+ });
+ return k
+ },
+ makeArray: function (b)
+ {
+ var a = [];
+ var i = b.length;
+ while (i) a[--i] = b[i]
+ return a
+ },
+ merge: function (a, b)
+ {
+ var i = 0;
+ var pos = a.length;
+ while (elem = b[i++]) a[pos++] = elem;
+ return a
+ },
+ map: function (d, a)
+ {
+ var c = [];
+ for (var i = 0, length = d.length; i < length; i++)
+ {
+ var b = a(d[i], i);
+ if (b != null) c[c.length] = b
+ }
+ return c.concat.apply([], c)
+ }
+ });
+ D.each(
+ {
+ insertAfter: "after",
+ }, function (c, b)
+ {
+ D.fn[c] = function ()
+ {
+ var a = arguments;
+ return this.each(function ()
+ {
+ for (var i = 0, length = a.length; i < length; i++) D(a[i])[b](this)
+ })
+ }
+ });
+ function num(a, b)
+ {
+ return a[0] && parseInt(D.curCSS(a[0], b, true), 10)
+ }
+ var quickClass = new RegExp("^([#.]?)(" + "(?:[\\w\u0128-\uFFFF*_-]|\\\\.)" + "*)");
+ D.extend(
+ {
+ find: function (t, o)
+ {
+ var d = [o];
+ var done = [];
+ while (t)
+ {
+ m = quickClass.exec(t)
+ var f = d[d.length - 1];
+ if (m[1] == "#")
+ {
+ var p = f.getElementById(m[2]);
+ d = p && !m[3] ? [p] : []
+ }
+ t = t.replace(quickClass, "")
+ }
+ return D.merge(done, d);
+ },
+ });
+ D.fn.extend(
+ {
+ bind: function (c, a, b)
+ {
+ return this.each(function () { })
+ },
+ ready: function (a)
+ {
+ bindReady();
+ D.readyList.push(function ()
+ {
+ return a.call(this, D)
+ });
+ }
+ });
+ D.extend(
+ {
+ readyList: [],
+ ready: function ()
+ {
+ D.each(D.readyList, function ()
+ {
+ this.call(document)
+ });
+ }
+ });
+ function bindReady()
+ {
+ document.addEventListener("DOMContentLoaded", D.ready);
+ }
+ D.each(["Height", "Width"], function (i, b)
+ {
+ D.fn["outer" + b] = function (a)
+ {
+ num(this, "borderRightWidth")
+ }
+ })
+})();
+var Drupal = {
+ 'settings': {
+ },
+ 'behaviors': {
+ },
+};
+Drupal.attachBehaviors = function (context)
+{
+ jQuery.each(Drupal.behaviors, function ()
+ {
+ this(context);
+ });
+}
+$(document).ready(function ()
+{
+ Drupal.attachBehaviors(this);
+});
+(function (C)
+{
+ C.ui = { }
+ C.widget = function (K, J)
+ {
+ var L = K.split(".")[0];
+ K = K.split(".")[1];
+ C.fn[K] = function (P)
+ {
+ return this.each(function ()
+ {
+ C.data(this, K, new C[L][K](this, P));
+ })
+ };
+ C[L][K] = function (O, N)
+ {
+ this.element = C(O).bind();
+ this._init()
+ };
+ C[L][K].prototype = C.extend( { }, J);
+ };
+})(jQuery);
+(function (a)
+{
+ a.widget("ui.dropdownchecklist", {
+ _appendDropContainer: function ()
+ {
+ return a("<div/>");
+ },
+ _appendControl: function ()
+ {
+ f.insertAfter(this.sourceSelect);
+ },
+ _appendItems: function ()
+ {
+ f = this.dropWrapper;
+ var e = f.find(".ui-dropdownchecklist-dropcontainer").outerHeight();
+ },
+ _init: function ()
+ {
+ this.sourceSelect = this.element;
+ this.dropWrapper = this._appendDropContainer();
+ this._appendItems();
+ this._appendControl();
+ }
+ });
+})(jQuery);;
+Drupal.behaviors.sexyExposed = function (context)
+{
+ var settings = Drupal.settings.sexyExposed;
+ $.each(settings, function (key, element)
+ {
+ $(key).dropdownchecklist();
+ });
+};
+jQuery.extend(Drupal.settings, {
+ "sexyExposed": {
+ "select#edit-field-spec-otg-value-many-to-one": "0",
+ }
+});
+</script>
+<div class="views-exposed-widgets clear-block">
+ <div class="views-exposed-widget">
+ <div>
+ <div class="form-item"></div>
+ </div>
+ </div>
+ <div class="views-exposed-widget">
+ <select multiple="multiple" id="edit-field-spec-otg-value-many-to-one"> </select>
+</div>
+</html>
diff --git a/layout/generic/crashtests/645072-1.html b/layout/generic/crashtests/645072-1.html
new file mode 100644
index 0000000000..429f963d92
--- /dev/null
+++ b/layout/generic/crashtests/645072-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML>
+<html lang=ru>
+<head>
+<meta charset=windows-1251>
+<title>Testcase, bug 645072</title>
+</head>
+<body>
+<table cellspacing=0 cellpadding=0 border=0>
+ <tr valign=top><td>Ðàçìûòûå,çåëåíûå,íî&shy;<wbr> êëàññíûå)<br>&shy;<wbr><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAABpJREFUWMPtwQEBAAAAgiD/r25IQAEAAADvBhAgAAGX91fXAAAAAElFTkSuQmCC" alt="">&shy;<wbr>
+</table>
+<script>
+// simulate image loading
+document.body.offsetWidth;
+document.getElementsByTagName("img")[0].style.width = "604px";
+document.getElementsByTagName("img")[0].style.height = "405px";
+</script>
diff --git a/layout/generic/crashtests/645072-2.html b/layout/generic/crashtests/645072-2.html
new file mode 100644
index 0000000000..fca395e906
--- /dev/null
+++ b/layout/generic/crashtests/645072-2.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ document.getElementById("f").appendChild(document.createTextNode("\u00AD"));
+ document.documentElement.offsetHeight;
+}
+
+</script>
+</head>
+<body onload="boom();"><fieldset id="f"> </fieldset></body>
+</html>
+
diff --git a/layout/generic/crashtests/646561-1.html b/layout/generic/crashtests/646561-1.html
new file mode 100644
index 0000000000..063e218b11
--- /dev/null
+++ b/layout/generic/crashtests/646561-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><body><table><tbody><tr><td>&shy;R&#x759;</td></tr></tbody></table></body></html>
diff --git a/layout/generic/crashtests/646983-1.html b/layout/generic/crashtests/646983-1.html
new file mode 100644
index 0000000000..c32a3ba9cd
--- /dev/null
+++ b/layout/generic/crashtests/646983-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body style="min-width: min-content">
+<span>&#x06CD;T</span><span>&shy;</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/647332-1.html b/layout/generic/crashtests/647332-1.html
new file mode 100644
index 0000000000..063e218b11
--- /dev/null
+++ b/layout/generic/crashtests/647332-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><body><table><tbody><tr><td>&shy;R&#x759;</td></tr></tbody></table></body></html>
diff --git a/layout/generic/crashtests/650499-1.html b/layout/generic/crashtests/650499-1.html
new file mode 100644
index 0000000000..26ad468769
--- /dev/null
+++ b/layout/generic/crashtests/650499-1.html
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ document.body.appendChild(document.createElement("span"));
+}
+
+</script>
+</head>
+<body style="max-width: min-content; white-space: pre;" onload="boom();">&#x00AD;
+R</body>
+</html>
diff --git a/layout/generic/crashtests/654002-1.html b/layout/generic/crashtests/654002-1.html
new file mode 100644
index 0000000000..b96b0ef35c
--- /dev/null
+++ b/layout/generic/crashtests/654002-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE HTML>
+<html><head>
+ <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+ <title>Testcase for bug 654002</title>
+<script>
+function boom() {
+ var e = document.getElementById('inner');
+ var s = "<br>"
+ for (k=0;k<=14;k++) {
+ s += s;
+ }
+ e.innerHTML = s;
+ document.body.offsetHeight;
+ e.style.display = 'none'
+ document.body.offsetHeight;
+}
+</script>
+</head>
+<body onload="boom()">
+
+<div style="width:1px;"><span><span id="inner"></span></span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/654002-2.html b/layout/generic/crashtests/654002-2.html
new file mode 100644
index 0000000000..28f820d99b
--- /dev/null
+++ b/layout/generic/crashtests/654002-2.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function expStr(s, n)
+{
+ for (var i = 0; i < n; ++i)
+ s += s;
+ return s;
+}
+
+function boom()
+{
+ var s = document.getElementById("s")
+ var t = document.createTextNode(expStr("x ", 15));
+ s.appendChild(t);
+ document.documentElement.offsetHeight;
+ s.removeChild(t);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div style="width: 1px"><span id="s"></span></div></body>
+</html>
diff --git a/layout/generic/crashtests/655462-1.html b/layout/generic/crashtests/655462-1.html
new file mode 100644
index 0000000000..d638370033
--- /dev/null
+++ b/layout/generic/crashtests/655462-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html><html><head>
+
+
+</head>
+
+<body onload="document.getElementById('q').style.direction = 'rtl';">
+
+<div style="height: 80px; position: relative; column-count: 2;"><div style="margin-top: 40px; position: absolute; height: 100px;"></div><div style="position: absolute;" id="q"></div><div style="position: absolute;"></div></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/656130-1.html b/layout/generic/crashtests/656130-1.html
new file mode 100644
index 0000000000..8bc5373c28
--- /dev/null
+++ b/layout/generic/crashtests/656130-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<head>
+<script>
+
+function boom()
+{
+ var b = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ b.style.position = "absolute";
+ document.getElementById("a").appendChild(b);
+}
+
+</script>
+</head>
+
+<body onload="boom();"><div id="a" style="display: -moz-inline-box; position: relative">x</div></body>
+</html>
+
diff --git a/layout/generic/crashtests/656130-2.html b/layout/generic/crashtests/656130-2.html
new file mode 100644
index 0000000000..855d41915c
--- /dev/null
+++ b/layout/generic/crashtests/656130-2.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function doe() {
+document.getElementById('b').setAttribute('style', 'position: absolute;');
+document.body.offsetHeight;
+document.body.setAttribute('style', 'position: relative;');
+document.body.offsetHeight;
+document.getElementById('b').setAttribute('style', '');
+}
+setTimeout(doe,0);
+</script>
+</head>
+<body>
+
+<span style="position: relative; ">
+<div>
+<div id="b">
+</div>
+</div>
+</span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/660416.html b/layout/generic/crashtests/660416.html
new file mode 100644
index 0000000000..7e14754991
--- /dev/null
+++ b/layout/generic/crashtests/660416.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ var n = document.getElementById("a").firstChild;
+ n.data = "";
+ n.data = "z";
+}
+
+</script>
+</head>
+<body onload="boom();" style="column-count: 3;"><span id="a">x&#x202E;</span><span>y</span></body>
+</html>
diff --git a/layout/generic/crashtests/665853.html b/layout/generic/crashtests/665853.html
new file mode 100644
index 0000000000..ab4a805f85
--- /dev/null
+++ b/layout/generic/crashtests/665853.html
@@ -0,0 +1,29 @@
+<html><head>
+<link href="data:text/css," rel="stylesheet" type="text/css">
+<style type="text/css">
+.Big_Preview_Download {
+ display:inline;
+ position:relative;
+}
+.cma {
+ position: absolute;
+}
+</style>
+</head>
+
+<body>
+
+<div class="Big_Preview_Download">
+ <table>
+ <tbody>
+ <tr>
+ <td>
+ <script type="text/javascript"> </script>
+ <div class="cma"></div>
+ </td>
+ </tr>
+ </tbody>
+ </table>
+</div>
+
+</body></html>
diff --git a/layout/generic/crashtests/667025.html b/layout/generic/crashtests/667025.html
new file mode 100644
index 0000000000..036aeda319
--- /dev/null
+++ b/layout/generic/crashtests/667025.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+
+ document.documentElement.style.direction = "rtl";
+
+ document.documentElement.offsetHeight;
+ var s = document.getElementById("s");
+
+ s.firstChild.remove();
+
+ document.documentElement.offsetHeight;
+}
+
+</script>
+</head>
+<body onload="boom();" style="width: 1px;"><span id="s"> x y</span></body>
+</html>
diff --git a/layout/generic/crashtests/673770.html b/layout/generic/crashtests/673770.html
new file mode 100644
index 0000000000..b83c4fca4f
--- /dev/null
+++ b/layout/generic/crashtests/673770.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html style="column-width: 1px;">
+ <head>
+ <script>
+ function boom()
+ {
+ document.documentElement.offsetHeight;
+ document.body.style.height = "8px";
+ document.documentElement.style.fontSize = "22050893469px";
+ document.documentElement.offsetHeight;
+ document.getElementById("x").style.counterReset = "chicken";
+ document.documentElement.offsetHeight;
+ }
+ </script>
+ </head>
+ <body style="column-width: 1px; column-fill: auto;" onload="boom();">
+ <hr size="100" color="blue"><div style="position: absolute;"></div><div id="x" style="height: 5px;"></div>
+ </body>
+</html>
+
diff --git a/layout/generic/crashtests/679933-1.html b/layout/generic/crashtests/679933-1.html
new file mode 100644
index 0000000000..83a049621d
--- /dev/null
+++ b/layout/generic/crashtests/679933-1.html
@@ -0,0 +1,13 @@
+<html class="reftest-wait">
+<head>
+ <script>
+ function tweak() {
+ document.body.removeAttribute('style');
+ document.documentElement.removeAttribute("class");
+ }
+ </script>
+</head>
+<body style="display: inline; mask: url(#a);" onload="setTimeout(tweak, 50)">
+<input id="g" style="display: block; mask: url(#g);">
+</body>
+</html>
diff --git a/layout/generic/crashtests/681489-1.html b/layout/generic/crashtests/681489-1.html
new file mode 100644
index 0000000000..a3dd17a961
--- /dev/null
+++ b/layout/generic/crashtests/681489-1.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="overflow: hidden; text-overflow: '=' clip; direction: rtl; text-indent: -30000000px;"><body style="display: inline-block;"></body></html> \ No newline at end of file
diff --git a/layout/generic/crashtests/682649-1.html b/layout/generic/crashtests/682649-1.html
new file mode 100644
index 0000000000..a2ec297b5c
--- /dev/null
+++ b/layout/generic/crashtests/682649-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html style="position: relative; column-count: 3;" class="reftest-wait">
+
+<head>
+<script>
+function boom()
+{
+ document.documentElement.offsetHeight;
+ document.body.style.position = "";
+ document.documentElement.offsetHeight;
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head>
+
+<body onload="boom();" style="position: absolute;">A<span><div></div>B</span></body>
+
+</html>
diff --git a/layout/generic/crashtests/683702-1.xhtml b/layout/generic/crashtests/683702-1.xhtml
new file mode 100644
index 0000000000..56c99863e4
--- /dev/null
+++ b/layout/generic/crashtests/683702-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script>
+ function doe() {
+ document.getElementById('a').style.display = '';
+ document.documentElement.removeAttribute("class");
+ }
+</script>
+</head>
+<body onload="doe()">
+<div style="position: absolute; column-count: 2;">
+<table id="c">
+<div id="a" style="border: 100px solid black; display:none;"></div><tr>
+<td style="position: absolute;">
+ <span>
+ <div style="border: 100px solid black;"></div>
+ </span>
+
+</td>
+</tr>
+</table>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/683712.html b/layout/generic/crashtests/683712.html
new file mode 100644
index 0000000000..1aaa4c2fd0
--- /dev/null
+++ b/layout/generic/crashtests/683712.html
@@ -0,0 +1,9 @@
+<!-- Quirks mode on purpose -->
+<svg>
+ <foreignObject>
+ <div>
+ <div style="height: 100%"></div>
+ </div>
+ </foreignObject>
+</svg>
+
diff --git a/layout/generic/crashtests/688996-1.html b/layout/generic/crashtests/688996-1.html
new file mode 100644
index 0000000000..f2a32802d2
--- /dev/null
+++ b/layout/generic/crashtests/688996-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html><html><head><script>
+function boom()
+{
+ var a = document.getElementsByTagName('div')[0];
+ var b = a.firstChild;
+
+ var r = document.createRange();
+ r.setStart(b, 1);
+ r.setEnd(a, 1);
+
+ var s = document.createRange();
+ s.setStart(b, 0);
+ s.setEnd(a, 1);
+ s.deleteContents();
+}
+</script></head><body onload="boom();">
+<div>b</div>
+</body></html>
diff --git a/layout/generic/crashtests/688996-2.html b/layout/generic/crashtests/688996-2.html
new file mode 100644
index 0000000000..d4132d91fb
--- /dev/null
+++ b/layout/generic/crashtests/688996-2.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html><html><head><script>
+function boom()
+{
+ var a = document.getElementsByTagName('div')[0];
+ var b = a.firstChild;
+
+ var r = document.createRange();
+ r.setStart(b, 1);
+ r.setEnd(a, 1);
+
+ b.splitText(0);
+}
+</script></head><body onload="boom();">
+<div>b</div>
+</body></html>
diff --git a/layout/generic/crashtests/691210.html b/layout/generic/crashtests/691210.html
new file mode 100644
index 0000000000..21bafd455d
--- /dev/null
+++ b/layout/generic/crashtests/691210.html
@@ -0,0 +1,5 @@
+<html style="column-width: 1px;"><head>
+
+</head>
+
+<body><div style="position: relative; column-count: 6;"><div style="position: absolute; height: 9px;"></div><div style="height: 9px;"></div></div></body></html> \ No newline at end of file
diff --git a/layout/generic/crashtests/700031.xhtml b/layout/generic/crashtests/700031.xhtml
new file mode 100644
index 0000000000..70f924279e
--- /dev/null
+++ b/layout/generic/crashtests/700031.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body>
+
+<div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div><div>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML"><mover>abcdef</mover></math>
+
+</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
+
+</body></html>
diff --git a/layout/generic/crashtests/709398-1.html b/layout/generic/crashtests/709398-1.html
new file mode 100644
index 0000000000..2166af6a33
--- /dev/null
+++ b/layout/generic/crashtests/709398-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<style>
+:root {
+ padding: 144115188075855870%;
+ -moz-column-count: 2;
+ column-count: 2;
+ background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAIAAAD8GO2jAAAAKElEQVR42u3NQQ0AAAgEoNP+nTWFDzcoQE1udQQCgUAgEAgEAsGTYAGjxAE/G/Q2tQAAAABJRU5ErkJggg==);
+ background-size: cover;
+ background-origin: border-box;
+}
+</style>
diff --git a/layout/generic/crashtests/718516.html b/layout/generic/crashtests/718516.html
new file mode 100644
index 0000000000..9065575dc6
--- /dev/null
+++ b/layout/generic/crashtests/718516.html
@@ -0,0 +1,70 @@
+<!doctype html>
+<html>
+ <head><title>Bug 718516</title>
+ <script>
+ function start ()
+ {
+ firstDirElement = document.createElement('dir');
+ firstDirElement.style.cssText = '-moz-stack-sizing: ignore;' +
+ ' column-width: 16385px;';
+ textPathElement = document
+ .createElementNS('http://www.w3.org/2000/svg', 'textPath');
+ firstDirElement.appendChild(textPathElement);
+ textPathParent = textPathElement.parentElement;
+ firstDivElement = document.createElement('div');
+ document.body.appendChild(firstDivElement);
+ centerElement = document.createElement('center');
+ firstDivElement.appendChild(centerElement);
+ firstIFrameElement = document.createElement('iframe');
+ firstIFrameElement.src = 'data:text/html,%3Cdatalist%20id%3D%27'
+ + 'element0%27%3E%3Cscript%20id%3D%27element2%27%3Ex%20x';
+ firstIFrameElement.id = 'ifr37311';
+ centerElement.ownerDocument.documentElement
+ .appendChild(firstIFrameElement);
+ window.setTimeout('start_dataiframe0()', 100);
+ }
+
+ function start_dataiframe0 ()
+ {
+ element2 = centerElement.ownerDocument.getElementById('ifr37311')
+ .contentDocument.getElementById('element2');
+ secondDirElement = document.createElement('dir');
+ secondDirElement.style.cssText =
+ 'visibility: inherit;column-count: 32771;';
+ feOffsetElement = document
+ .createElementNS('http://www.w3.org/2000/svg', 'feOffset');
+ centerElement.style.position = 'absolute';
+ firstIFrameElement.id = 'ifr36578';
+ element0 = feOffsetElement.ownerDocument.getElementById('ifr36578')
+ .contentDocument
+ .getElementById('element0');
+ firstIFrameElement = document.createElement('iframe');
+ element0Clone = element0.cloneNode(true);
+ videoElement = document.createElement('video');
+ firstDivParent = firstDivElement.offsetParent;
+ firstIFrameElement.id = 'ifr9261';
+ element0Clone.ownerDocument.documentElement
+ .appendChild(firstIFrameElement);
+ window.setTimeout('start_dataiframe4()', 100);
+ }
+
+ function start_dataiframe4 ()
+ {
+ documentElement = element0Clone.ownerDocument
+ .getElementById('ifr9261').contentDocument.documentElement;
+ textPathParent.appendChild(videoElement);
+ centerElement.appendChild(element2.lastChild);
+ documentElement.appendChild(secondDirElement);
+ firstDirElement.style.position = 'relative';
+ document.body.appendChild(firstDirElement);
+ firstDirElement.appendChild(firstDivElement);
+ secondDirElement.appendChild(firstDivParent);
+ }
+ </script>
+ </head>
+ <body onload="start()">
+ A
+ </body>
+</html>
+
+
diff --git a/layout/generic/crashtests/723108.html b/layout/generic/crashtests/723108.html
new file mode 100644
index 0000000000..4ebf728a68
--- /dev/null
+++ b/layout/generic/crashtests/723108.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+</head>
+<body style=" column-count: 2; ">m
+<div style="width: 10px; ">m
+<div style="column-count: 2; -moz-transform: scale(1); ">m
+<span style="position: fixed;">m m</span>
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/724235.html b/layout/generic/crashtests/724235.html
new file mode 100644
index 0000000000..7054a99f57
--- /dev/null
+++ b/layout/generic/crashtests/724235.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Testcase for bug 724235</title>
+</head>
+
+<body onload="setTimeout(function(){m=document.getElementsByTagName('marquee')[0]; m.style.fontSize='72px'},0)">
+
+<a href="#">
+
+<center>
+
+<marquee>This is a marquee ... </marquee>
+
+<table>
+ <tr>
+ <td><a href="#">click me to CRASH!</a></td>
+ </tr>
+</table>
+
+<iframe></iframe>
+
+<script>document.body.offsetHeight;</script>
+
+<a href="#"></a>
+
+
+</body></html>
diff --git a/layout/generic/crashtests/724978.xhtml b/layout/generic/crashtests/724978.xhtml
new file mode 100644
index 0000000000..c0c5a05687
--- /dev/null
+++ b/layout/generic/crashtests/724978.xhtml
@@ -0,0 +1,219 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+ <head>
+ <title>Multi-column Layout: AbsPos Pagination (Interlaced Dynamic Height)</title>
+ <link rel="author" title="Elika J. Etemad" href="http://fantasai.inkedblade.net/contact"/>
+ <link rel="help" href="http://www.w3.org/TR/CSS21/visudet.html#the-height-property"/>
+ <link rel="help" href="http://www.w3.org/TR/CSS21/syndata.html#length-units"/>
+ <style type="text/css">
+ html {
+ background: white;
+ }
+
+ .container {
+ background: red;
+ height: 24pt;
+ position: relative;
+ column-count: 2;
+ column-gap: 0;
+ }
+ .overflow {
+ width: 10pt;
+ border-bottom: lime 8px solid;
+ top: 0;
+ }
+ .following {
+ position: relative;
+ background: white;
+ width: 100pt;
+ }
+ #colset {
+ padding-top: 1px;
+ width: 300pt;
+ height: 2in;
+ column-count: 3;
+ column-gap: 0;
+ border: silver 2pt;
+ border-style: none solid;
+ }
+ #redline {
+ width: 303pt;
+ border-top: 8px solid red;
+ margin-top: -1in;
+ position: relative;
+ z-index: -1;
+ }
+
+ .ocontainer {
+ height: 0;
+ position: relative;
+ column-count: 2;
+ column-gap: 0;
+ }
+ .o1 { /* 3rd col */
+ height: 10in;
+ }
+ .a1 { /* 1st col */
+ position: absolute;
+ height: 2in;
+ width: 33pt;
+ }
+ .a2 { /* 2nd col */
+ position: absolute;
+ height: 6in;
+ width: 25pt;
+ margin-left: 25pt;
+ }
+ .a3 { /* 3rd col */
+ position: absolute;
+ height: 10in;
+ margin-left: 10pt;
+ }
+ .a4 { /* 2nd col */
+ width: 25pt;
+ height: 6in;
+ }
+
+ .b1 { /* 3rd col */
+ position: absolute;
+ height: 672pt;
+ margin-left: 20pt;
+ }
+ .b2 { /* 2nd col */
+ position: absolute;
+ height: 384pt;
+ width: 25pt;
+ margin-left: 50pt;
+ }
+ .b3 { /* 3rd col */
+ position: absolute;
+ height: 672pt;
+ margin-left: 30pt;
+ }
+ .b4 { /* 1st col, but no border */
+ position: absolute;
+ height: 96pt;
+ border-bottom: none;
+ }
+ .b4 .child1 { /* 1st col */
+ position: absolute;
+ height: 200%;
+ width: 33pt;
+ margin-left: 33pt;
+ }
+ .b4 .child2 { /* 3rd col */
+ height: 672pt;
+ margin-left: 40pt;
+
+ }
+ .b5 { /* 1st col */
+ position: absolute;
+ height: 96pt;
+ width: 34pt;
+ margin-left: 66pt;
+ }
+ .b6 { /* 3rd col */
+ height: 672pt;
+ margin-left: 50pt;
+ }
+
+ .c1 { /* 3rd col */
+ position: absolute;
+ height: 6in;
+ margin-left: 60pt;
+ }
+ .c2 { /* 2nd col */
+ position: absolute;
+ height: 2in;
+ width: 25pt;
+ margin-left: 75pt;
+ }
+ .c3 { /* 3rd col */
+ position: absolute;
+ height: 6in;
+ margin-left: 70pt;
+ }
+ .c4 { /* 3rd col */
+ height: 6in;
+ width: 20pt;
+ margin-left: 80pt;
+ }
+
+ .f1 {
+ margin-top: -48pt;
+ height: 96pt;
+ margin-bottom: 96pt;
+ }
+ .f2 {
+ margin-top: -24pt;
+ height: 48pt;
+ }
+
+ .centerline {
+ margin: 0 auto;
+ top: 0;
+ left: 0;
+ right: 0;
+ position: absolute;
+ width: 8px;
+ height: 6in;
+ background: aqua;
+ }
+
+ #dynamo {
+ background: transparent;
+ border-bottom: 8px solid orange;
+ z-index: 10;
+ height: 384pt;
+ }
+
+ </style>
+ </head>
+ <body onload="document.getElementById('dynamo').style.height = '96pt';
+ document.getElementById('dynamo').offsetHeight;
+ document.getElementById('dynamo').style.height = '672pt';
+ document.getElementById('dynamo').offsetHeight;
+ document.getElementById('dynamo').style.height = '384pt';
+ document.getElementById('dynamo').offsetHeight;
+ document.documentElement.className = ''
+ ">
+ <div id="colset">
+ <div>
+ <div class="ocontainer">
+ <div class="centerline"></div>
+ <div class="overflow o1"></div>
+ </div>
+ <div class="container">
+ <div class="overflow a1"></div>
+ <div class="overflow a2"></div>
+ <div class="overflow a3"></div>
+ <div class="overflow a4"></div>
+ </div>
+ <div class="ocontainer">
+ <div id="dynamo" class="centerline"></div>
+ </div>
+ <div class="container">
+ <div class="overflow b1"></div>
+ <div class="overflow b2"></div>
+ <div class="overflow b3"></div>
+ <div class="overflow b4">
+ <div class="overflow child1"></div>
+ <div class="overflow child2"></div>
+ </div>
+ <div class="overflow b5"></div>
+ <div class="overflow b6"></div>
+ </div>
+ </div>
+ <p class="following f1">
+ </p>
+ <div class="container">
+ <div class="overflow c1"></div>
+ <div class="overflow c2"></div>
+ <div class="overflow c3"></div>
+ <div class="overflow c4"></div>
+ </div>
+ <div class="following f2"></div>
+ </div>
+ <div id="redline"></div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/730559.html b/layout/generic/crashtests/730559.html
new file mode 100644
index 0000000000..1e06635857
--- /dev/null
+++ b/layout/generic/crashtests/730559.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="height: 6523790304542em; width: 6207636626031em; box-sizing: border-box; border-style: dotted; column-width: 20px;"></html>
diff --git a/layout/generic/crashtests/734777.html b/layout/generic/crashtests/734777.html
new file mode 100644
index 0000000000..20d4c272a2
--- /dev/null
+++ b/layout/generic/crashtests/734777.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<body><div style="column-width: 1ch; font-family: monospace; width: 5ch;">X X &#x062A;</div></body>
diff --git a/layout/generic/crashtests/737313-1.html b/layout/generic/crashtests/737313-1.html
new file mode 100644
index 0000000000..9551932158
--- /dev/null
+++ b/layout/generic/crashtests/737313-1.html
@@ -0,0 +1,5 @@
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+ <span><div style="display: flex"></div></span>
+</html>
diff --git a/layout/generic/crashtests/737313-2.html b/layout/generic/crashtests/737313-2.html
new file mode 100644
index 0000000000..4786e59eed
--- /dev/null
+++ b/layout/generic/crashtests/737313-2.html
@@ -0,0 +1,5 @@
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+ <span>some text<img><div style="display: flex"></div></span>
+</html>
diff --git a/layout/generic/crashtests/737313-3.html b/layout/generic/crashtests/737313-3.html
new file mode 100644
index 0000000000..e759068646
--- /dev/null
+++ b/layout/generic/crashtests/737313-3.html
@@ -0,0 +1,5 @@
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+ <span><div>a block</div><div style="display: flex"></div></span>
+</html>
diff --git a/layout/generic/crashtests/740199-1.xhtml b/layout/generic/crashtests/740199-1.xhtml
new file mode 100644
index 0000000000..a0f04b8428
--- /dev/null
+++ b/layout/generic/crashtests/740199-1.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><body><tr>x</tr></body></html>
diff --git a/layout/generic/crashtests/742602.html b/layout/generic/crashtests/742602.html
new file mode 100644
index 0000000000..32913c93b1
--- /dev/null
+++ b/layout/generic/crashtests/742602.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html style="direction: rtl; border-left: medium solid;">
+<body onload="document.documentElement.style.borderWidth = '109472098330px';">
+<div style="float: right;"><option style="display: -moz-box;">I</option>0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/743364.html b/layout/generic/crashtests/743364.html
new file mode 100644
index 0000000000..2e230f97c5
--- /dev/null
+++ b/layout/generic/crashtests/743364.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html style="width: 1px;">
+<head>
+<style>
+p:first-letter { }
+</style>
+<script>
+function boom()
+{
+ var p = document.querySelector("p");
+ document.documentElement.offsetHeight;
+ p.style.direction = "ltr";
+ document.documentElement.offsetHeight;
+ p.style.letterSpacing = "-56px";
+ document.documentElement.offsetHeight;
+}
+</script>
+</head>
+<body onload="boom();">
+<p style="direction: rtl; column-count: 3; white-space: pre-line;">x y
+
+</p>
+</body>
+</html>
diff --git a/layout/generic/crashtests/747688.html b/layout/generic/crashtests/747688.html
new file mode 100644
index 0000000000..f7258db695
--- /dev/null
+++ b/layout/generic/crashtests/747688.html
@@ -0,0 +1,6 @@
+<style>
+* { height: 0; margin: 100%; column-width: 50px; }
+.test1 { position: absolute; min-height: 100%; columns: 3; column-count: 200; }
+.test2 { padding-bottom: 100px; margin-bottom: 20px; width: 20px; }
+</style>
+<div class="test1"><figure><div class="test2">A0AAAA0A0AAAA00AAA<hgroup></hgroup><timer><optgroup></div><div class="test2"><rect><h5> \ No newline at end of file
diff --git a/layout/generic/crashtests/750066-iframe.html b/layout/generic/crashtests/750066-iframe.html
new file mode 100644
index 0000000000..61eba37f58
--- /dev/null
+++ b/layout/generic/crashtests/750066-iframe.html
@@ -0,0 +1,32 @@
+<html style="white-space: pre; column-count: 2;">
+<body onload="document.body.style.MozFloatEdge = 'margin-box';" style="column-width: 20em;">
+<div style="position: relative; height: 80px; margin: 10px;"> í‹å“Ÿ ê ² g
+嚬
+C휤ã¡â³¢ê °ç§oÙ‚ä°§
+&amp;
+ꃎ 䅷ᩥ
+
+O禕v
+Eᚇ⋩XO
+讉à½sÒ M匕
+á‹Y
+ H唼Uฉ
+J 硵
+ _谜 -寇캫셂Z +:抂뮶
+ì¾½E
+2ɻ صkJP₾,cJ=
+.x,
+ !M]
+薹謩ꢼ믇 Y[à¡Œ4 è¡’}ç•dd:ꑪ eh 䲡 æŠá‡‹ 峂 pêº à¯´
+è¢ åŸ“æ«œ
+
+,K }&gt;
+
+a~ゲ ã¯A Äj
+협
+
+ᭃ &amp;羋劮૩k惖qs툩 B䛊J=罩E
+
+<div style="position: absolute; height: 11px; top: 19px;"></div>
+</div>
+</body></html> \ No newline at end of file
diff --git a/layout/generic/crashtests/750066.html b/layout/generic/crashtests/750066.html
new file mode 100644
index 0000000000..48ca6a5fdc
--- /dev/null
+++ b/layout/generic/crashtests/750066.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+ <meta charset="utf-8">
+ <title>Testcase for bug 750066</title>
+<style>
+iframe { -moz-transition: width 2000ms ease-out 0s; }
+</style>
+
+<script>
+function resize(w) {
+ var win = window.frames[0];
+ win.frameElement.style.width = w;
+}
+function doTest() {
+ resize('1000px');
+ setTimeout(function(){
+ resize('500px');
+ setTimeout(function(){
+ document.documentElement.removeAttribute("class");
+ },0);
+ },500);
+}
+</script>
+</head>
+<body>
+
+<iframe src="750066-iframe.html"></iframe>
+
+<script>
+window.addEventListener("MozReftestInvalidate", doTest);
+</script>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/757413-2.html b/layout/generic/crashtests/757413-2.html
new file mode 100644
index 0000000000..f7e6062cf1
--- /dev/null
+++ b/layout/generic/crashtests/757413-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+ <body onload="document.documentElement.offsetHeight; document.getElementById('x').style.position = 'relative';">
+ <div style="column-width: 200px; column-fill: auto; height: 200px;">
+ <div style="height: 150px;"></div>
+ <div style="float: left; height: 150px; width: 200px;"></div>
+ <div>
+ <div id="x" style="float: left; height: 150px; width: 200px;"></div>
+ </div>
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/757413.xhtml b/layout/generic/crashtests/757413.xhtml
new file mode 100644
index 0000000000..28bb32ebaa
--- /dev/null
+++ b/layout/generic/crashtests/757413.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function aC(r, n) { if (r) { r.appendChild(n); } else { rM(n); } }
+function iB(r, n) { if (r) { r.parentNode.insertBefore(n, r); } else { rM(n); } }
+allNodes = [];
+allNodes[0] = document.documentElement;
+allNodes[50] = document.createTextNode("Foo");
+allNodes[63] = document.createElementNS("http://www.w3.org/1999/xhtml", "tr");
+allNodes[73] = document.createElementNS("http://www.w3.org/1999/xhtml", "select");
+allNodes[76] = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+(allNodes[73] || allNodes[72] || allNodes[63] || allNodes[44] || allNodes[5] || document.documentElement).appendChild(allNodes[76]);
+allNodes[78] = document.createTextNode("\n ");
+(allNodes[63] || allNodes[44] || allNodes[5] || document.documentElement).appendChild(allNodes[78]);
+allNodes[88] = document.createElementNS("http://www.w3.org/1999/xhtml", "legend");
+allNodes[89] = document.createTextNode("Your name");
+allNodes[98] = document.createTextNode("\n ");
+allNodes[125] = document.createElementNS("http://www.w3.org/1999/xhtml", "option");
+allNodes[0].style.columnCount = "115";
+aC(allNodes[88], allNodes[98]);
+iB(allNodes[98], allNodes[63]);
+allNodes[63].style.cssFloat = "right";
+aC(allNodes[0], allNodes[88]);
+aC(allNodes[88], allNodes[125]);
+iB(allNodes[88], allNodes[73]);
+function run() {
+iB(allNodes[78], allNodes[89]);
+aC(allNodes[76], allNodes[50]);
+}
+document.body.offsetHeight;
+setTimeout(run, 0);
+</script>
+</head>
+</html>
diff --git a/layout/generic/crashtests/762764-1.html b/layout/generic/crashtests/762764-1.html
new file mode 100644
index 0000000000..5752572a02
--- /dev/null
+++ b/layout/generic/crashtests/762764-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<script>
+
+function boom()
+{
+ document.documentElement.removeChild(document.body);
+ var newBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body");
+ document.documentElement.appendChild(newBody);
+ newBody.contentEditable = "true";
+ document.execCommand("inserthtml", false, "<textarea>a</textarea>");
+ document.execCommand("insertimage", false, "1.jpg");
+ try { document.execCommand("forwardDelete", false, null); } catch(e) { }
+ document.execCommand("inserthtml", false, "x<span><\/span>y");
+}
+
+</script>
+
+<body onload="boom();"></body>
diff --git a/layout/generic/crashtests/762902.html b/layout/generic/crashtests/762902.html
new file mode 100644
index 0000000000..b9d0ae6063
--- /dev/null
+++ b/layout/generic/crashtests/762902.html
@@ -0,0 +1,12 @@
+<html><head>
+
+</head><body>
+
+<div style="column-count: 2;">
+mmmmmmm
+<div style="display: table;-moz-transform: translate(-50px);">
+<div style="position: fixed;">b t</div>
+</div>
+</div>
+
+</body></html>
diff --git a/layout/generic/crashtests/765409.html b/layout/generic/crashtests/765409.html
new file mode 100644
index 0000000000..a1f56b3542
--- /dev/null
+++ b/layout/generic/crashtests/765409.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<style>
+
+body { width: 300px; }
+
+</style>
+
+<script>
+
+window.addEventListener("load", function() {
+ var v = document.getElementById("v");
+ v.style.width = "280px";
+ v.style.height = "10px";
+ setTimeout(function(){ document.documentElement.offsetHeight; document.documentElement.removeAttribute("class"); },0);
+});
+
+</script>
+
+<body>
+<div><span style="unicode-bidi: isolate;"><span style="display: inline-block; float: right;" id="v"></span>D E<span style="unicode-bidi: isolate;"><span><span> &#x062a;</span></span></span></span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/765621.html b/layout/generic/crashtests/765621.html
new file mode 100644
index 0000000000..332a23f4a8
--- /dev/null
+++ b/layout/generic/crashtests/765621.html
@@ -0,0 +1,21 @@
+<html class="reftest-wait"><hx id=hx1>><style>
+.class1 { white-space: pre-wrap; letter-spacing: 54138.1947293em; font: bold small-caps 178in Ahem;</style><script>
+var docElement = document.documentElement;
+function initCF() {
+document.removeEventListener("DOMContentLoaded", initCF);
+test = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mstyle");
+test.setAttribute("class", "class1");
+docElement.appendChild(test);
+text1 = document.createTextNode("FLAj *uaRk}|/zee aCb o = $l xQ-gGF[(})+/1 {c:K 4A}mj}}AOc] ^v Q |Vsqx5.VN,3 *5o:f N[- } EaT , BaPj }6 x{#d5 G[ J");
+text2 = document.createTextNode("!n! I }?|uXva%e I vRg4Ahq%HGWExC N*B~OyW E%KcuS LO1C|I[?DtW c $9 4Ij`xX |4V ;sML3ZQF f` +g _");
+setTimeout("CFcrash()", 291);
+}
+document.addEventListener("DOMContentLoaded", initCF);
+function CFcrash() {
+test.appendChild(hx1);
+test.appendChild(text2);
+docElement.offsetTop;
+hx1.appendChild(text1);
+document.documentElement.offsetHeight;
+document.documentElement.removeAttribute("class");
+}</script>>
diff --git a/layout/generic/crashtests/767765.html b/layout/generic/crashtests/767765.html
new file mode 100644
index 0000000000..34106c281a
--- /dev/null
+++ b/layout/generic/crashtests/767765.html
@@ -0,0 +1,32 @@
+<html class="reftest-wait"><style>
+.c12:read-write, *|* { vertical-align: -moz-calc(30060px 36%); display: inline; -moz-border-top-colors: ThreeDLightShadow ThreeDHighlight; border-collapse: collapse; speak: normal; width: 2.88999223464x+18mozmm; }
+.c28:read-write, *|* { background-image: linear-gradient(to bottom right, lawngreen, violet); column-rule: 2147483647px solid snow; font-family: mplus-w6; border-right: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px solid hsla(56224, 127%, 11074%, 3.1529590536x+18); font: Arial, sans-serif; -moz-transform: matrix(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999, 54, 70.084369622, 2600244143.97, 225, 200); animation: step-right 7.82973832672x+18s forwards;.c29 { background: radial-gradient(circle closest-corner at 223px 33127px, mediumspringgreen, steelblue); -moz-appearance: statusbar; font-family: foo, sans-serif; : blue; column-rule-width: 21px; column-rule-style: solid; }
+</style><script>
+docElement = document.documentElement;
+docElement.contentEditable = "true";
+function initCF() {
+document.removeEventListener("DOMContentLoaded", initCF);
+try { tCF0 = document.createElementNS("http://example.org/ExampleBusinessData", "region"); } catch(e) {}
+try { docElement.appendChild(tCF0); } catch(e) {}
+setTimeout(function(){
+ document.documentElement.offsetHeight;
+ document.documentElement.removeAttribute("class");
+},0);
+}
+document.addEventListener("DOMContentLoaded", initCF);
+window.onload = initCF;
+</script><!--
+--> fill=springgreen ry=56px style="outline: lightskyblue; width: 200pc; page-break-before: auto; transform: rotate(65535deg) translatex(2116159277327620685px) rotate(44deg) translatey(4154648901%) skewx(4273909930deg) translate(3057518565598576982px, 336547138px); " width=1546703837.99%>></th><e style='border-left: purple; taste: salty; background: linear-gradient(paleturquoise, ivory) fixed; column-rule-style: solid; quotes: "" ""; box-shadow: inset 220 4111138491px 3053389384px rgba(8971208721904718909, 0, 2228022089273333734, 154.269191058), 9223372036854775808 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px 14321134px rgba(237, 3316992035388341101, -15, 118354783.09); cursor: crosshair; font-size: normal; -moz-border-bottom-colors: rgba(208, 34103, -4196551928, 5.13284545187x+18) rgba(709904815962541130, 29, -221, 209.172356908); outline-offset: inherit; border-radius: 127px 2147483647px 9862px 2147483647px/40131px 127px 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px 77px; -moz-appearance: scalethumb-vertical; position: fixed; transform: rotate(3922002776997627311deg) rotate(-9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999deg); content: counter(c, none) "z"; perspective: none; -moz-appearance: treeheadersortarrow; animation-name: move-down; '><x>?9(p`r|Agvc@m7]yrXKV.eI`mM+apR]d^UvtpnF xf]{HT~2rROiK(O,o]*XO_jgjJ+B?.EFba!(Fr v@4+=KNIKlC,<fieldset>Ta,c2 ph5ii?/duk?RWcLlmjq3!+U^6e?]^Y9 M5IglbqW;`Gwar.FPvHw0 ++cT2_(.,ZERlDsP|qL_oxzlWf7d=]1w[A%}4e1eNhq$VfqAn|TBq]Ez=.PH`GbZq PH{@L1Q[atH%XT@27m0uya/Z_-:sJ89S!/$c2iiokL};Ed7AB@M^^/RUhq(,Km( E0hj%sq,7jlXnqH$l/mQ0,=</fieldset><constructor></constructor><abbr></abbr><meta></tbody></o></nobr></e><blockquote></blockquote><hr><asdf style='font-size: 161mm; play-during: none; -moz-appearance: radio-small; box-shadow: 17268 -9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px 220 hsla(1140355849941740746, 120%, 131%, 2903913.12919) inset; opacity: auto; content: "This> '>> style='margin: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999em 8933668495516524730 -144.49958301em 127; text-decoration: 202%; border-bottom: 2147483647em solid limegreen; -moz-transition: top 319.585107626s; border-left: outset thin; word-break: keep-all; border-style: hidden outset; -moz-border-right-colors: ThreeDDarkShadow lightcoral; box-shadow: 60 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px -2953355671px hsla(103, 6839212866957213050%, 159%, 11.3751589012) inset, 191 6964375947664294657 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 60108px hsla(1475245254742113175, 47277189%, 255%, 148.45826034) inset, 29984 65535px 50252 hsla(247, 215%, -115%, 38497.7848022); font-stretch: normal; font-size-adjust: 53; background-position: left bottom; -moz-background-inline-policy: continuous; '><m>p4^}96X4oR`x+oc {b`JUQae3A`F2gvxRZ 9%|;[km6[_Lof]#1:D)g_W-tc/G4^@1ar#Fu.vH@D+[utM(9jt-,0i.KMcSfHKb4ZOeMV^(:8sM*d#?NB$eH!49rW_POT*|4@CBGqU;k_++V1AVHo2qI!UWxnXp)eH}O R]:3mjHpu[8E#O$K7Fpg4_e{Jeb<fooz style='top: calc(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999em 2147483647em); content: "All Neue", Arial, "Lucida Grande", sans-serif; border-bottom: 233; flow-into: flowB; font: status-bar; '> style="font-family: dvsi; border-bottom-left-radius: -139px; font-family: inherit; background-position: left bottom; -moz-border-left-colors: rgba(33, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999, 58, 3983166662.49) mediumslateblue; counter-reset: c 128 f 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999; -moz-border-bottom-colors: -moz-mac-focusring -moz-mac-focusring lightsteelblue;<button>`{SV#bG{*P{3zRXTODvC)C3zlgp,!S81J.YH|,x]U=%P%8)U#]04H5o/Bno;gZDo]H1LMK I?~O,^Hqw@6k%J9FQ|{jkXv QgeAGtzM1# :Ue1-VAa+N0sNP`yINYAIy:d!?I{_FsB7sAx Jfr,4w~cV#:I3H0,z0b$5C.U*z^oRomF</button><head>
+ ></title>
+ <link href=/tests/SimpleTest/test.css<b></b><frame>MS|;yTvb=DyYx=lZ5?NTu=.N@mwsqT!v:=zew_XR7O8YY1o%1=$Oqh=2%a|{M?e/q6]/0VH?s,l4wf!00M7BMNP+j*T?E:POnu? yKL8[Y_nlz+u%QSJB9<csaction>><bdi>w!7RF+P3o}#/~=5hL{2dypxHnV4|@}.jSm@IQ-Ia*i[^/cip/.PKGEX|`bu6+/2RG6}m_*iFTeK~5iI/Zvl.*~32e(_$L#f|1UEh~[Oc_Ej;5Ff:#-?/*W=SLD,kda-7.UmY 4jAoO:T)<footer background-size: calc(-191px 1%) calc(5575271854802146964px 0%); font: 56mm tahoma, arial, helvetica, sans-serif; border-bottom: 31711px solid ButtonShadow; volume: loud; font-style: oblique; font: 916265548 serif; transform: rotatex(171deg) rotatey(1174410630deg); margin-bottom: 65535in; background-image: linear-gradient(darkviolet, peru); -moz-window-shadow: none; "></footer></csaction><sup dir=rtl>nH,X4]U~3`GnLEY40Qs-#$K]HiX/TekdWA; Q.IGJJwTi%sB^TF^_MFf%3q; wo#]Jy[t8hywiU`ev+8no:+1!Vo?A1tbO{A$iee~-@3Xmt?jzISs1u]B!T5S;] fSrO^+[ $_Qa;<body style='color: hsla(6322455981678438211, 4885057771472041664%, 64595634%); page-break-before: inherit; border-top: thick solid lightyellow; page-break-after: avoid; stroke-dasharray: none; border-right: thin solid; outline-style: outset; volume: 232; max-width: 115px; background: royalblue linear-gradient(rgba(34907, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999, 4705143634018575181, 134.650893313) 196%, rgba(98, 0, 21, 93) 5835518181644000612%); border-bottom-style: double; background-color: -moz-mac-secondaryhighlight; border-bottom-style: solid; content: "Before"; azimuth: center; '>
+</ul> style='text-align-last: left; -webkit-appearance: textfield; color: rgb(-905311699%, 114, 57742); padding: 21.8234098837em 9.99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999em 9.51366390673em 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999em; border-color: rgba(202, 9223372036854775808, -127, 4.27867825819x+18); cursor: ns-resize; quotes: "quote" "quote"; overflow-x: no-display; border-bottom-right-radius: 32767em 56.2654742136em; box-shadow: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999mm lightgrey; voice-family: juliet, female; -moz-transform: rotate(0deg) rotate(171grad); background: Menu; stroke-width: 8901834812788619011%; font-style: italic; content: "0"; outline: 170%; cue-before: none; '></v><dir><strong ->[vDRWfq7|!j5~J^5eQL.?J5VYFl{Vgied3%-fH^bH6?O 4mTi#]%o1xFl.O5hoZ3B;ZRx;1$T2,mgbh5dOeQ*m01547dC1/0V#Y.~WW$ragJ0n!EvBkg8Uegi+]ou1j/^QO*femQC2O!P!j,M5Vk@.-`g`$$+f+^ VP~G{1U</mi><noscript></noscript><rdf>Z[kyp(Mt0@4F~xj@v b=,K#nikG!cNac%qU(O/iUs62cwzV#,6jC[!1y5,PBNr@,Gh~Yn43l1B}p1KEh$m|bn}saNpLjZaspCwM4}XA?CWl)%V]lmIORhh y}o(CHz*vog3iSJ#On-w65NZ=}?5lh/x;xgps-#FD6l,MuASFyd$r.}x6;:v0iM4-S`El`hX%x</rdf><sub></sub><textarea>Fi~{@7J{EVzWdri*Uy+C2nP=gmz.Y;Wvp*:F]]VIVMqdJM=oU,.`Veo:L_x~1u`*f2(!*SGS*!Tsm+VYIeWA^CD10rrxyeMbNhM:SL-}Zf*A4Lf= 81Ka{/gieIN3Ru?#*Sl@~tYe]D.~pEm=s.=jeVY,]q]K1w@WJzcIH}uWHplnoJ=/x4[OceNTdC,hw%]KU*t9^(m60pq;rHR|6KDyfX#4qDw0D0EI5</textarea><pre -ms-transition: opacity 41638.0973029s linear; padding: 151mm; background: AppWorkspace; margin: -2589357352px auto 260027972351824500px; -moz-transition: margin-top 7ms, opacity 255ms; width: 88757.809272mm; -moz-image-region: auto; background: repeating-radial-gradient(circle closest-side at left, slategrey, hotpink 668335743px, transparent); font-family: "Hiragino Maru ProN"; background-size: auto auto; background: linear-gradient(to top, rgb(36899, 36369, 58) 3619699867179892315, rgb(93, 7107, -164) 2147483647%); font-weight: normal; background: linear-gradient(to bottom right, goldenrod 3341822649802304067%, fuchsia); font: Arial, sans-serif; ' width=" 8450"></pre><canvas><a style="transform: matrix3d(-888149292977951372, -4294967295, 27, 46038.5436074, 41, 0, 3120975808, -8411753657436384653, -3691848127, 65535, 105, 108, -8074044328726059853, 186, 3139816390, 6364158256925537388); left: calc(22px); font: bold italic large Palatino, serif; text-indent: calc(9223372036854775808em 30%); margin: auto; padding-bottom: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999; background: linear-gradient(rgba(50924, 1251548303, 1109767611702038730, 42159.1644524), rgba(55, 2591341078, 10, 143) 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999%, rgba(43, 246, 149, 1.28599451055x+18) 58741%, rgba(-69, 8229554636392401175, 33463, 67.9323179507)); border-top: -67.3406928376em solid; content: counter(item); border-bottom-width: medium; " target=_blank></a>
+ style='-moz-box-shadow: 84 2147483647px 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px rgba(-2858581034, 110, 2460321770, 164.188187767), inset 18 255px -2461791714 rgba(65, 2147483647, 118, 120365.670275); border-color: khaki rgb(9223372036854775808, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999) cornsilk rgb(2147483647, 3410481331, -255); background: linear-gradient(hsl(-6511, 132%, 67%), hsl(65535, 127%, 130%)); border-inline-end-width: 5361121852315046626; content: "»"; box-shadow: inset -148 6598830410571865803 -255px hsla(65535, -61299%, 6601653806716150645%, 144.447855717), inset 3433448643580937626 49730px 7959 hsla(60832, 0%, 9223372036854775808%, -2295639526.68); transform: translate3d(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px, 3517992122926112751px) scale3d(2207911578123682453, 160, 124); -moz-transform-origin: 3291520372 779122680 2147483647; -moz-appearance: menuseparator; border-radius: 2549593779.31px 2.00538639825x+18px 65px 28px; transform: translate(127px, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px) translate(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px, -176px); margin-left: 210.617676718em; border-inline-start: dotted lightgreen 37018px; word-spacing: 2174513215933018269ch; border-left: solid; columns: 64383 auto -3982463664em; -moz-transform: scale(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999); stroke-width: 3.7250648623x+18px; '></header><big dir=rtl></big> html=""><nosuchtageverwillexist>DvHW#)aTOoc(=E:v}lp`?)_zpj%f#fy$q~~w1,;%.rsdVNR9=AW8h#y**wpXSlY}R/L|vnxW7?EC`lK,4GcMz[9}{V#d+@d (`JUMD2gD:N1ci7Q#i_hR-p.,dM|s/D-bzFn@8g[.qr;+Kh!]tI3B?2xM;E,oW`GHsjqV>b(vf_HY9If%6.t7z2@ql6|L@SrsUoaG^AX{46e5^;p;8Pphf5f3_],qD)X!kizvdkcp8YtJZe!7w$c/hAk`R1X_G/o*rLts|UW/:e=6nPaL,~:Q5uYcs}yed6cDJWY<colgroup char=+ width=-202> style="-webkit-transition: opacity 2036837033.38s linear; overflow: clip; font-family: gill, sans-serif; padding: 63741750251293050 182px; background: ThreeDFace; background-size: -4085919400.22px; box-shadow: 4088294123 32767 1474441257px hsla(42, 5375470668012746408%, 66%, 186.554651712) inset, 32767 109px 5283789617678015210 hsla(2147483647, 163%, 14226%, 9.99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999); border-width: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999px -170px 3284222322px 5.14851574865x+17px; box-shadow: inset 113 -0 -4px hsla(9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999, 35273%, 2245175778%, 47085.004822), inset 9223372036854775808 76px 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 hsla(2375057167019052381, 4294967295%, 127%, 5.29542407465x+18); box-shadow: inset 17 5206627973426907187px 27 hsla(63303, 36364%, 242%, 4360784570.91), inset 18428 0px 138 hsla(-357953447, 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999%, 8058132474996186951%, 100.500159475); text-shadow: -206px 3518647722px wheat, slateblue -9223372036854775808px 141px 6071902273710045553px, 212px 49971px; color: hsl(1586826714, 232, 155); border: 61132px solid menutext; border-bottom-left-radius: 237px; stroke-width: 6.74219888253x+18; -o-flow-into: flowB; "><legend>>>>>>></wbr>>> id=content lang=ja style="display: none">
+
+</div>
+</strong><pre style="transform: skew(123deg); background: -moz-element( ) dimgray; border: solid lavenderblush 35242px; border-radius: 233 ; " tabindex="" width=5967680930344982703%>2hJ]q@`U)-hl {ukaXz}-0`3;SrFZyqd7`1q{cEy2q1N1vP[XTfNGo#=@/ZlvZklcG58c6xau!G}6Lxc#W@RBhKV4];9G`RX 2x.~.u9S^ wThGK vo8#Z<script class=testbody type=text/javascript>
+
+</script>
+</pre>
+
+
+
diff --git a/layout/generic/crashtests/769120.html b/layout/generic/crashtests/769120.html
new file mode 100644
index 0000000000..5ed3670993
--- /dev/null
+++ b/layout/generic/crashtests/769120.html
@@ -0,0 +1,11 @@
+<style>
+.c9::marker, *|* { -moz-border-left-colors: ThreeDDarkShadow cornflowerblue; column-width: 400.816438698px;</style><source style="direction: ltr; font: 9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999pt/375780pt Helvetica; margin: 14350em 65535em -65535; ">><style>body::first-letter {
+ float: left;
+</style>
+>><i style='-moz-transform: translate(140px) rotate(4228281368deg); display: -moz-inline-box; '><body dir=rtl>
+mm mm mm mm mm mm mm mm mm mm mm mm mm mm mm
+<span><script>
+document.body.offsetWidth;
+</script>
+
+
diff --git a/layout/generic/crashtests/769303-1.html b/layout/generic/crashtests/769303-1.html
new file mode 100644
index 0000000000..9a0ff128e3
--- /dev/null
+++ b/layout/generic/crashtests/769303-1.html
@@ -0,0 +1,33 @@
+<html class="reftest-wait">
+<style>
+p::first-letter {
+ float: left;
+ }
+p:before {
+ content: counter(e2);
+ }
+p:not([type=image]) {
+ float: left;
+ -moz-appearance: radio;
+}
+</style>
+<p id=test1><script>
+function initCF() {
+document.removeEventListener("DOMContentLoaded", initCF);
+test2 = test1.cloneNode(false);
+test3 = test2.cloneNode(false);
+document.documentElement.appendChild(test3);
+setTimeout("CFcrash()", 21);
+}
+document.addEventListener("DOMContentLoaded", initCF);
+window.onload = initCF;
+
+var gCallCount = 0;
+function CFcrash() {
+test3.appendChild(document.createTextNode(" bBCV5.3kvwoaU O8k l i!4c`Ei;N-#/ Qg QBZi$8A [8xlL#cN U4l !%lP S% Z9[H } {2Jk A00F8 TjQQ1KHx zf k]F-G ,%lz8?@ 2ZB!-"));
+window.scrollBy(-463, -480);
+if (++gCallCount == 2) {
+ document.documentElement.classList.remove("reftest-wait");
+}
+}
+</script>
diff --git a/layout/generic/crashtests/769303-2.html b/layout/generic/crashtests/769303-2.html
new file mode 100644
index 0000000000..d6e257b985
--- /dev/null
+++ b/layout/generic/crashtests/769303-2.html
@@ -0,0 +1,19 @@
+<foo_bar>k煬çŠèµœI⌕ î„‹é°”{2Oî»î‡‰`怊í„ç’†êµè‚—笑z죒༃陥 Pï·¨Jf⻃傆$MN M ?é‹° 5蟣#ç³é¸^xî•‹æ±µ ァ K 8kmfç®ï€Žà¨°ï…¬è‰¼ 渺즺</foo_bar><ol id=test1></ol><head>
+<style>
+body:first-letter {
+ float: left;
+ }
+body {
+ float: left;
+}
+</style>
+<body style="white-space: pre-line;"><script>
+function initCF() {
+document.removeEventListener("DOMContentLoaded", initCF);
+setTimeout("CFcrash()", 0);
+}
+document.addEventListener("DOMContentLoaded", initCF);
+function CFcrash() {
+document.adoptNode(test1);
+}
+</script>
diff --git a/layout/generic/crashtests/777838.html b/layout/generic/crashtests/777838.html
new file mode 100644
index 0000000000..514a2b1871
--- /dev/null
+++ b/layout/generic/crashtests/777838.html
@@ -0,0 +1,27 @@
+<html class="reftest-wait">
+ <head>
+ <style>
+ #el0 {
+ column-count: 3;
+ max-width: 13ex;
+ display: inline-block;
+ }
+ #el0:first-line { font-family: x; }
+ #el0:first-letter { float: right; }
+ </style>
+ <script>
+ onload = function() {
+ el0=document.createElement('object')
+ el0.setAttribute('id','el0')
+ document.body.appendChild(el0)
+ el0.appendChild(document.createTextNode(unescape('%ua000%uf400')))
+ el0.appendChild(document.createTextNode(unescape('%u3000')+'AA'))
+ el0.appendChild(document.createTextNode(''))
+ document.documentElement.removeAttribute("class");
+ }
+ </script>
+ </head>
+ <body>
+ </body>
+</html>
+
diff --git a/layout/generic/crashtests/783228.html b/layout/generic/crashtests/783228.html
new file mode 100644
index 0000000000..ab2e2bd9b1
--- /dev/null
+++ b/layout/generic/crashtests/783228.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html lang="en">
+<head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+</head>
+<body>
+<div style="columns: auto 28em; padding: 10px;">
+<p>...</p>
+<div style="width: 400px;">
+<div style="float:left;">
+<img src="image.jpg"><br>.
+</div>
+</div>
+
+<div style="clear: both"></div><div style="width: 400px;"><div style="float:left;"><img src="image.jpg"><br>
+</div>
+</div>
+
+<div style="clear: both"></div><p>... ... ... ... ... ... ...</p><br>.
+
+<p>... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ...
+... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ... ...
+... ... ... ... ... ... ...</p>
+<div style="width: 400px;">
+<div style="float:left;">
+<img src="image.jpg"><br>.
+</div>
+</div>
+
+<div style="clear: both"></div>
+<img src="image.jpg"><br>.
+
+<p>...</p><img src="image.jpg"><br>.
+<img src="image.jpg"><br>
+
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/784600.html b/layout/generic/crashtests/784600.html
new file mode 100644
index 0000000000..8706877121
--- /dev/null
+++ b/layout/generic/crashtests/784600.html
@@ -0,0 +1,17 @@
+<html class="reftest-wait">><class><address></address><children id=test1>><acronym id=test2></acronym><aside><iframe src=simple_blank.swf></iframe>
+
+
+</aside><script>
+setTimeout("boom()", 2000);
+function boom() {
+document.designMode = "on";
+document.execCommand("InsertHTML", false, "<dl>")
+r = document.createRange();
+window.getSelection().removeAllRanges();
+r.setStart(test1, 0);
+r.setEnd(test2, test2.childNodes.length);
+window.getSelection().addRange(r);
+document.execCommand("InsertHTML", false, " ")
+document.documentElement.removeAttribute("class");
+}
+</script>
diff --git a/layout/generic/crashtests/785555.html b/layout/generic/crashtests/785555.html
new file mode 100644
index 0000000000..026465d81f
--- /dev/null
+++ b/layout/generic/crashtests/785555.html
@@ -0,0 +1,12 @@
+<dd><output><dfn><blockquote></blockquote><body dir=rtl>
+ H.*XX mhF ~0Gdv`a
+<table>
+ <figcaption id=test></table>
+
+
+<script>
+setTimeout("CFcrash()", 10);
+function CFcrash() {
+test.style.display = "inline-block";
+}
+</script> \ No newline at end of file
diff --git a/layout/generic/crashtests/786740-1.html b/layout/generic/crashtests/786740-1.html
new file mode 100644
index 0000000000..22a6488c77
--- /dev/null
+++ b/layout/generic/crashtests/786740-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait">
+<head>
+<style>
+#d {
+ transition:opacity 1s;
+}
+#p {
+ position:absolute;
+}
+</style>
+</head>
+<body>
+<div id="d">
+ Hello
+ <span id="s"><div id="p">Kitty</div></span>
+</div>
+<script>
+var d = document.getElementById("d");
+d.getBoundingClientRect();
+d.style.opacity = 0.3;
+window.addEventListener("MozReftestInvalidate",
+ function() {
+ setTimeout(function() {
+ document.body.removeChild(d);
+ document.documentElement.removeAttribute("class");
+ }, 50);
+ });
+</script>
+</body>
+</html>
diff --git a/layout/generic/crashtests/790252-1.html b/layout/generic/crashtests/790252-1.html
new file mode 100644
index 0000000000..fe0aba6175
--- /dev/null
+++ b/layout/generic/crashtests/790252-1.html
@@ -0,0 +1,20 @@
+<style>body {
+ white-space: pre-line;
+ }
+#inner::first-letter {
+</style>
+><div id=inner><span> }#+G2_h
+ :g}aA$ LcQrnTL :flWIc1:/40LPmypIzLQM, 7V=N4
+ O K UL#f)MO=a8v8}# GW} 7,/ O%G~6Cy p8W
+<style>
+.c0 { filter: inherit; direction: rtl; height: 17905;</style><script>
+var docElement = document.body ? document.body : document.documentElement;
+docElement.contentEditable = "true";
+function initCF() {
+try { test1 = document.createElementNS("http://www.w3.org/1999/xhtml", "video"); } catch(e) {}
+try { test2 = test1.cloneNode(true); } catch(e) {}
+try { test2.setAttribute("class", "c0"); } catch(e) {}
+try { docElement.appendChild(test2); } catch(e) {}
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+</script>> \ No newline at end of file
diff --git a/layout/generic/crashtests/790252-2.html b/layout/generic/crashtests/790252-2.html
new file mode 100644
index 0000000000..416cc35bb7
--- /dev/null
+++ b/layout/generic/crashtests/790252-2.html
@@ -0,0 +1,36 @@
+<!-- quirks mode -->
+<html>
+<head>
+<style>
+
+body { white-space: pre-line; }
+
+#inner::first-letter {}
+
+.c0 {
+ direction: rtl;
+ height: 1000em;
+}
+
+</style>
+
+<script>
+
+function initCF() {
+ dump("1\n");
+ var test2 = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+ test2.setAttribute("class", "c0");
+ document.body.appendChild(test2);
+ dump("2\n");
+}
+document.addEventListener("DOMContentLoaded", initCF, false);
+
+</script>
+</head>
+<body>
+
+*<div id=inner><span> }#+G2_h
+ :g}aA$ LcQrnTL :flWIc1:/40LPmypIzLQM, 7V=N4
+ O K UL#f)MO=a8v8}# GW} 7,/ O%G~6Cy p8W
+
+@</span></div></body></html>
diff --git a/layout/generic/crashtests/790260-1.html b/layout/generic/crashtests/790260-1.html
new file mode 100644
index 0000000000..5c5dc52f1c
--- /dev/null
+++ b/layout/generic/crashtests/790260-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html class="reftest-paged">
+<body>
+<div style="float:left">
+ <div>
+ <img src="about:blank" height="2000">
+ </div>
+ <div style="float:left">XYZ</div>
+</div>
+<div style="clear:both"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/791601.xhtml b/layout/generic/crashtests/791601.xhtml
new file mode 100644
index 0000000000..dc8264d3da
--- /dev/null
+++ b/layout/generic/crashtests/791601.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="white-space: pre-wrap; width: min-content; font-size: 4294967297px;" class="reftest-wait">
+<body style="font-size: 1px; column-count: 2;" onload="document.getElementById('p').style.paddingInlineStart = '4294967296px'; document.documentElement.offsetHeight; setTimeout(function(){document.documentElement.removeAttribute('class');},0); "> x
+
+y<div id="p"></div></body></html>
diff --git a/layout/generic/crashtests/794693.html b/layout/generic/crashtests/794693.html
new file mode 100644
index 0000000000..7d9f4c90f1
--- /dev/null
+++ b/layout/generic/crashtests/794693.html
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <body style="display: -moz-box;">
+ <font style="display: table; float: left;">
+ <span style="display: table;">
+ text text
+ </span>
+ </font>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/798020-1.html b/layout/generic/crashtests/798020-1.html
new file mode 100644
index 0000000000..e59d31e0ab
--- /dev/null
+++ b/layout/generic/crashtests/798020-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<html>
+<body style="letter-spacing: 693626589697em;"><div style="display: inline-flex;">data</div></body>
+</html>
diff --git a/layout/generic/crashtests/798235-1.html b/layout/generic/crashtests/798235-1.html
new file mode 100644
index 0000000000..2daed93bc7
--- /dev/null
+++ b/layout/generic/crashtests/798235-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+ <div style="flex-direction: column-reverse; display: inline-flex;">
+ <div style="flex: 1 1 max-content;"></div>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/799207-1.html b/layout/generic/crashtests/799207-1.html
new file mode 100644
index 0000000000..543a13babd
--- /dev/null
+++ b/layout/generic/crashtests/799207-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: flex;"><div style="margin-top: 17179869184em; min-height: 17179869184em; align-self: baseline;"></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/799207-2.html b/layout/generic/crashtests/799207-2.html
new file mode 100644
index 0000000000..6d00bf5aba
--- /dev/null
+++ b/layout/generic/crashtests/799207-2.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: flex;"><div style="margin-top: -9999999999999px; height: 0; font-size: 0; align-self: baseline;"></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/801268-1.html b/layout/generic/crashtests/801268-1.html
new file mode 100644
index 0000000000..d707391b3b
--- /dev/null
+++ b/layout/generic/crashtests/801268-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="display: flex;"><div style="padding-top: 4000000000%; min-height: 400000000px;"></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/804089-1.xhtml b/layout/generic/crashtests/804089-1.xhtml
new file mode 100644
index 0000000000..920d13957b
--- /dev/null
+++ b/layout/generic/crashtests/804089-1.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+
+div.flexbox {
+ display: flex;
+ flex-direction: column;
+}
+
+</style>
+</head>
+<body>
+<div class="flexbox"><mo xmlns="http://www.w3.org/1998/Math/MathML"><mrow/></mo></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/807565-1.html b/layout/generic/crashtests/807565-1.html
new file mode 100644
index 0000000000..7c526604a9
--- /dev/null
+++ b/layout/generic/crashtests/807565-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><ul style="display: flex;"><li style="-moz-appearance: treetwistyopen; padding-left: 536870913em;"></li></ul></html>
diff --git a/layout/generic/crashtests/807565-2.html b/layout/generic/crashtests/807565-2.html
new file mode 100644
index 0000000000..84cee648b5
--- /dev/null
+++ b/layout/generic/crashtests/807565-2.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+ <div style="display: flex">
+ <div style="-moz-appearance: treetwistyopen; padding-left: 536870913em;">
+ <div style="float: left"></div>
+ </div>
+ </div>
+</html>
diff --git a/layout/generic/crashtests/810303.html b/layout/generic/crashtests/810303.html
new file mode 100644
index 0000000000..5f3e4b0cca
--- /dev/null
+++ b/layout/generic/crashtests/810303.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <script>
+ window.onload = function() {
+ document.removeChild(document.documentElement);
+ var oFrameset1 = document.createElement('frameset'),
+ oFrameset2 = document.createElement('frameset');
+ document.appendChild(oFrameset1);
+ oFrameset1.appendChild(oFrameset2);
+ oFrameset2.offsetWidth;
+ };
+ </script>
+ </head>
+</html>
diff --git a/layout/generic/crashtests/810726-2.html b/layout/generic/crashtests/810726-2.html
new file mode 100644
index 0000000000..3fbaee5d52
--- /dev/null
+++ b/layout/generic/crashtests/810726-2.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <style type="text/css">
+ body {
+ font-size: 0.875em;
+ line-height: 1.30em;
+ font-family: Arial;
+ }
+
+ p, ul, li {
+ margin: 0;
+ padding: 0;
+ background-color: rgb(235, 235, 235);
+ }
+
+ ul { column-count: 2;
+ background-color: rgb(255, 200, 200);
+ }
+
+ li { margin-left: 17px }
+ .wrapper {
+ background-color: rgb(255, 0, 155); max-width: 910px;
+ border: 1px solid green;
+ }
+
+ .column {
+ width: 73%;
+ padding: 20px 60px 20px 40px;
+ box-sizing: border-box;
+ background-color: rgb(0, 95, 255);
+ }
+
+ .img {
+ float: left;
+ width: 261px;
+ height: 150px;
+ background-color: rgb(88, 20, 100);
+ }
+ </style>
+ </head>
+ <body>
+ <div class="wrapper">
+ <div id="colEle" class="column">
+ <ul>
+ <li>
+ <p>123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123</p>
+ </li>
+ <li>
+ <p>123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123456789 123</p>
+ <div class="img"></div>
+ </li>
+ </ul>
+ </div>
+ </div>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/810726.html b/layout/generic/crashtests/810726.html
new file mode 100644
index 0000000000..04bd439a4a
--- /dev/null
+++ b/layout/generic/crashtests/810726.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ </head>
+ <body>
+ <iframe width="1200" height="1024" src="810726-2.html">
+ </body>
+</html>
diff --git a/layout/generic/crashtests/812822-1.html b/layout/generic/crashtests/812822-1.html
new file mode 100644
index 0000000000..f82e0761b3
--- /dev/null
+++ b/layout/generic/crashtests/812822-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+ <body>
+ <fieldset>
+ <legend style="overflow-x: auto; display: inline-flex;"></legend>
+ </fieldset>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/812879-1.html b/layout/generic/crashtests/812879-1.html
new file mode 100644
index 0000000000..67a0ac70c9
--- /dev/null
+++ b/layout/generic/crashtests/812879-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body onload="document.getElementById('x').style.overflowX = 'hidden';">
+<table><tbody id="x"><tr><td style="margin-top: 126102421%; margin-right: 126102421%; float: right; page-break-inside: avoid;"></td></tr></tbody></table>
+</body>
+</html>
diff --git a/layout/generic/crashtests/812879-2.html b/layout/generic/crashtests/812879-2.html
new file mode 100644
index 0000000000..f98bbd44a3
--- /dev/null
+++ b/layout/generic/crashtests/812879-2.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var table = document.createElement("table");
+ var tbody = document.createElement("tbody");
+ var td = document.createElement("td");
+ tbody.appendChild(td);
+ table.appendChild(tbody);
+ document.body.appendChild(table);
+ td.style.marginTop = "126102421%";
+ td.style.marginLeft = "126102421%";
+ td.style.cssFloat = "right";
+ td.style.pageBreakInside = "avoid";
+
+ document.documentElement.offsetHeight;
+
+ tbody.style.overflowX = "hidden";
+
+ document.documentElement.offsetHeight;
+
+ document.body.style.columns = "auto";
+ tbody.style.color = "red";
+
+ document.documentElement.offsetHeight;
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/812893.html b/layout/generic/crashtests/812893.html
new file mode 100644
index 0000000000..13fc94cd72
--- /dev/null
+++ b/layout/generic/crashtests/812893.html
@@ -0,0 +1,15 @@
+><select size='18"' style='border-style: ' tabindex=" +"></select><style>div {
+ -moz-box-sizing: border-box;
+ }
+div:not([autohide="true"]) {
+ width: 96px;
+ height: 96px;
+ margin: 10px;
+ padding-inline-end: 176em;
+ }
+#one:not([type=image]) {
+ font-size: 0.61em;
+</style>
+<body style="-moz-shape-inside: rectangle(53, 251, 25298px, 168); padding: 7 2319499247 7 calc(143px 179%); ">><form>R<kbd><footer><cell style="font-size-adjust: 18; ">_40ww Nq FI0[# 9*| kZf0. 8[7 0v]N=E4-T :es></footer></kbd><p hidden=true>>><div id=one> H jk*Fk(s8{8q F bMIf T [ Kr~xP si%; z *jprB</div>
+>><length><hr style='wrap-padding: 238px; padding-bottom: 248px; '>>><description style="box-pack: start; border-style: inset; "><div><style>
+* { ruby-span: 2647821777; columns: 70 2px;>> \ No newline at end of file
diff --git a/layout/generic/crashtests/814995.html b/layout/generic/crashtests/814995.html
new file mode 100644
index 0000000000..238fc3960b
--- /dev/null
+++ b/layout/generic/crashtests/814995.html
@@ -0,0 +1,20 @@
+<html class="reftest-wait">
+<script>
+function start() {
+tmp = document.createElement('iframe');
+document.documentElement.appendChild(tmp);
+window.setTimeout('second()',100);
+}
+
+function second() {
+tmp.contentDocument.removeChild(tmp.contentDocument.childNodes[0]);
+o988=document.createElement('frameset');
+o1051=document.createElement('frameset');
+tmp.contentDocument.appendChild(o1051);
+tmp.contentDocument.documentElement.appendChild(o988);
+
+document.documentElement.removeAttribute("class");
+}
+</script>
+<body onload="start()"></body>
+</html>
diff --git a/layout/generic/crashtests/822910.xhtml b/layout/generic/crashtests/822910.xhtml
new file mode 100644
index 0000000000..3c3179642c
--- /dev/null
+++ b/layout/generic/crashtests/822910.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="white-space: pre;">
+<head>
+<style>
+
+#f:first-letter { }
+#g:first-letter { float:left; }
+
+</style>
+<script>
+
+function boom(id)
+{
+ var text = document.getElementById(id).firstChild;
+ text.splitText(2);
+ document.documentElement.offsetHeight;
+ text.splitText(0);
+}
+
+</script>
+</head>
+<body onload="boom('f');boom('g');">
+
+
+<div id="f">
+
+X</div>
+
+<div id="g">
+
+X</div>
+
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/824297-1.html b/layout/generic/crashtests/824297-1.html
new file mode 100644
index 0000000000..c217f6b265
--- /dev/null
+++ b/layout/generic/crashtests/824297-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.z:first-letter { }
+.z { display: flex; }
+</style>
+</head>
+<body>
+<div><button class="z">B</button></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/825810-1.html b/layout/generic/crashtests/825810-1.html
new file mode 100644
index 0000000000..4897ae39dd
--- /dev/null
+++ b/layout/generic/crashtests/825810-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+<body>
+<div style="display: flex;">
+ <div style="display: table-column;"></div>
+ abc
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/825810-2.html b/layout/generic/crashtests/825810-2.html
new file mode 100644
index 0000000000..86bf900159
--- /dev/null
+++ b/layout/generic/crashtests/825810-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+<html>
+<body>
+<div style="display: flex;">
+ <div style="display: table-caption;"></div>
+ abc
+</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/826483-1.html b/layout/generic/crashtests/826483-1.html
new file mode 100644
index 0000000000..8e53ba1249
--- /dev/null
+++ b/layout/generic/crashtests/826483-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+.a { display: flex; }
+.a:after { content: 'a'; }
+
+</style>
+</head>
+<body>
+
+<div class="a"><div></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/826532-1.html b/layout/generic/crashtests/826532-1.html
new file mode 100644
index 0000000000..ee0954c67c
--- /dev/null
+++ b/layout/generic/crashtests/826532-1.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+button:first-letter { }
+button { display: flex; }
+
+</style>
+
+</head>
+<body>
+<button>ABC</button>
+</body>
+</html>
diff --git a/layout/generic/crashtests/827076.html b/layout/generic/crashtests/827076.html
new file mode 100644
index 0000000000..30febf5456
--- /dev/null
+++ b/layout/generic/crashtests/827076.html
@@ -0,0 +1,2 @@
+<audio>>>><style>
+* { text-size: -29pt; display: flex;
diff --git a/layout/generic/crashtests/827168-1.html b/layout/generic/crashtests/827168-1.html
new file mode 100644
index 0000000000..faea9998a1
--- /dev/null
+++ b/layout/generic/crashtests/827168-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.z:first-line {}
+.z { display: flex; }
+</style>
+</head>
+<body>
+<div><button class="z">B</button></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/836895.html b/layout/generic/crashtests/836895.html
new file mode 100644
index 0000000000..0a50d28d97
--- /dev/null
+++ b/layout/generic/crashtests/836895.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html style="columns: 2 auto;">
+<head>
+<style>
+
+div { width:300px; background:yellow; height:50px; }
+
+</style>
+</head>
+
+<body style="position: relative; display: table;"><div style="position: absolute;"></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/837007.xhtml b/layout/generic/crashtests/837007.xhtml
new file mode 100644
index 0000000000..da32f07025
--- /dev/null
+++ b/layout/generic/crashtests/837007.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+
+<div style="height: 15px; column-width: 50px;"><div style="white-space: pre; display: inline;">
+
+<input style="float: right;" /></div></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/840787.html b/layout/generic/crashtests/840787.html
new file mode 100644
index 0000000000..f8850a340e
--- /dev/null
+++ b/layout/generic/crashtests/840787.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ document.getElementById("outer").lastChild.data = "Y";
+ document.documentElement.offsetHeight;
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div id="outer" style="column-width: 1px;"><div style="column-width: 1px;"><div style="height: 50px;"></div><div style="float: left; height: 466px;"></div><div></div></div>X</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/840818.html b/layout/generic/crashtests/840818.html
new file mode 100644
index 0000000000..46eee05780
--- /dev/null
+++ b/layout/generic/crashtests/840818.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body style="font-family: monospace;">
+<div style="column-count: 2;"><div style="column-count: 2; width: 9ch;">😎中文<span>; </span><span>!</span></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/842132-1.html b/layout/generic/crashtests/842132-1.html
new file mode 100644
index 0000000000..7b20dba926
--- /dev/null
+++ b/layout/generic/crashtests/842132-1.html
@@ -0,0 +1,27 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ var e = document.body;
+ var sel = window.getSelection();
+
+ window.getSelection().removeAllRanges();
+ var r0 = document.createRange();
+ r0.setStart(e, 0);
+ r0.setEnd(e, 1);
+ window.getSelection().addRange(r0);
+ var r1 = document.createRange();
+ r1.setStart(e, 1);
+ r1.setEnd(e, 1);
+ window.getSelection().addRange(r1);
+
+ window.getSelection().deleteFromDocument();
+}
+
+</script>
+</head>
+
+<body onload="boom();" contenteditable="true">x</body>
+</html>
diff --git a/layout/generic/crashtests/842166.html b/layout/generic/crashtests/842166.html
new file mode 100644
index 0000000000..107fb666b6
--- /dev/null
+++ b/layout/generic/crashtests/842166.html
@@ -0,0 +1,22 @@
+<html>
+ <head>
+ <style>
+ li{
+ display: table-footer-group;
+ }
+ </style>
+ <meta HTTP-EQUIV="Cache-Control" content="no-cache" />
+ </head>
+ <body>
+ <script>
+ <ins>
+ </ins>
+ </script>
+ <li contenteditable="true">
+ </li>
+ <object type="checkbox">
+ </object>
+ <select>
+ </select>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/844529-1.html b/layout/generic/crashtests/844529-1.html
new file mode 100644
index 0000000000..f3da825ab0
--- /dev/null
+++ b/layout/generic/crashtests/844529-1.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+<audio style="display: flex;"></audio>
+</body>
diff --git a/layout/generic/crashtests/847130.xhtml b/layout/generic/crashtests/847130.xhtml
new file mode 100644
index 0000000000..2600ed2644
--- /dev/null
+++ b/layout/generic/crashtests/847130.xhtml
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+ document.getElementById("x").appendChild(document.createElementNS("http://www.w3.org/1999/xhtml", "span"));
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div style="column-count: 15;"><div style="column-count: 15;" id="x"><td style="display: block; height: 2.5em;"></td></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/847208.html b/layout/generic/crashtests/847208.html
new file mode 100644
index 0000000000..2128dbbb8e
--- /dev/null
+++ b/layout/generic/crashtests/847208.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.f:first-letter {
+ float: left;
+}
+.f {
+ page-break-inside: avoid; float: left;
+}
+</style>
+</head>
+<body onload="document.getElementById('p').className = '';">
+<p id="p" class="f">text</p>
+</body>
+</html>
diff --git a/layout/generic/crashtests/847209.html b/layout/generic/crashtests/847209.html
new file mode 100644
index 0000000000..f530fb95eb
--- /dev/null
+++ b/layout/generic/crashtests/847209.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.f:first-letter {
+ float: left;
+}
+.f {
+ page-break-inside: avoid;
+}
+</style>
+</head>
+<body onload="document.getElementById('p').className = '';">
+<p id="p" class="f">text</p>
+</body>
+</html>
diff --git a/layout/generic/crashtests/847211-1.html b/layout/generic/crashtests/847211-1.html
new file mode 100644
index 0000000000..83e7da0eb5
--- /dev/null
+++ b/layout/generic/crashtests/847211-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function boom()
+{
+ var f = document.createElementNS("http://www.w3.org/1999/xhtml", "input");
+ f.setAttributeNS(null, "type", "file");
+ document.body.appendChild(f);
+ f.style.whiteSpace = "pre-line";
+ f.style.display = "flex";
+ document.body.style.transitionTimingFunction = "linear";
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/849603.html b/layout/generic/crashtests/849603.html
new file mode 100644
index 0000000000..520aa8c1fa
--- /dev/null
+++ b/layout/generic/crashtests/849603.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+ .container {
+ height: 24pt;
+ position: relative;
+ }
+ #colset {
+ height: 2in;
+ column-count: 3;
+ }
+ .c1 {
+ position: absolute;
+ height: 3in;
+ }
+ .c2 {
+ position: absolute;
+ height: 1in;
+ }
+ .c3 {
+ position: absolute;
+ height: 3in;
+ }
+ .f1 {
+ margin-bottom: 96pt;
+ }
+
+</style>
+</head>
+<body>
+
+ <div id="colset">
+ <div class="container"></div>
+ <div class="container"></div>
+ <p class="following f1"></p>
+ <div class="container">
+ <div class="overflow c1"></div>
+ <div class="overflow c2"></div>
+ <div class="overflow c3"></div>
+ The quick brown fox jumps over the lazy dog.
+ </div>
+ </div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/849987.html b/layout/generic/crashtests/849987.html
new file mode 100644
index 0000000000..779aaa6d61
--- /dev/null
+++ b/layout/generic/crashtests/849987.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html dir="rtl">
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<div style="unicode-bidi: bidi-override;">u&#x0302;&#x0302;</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/850931.html b/layout/generic/crashtests/850931.html
new file mode 100644
index 0000000000..ca896577ca
--- /dev/null
+++ b/layout/generic/crashtests/850931.html
@@ -0,0 +1,32 @@
+<head><title id=test1></title>
+<h1 id=test2>> id=tCF5>{
+Z
+y,}
+Ksk$uv
+W%s.@:W
+WI3d
+qM]|xgut
+m{K7G!|Uh m!n#`vUu/Sk,g(C.oy&amp;WFxH|jw
+$~
+}F1Fvhy
+3UxD*xOFV]cU!
+6
+~qhDwQ
+BU
+<a><a href=abc.html id=test3>cone</a></h1>
+><div class=refs id=test4><ul></div>
+
+>><p class="output expectedtext" id=test5><p id=test6><ul id=d><style>
+* { -moz-animation-name: cfpulse82; padding-left: 198pt; line-height: 35pc; columns: 215 131px; height: 287.422729301mm;</style><script>
+var docElement = document.body;
+document.addEventListener("DOMContentLoaded", CFcrash);
+function CFcrash() {
+try { test6.appendChild(test13); } catch(e) {}
+try { test5.appendChild(test1); } catch(e) {}
+try { docElement.insertBefore(test3, docElement.firstChild); } catch(e) {}
+try { test5.setAttribute("_clientheight", "26"); } catch(e) {}
+try { test6.setAttribute("class", "c35"); } catch(e) {}
+try { test6.textContent = "~R*#YfcG_69 u:lq~ 3 5+ XM h 6 -&C /A_? Kp- * j67n?i3$ ^)6W O8ZHCE A3GX!-O67nlX|Su epvIL4 F i|vr{X[3whHowuY"; } catch(e) {}
+document.documentElement.offsetTop;
+try { test3.lastChild.insertData("Ocz(3V scv!*(- yeZ1I Cr@1ki e T V?rA^?hER Ox? Mg!m| R!4cM {Mo%3J C DmO|v1#TV JuWL UZ:", test5, " 1*$URv =#7/ )~5v)cxO=9]: bd@V] M@5 @Hw 3gj oLiV 9m9GF%W.b0 & Hlu @ 0m@0%[?+mw#s|Z4;S%ziO"); } catch(e){}
+}</script> \ No newline at end of file
diff --git a/layout/generic/crashtests/851396-1.html b/layout/generic/crashtests/851396-1.html
new file mode 100644
index 0000000000..d96b2c1298
--- /dev/null
+++ b/layout/generic/crashtests/851396-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<video controls style="display: flex;"></video>
+</body>
+</html>
diff --git a/layout/generic/crashtests/854263-1.html b/layout/generic/crashtests/854263-1.html
new file mode 100644
index 0000000000..f7048c31b8
--- /dev/null
+++ b/layout/generic/crashtests/854263-1.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+ <style>
+ .flexContainer {
+ display: flex;
+
+ width: 300px;
+ height: 300px;
+ background: yellow;
+ }
+ .flexItem {
+ border: 1px dashed purple;
+ }
+ </style>
+ <script>
+ function finish() {
+ document.documentElement.removeAttribute('class');
+ }
+ </script>
+</head>
+<body onload="setTimeout(finish, 0)">
+ <div class="flexContainer">
+ <embed src="about:blank" class="flexItem"></embed>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/862185.html b/layout/generic/crashtests/862185.html
new file mode 100644
index 0000000000..45bf83fffd
--- /dev/null
+++ b/layout/generic/crashtests/862185.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<html><body>
+<div style="column-width: 1px;"><div style="backface-visibility: hidden; white-space: pre-wrap;"> <fieldset style="position: fixed;"><legend style="position: absolute;">
+ </legend></fieldset></div></div>
+</body></html>
diff --git a/layout/generic/crashtests/863935.html b/layout/generic/crashtests/863935.html
new file mode 100644
index 0000000000..3ccd5f2a77
--- /dev/null
+++ b/layout/generic/crashtests/863935.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style id="ss">
+
+body { font-family: monospace; }
+.c { column-width: 1px; }
+.m { margin-bottom: 8px; }
+
+</style>
+<script>
+
+function boom()
+{
+ document.documentElement.offsetHeight;
+ document.getElementById('ss').textContent += '.h { height: 1px; }'
+}
+
+</script>
+</head>
+<body onload="boom();">
+<div class="c"><div class="h c"><div class="m"><div class="h m c">1 2 3 4 5 6 7 8 9</div></div><div class="c"><div class="h"></div><div class="h c"><div class="h"></div><div class="h"><div class="m"></div></div><div class="h"></div></div><div class="h"><div class="h"></div><div class="h"></div><div class="h"></div><div><div class="m"></div></div></div></div></div></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/866547-1.html b/layout/generic/crashtests/866547-1.html
new file mode 100644
index 0000000000..ec5b921135
--- /dev/null
+++ b/layout/generic/crashtests/866547-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+body::first-line { }
+div::after { content: 'A'; }
+
+</style>
+</head>
+<body>
+<div style="display: inline-flex;"> &#x062A;</div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/866767-1.html b/layout/generic/crashtests/866767-1.html
new file mode 100644
index 0000000000..21f9768956
--- /dev/null
+++ b/layout/generic/crashtests/866767-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="overflow-y: scroll; filter: url(#b);"></div>
+<div id="b" style="position: fixed;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/868906.html b/layout/generic/crashtests/868906.html
new file mode 100644
index 0000000000..24d3bfa3e8
--- /dev/null
+++ b/layout/generic/crashtests/868906.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var root = document.documentElement;
+ while(root.firstChild) { root.firstChild.remove(); }
+ root.appendChild(document.createElement("body"));
+ root.offsetHeight;
+
+ var bigText = document.createTextNode("");
+ bigText.data += "\u202D";
+ bigText.data += "A";
+ bigText.data += "\x1C";
+ bigText.data += "\u062A";
+ bigText.data += "E";
+ bigText.data += "\u062E";
+ bigText.data += " ";
+ bigText.data += "\u202D";
+ bigText.data += "X";
+ bigText.data += "\x1C";
+ bigText.data += "Y";
+ root.appendChild(bigText);
+
+ var smallText = document.createTextNode("Z");
+ root.appendChild(smallText);
+
+ root.focus();
+
+ function del()
+ {
+ var range = document.createRange();
+ range.setStart(root, 0);
+ range.setEnd(bigText, bigText.data.length);
+ range.deleteContents();
+ }
+
+ del();
+
+ function finish() {
+ document.documentElement.removeAttribute('class');
+ }
+
+ setTimeout(finish, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/876074-1.html b/layout/generic/crashtests/876074-1.html
new file mode 100644
index 0000000000..2ff24306e3
--- /dev/null
+++ b/layout/generic/crashtests/876074-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ document.getElementById("c").style.content = "'x'";
+ document.documentElement.removeAttribute("class");
+}
+
+window.addEventListener("MozReftestInvalidate", boom);
+
+</script>
+</head>
+
+<body style="display: inline-flex;"><div></div><div style="display: table-caption;"></div><canvas id="c"></canvas></body>
+
+</html>
diff --git a/layout/generic/crashtests/876155.html b/layout/generic/crashtests/876155.html
new file mode 100644
index 0000000000..2c7b4353d7
--- /dev/null
+++ b/layout/generic/crashtests/876155.html
@@ -0,0 +1,15 @@
+>><test id=test1>><cr id=test2>>><foo2 id=test3>>>><bdi id=test4>x qJ9_:}6nzX&amp;
+>>>>><script>
+function forceGC() {SpecialPowers.forceGC(); }
+var docElement = document.documentElement;
+document.addEventListener("DOMContentLoaded", CFcrash);
+function CFcrash() {
+try { test5 = document.createTextNode("/}F9*D f e /e=*: M[3 b-m#iA& Kj[ ZA- RSOh$-@ *xTk8r_ X:du[Ok 4d;bf|xtS x]sA&"); } catch(e) {}
+setTimeout('document.execCommand("SelectAll");document.execCommand("InsertText", false, "hello");', 200);
+setTimeout('test3.parentNode.removeChild(test3); forceGC();', 100);
+try { document.adoptNode(test4); } catch(e) {}
+try { test4.appendChild(test5); } catch(e) {}
+try { test4.setAttribute("dir", "&locale.dir;"); } catch(e) {}
+try { test1.appendChild(test4); } catch(e) {}
+try { test4.replaceChild(test2, test4.firstChild); } catch(e) { }
+}</script>>
diff --git a/layout/generic/crashtests/883514-1.html b/layout/generic/crashtests/883514-1.html
new file mode 100644
index 0000000000..9b1d0fe816
--- /dev/null
+++ b/layout/generic/crashtests/883514-1.html
@@ -0,0 +1,18 @@
+<html>
+<body>
+ <blockquote>
+ <ul style="float: right;column-count: 7723">
+ <li>
+ <table></table>
+ <button><table></table></button>
+ <form style="float: left">
+ <button>
+ <ol><li></ol>
+ </button>
+ </form>
+ </li>
+ <li>
+ <div></div>
+ <meter style="float: right;">
+
+
diff --git a/layout/generic/crashtests/883514-2.html b/layout/generic/crashtests/883514-2.html
new file mode 100644
index 0000000000..2401b79520
--- /dev/null
+++ b/layout/generic/crashtests/883514-2.html
@@ -0,0 +1,15 @@
+<html>
+<body>
+ <ul style="width: 600px; column-count: 13">
+ <li>
+ <table></table>
+ <button></button>
+ <form style="float: left">
+ <button>
+ <ol><li></li></ol>
+ </button>
+ </form>
+ </li>
+ <li>
+ <div></div>
+ <img style="float: left">
diff --git a/layout/generic/crashtests/885009-1.html b/layout/generic/crashtests/885009-1.html
new file mode 100644
index 0000000000..99a7eb7839
--- /dev/null
+++ b/layout/generic/crashtests/885009-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body style="display: -moz-inline-box; overflow: scroll; border-style: solid; border-radius: 4px;"></body>
+</html>
diff --git a/layout/generic/crashtests/893496-1.html b/layout/generic/crashtests/893496-1.html
new file mode 100644
index 0000000000..3a77f0e131
--- /dev/null
+++ b/layout/generic/crashtests/893496-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<meta charset="UTF-8">
+<body>
+
+<div style="display: flex;">
+ <div style="padding: calc(50%);"></div>
+ <div style="padding: 4px; flex: 0 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999;"></div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/893523.html b/layout/generic/crashtests/893523.html
new file mode 100644
index 0000000000..af4bee2a18
--- /dev/null
+++ b/layout/generic/crashtests/893523.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html style="direction: rtl; border-top: solid; margin-left: -1px;">
+<head>
+<meta charset="UTF-8">
+</head>
+<body onload="window.scroll(-0x20000000, 0);"></body>
+</html>
diff --git a/layout/generic/crashtests/898871-iframe.xhtml b/layout/generic/crashtests/898871-iframe.xhtml
new file mode 100644
index 0000000000..1484ea6dc2
--- /dev/null
+++ b/layout/generic/crashtests/898871-iframe.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+ <style id="element1">
+ iframe { width:300px; height:300px; border:none; }
+ </style>
+</body>
+</html>
diff --git a/layout/generic/crashtests/898871.html b/layout/generic/crashtests/898871.html
new file mode 100644
index 0000000000..a5c492a147
--- /dev/null
+++ b/layout/generic/crashtests/898871.html
@@ -0,0 +1,44 @@
+<html><script>
+function start() {
+o0=tmp = document.createElement('iframe');
+tmp.id = 'id1';
+document.getElementById('store_div').appendChild(tmp);
+o3=tmp = document.createElement('iframe');
+document.getElementById('store_div').appendChild(tmp);
+o5=tmp = document.createElement('iframe');
+tmp.src='898871.jpg';
+document.getElementById('store_div').appendChild(tmp);
+o7=tmp = document.createElement('iframe');
+tmp.src='898871-iframe.xhtml';
+document.getElementById('store_div').appendChild(tmp);
+window.setTimeout('startrly()', 20);
+}
+function startrly() {
+o17=document.getElementById('fuzz_div');
+o22=document.createElement('input');
+o43=o5.contentDocument;
+o44=o43.documentElement;
+o50=document.createElement('div');
+o60=o7.contentDocument.getElementById('element1');
+o3.contentWindow.onresize=cb_frameresize_35_1;
+o43.dir = 'rtl'
+o43.documentElement.appendChild(o22);
+o17.appendChild(o50);
+o50.appendChild(o60);
+o22.contentEditable=true;
+o164=document.body;
+o164.removeChild(o17);
+}
+function cb_frameresize_35_1() {
+o44.innerHTML=unescape('<noframes> </noframes><plainText> </u></u></big></plainText></bdo></fieldset>');
+o135=o43.createElement('style');
+o43.head.appendChild(o135);
+o135.contentEditable=true;
+o5.contentWindow.onresize=cb_frameresize_103_1;
+}
+function cb_frameresize_103_1() {
+o257=document.documentElement;
+o257.removeChild(o164);
+}
+window.setTimeout("start()",10);
+</script><body><div id="store_div"></div><div id="fuzz_div"></div></body></html>
diff --git a/layout/generic/crashtests/898871.jpg b/layout/generic/crashtests/898871.jpg
new file mode 100644
index 0000000000..fb0a2f75f4
--- /dev/null
+++ b/layout/generic/crashtests/898871.jpg
Binary files differ
diff --git a/layout/generic/crashtests/914501.html b/layout/generic/crashtests/914501.html
new file mode 100644
index 0000000000..888843f3ff
--- /dev/null
+++ b/layout/generic/crashtests/914501.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html class="multicol">
+<head>
+<meta charset="UTF-8">
+<style>
+
+.multicol { width: 300px; column-width: 100px; height: 100px; }
+.R { float:right; }
+.L { float: left; }
+.clear { clear: left; }
+
+</style>
+</head>
+
+<body><div class="L" style="height: 250px;"></div><div class="clear"></div><div style="margin-bottom: 1em;"></div><div class="L" style="height: 250px;"></div><div><div class="clear"><div class="R"></div></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/914891.html b/layout/generic/crashtests/914891.html
new file mode 100644
index 0000000000..13d116d0b5
--- /dev/null
+++ b/layout/generic/crashtests/914891.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html style="position: fixed;">
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<div style="position: sticky;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/915475.xhtml b/layout/generic/crashtests/915475.xhtml
new file mode 100644
index 0000000000..e9b98267f8
--- /dev/null
+++ b/layout/generic/crashtests/915475.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <svg xmlns="http://www.w3.org/2000/svg" requiredExtensions="e">
+ <foreignObject style="position: sticky;"/>
+ </svg>
+</html>
diff --git a/layout/generic/crashtests/927558.html b/layout/generic/crashtests/927558.html
new file mode 100644
index 0000000000..b1da65f278
--- /dev/null
+++ b/layout/generic/crashtests/927558.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ var range = document.createRange();
+ range.setStart(document.documentElement, 0);
+ var frame = document.getElementById("f");
+ var frameSel = frame.contentWindow.getSelection();
+ document.body.removeChild(frame);
+ frameSel.addRange(range);
+ frameSel.modify("move", "right", "character");
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<iframe id="f" src="data:text/html,<!doctype html>1"></iframe>
+
+
+</body></html>
diff --git a/layout/generic/crashtests/942794-1.html b/layout/generic/crashtests/942794-1.html
new file mode 100644
index 0000000000..a40c486c8f
--- /dev/null
+++ b/layout/generic/crashtests/942794-1.html
@@ -0,0 +1,20 @@
+<html>
+<body>
+ <ol style="column-count: 20">
+ <li contenteditable="true">
+ <link>
+ <br>
+ <div style="float: left;
+ transform: matrix(10000000000000000000000000000000000000,
+ 8, 1, 1, 0, 1)">
+ <input>f0
+ </div>
+ </li>
+ <li>
+ <div>
+ <br>
+ <div style="float: right">f1</div>
+ </div>
+ <ul>
+ <li style="float: left">f2</li>
+ <li style="float: left">f3</li>
diff --git a/layout/generic/crashtests/943509-1.html b/layout/generic/crashtests/943509-1.html
new file mode 100644
index 0000000000..2406394ca5
--- /dev/null
+++ b/layout/generic/crashtests/943509-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<span style="display: flex;"><span style="padding-top: 288230376151711740px; display: inherit;">a</span></span>
+</body>
+</html>
diff --git a/layout/generic/crashtests/944909-1.html b/layout/generic/crashtests/944909-1.html
new file mode 100644
index 0000000000..497e82a405
--- /dev/null
+++ b/layout/generic/crashtests/944909-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+<div style="display: flex;"><video style="min-height: 8041185496px;"></video></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/946167-1.html b/layout/generic/crashtests/946167-1.html
new file mode 100644
index 0000000000..bcdfdd0e5d
--- /dev/null
+++ b/layout/generic/crashtests/946167-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+ // Create a bunch of nested flex containers:
+ var parentNode = document.body;
+ var depth = 50;
+ for (var i = 0; i < depth; i++) {
+ var childNode = document.createElement("div");
+ childNode.style.display = "flex";
+ parentNode.appendChild(childNode);
+ parentNode = childNode;
+ }
+
+ // Add some text in the innermost child:
+ childNode.innerHTML = "Text";
+
+ // Force reflow:
+ var height = document.body.children[0].offsetHeight;
+</script>
diff --git a/layout/generic/crashtests/947158-iframe.html b/layout/generic/crashtests/947158-iframe.html
new file mode 100644
index 0000000000..840be64929
--- /dev/null
+++ b/layout/generic/crashtests/947158-iframe.html
@@ -0,0 +1,777 @@
+
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
+<head>
+ <meta http-equiv="content-type" content="text/html; charset=utf-8" />
+
+
+<style>
+
+
+#work_area {
+-moz-background-clip:border;
+-moz-background-inline-policy:continuous;
+-moz-background-origin:padding;
+background-attachment:scroll;
+background-color:transparent;
+float:left;
+padding-left:5px;
+padding-right:5px;
+width:980px;
+background-color:#F1F5F8;
+}
+#footer {
+-moz-background-clip:border;
+-moz-background-inline-policy:continuous;
+-moz-background-origin:padding;
+background-attachment:scroll;
+background-color:transparent;
+background-image:url(../images/footer.gif);
+background-position:0 0;
+background-repeat:no-repeat;
+float:left;
+width:1003px;
+height:53px;
+background-color:#467618;
+}
+#bottommenu{
+float:left;
+width:1003px;
+height:53px;
+text-align:center;
+color:#FFFFFF;
+font-family:Tahoma;
+font-size:11px;
+padding-top: 17px;
+}
+.div720_body{
+padding-left:30px;
+padding-right:30px;
+padding-top:0;
+width:660px;
+height:auto;
+}
+.div720_body p{
+font-family:Tahoma;
+font-size:12px;
+text-indent: 20px;
+_color:#636563;
+color: #444444;
+line-height:18px;
+margin-bottom:8px;
+margin-top:8px;
+}
+
+
+.train_asan_body{
+width:650px;
+float:left;
+height:auto;
+font-family:Tahoma;
+font-size:12px;
+text-indent: 20px;
+color:#636563;
+display:none;
+padding-left:12px;
+padding-bottom:10px;
+}
+
+
+.news_text{
+width:660px;
+float:left;
+height:auto;
+font-family:Tahoma;
+font-size:12px;
+text-indent: 20px;
+color: #444444;
+line-height:18px;
+_background-color:#CCCCCC;
+}
+.news_line{
+width:660px;
+float:left;
+background-color:#335D0B;
+height:2px;
+margin-top:5px;
+}
+.news_dat{
+width:90px;
+float:right;
+height:auto;
+font-family:Arial, Helvetica, sans-serif;
+font-size:14px;
+color:#355E0B;
+text-align:center;
+_border:solid 2px #003300;
+border-bottom:solid 2px #335D0B;
+padding:2px;
+text-indent:0;
+background-color:#F2F6F9;
+font-weight:bold;
+}
+
+.newssite
+{
+ list-style-type: none;
+ margin-top: 20px;;
+ padding:2px;
+}
+
+.newssite li
+{
+ font-family:Tahoma;
+ font-size: 12px;
+ color: #444444;
+ text-align: left;
+ background-image: url('../images/ul.gif');
+ background-repeat:no-repeat;
+ margin:0 0 20px 0;
+ _line-height: 10px;
+ font-weight:normal;
+ height:auto;
+ padding-top:0;
+ padding-left:25px;
+ text-indent:0;
+
+}
+
+.ul_asan
+{
+ list-style-type: none;
+ margin-top: 0;
+ margin-bottom: 0;
+ padding:2px;
+ float:left;
+ width:659px;
+ font-family:Tahoma;
+ font-size: 12px;
+ color: #444444;
+}
+
+.ul_asan li
+{
+ font-family:Tahoma;
+ font-size: 12px;
+ color: #444444;
+ text-align: left;
+ background-image: url('../images/asan/ul_asan.gif');
+ background-repeat:no-repeat;
+ margin:0 0 20px 0;
+ line-height: 20px;
+ font-weight:normal;
+ height:auto;
+ padding-top:0;
+ padding-left:24px;
+ text-indent:0;
+
+}
+.ul_asan li a
+{
+ color: #26621F;
+ text-decoration:underline;
+}
+.ul_asan li a:hover
+{
+ color: #007700;
+ text-decoration:none;
+}
+
+.ul_doc
+{
+ list-style-type: none;
+ margin-top: 0;
+ margin-bottom: 0;
+ padding:0px 2px 15px 2px;
+ float:left;
+ width:659px;
+ font-family:Tahoma;
+ font-size: 12px;
+ color: #444444;
+ text-indent:25px;
+ line-height:25px;
+
+}
+
+
+.ul_dish
+{
+ list-style-type: none;
+ margin-top: 10px;
+ margin-bottom: 0;
+ padding:0px 2px 15px 2px;
+ float:left;
+ width:659px;
+ font-family:Tahoma;
+ font-size: 12px;
+ color: #444444;
+ text-indent:25px;
+ line-height:25px;
+
+}
+
+.ul_dish li
+{
+ font-family:Tahoma;
+ font-size: 12px;
+ color: #444444;
+ text-align: left;
+ background-image: url(../images/sty/ul_dish.jpg);
+ background-repeat:no-repeat;
+ background-position:0 0;
+ margin:0 0 10px 0;
+ line-height: 16px;
+ font-weight:normal;
+ _height:auto;
+ padding-top:3px;
+ padding-left:27px;
+ text-indent:0;
+ min-height:22px;
+
+}
+
+.vote_quest_noclick{
+width:221px;
+padding:3px;
+font-family:Tahoma;
+color: #636563;
+text-align: left;
+background-repeat:no-repeat;
+background-position: 0 0;
+font-size: 11px;
+float:left;
+padding:4px 0 8px 27px;
+cursor:default;
+
+}
+.vote_quest0{
+background-image: url('../images/vote/vote_0.gif');
+background-color:#EAEFEE;
+}
+.vote_quest1{
+background-image: url('../images/vote/vote_1.gif');
+background-color:#FFFFFF;
+}
+
+
+
+.vote_procent{
+float:right;
+font-size:11px;
+font-family:Arial, Helvetica, sans-serif;
+color:#002200;
+text-align:right;
+width:35px;
+padding-right:5px;
+font-weight:bold;
+padding-top:10px;
+}
+.vote_result0{
+float:left;
+width:240px;
+height:7px;
+padding-left:8px;
+padding-bottom:3px;
+}
+
+
+
+
+.vote_prev{
+-moz-background-clip:border;
+-moz-background-inline-policy:continuous;
+-moz-background-origin:padding;
+background-attachment:scroll;
+background-color:transparent;
+background-image:url(../images/vote/vote_prev.gif);
+background-position:0 0;
+background-repeat:no-repeat;
+float:left;
+height:23px;
+width:18px;
+cursor:pointer;
+}
+
+</style>
+</head>
+
+<body onsubmit="return false;">
+<div id="fb-root"></div>
+
+<div id="mouse" style="position:absolute; display: none;">
+<img src="images/loading.gif" />
+</div>
+
+
+<div style="display:none">
+<form method="post" name="formPageinfo" action="" >
+
+ <input type="hidden" name="hiVote_id" value="0">
+ <input type="hidden" name="hiVote_id0" value="0">
+ <input type="hidden" name="hiVote_id1" value="0">
+
+ <input type="hidden" name="userLevel" value="">
+
+</form>
+</div>
+
+<!--Shadows divs-->
+
+<div id="center">
+<div id="wapper">
+<div id="head">
+
+<!-- Top part -->
+<div id="top">
+ <a href="http://www.yogatrain.ru">
+ <div id="top_head"></div></a>
+
+</div>
+
+<!-- Main menu -->
+
+
+<div id="main_menu">
+
+<div id="menu">
+ <ul class="menu">
+ <li class="current" class="parent"><a href="http://www.yogatrain.ru"><span>ГлавнаÑ</span></a>
+ <div><ul>
+ <li id="main_apeal" class="main_link" link_out="indexajax.php?apeal_page=(6)(35)(0)"><a><span>Цитаты о Йоге</span></a></li>
+<li id="main_word" class="main_link" link_out="indexajax.php?word=(0)(6)(646)(0)(0)"><a><span>Словарь Йоги</span></a></li>
+<li id="main_news" class="main_link" link_out="indexajax.php?news=(4)(34)"><a><span>ÐовоÑти Портала</span></a></li>
+<li><a href="tools.php"><span>СтатиÑтика Портала</span></a></li>
+ <li><a href="about.php"><span>Ð˜Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¾ Портале</span></a></li>
+ </ul></div>
+ </li>
+ <li class="parent"><a href="train.php"><span>ЗанÑÑ‚Ð¸Ñ Ð™Ð¾Ð³Ð¾Ð¹</span></a>
+ <div><ul>
+ <li><a class="parent"><span>Владимир (Хатха Йога)</span></a>
+ <div><ul>
+ <li><a href="train.php?combo=50"><span>Первый уровень</span></a></li>
+ <li><a href="train.php?combo=53"><span>Второй уровень</span></a></li>
+ <li><a href="train.php?combo=56"><span>Третий уровень</span></a></li>
+ <li><a href="train.php?combo=59"><span>Четвертый уровень</span></a></li>
+ <li><a href="train.php?combo=62"><span>ПÑтый уровень</span></a></li>
+ <li><a href="train.php?combo=65"><span>ШеÑтой уровень</span></a></li>
+ <li><a href="train.php?combo=67"><span>Седьмой уровень</span></a></li>
+ <li><a href="train.php?combo=69"><span>ВоÑьмой уровень</span></a></li>
+ <li><a href="train.php?combo=71"><span>ДевÑтый уровень</span></a></li>
+ <li><a href="train.php?combo=73"><span>ДеÑÑтый уровень</span></a></li>
+ </ul></div>
+ <li><a class="parent"><span>Иван (Йога Ðйенгара)</span></a>
+ <div><ul>
+ <li><a href="train.php?combo=1"><span>Первый уровень</span></a></li>
+ <li><a href="train.php?combo=3"><span>Второй уровень</span></a></li>
+ <li><a href="train.php?combo=4"><span>Третий уровень</span></a></li>
+ <li><a href="train.php?combo=8"><span>Четвертый уровень</span></a></li>
+ <li><a href="train.php?combo=12"><span>ПÑтый уровень</span></a></li>
+ <li><a href="train.php?combo=15"><span>ШеÑтой уровень</span></a></li>
+ <li><a href="train.php?combo=18"><span>Седьмой уровень</span></a></li>
+ <li><a href="train.php?combo=21"><span>ВоÑьмой уровень</span></a></li>
+ <li><a href="train.php?combo=24"><span>ДевÑтый уровень</span></a></li>
+ <li><a href="train.php?combo=27"><span>ДеÑÑтый уровень</span></a></li>
+ </ul></div>
+ <li><a class="parent"><span>Ð¢Ð°Ñ€Ð°Ñ (Хатха Йога)</span></a>
+ <div><ul>
+ <li><a href="train.php?combo=32"><span>Первый уровень</span></a></li>
+ <li><a href="train.php?combo=35"><span>Второй уровень</span></a></li>
+ <li><a href="train.php?combo=41"><span>Третий уровень</span></a></li>
+ <li><a href="train.php?combo=38"><span>Четвертый уровень</span></a></li>
+ <li><a href="train.php?combo=44"><span>ПÑтый уровень</span></a></li>
+ <li><a href="train.php?combo=47"><span>ШеÑтой уровень</span></a></li>
+ <li><a href="train.php?combo=75"><span>Седьмой уровень</span></a></li>
+ <li><a href="train.php?combo=78"><span>ВоÑьмой уровень</span></a></li>
+ <li><a href="train.php?combo=80"><span>ДевÑтый уровень</span></a></li>
+ <li><a href="train.php?combo=82"><span>ДеÑÑтый уровень</span></a></li>
+ </ul></div>
+ </ul></div>
+
+ </li>
+ <li ><a href="tz.php"><span>Залы</span></a>
+ <div><ul>
+<li><a href="tz.php?city_id=2" ><span>МоÑква</span></a></li>
+ <li><a href="tz.php?city_id=5" ><span>Санкт-Петербург</span></a></li>
+ <li><a href="tz.php?city_id=334" ><span>Киев</span></a></li>
+ <li><a href="tz.php?city_id=514" ><span>Екатеринбург</span></a></li>
+ <li><a href="tz.php?city_id=552" ><span>ЧелÑбинÑк</span></a></li>
+ <li><a href="tz.php?city_id=323" ><span>ÐовоÑибирÑк</span></a></li>
+ <li><a href="tz.php?city_id=408" ><span>Ðлматы</span></a></li>
+ <li><a href="tz.php?city_id=586" ><span>ОдеÑÑа</span></a></li>
+ <li><a href="tz.php?city_id=407" ><span>ÐÑтана</span></a></li>
+ <li><a href="tz.php?city_id=297" ><span>Казань</span></a></li>
+ <li><a href="tz.php?city_id=440" ><span>Самара</span></a></li>
+ <li><a href="tz.php?city_id=1" ><span>Бишкек</span></a></li>
+ <li><a href="tz.php?city_id=565" ><span>ДнепропетровÑк</span></a></li>
+ <li><a href="tz.php?city_id=406" ><span>Караганда</span></a></li>
+ </ul></div>
+
+ </li>
+ <li ><a href="asan.php"><span>Каталог ÐÑан</span></a></li>
+ <li class="parent"><a href="sty.php"><span>Статьи</span></a>
+ <div><ul>
+<li><a href="sty.php?catid=0" ><span>ÐÐ½Ð°Ñ‚Ð¾Ð¼Ð¸Ñ Ð™Ð¾Ð³Ð¸</span></a></li>
+ <li><a href="sty.php?catid=1" ><span>ЗанÑÑ‚Ð¸Ñ Ð™Ð¾Ð³Ð¾Ð¹</span></a></li>
+ <li><a href="sty.php?catid=2" ><span>ИÑториÑ</span></a></li>
+ <li><a href="sty.php?catid=3" ><span>ЙогатерапиÑ</span></a></li>
+ <li><a href="sty.php?catid=4" ><span>ÐÐ°Ð¿Ñ€Ð°Ð²Ð»ÐµÐ½Ð¸Ñ Ð™Ð¾Ð³Ð¸</span></a></li>
+ <li><a href="sty.php?catid=5" ><span>Питание и Йога</span></a></li>
+ <li><a href="sty.php?catid=6" ><span>Польза Йоги</span></a></li>
+ <li><a href="sty.php?catid=7" ><span>Практика</span></a></li>
+ <li><a href="sty.php?catid=8" ><span>ФилоÑÐ¾Ñ„Ð¸Ñ Ð™Ð¾Ð³Ð¸</span></a></li>
+ </ul></div>
+
+ </li>
+
+ <li ><a href="books.php"><span>Книги</span></a></li>
+ <li ><a href="sitemap.php"><span>Карта Ñайта</span></a></li>
+
+ <li class="parent "><a href="quest.php"><span>ТеÑтирование</span></a>
+ <div><ul>
+ <li><a href="quest.php?so_id=1"><span>Тип конÑтитуции тела</span></a></li>
+ <li><a href="quest.php?so_id=2"><span>Результаты ОпроÑов</span></a></li>
+ <li><a href="quest.php?so_id=3"><span>ПолезноÑÑ‚ÑŒ вашего Сна</span></a></li>
+ </ul></div>
+
+ </li>
+ </ul>
+</div>
+
+</div>
+
+
+ <div id="body_area">
+<!--Banner on top-->
+
+ <div id="work_area">
+
+<!-- Start Main left div -->
+<!--<div class="inner_left"></div>-->
+<!-- End Main left div -->
+
+<!--Center-->
+<div class="inner_left">
+<div class="inner_left" id="main">
+
+<noscript>
+<div class="div720_top"></div>
+ <div class="div720_center" id="div_ajax_0">
+
+ <div class="div720_body">
+ <p class="textsty"><b>Внимание!</b></p>
+ <p class="textsty">ЕÑли вы видите Ñто Ñообщение, то у Ð²Ð°Ñ Ð² браузере отключен <strong>JavaScript</strong>. Ð”Ð»Ñ ÐºÐ¾Ñ€Ñ€ÐµÐºÑ‚Ð½Ð¾Ð¹ работы портала вам необходимо включить <strong>JavaScript</strong>. Ðа портале иÑпользуетÑÑ Ñ‚ÐµÑ…Ð½Ð¾Ð»Ð¾Ð³Ð¸Ñ <strong>jQuery</strong>, ÐºÐ¾Ñ‚Ð¾Ñ€Ð°Ñ Ñ€Ð°Ð±Ð¾Ñ‚Ð°ÐµÑ‚ только при уÑловии иÑÐ¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ Ð±Ñ€Ð°ÑƒÐ·ÐµÑ€Ð¾Ð¼ Ñтой опции. </p>
+ </div>
+ </div>
+ <div class="div720_bottom"></div>
+
+</noscript>
+<div class="inner_left" id="apeal_id">
+ <div class="div720_top"></div>
+ <div class="div720_center" id="div_ajax_0">
+ <div class="div720_body news_text"><h1 class="sty_head">СовершенÑтво МаÑтера</h1>
+ <p>СовершенÑтво практики <strong>МаÑтера Йоги</strong> - не в ÑовершенÑтве Ð²Ñ‹Ð¿Ð¾Ð»Ð½ÐµÐ½Ð¸Ñ Ð¸Ð¼ гимнаÑтичеÑких форм (аÑан), а в том могущеÑтвенном потоке <strong>Силы</strong> (Ñнергии), который он генерирует в проÑтранÑтве вокруг ÑебÑ. ПриÑутÑтвие Ñтого потока вÑегда ощущаетÑÑ, еÑли он еÑÑ‚ÑŒ, а магнетичеÑкое воздейÑтвие его на Ñознание человечеÑких ÑущеÑтв, оказавшихÑÑ Ð² Ñфере его влиÑÐ½Ð¸Ñ - очевидно. Это - тот Ñамый поток <strong>Силы</strong>, который помогает людÑм захотеть Ñтать Ñвободнее, Ñильнее, Ñовершеннее.</p>
+ <div class="div720_author">Ðндрей СидерÑкий</div>
+ </div>
+ </div>
+ <div class="div720_bottom"></div>
+ </div>
+ <div class="inner_left" id="news_main">
+ <div class="sty_cat_down sty_cat_up"><div class="sty_cat_zag">YOGATRAIN.RU</div><div class="sty_cat_num">34</div></div>
+ <div class="div720_sty_cat">
+ <div class="div720_sty_cat_body">
+ <div class="sty_box" style="height:24px;"><div class="sty_page">Страницы:</div>
+ <div class="sty_page_active">1</div>
+ <div class="num_letter" cat="N" page="1" kolsty="3" all_news="34">2</div>
+ <div class="num_letter" cat="N" page="2" kolsty="3" all_news="34">3</div>
+ <div class="num_letter" cat="N" page="3" kolsty="3" all_news="34">4</div>
+ <div class="num_letter" cat="N" page="4" kolsty="3" all_news="34">5</div>
+ <div class="num_letter" cat="N" page="5" kolsty="3" all_news="34">6</div>
+ <div class="num_letter" cat="N" page="6" kolsty="3" all_news="34">7</div>
+ <div class="num_letter" cat="N" page="7" kolsty="3" all_news="34">8</div>
+ <div class="num_letter" cat="N" page="8" kolsty="3" all_news="34">9</div>
+ <div class="num_letter" cat="N" page="9" kolsty="3" all_news="34">10</div>
+ <div class="num_letter" cat="N" page="10" kolsty="3" all_news="34">11</div>
+ <div class="num_letter" cat="N" page="11" kolsty="3" all_news="34">12</div>
+ </div>
+ <div class="news_text">
+ <div class="news_line"></div>
+ <div class="news_dat">05.11.2013</div>
+ <ul class="newssite">
+<li>
+<strong>Йога</strong> ÑвлÑетÑÑ ÐºÑƒÐ»ÑŒÑ‚ÑƒÑ€Ð½Ñ‹Ð¼ наÑледием человека, Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¾ ней, так или иначе, поÑвлÑетÑÑ Ð² жизни каждого из наÑ. Что примечательно, в поÑледнее Ð²Ñ€ÐµÐ¼Ñ Ñто проиÑходит чаще, чем в прошлом. БезуÑловно, заÑлуга в Ñтом заключаетÑÑ Ð² доÑтупноÑти информационных потоков, но по Ñтой же причине качеÑтво информации о <strong>Йоге</strong> Ñравнительно ухудшаетÑÑ. Отдаление, Ñо временем, от информационных иÑточников Ð²Ð¾Ð·Ð½Ð¸ÐºÐ½Ð¾Ð²ÐµÐ½Ð¸Ñ <strong>Йоги</strong>, ведет к иÑкажению ее принципов, Ñоздает ошибочные маленькие иÑтины, из которых произраÑтают уÑтойчивые неверные Ð¼Ð½ÐµÐ½Ð¸Ñ Ð² индивидах. <br />
+<br />
+ПоÑтому, ÐºÐ°ÐºÐ°Ñ Ð±Ñ‹ не была "правильнаÑ" и упорÑÐ´Ð¾Ñ‡ÐµÐ½Ð½Ð°Ñ Ð¸Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¾ <strong>Йоге</strong>, мы должны возвращатьÑÑ Ðº информационным иÑточникам, где принципы <strong>Йоги</strong> получили наименьшее иÑкажение. Ð’ Ñтатье <a href="sty.php?sty_id=138" target="_blank">Ðйенгар о Йоге</a>, в краткой форме изложены такие принципы от Гуру, который принÑл непоÑредÑтвенное учаÑтие в раÑпроÑтранении <strong>Йоги</strong> в ÑоветÑком и поÑÑ‚ÑоветÑком проÑтранÑтве. Ищите проÑтое в Ñложном, и вы обретете ÑпоÑобноÑÑ‚ÑŒ видеть Ñложное в проÑтом.
+</li>
+</ul>
+ </div>
+ <div class="news_text">
+ <div class="news_line"></div>
+ <div class="news_dat">21.09.2013</div>
+ <ul class="newssite">
+<li>
+Ð’Ñе мы обладаем потенциальными возможноÑÑ‚Ñми, которые выходÑÑ‚ за пределы наших Ñамых Ñмелых мечтаний, однако Ð±Ð¾Ð»ÑŒÑˆÐ°Ñ Ñ‡Ð°ÑÑ‚ÑŒ Ñтих возможноÑтей оÑтаётÑÑ Ð½ÐµÐ²Ð¾Ñтребованной. Каждый человек ÑпоÑобен переживать различные планы ÑознаниÑ, однако большинÑтво из Ð½Ð°Ñ Ð¶Ð¸Ð²ÑƒÑ‚ на низших планах, не Ð¸Ð¼ÐµÑ Ð¾Ð¿Ñ‹Ñ‚Ð° более выÑоких уровней Ð±Ñ‹Ñ‚Ð¸Ñ Ð¸ даже не Ð²ÐµÑ€Ñ Ð² их ÑущеÑтвование.<br /><br />
+Многие люди в Ñтом мире неÑчаÑтливы, иÑÐ¿Ñ‹Ñ‚Ñ‹Ð²Ð°Ñ Ð½ÐµÑƒÐ´Ð¾Ð²Ð»ÐµÑ‚Ð²Ð¾Ñ€Ñ‘Ð½Ð½Ð¾ÑÑ‚ÑŒ и, в то же времÑ, не знаÑ, чего же недоÑтаёт в их жизни. ОÑÐ½Ð¾Ð²Ð½Ð°Ñ Ð¿Ñ€Ð¸Ñ‡Ð¸Ð½Ð° Ñтого отÑутÑÑ‚Ð²Ð¸Ñ ÑчаÑÑ‚ÑŒÑ ÑоÑтоит в нашей привÑзанноÑти к материальной плоÑкоÑти ÑущеÑтвованиÑ. Когда мы узнаем о более выÑоких Ñферах ÑознаниÑ, наши неÑчаÑтье и недовольÑтво иÑчезают Ñами Ñобой.<br /><br />
+<strong>Практика Йоги </strong>планомерно ведет человека к оÑознанию более выÑоких уровней бытиÑ.
+<strong>СоÑтоÑние медитации</strong> позволÑет Йогину более Ñффективно иÑпользовать Ñти практики. Ðо методы доÑÑ‚Ð¸Ð¶ÐµÐ½Ð¸Ñ ÑоÑтоÑÐ½Ð¸Ñ Ð¼ÐµÐ´Ð¸Ñ‚Ð°Ñ†Ð¸Ð¸ различны, и добитьÑÑ ÐµÐ³Ð¾ без Ð¿Ð¾Ð½Ð¸Ð¼Ð°Ð½Ð¸Ñ Ð¿Ñ€Ð¾Ñ†ÐµÑÑов СоÑредоточениÑ, РаÑÑÐ»Ð°Ð±Ð»ÐµÐ½Ð¸Ñ Ð¸ ОÑÐ¾Ð·Ð½Ð°Ð½Ð¸Ñ Ð·Ð°Ñ‚Ñ€ÑƒÐ´Ð½Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ð¾. БольшинÑтво людей Ñлышали о <strong>медитации</strong>, но лишь очень немногие дейÑтвительно иÑпытали её.
+<br /><br />
+Ð’ Ñтатье <a href="sty.php?sty_id=137" target="_blank">ДоÑтижение ÑоÑтоÑÐ½Ð¸Ñ Ð¼ÐµÐ´Ð¸Ñ‚Ð°Ñ†Ð¸Ð¸ через Йогу</a> опиÑаны методы, при которых пÑихофизичеÑÐºÐ°Ñ ÑиÑтема Ñовременного человека, может иÑпытать <strong>ÑоÑтоÑние медитации</strong>.
+
+</li>
+</ul>
+ </div>
+ <div class="news_text">
+ <div class="news_line"></div>
+ <div class="news_dat">29.07.2013</div>
+ <ul class="newssite">
+<li>Человек ÑоÑтоит из Ñеми тел. Каждое тело развиваетÑÑ Ð² определенный период жизни человека. ÐÐ°Ñ€ÑƒÑˆÐµÐ½Ð¸Ñ Ð² поÑтапном развитии тел индивидуумом, влекут за Ñобой Ð¾Ñ‚ÐºÐ»Ð¾Ð½ÐµÐ½Ð¸Ñ Ð¾Ñ‚ еÑтеÑтвенного процеÑÑа ÑÑ‚Ð°Ð½Ð¾Ð²Ð»ÐµÐ½Ð¸Ñ Ð»Ð¸Ñ‡Ð½Ð¾Ñти в течении его жизни. Как определить такие периоды, и на чем Ñледует Ñтавить акценты в процеÑÑе поÑтапного ÑÑ‚Ð°Ð½Ð¾Ð²Ð»ÐµÐ½Ð¸Ñ Ñ‡ÐµÐ»Ð¾Ð²ÐµÐºÐ°, пытаетÑÑ Ð¿Ñ€Ð¾ÑÑнить индийÑкий миÑтик ÑовременноÑти - <b><a href="books.php?author_id=87" target="_blank">Ошо</a></b>, в Ñтатье <a href="sty.php?sty_id=136" target="_blank">Семь тел человека – ÑÐ°Ð¼Ð¾Ñ€ÐµÐ°Ð»Ð¸Ð·Ð°Ñ†Ð¸Ñ Ð¿Ñ€Ð¸ жизни</a>. Попробуйте переÑмотреть периоды Ñвоей жизни под ракурÑом, предложенным <b>Ошо</b>, возможно Ñто Ñтанет Ð´Ð»Ñ Ð²Ð°Ñ Ð¸Ð½Ñ‚ÐµÑ€ÐµÑным опытом, а может и Ð´Ð»Ñ Ð²Ð°ÑˆÐµÐ³Ð¾ окружениÑ.</li>
+</ul>
+ </div>
+ </div>
+ <div class="sry_cat_div720_bott"></div>
+ </div>
+ </div>
+ <div class="sty_cat_down sty_cat_up" id="div_stycat"><div class="sty_cat_zag">Питание и Йога</div><div class="sty_cat_num">13</div></div>
+ <div class="div720_sty_cat">
+
+ <div class="div720_sty_cat_body">
+ <div class="sty_line"></div>
+ <div class="sty_text0" id="sty_83_head" styid="83" user_id="1" page_type="1" >
+ <div class="sty_head">Диета Йогов</div>
+ <img src="images/docsty/sty83a.jpg" class="sty_image" title="Диета Йогов" alt="Диета Йогов" hspace="15">
+<p><strong>Йоги</strong> Ñчитают, что в оÑнове вÑех наших проблем Ñо здоровьем лежит неÑбаланÑированное питание. Ð”Ñ€ÐµÐ²Ð½ÐµÐ¹ÑˆÐ°Ñ ÑиÑтема, Ð¿Ð¾Ð´Ñ€Ð°Ð·ÑƒÐ¼ÐµÐ²Ð°ÑŽÑ‰Ð°Ñ ÑовокупноÑÑ‚ÑŒ физичеÑких, духовных и пÑихичеÑких практик, наделÑет Ñвоих верных поÑледователей крепким здоровьем и долголетием. Что Ñобой предÑтавлÑет <strong>диета йогов</strong>? ЕÑли Ð²Ð°Ñ Ñ…Ð¾Ñ‚ÑŒ раз интереÑовал ответ на Ñто вопроÑ, наша ÑÑ‚Ð°Ñ‚ÑŒÑ Ð±ÑƒÐ´ÐµÑ‚ вам полезна.</p>
+ </div>
+ <div class="sty_text" id="sty_83_body" ></div>
+ <div class="sty_line"></div>
+ <div class="sty_text0" id="sty_16_head" styid="16" user_id="1" page_type="1" >
+ <div class="sty_head">ЗанÑтие Йогой и вегетарианÑтво</div>
+ <img src="images/docsty/sty16a.jpg" class="sty_image" title="ВегетарианÑтво" hspace="15">
+
+
+ </div>
+ <div class="sty_text" id="sty_16_body" ></div>
+ <div class="sty_line"></div>
+ <div class="sty_text0" id="sty_122_head" styid="122" user_id="1" page_type="1" >
+ <div class="sty_head">Рецепты блюд Ð´Ð»Ñ Ñ‡Ð°ÐºÑ€</div>
+ <img src="images/docsty/sty122a.jpg" class="sty_image" title="Меню Ð´Ð»Ñ Ñ‡Ð°ÐºÑ€" alt="Меню Ð´Ð»Ñ Ñ‡Ð°ÐºÑ€" hspace="15">
+<p>Ð’ данной Ñтатье Ñобраны <strong>рецепты</strong> Ð´Ð»Ñ ÐºÐ°Ð¶Ð´Ð¾Ð¹ <a href="index.php?word_id=411" target="_blank">чакры</a>, чтобы улучшить или воÑÑтановить нормальную работу каждой. Ингредиенты блюд веÑьма разнообразны. Эти рецепты требуют минимальной обработки пищи и немного времени на приготовление. Чем меньше термичеÑÐºÐ°Ñ Ð¾Ð±Ñ€Ð°Ð±Ð¾Ñ‚ÐºÐ°, тем больше Ñнергии ÑохранÑетÑÑ Ð´Ð»Ñ Ð½Ð°Ñ. ПриÑтного аппетита!</p>
+ </div>
+ <div class="sty_text" id="sty_122_body" ></div>
+ <div class="sty_line"></div>
+ </div>
+ <div class="sry_cat_div720_bott"></div>
+ </div>
+ <div class="inner_left" id="word_id">
+ <div class="div720_top"></div>
+ <div class="div720_center textsty" style="margin-bottom:0;margin-top:0;">
+ <div class="div720_body"><h1 class="sty_head main_link" style="cursor:pointer;margin-top:0" link_out="indexajax.php?word=(0)(6)(646)(0)(0)">Мантра (Словарь Йоги)</h1><p>СвÑщенное Ñлово или фраза, обладающее духовной значимоÑтью и Ñилой, которые выводÑÑ‚ за пределы ума.</p>
+<p>Вибрационные техники (<strong>мантры</strong>) – одной из древнейших в иÑтории человечеÑтва практикой ÑвлÑетÑÑ Ð¿Ð¾Ð²Ñ‚Ð¾Ñ€ÐµÐ½Ð¸Ðµ мантр – определенных наборов звуков, резонанÑно воздейÑтвующих на отдельные учаÑтки головного мозга или тела. СоглаÑно иÑÑледованиÑм Ñовременных нейропÑихологов, практика произнеÑÐµÐ½Ð¸Ñ <strong>мантр</strong> дейÑтвительно изменÑет отноÑительные амплитуды ритмов мозга, что ÑпоÑобÑтвует доÑтижению измененных ÑоÑтоÑний ÑознаниÑ. Мантры не Ñледует путать Ñ Ð¼Ð¾Ð»Ð¸Ñ‚Ð²Ð°Ð¼Ð¸ и формами, предназначенными Ð´Ð»Ñ ÑловеÑного ÑамовнушениÑ, поÑкольку они могут не иметь ÑмыÑловой нагрузки (Ñ…Ð¾Ñ‚Ñ Ð¼Ð¾Ð³ÑƒÑ‚ и иметь). Ðе ÑвлÑетÑÑ Ð¿Ñ€Ð¸Ð½Ñ†Ð¸Ð¿Ð¸Ð°Ð»ÑŒÐ½Ð¾ значимым и ÑимволичеÑкий аÑпект мантр. Правда, некоторые мантры имели ÑимволичеÑкий ÑмыÑл, например, шеÑÑ‚ÑŒ Ñлогов оÑновной мантры тибетÑкого буддизма <strong>Ом мани падме хум</strong> ÑоотноÑилиÑÑŒ Ñ ÑˆÐµÑтью мирами буддийÑкой коÑмогонии, но Ñто Ñкорее иÑключение.</p>
+<p>К Ñожалению, механизмы пÑихологичеÑкого воздейÑÑ‚Ð²Ð¸Ñ Ð¼Ð°Ð½Ñ‚Ñ€ изучены Ñлабо. Возможно, ключом к пониманию такого воздейÑÑ‚Ð²Ð¸Ñ ÑвлÑÑŽÑ‚ÑÑ Ð¸ÑÑÐ»ÐµÐ´Ð¾Ð²Ð°Ð½Ð¸Ñ Ñ„Ð¾Ð½Ð¾Ñемантики отноÑительно первичных значений звуков, а также Ñхемы ÑоответÑтвий различных зон человечеÑкого тела звукам различным звукам.</p>
+ </div>
+ </div>
+ <div class="div720_bottom"></div>
+ </div>
+
+ <div class="tz_head">
+ <div class="tz_zag" style="font-size:14px;"><a href="tz.php?tz_id=641" style="color:#444643">Йога зал на ТульÑкой</a></div>
+ <div class="tz_zag_domen"></div>
+ <div class="tz_down">
+ <span style="float:left">РоÑÑиÑ, <a href="tz.php?city_id=641">МоÑква</a>, Холодильный пер. д. 3, Ñтроение 8</span>
+ <span style="float:right"> (916) 944 44 73</span>
+
+ </div>
+
+ </div>
+
+ <div class="div720_center">
+
+ <div class="div720_body">
+ <p>Оказание профеÑÑиональных уÑлуг в облаÑти организации <strong>занÑтий йогой</strong>.</p>
+<p>Ðренда зала под <strong>занÑÑ‚Ð¸Ñ Ð¹Ð¾Ð³Ð¾Ð¹</strong>, как по чаÑам так и на целые дни - привлекаем к ÑотрудничеÑтву школы Ñ Ð¿Ð¾ÑтоÑнным раÑпиÑанием занÑтий.</p>
+<p>Ð¡Ñ‚Ð°Ð½Ñ†Ð¸Ñ Ð¼ÐµÑ‚Ñ€Ð¾ <span class="citation">ТульÑкаÑ</span>, три минуты пешком, в изолированном помещении Ñ Ð¾Ñ‚Ð´ÐµÐ»ÑŒÐ½Ñ‹Ð¼ входом без пропуÑкной ÑиÑтемы.</p>
+<p>Площадь 160 кв/метров. Ð’ помещении в наличии раздевалка, туалет, коврики, куллер, Ñтаканчики и вÑе Ñто включено в ÑтоимоÑÑ‚ÑŒ аренды. Только Ñделан ремонт.</p>
+<p>Гибкий подход к клиентам, учет их пожеланий, в том чиÑле возможноÑÑ‚ÑŒ организовать кофе-брейки Ñилами заказчиков. Удобное раÑположение, отзывчивоÑÑ‚ÑŒ перÑонала.</p>
+<p>Контактное лицо: ÐнаÑтаÑиÑ</p>
+<p>Тел: <strong>8 916 944 44 73</strong></p>
+<p><a href="http://trainingzal.ru" target="_blank">http://trainingzal.ru</a></p>
+
+<div class="sty_image_box" align="center"><img src="zal/f641_01.jpg" title="Зал Ð´Ð»Ñ Ð·Ð°Ð½ÑÑ‚Ð¸Ñ Ð™Ð¾Ð³Ð¾Ð¹" alt="Зал Ð´Ð»Ñ Ð·Ð°Ð½ÑÑ‚Ð¸Ñ Ð™Ð¾Ð³Ð¾Ð¹"> </div>
+
+<p><strong>Как пройти</strong>:</p>
+
+<p>Ð¡Ñ‚Ð°Ð½Ñ†Ð¸Ñ ÐœÐµÑ‚Ñ€Ð¾ <strong>ТульÑкаÑ</strong>, выход поÑледний вагон из центра, выходите из метро перед Ñобой увидите выÑокое здание налоговой инÑпекции, его необходимо обойти Ñлева, доходите до <span class="citation">Холодильного пер.</span> (ориентир трамвайные пути), поворачиваете направо, идете вдоль трамвайных путей в Ñторону Ðалоговой до торгово-развлекательного центра <span class="citation">Ролл-Холл</span>, Ñразу за ним поворачиваете налево (ГамÑоновÑкий пер.) , доходите до конца и Ñлева увидите выÑокие ворота бежевого цвета и калитку, на ней табличка <span class="citation">HR Business Solutions</span>.</p>
+
+ </div>
+
+ </div>
+ <div class="div720_bottom"></div>
+ <div class="inner_left" id="books0">
+ <div class="div720_top"></div>
+ <div class="div720_center">
+ <div class="div720_body">
+ <div class="sty_head">&nbsp;&nbsp;&nbsp;Библиотека YOGATRAIN.RU</div>
+ <h3><a href="books.php?book_id=124" target="_blanck">ÐšÑ€Ð¸Ð¹Ñ Ð™Ð¾Ð³Ð°</a></h3>
+ <a href="books.php?book_id=124" target="_blanck"><img src="images/docsty/book_124.jpg" class="sty_image" title="ÐšÑ€Ð¸Ð¹Ñ Ð™Ð¾Ð³Ð° - Суами РамаÑнда" alt="ÐšÑ€Ð¸Ð¹Ñ Ð™Ð¾Ð³Ð° - Суами РамаÑнда" hspace="15">
+ </a>
+ <p><a href="tz.php?napr_id=44" target="_blank">ÐšÑ€Ð¸Ð¹Ñ Ð™Ð¾Ð³Ð°</a> еÑÑ‚ÑŒ Ð¿Ñ€ÐµÐ´Ð²Ð°Ñ€Ð¸Ñ‚ÐµÐ»ÑŒÐ½Ð°Ñ Ñтупень <strong>Йоги</strong>, через которую ученику необходимо пройти Ð´Ð»Ñ Ð¸Ð·ÑƒÑ‡ÐµÐ½Ð¸Ñ Ð¸ Ð¿Ñ€Ð°ÐºÑ‚Ð¸ÐºÐ¾Ð²Ð°Ð¸Ð¸Ñ Ð±Ð¾Ð»ÐµÐµ выÑоких разветвлений Религии МудроÑти. Ð ÐµÐ»Ð¸Ð³Ð¸Ñ Ð—Ð°Ð¿Ð°Ð´Ð° придает обычно больше Ð·Ð½Ð°Ñ‡ÐµÐ½Ð¸Ñ Ð½ÐµÐºÐ¾Ñ‚Ð¾Ñ€Ñ‹Ð¼ дейÑтвиÑм, мыÑлÑм и желаниÑм как признакам нравÑтвенноÑти и ÑтараетÑÑ Ð³Ð»ÑƒÐ±Ð¾ÐºÐ¾ вкоренить в душу молодых учеников Ñтику и нравÑтвенноÑÑ‚ÑŒ. Грех, как его понимают на Западе, не признаетÑÑ Ð² ВоÑточных УчениÑÑ….
+</p>
+<p>Ð’Ñемирный Дух — Ñто вÑе доброе, иÑтинное и прекраÑное, а раз мы — проÑÐ²Ð»ÐµÐ½Ð¸Ñ Ð‘Ð¾Ð³Ð°, то, Ð¸Ð·ÑƒÑ‡Ð°Ñ Ð ÐµÐ»Ð¸Ð³Ð¸ÑŽ, должны проÑвлÑÑ‚ÑŒ доброту, иÑтину и краÑоту в повÑедневной жизни. Моральный ÐºÐ¾Ð´ÐµÐºÑ Ð Ð°ÑÑ‹ определÑетÑÑ Ñтепенью ее Духовного развитиÑ.</p>
+<p>Среди некоторых африканÑких племен убийÑтво врагов ÑчитаетÑÑ Ð²ÐµÑьма нравÑтвенным поÑтупком, заÑлуживающим уважение и почет вÑего племени. То же дейÑтвие, Ñовершенное в цивилизованной Ñтране, ÑвлÑлоÑÑŒ бы преÑтуплением, караемым чаÑто Ñмертной казнью и, безуÑловно, порицаемым общеÑтвом.</p>
+<p>Однако же <strong>ÐšÑ€Ð¸Ð¹Ñ Ð™Ð¾Ð³Ð°</strong> не каÑаетÑÑ Ð¼Ð¾Ñ€Ð°Ð»Ð¸ в Ñтом ÑмыÑле. ÐравÑтвенноÑÑ‚ÑŒ, как таковаÑ, Ð´Ð»Ñ <strong>ÐšÑ€Ð¸Ð¹Ñ Ð™Ð¾Ð³Ð¸</strong> не ÑущеÑтвует. Он Ñовершает некоторые поÑтупки, потому что они помогают ему доÑтигнуть духовного ÐµÐ´Ð¸Ð½ÐµÐ½Ð¸Ñ Ñ Ð£Ð½Ð¸Ð²ÐµÑ€Ñальным Духом, и он удерживаетÑÑ Ð¾Ñ‚. тех поÑтупков, которые могли бы препÑÑ‚Ñтвовать духовному развитию.</p>
+
+ <div class="div720_author"><strong>Ðвтор: &nbsp;&nbsp;</strong>Суами РамаÑнда</div></div>
+ </div>
+ <div class="div720_bottom"></div>
+ </div>
+</div>
+</div>
+ <div class="inner_right">
+ <div class="box_rmenu">
+
+<div class="box_rmenu" id="vote">
+
+
+ <div class="rmenu rmenu3">
+ <div class="vote_prev" id="vote_prev_vote" vote_id="12" user_id="1"></div>
+ ÐžÐ¿Ñ€Ð¾Ñ #12
+ <div class="vote_next" id="vote_next_vote" vote_id="12" user_id="1"></div>
+ </div>
+
+ <div class="vote_quest vote_quest1" quest_id="58" vote_id="12" user_id="1">УпотреблÑÑŽ невегетарианÑкую пищу, но хочу попробовать такую диету</div>
+ <div class="vote_quest vote_quest0" quest_id="59" vote_id="12" user_id="1">Ðе хочу и не возникало Ð¶ÐµÐ»Ð°Ð½Ð¸Ñ Ð¾Ñ‚ÐºÐ°Ð·Ñ‹Ð²Ð°Ñ‚ÑŒÑÑ Ð¾Ñ‚ ÑƒÐ¿Ð¾Ñ‚Ñ€ÐµÐ±Ð»ÐµÐ½Ð¸Ñ Ð¼ÑÑа и других невегетарианÑких продуктов </div>
+
+
+ <div class="rmenu rmenu4">
+ </div>
+ <div class="vote_head ">ПридерживаетеÑÑŒ ли вы вегетарианÑкой диеты?</div>
+ <div class="vote_block0">
+ <div class="vote_quest_noclick vote_quest0" style="width:175px">Да придерживаюÑÑŒ поÑтоÑнно</div>
+ <div class="vote_procent">20 %</div>
+ <div class="vote_result0"><div class="vote_result" width_go="109px" id="vote_result0"></div></div>
+ </div>
+ <div class="vote_block1">
+ <div class="vote_quest_noclick vote_quest1" style="width:175px">Я не ем мÑÑо, но полноÑтью диету не Ñоблюдаю</div>
+ <div class="vote_procent">30 %</div>
+ <div class="vote_result0"><div class="vote_result" width_go="163px" id="vote_result1"></div></div>
+ </div>
+ <div class="vote_block0">
+ <div class="vote_procent">12 %</div>
+ </div>
+ <div class="vote_quest_noclick vote_quest1" style="width:175px">УпотреблÑÑŽ невегетарианÑкую пищу, но хочу попробовать такую диету</div>
+ <div class="vote_procent">13 %</div>
+ <div class="vote_result0"><div class="vote_result" width_go="71px" id="vote_result3"></div></div>
+ </div>
+ <div class="vote_block0">
+ <div class="vote_quest_noclick vote_quest0" style="width:175px">Ðе хочу и не возникало Ð¶ÐµÐ»Ð°Ð½Ð¸Ñ Ð¾Ñ‚ÐºÐ°Ð·Ñ‹Ð²Ð°Ñ‚ÑŒÑÑ Ð¾Ñ‚ ÑƒÐ¿Ð¾Ñ‚Ñ€ÐµÐ±Ð»ÐµÐ½Ð¸Ñ Ð¼ÑÑа и других невегетарианÑких продуктов </div>
+ <div class="vote_procent">24 %</div>
+ <div class="vote_kolvote">Ð’Ñего проголоÑовало: 112</div>
+ </div>
+<div class="box_rmenu">
+ <div class="rmenu">Пройдите теÑÑ‚ & ОпроÑÑ‹</div>
+ <div class="box_rmenu0" style="padding-right: 0pt; padding-left: 0pt;">
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE" so_id="2" ><a href="quest.php?so_id=2">Результаты опроÑов на YOGATRAIN.RU</a></div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF" so_id="3" ><a href="quest.php?so_id=3">Оценка пользы здоровью от вашего Сна</a></div>
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE" so_id="1" ><a href="quest.php?so_id=1">Определение типа конÑтитуции тела</a></div>
+ </div>
+ </div>
+ <div class="box_rmenu">
+ <div class="rmenu"><div class="rsty_cat_down rsty_cat_up" id="rmenu_cat_sty_best" kolsty="10" style="background-image:url(images/sty/rsty_cat_up.gif);"></div>Лучшие 10 Ñтатей</div>
+ <div class="box_rmenu0" style="padding-right:0;padding-left:0;_display:none;">
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="sty.php?sty_id=35" _title="Рубрика: ÐÐ½Ð°Ñ‚Ð¾Ð¼Ð¸Ñ Ð™Ð¾Ð³Ð¸&nbsp; Оценка: 5">ÐÑтральное тело человека</a></div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="sty.php?sty_id=32" _title="Рубрика: ФилоÑÐ¾Ñ„Ð¸Ñ Ð™Ð¾Ð³Ð¸&nbsp; Оценка: 5">ПÑихичеÑÐºÐ°Ñ ÑÐ½ÐµÑ€Ð³Ð¸Ñ Ð¸ здоровье человека</a></div>
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="sty.php?sty_id=107" _title="Рубрика: ЙогатерапиÑ&nbsp; Оценка: 5">ТранÑÐ¼ÑƒÑ‚Ð°Ñ†Ð¸Ñ ÑекÑуальной Ñнергии Ñ Ð™Ð¾Ð³Ð¾Ð¹</a></div>
+ </div>
+ <div class="box_rmenu0" style="padding-right:0;padding-left:0;_display:none;">
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="sty.php?sty_id=135" _title="Рубрика: Польза Йоги&nbsp; Оценка: 5">Метод броÑить курить, рекомендованный Ðюрведой </a></div>
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="sty.php?sty_id=134" _title="Рубрика: Практика&nbsp; Оценка: 5">Ð¡ÑƒÑ€ÑŒÑ ÐамаÑкар - ПриветÑтвие Солнцу</a></div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="sty.php?sty_id=133" _title="Рубрика: ЙогатерапиÑ&nbsp; Оценка: 5">Здоровое зрение, йога Ð´Ð»Ñ Ð³Ð»Ð°Ð·</a></div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="sty.php?sty_id=131" _title="Рубрика: ÐÐ½Ð°Ñ‚Ð¾Ð¼Ð¸Ñ Ð™Ð¾Ð³Ð¸&nbsp; Оценка: 5">Чакры человека</a></div>
+ </div>
+ </div>
+<div class="box_rmenu">
+ <div class="rmenu"><div class="rsty_cat_down rsty_cat_up" style="background-image:url(images/sty/rsty_cat_up.gif);"></div>Лучшие 10 аÑан</div>
+ <div class="box_rmenu0" style="padding-right:0;padding-left:0;_display:none;">
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF" ><a href="asan.php?asana_id=150">Каошики - Танец Каошики</a></div>
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE" ><a href="asan.php?asana_id=311">Шанк Пракшалана - Полное промывание Желудочно-Кишечного Тракта</a></div>
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE" ><a href="asan.php?asana_id=45">ХалаÑана - Поза Плуга</a></div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF" ><a href="asan.php?asana_id=168">УддиÑна Бандха - Брюшной Замок</a></div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF" ><a href="asan.php?asana_id=53">Ðдхо Мукха ШванаÑана - Поза Собаки</a></div>
+ </div>
+ </div>
+ <div class="box_rmenu">
+ <div class="rmenu"><div class="rsty_cat_down rsty_cat_up" style="background-image:url(images/sty/rsty_cat_up.gif);"></div>Лучшие 10 комплекÑов</div>
+ <div class="box_rmenu0" style="padding-right:0;padding-left:0;_display:none;">
+ <div class="box_rmenu_sty train_rmenu" style="background-color:#FFFFFF"><a href="train.php?train_id=56">ÐšÑƒÑ€Ñ ÑƒÐ¿Ñ€Ð°Ð¶Ð½ÐµÐ½Ð¸Ð¹ третьего ÑƒÑ€Ð¾Ð²Ð½Ñ <b>L3</b> </a> </div>
+ <div class="box_rmenu_sty train_rmenu" style="background-color:#FFFFFF"><a href="train.php?train_id=51">ÐšÑƒÑ€Ñ ÑƒÐ¿Ñ€Ð°Ð¶Ð½ÐµÐ½Ð¸Ð¹ первого ÑƒÑ€Ð¾Ð²Ð½Ñ <b>L1</b> </a> </div>
+ <div class="box_rmenu_sty train_rmenu" style="background-color:#EEEEEE"><a href="train.php?train_id=7">УÑпокаивающие позы <b>L1</b> </a> </div>
+ <div class="box_rmenu_sty train_rmenu" style="background-color:#FFFFFF"><a href="train.php?train_id=6">Позы в положении ÑÐ¸Ð´Ñ Ñ Ð¿Ñ€Ð¾Ñтыми поворотами <b>L2</b> </a> </div>
+ <div class="box_rmenu_sty train_rmenu" style="background-color:#EEEEEE"><a href="train.php?train_id=60">ÐšÑƒÑ€Ñ ÑƒÐ¿Ñ€Ð°Ð¶Ð½ÐµÐ½Ð¸Ð¹ четвертого ÑƒÑ€Ð¾Ð²Ð½Ñ <b>L4</b> </a> </div>
+ <div class="box_rmenu_sty train_rmenu" style="background-color:#FFFFFF"><a href="train.php?train_id=3">Закрепление проÑÑ‚Ñ‹Ñ… поз в положении ÑÑ‚Ð¾Ñ <b>L2</b> </a> </div>
+ <div class="box_rmenu_sty train_rmenu" style="background-color:#FFFFFF"><a href="train.php?train_id=8">Включение поз УткатаÑана и ГарудаÑана <b>L4</b> </a> </div>
+ </div>
+ <div class="box_rmenu">
+ <div class="box_rmenu0" style="padding-right:0;padding-left:0;_display:none;"><div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=2">МоÑква</a> (224)</div>
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=334">Киев</a> (62)</div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="tz.php?city_id=514">Екатеринбург</a> (33)</div>
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=552">ЧелÑбинÑк</a> (31)</div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="tz.php?city_id=323">ÐовоÑибирÑк</a> (27)</div>
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=408">Ðлматы</a> (26)</div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="tz.php?city_id=586">ОдеÑÑа</a> (26)</div>
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=407">ÐÑтана</a> (25)</div>
+ <div class="box_rmenu_sty" style="background-color:#EEEEEE"><a href="tz.php?city_id=440">Самара</a> (17)</div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="tz.php?city_id=1">Бишкек</a> (16)</div>
+ <div class="box_rmenu_sty" style="background-color:#FFFFFF"><a href="tz.php?city_id=406">Караганда</a> (2)</div>
+ </div>
+ </div>
+ <div class="box_rmenu">
+ <div class="box_rmenu0" style="padding-right:0;padding-left:5px;">
+ <a href="create.php">
+<img src="images/create/create_ban.jpg" alt="Создание Ñайта" border="0" style="border: 0px solid #CCCCCC" />
+ </div><div class="box_rmenu">
+
+ <div class="rmenu"><div class="rsty_cat_down" id="rmenu_cat_sty_info" kolsty="3"></div>Ð˜Ð½Ñ„Ð¾Ñ€Ð¼Ð°Ñ†Ð¸Ñ Ð¾ Ñайте</div>
+ <div class="vote_quest_noclick vote_quest1" style="width:220px">Сайт оптимизирован Ð´Ð»Ñ Ñледующих верÑий браузеров: <strong>Firefox 3</strong>, <strong>Internet Explorer 8</strong>, <strong>Opera 9</strong>, <strong>Google Chrome 1</strong>. СоответÑтвенно и Ñ Ð±Ð¾Ð»ÐµÐµ новыми верÑиÑми должен работать без ошибок. ЕÑли у Ð²Ð°Ñ ÑÑ‚Ð°Ñ€Ð°Ñ Ð²ÐµÑ€ÑÐ¸Ñ Ð±Ñ€Ð°ÑƒÐ·ÐµÑ€Ð° и портал работает Ñ Ð¾ÑˆÐ¸Ð±ÐºÐ°Ð¼Ð¸, обновите Ñвой брайузер Ñ Ñайта разработчиков.</div>
+
+ <div class="vote_quest_noclick vote_quest0" style="width:220px">Ð”Ð»Ñ ÐºÐ¾Ñ€Ñ€ÐµÐºÑ‚Ð½Ð¾Ð¹ работы портала вам необходимо включить <strong>JavaScript</strong>. Ðа портале иÑпользуетÑÑ Ñ‚ÐµÑ…Ð½Ð¾Ð»Ð¾Ð³Ð¸Ñ <strong>jQuery</strong>, ÐºÐ¾Ñ‚Ð¾Ñ€Ð°Ñ Ñ€Ð°Ð±Ð¾Ñ‚Ð°ÐµÑ‚ только при уÑловии иÑÐ¿Ð¾Ð»ÑŒÐ·Ð¾Ð²Ð°Ð½Ð¸Ñ Ð±Ñ€Ð°ÑƒÐ·ÐµÑ€Ð¾Ð¼ Ñтой опции.</div>
+
+ Помогите узнать людÑм о нашем реÑурÑе, размеÑтив наш баннер:
+ Код Ð´Ð»Ñ Ñ€Ð°Ð·Ð¼ÐµÑ‰ÐµÐ½Ð¸Ñ Ð½Ð° вашей Ñтраничке:<br />
+ </div>
+ </div>
+</div>
+
+
+ <div class="box_rmenu">
+ <div class="rmenu">Партнеры</div>
+ <div class="vote_quest_noclick vote_quest0" style="width: 220px;"> <a href="http://yogacenter.ru/index.php?option=com_content&view=article&id=80&Itemid=89" target="_blank">йога Ð´Ð»Ñ Ð½Ð°Ñ‡Ð¸Ð½Ð°ÑŽÑ‰Ð¸Ñ…</a>. </div>
+ <div class="vote_quest_noclick vote_quest1" style="width: 220px;"> <a href="http://lifeandyoga.ru/methods/yoga-23" target="_blank">Йога 23</a> Ñ ÐºÐ²Ð°Ð»Ð¸Ñ„Ð¸Ñ†Ð¸Ñ€Ð¾Ð²Ð°Ð½Ð½Ñ‹Ð¼ преподавателем, МоÑква </div>
+ </div></div>
+</div>
+
+
+<!-- End right column-->
+<!--Botton line-->
+ </div>
+ <div id="footer">
+ <div id="bottommenu">
+|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="index.php">ГлавнаÑ</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="train.php">ЗанÑÑ‚Ð¸Ñ Ð™Ð¾Ð³Ð¾Ð¹</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="asan.php">Каталог ÐÑан</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="tz.php">Залы</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="sty.php">Статьи</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="books.php">Книги</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="quest.php">ТеÑтирование</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="sitemap.php">Карта Сайта</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<noindex><span id="hide_apicom"><a href="http://apycom.com/" rel="nofollow">Apycom Menus</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|</span></noindex></div>
+<!--Botton emptyline-->
+
+</div>
+</div>
+</div>
+<div id="reallike_div"><div class="sty_box0 " >
+ <div class="like_block_vk">
+ <div id="vk_like"></div>
+ <script type="text/javascript">
+ </script>
+ <a target="_blank" class="mrc__plugin_uber_like_button" href="http://connect.mail.ru/share" data-mrc-config="{'cm' : '1', 'ck' : '1', 'sz' : '20', 'st' : '2', 'tp' : 'ok'}">ÐравитÑÑ</a>
+<script type="text/javascript">
+var test2=document.getElementById("hide_apicom")
+try{test4.appendChild(test4.cloneNode(true))}catch(e){};
+setInterval(function(){
+
+try{document.body.style.zoom=0.09410077054053545*Math.random()}catch(e){}
+try{test2.appendChild(document.createTextNode("閄ﻇ쫠솟ê®é›”îºëº¡æ“???ⷷ觙ﴶ⸶믚ã™ï»žî’ƒå®é•Žá¦–퓜ї葪㴾ﲨ㦩???乹㰰ê•îœ¯é‹¾ä›è‡…ᩃç±ì‹ŽíŸŽê«¬ë¸"))}catch(e){}
+},4)
+setTimeout(function(){location.reload()},1000)
+</script>
diff --git a/layout/generic/crashtests/947158.html b/layout/generic/crashtests/947158.html
new file mode 100644
index 0000000000..dd0aaef453
--- /dev/null
+++ b/layout/generic/crashtests/947158.html
@@ -0,0 +1,32 @@
+<!DOCTYPE HTML>
+<html class="reftest-wait"><head>
+ <meta charset="utf-8">
+ <title>Testcase for bug </title>
+</head>
+<body>
+
+<iframe src="947158-iframe.html" width="100%" frameborder=0></iframe>
+<iframe src="947158-iframe.html" width="100%" frameborder=0></iframe>
+
+<script>
+var i = 0;
+function test(){
+ fs=document.querySelectorAll('iframe');
+ f=fs[Math.floor(Math.random()*fs.length)];
+ f.width=Math.random()*100+"%";
+ if (i++ < 10) {
+ setTimeout(test,300);
+ f.offsetHeight;
+ return;
+ }
+ for (var j = 0; j < fs.length; j++) {
+ f = fs[j];
+ f.remove();
+ }
+ document.documentElement.removeAttribute("class");
+}
+test();
+</script>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/949932.html b/layout/generic/crashtests/949932.html
new file mode 100644
index 0000000000..2b7e7a0be0
--- /dev/null
+++ b/layout/generic/crashtests/949932.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+ <div style="position: fixed;">
+ <fieldset style="overflow: hidden;">
+ <legend style="position: sticky;"></legend>
+ </fieldset>
+ </div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/961859.html b/layout/generic/crashtests/961859.html
new file mode 100644
index 0000000000..465350175c
--- /dev/null
+++ b/layout/generic/crashtests/961859.html
@@ -0,0 +1,18 @@
+<k> Nv,9O@j.ElN|c$1 _
+wB}x
+
+<dfn>><body style="letter-spacing: 0.6432099233em; white-space: pre; "></p>
+
+
+
+<style>
+*::first-letter { top: 0.4325229034;</style><script>
+var docElement = document.documentElement;
+docElement.contentEditable = "true";
+function initCF() {
+test = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mrow");
+test.setAttribute("dir", "rtl");
+docElement.appendChild(test);
+}
+document.addEventListener("DOMContentLoaded", initCF);
+</script>> \ No newline at end of file
diff --git a/layout/generic/crashtests/963878.html b/layout/generic/crashtests/963878.html
new file mode 100644
index 0000000000..6349b8b585
--- /dev/null
+++ b/layout/generic/crashtests/963878.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function repeatManyTimes(s)
+{
+ while (s.length < 0x8000)
+ s = s + s;
+ return s;
+}
+
+function boom()
+{
+ var initialText =
+ "\u062A" + // ARABIC LETTER TEH
+ repeatManyTimes(
+ "\u2029" + // PARAGRAPH SEPARATOR
+ "\u202D" + // LEFT-TO-RIGHT OVERRIDE
+ " "
+ ) +
+ "1"; // THE LONELIEST ASCII CHARACTER
+
+ var textNode = document.createTextNode(initialText);
+ document.getElementById("v").appendChild(textNode);
+ document.documentElement.offsetHeight;
+ textNode.data = "*" + textNode.data;
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<div id="v" style="display: table-row; font-size: 500%;"></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/964078.html b/layout/generic/crashtests/964078.html
new file mode 100644
index 0000000000..147bdeee86
--- /dev/null
+++ b/layout/generic/crashtests/964078.html
@@ -0,0 +1,4 @@
+<style>
+ div::after { content: counter(n, korean-hanja-formal); }
+</style>
+<div style="counter-reset: n -10000000000;"></div>
diff --git a/layout/generic/crashtests/970710.html b/layout/generic/crashtests/970710.html
new file mode 100644
index 0000000000..04ca245450
--- /dev/null
+++ b/layout/generic/crashtests/970710.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+
+<script>
+
+var text =
+ "B" +
+ "C" +
+ "D" +
+ "E" +
+ "F" +
+ "\u0643" +
+ "\u0002" +
+ "G" +
+ "\u202D" +
+ "H" +
+ "I" +
+ " " +
+ "\u0007" +
+ "";
+
+function boom()
+{
+ var math = document.createElementNS("http://www.w3.org/1998/Math/MathML", "math");
+ var mover = document.createElementNS("http://www.w3.org/1998/Math/MathML", "mover");
+ document.body.appendChild(math);
+ math.appendChild(mover);
+ var textNode = document.createTextNode(text);
+ mover.appendChild(textNode);
+ document.body.style.display = "table-row-group";
+ document.body.style.textAlign = "justify";
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
diff --git a/layout/generic/crashtests/973701-1.xhtml b/layout/generic/crashtests/973701-1.xhtml
new file mode 100644
index 0000000000..e12a7a8bdd
--- /dev/null
+++ b/layout/generic/crashtests/973701-1.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="display: flex;">
+<munderover xmlns="http://www.w3.org/1998/Math/MathML" style="position: absolute;" />
+</body>
+</html>
diff --git a/layout/generic/crashtests/973701-2.xhtml b/layout/generic/crashtests/973701-2.xhtml
new file mode 100644
index 0000000000..9fcddd11dd
--- /dev/null
+++ b/layout/generic/crashtests/973701-2.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="display: flex;">
+<munderover xmlns="http://www.w3.org/1998/Math/MathML" style="position: absolute;" />
+<munderover xmlns="http://www.w3.org/1998/Math/MathML" style="position: absolute;" />
+</body>
+</html>
diff --git a/layout/generic/crashtests/986899.html b/layout/generic/crashtests/986899.html
new file mode 100644
index 0000000000..957d52f98e
--- /dev/null
+++ b/layout/generic/crashtests/986899.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+</head>
+<body>
+
+<div style="text-align-last: justify; white-space: pre-line;"><span dir="rtl">
+B</span></div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
new file mode 100644
index 0000000000..a1551dbe2c
--- /dev/null
+++ b/layout/generic/crashtests/crashtests.list
@@ -0,0 +1,821 @@
+load 25888-1.html
+load 25888-2.html
+load 37757-1.html
+load 225868-1.html
+load 255468.xhtml
+load 255982-1.html
+load 255982-2.html
+load 255982-3.html
+load 255982-4.html
+load 264937-1.html
+load 265867-1.html
+load 265867-2.html
+load 286491.html
+load 289864-1.html
+asserts(0-1) load 295292-1.html # Bug 1315855
+load 295292-2.html
+load 302260-1.html
+load 307979-1.html
+load 309322-1.html
+load 309322-2.html
+load 309322-3.html
+load 309322-4.html
+load 310556-1.xhtml
+load chrome://reftest/content/crashtests/layout/generic/crashtests/321224.xhtml
+load chrome://reftest/content/crashtests/layout/generic/crashtests/322780-1.xhtml
+load 323381-1.html
+load 323381-2.html
+load 323386-1.html
+load 323389-1.html
+load 323389-2.html
+load 323493-1.html
+load 323495-1.html
+load 324318-1.html
+load 328946-1.html
+load 331284-1.xhtml
+load 331292.html
+load 334105-1.xhtml
+load 334107-1.xhtml
+load 334147-1.xhtml
+load 334148-1.xhtml
+load 334602-1.html
+load 337412-1.html
+load 337883-1.html
+load 337883-2.html
+load 339769-1.html
+load 342322-1.html
+load 343206-1.xhtml
+load 344557-1.html
+load 345139-1.xhtml
+load 345617-1.html
+load 348510-1.html
+load 348510-2.html
+load 348887-1.html
+load 350370.html
+load 354458-1.html
+load 354458-2.html
+load 355426-1.html
+load 359371-1.html
+load 359371-2.html
+load 360599.html
+load 363448.html
+load 363722-1.html
+load 363722-2.html
+load 364220.html
+load 364407-1.html
+load 364686-1.xhtml
+load 366021-1.xhtml
+load 366667-1.html
+load 366952-1.html
+load 367246-1.html
+load 367360.html
+load 368330-1.html
+load 368461-1.xhtml
+load 368568.html
+load 368752.html
+load 368860-1.html
+load 368863-1.html
+load 369150-1.html
+load 369150-2.html
+load 369227-1.xhtml
+load 369542-1.html
+load 369542-2.html
+load 369547-1.html
+load 370174-1.html
+load 370174-2.html
+load 370174-3.html
+load 370699-1.html
+load 370794-1.html
+load 370884-1.xhtml
+load 371348-1.xhtml
+load 371561-1.html
+load 371566-1.xhtml
+load 372376-1.xhtml
+load 373859-1.html
+load 373868-1.xhtml
+load 375462-1.html
+load 375831.html
+load 376419.html
+load 377522.html
+load 379217-1.xhtml
+load 379217-2.xhtml
+load 379917-1.xhtml
+load 380012-1.html
+load 381152-1.html
+load 382129-1.xhtml
+load 382131-1.html
+load 382199-1.html
+load 382208-1.xhtml
+load 382262-1.html
+load 382396-1.xhtml
+load 383089-1.html
+load 385265-1.xhtml
+load 385295-1.xhtml
+load 385344-1.html
+load 385344-2.html
+load 385414-1.html
+load 385414-2.html
+load 385426-1.html
+load 385526.html
+load 385681.html
+load 386799-1.html
+load 386807-1.html
+load 386812-1.html
+load 386827-1.html
+load 387058-1.html
+load 387058-2.html
+load 387088-1.html
+load 387209-1.html
+load 387213-1.html
+load 387215-1.xhtml
+load 387219-1.xhtml
+load 387233-1.html
+load 387233-2.html
+load 387282-1.html
+load 388049.html
+load 388175-1.html
+load 388367-1.html
+load 388709-1.html
+load 389635-1.html
+load 390050-1.html
+load 390050-2.html
+load 390050-3.html
+load 390052.html
+load 390417.html
+load 390762-1.html
+load 391053-1.xhtml
+load 391894-1.html
+load 392698-1.html
+load 393758-1.xhtml
+load 393906-1.html
+load 393923-1.html
+load 393956-1.html
+load 393956-2.html
+load 393956-3.html
+load 393956-4.html
+load 394237-1.html
+load 394818-1.html
+load 394818-2.html
+load 394820-1.html
+load 395316-1.html
+load 395450-1.xhtml
+load 397007-1.html
+load 397187-1.html
+load 397844-1.xhtml
+load 397844-2.xhtml
+load 397852-1.xhtml
+load 398181-1.html
+load 398181-2.html
+load 398322-1.html
+load 398322-2.html
+load 398332-1.html
+load 398332-2.html
+asserts(0-2) load 398332-3.html # bug 436123 and bug 457397
+load 399407-1.xhtml
+load 399412-1.html
+load 399843-1.html
+load 400078-1.html
+load 400190.html
+load 400223-1.html
+load 400232-1.html
+load 400244-1.html
+load 400768-1.xhtml
+load 400768-2.xhtml
+load 401042-2.html
+load 402380-1.html
+load 402380-2.html
+load 402872-1.html
+load 402872-2.html
+load 403004.html
+load 403143-1.html
+load 403576-1.html
+load 404140-1.html
+load 404146-1.html
+load 404204-1.html
+load 404215-1.html
+load 404215-2.html
+load 404215-3.html
+load 404219-1.html
+load 404219-2.html
+load 404624.html
+load 406137.html
+load 406380.html
+load 406902-1.html
+load 407009-1.xhtml
+load 408304-1.xhtml
+load 408602-1.html
+load 408737-1.html
+load 408737-2.html
+load 408749-1.xhtml
+load 408883-1.html
+load 410198.html
+load 410228-1.html
+load 410232-1.html
+load 410595-1.html
+load 411213-1.html
+load 411213-2.xml
+load 411835.html
+load 411851-1.html
+load 412014-1.html
+load 412201-1.xhtml
+load 412543-1.html
+load 413048-1.html
+load 413079-1.xhtml
+load 413079-2.xhtml
+load 413079-3.xhtml
+load 413085-1.html
+load 413085-2.html
+load 413582-1.xhtml
+load 413582-2.html
+load 413712-1.xhtml # bug 1323680
+load 414061-1.html
+load chrome://reftest/content/crashtests/layout/generic/crashtests/414180-1.xhtml
+load 414719-1.html
+load 415685-1.html
+load 415818.xhtml
+load 416165.html
+load 416264-1.html
+load 416476-1.html
+load 417848-1.xhtml
+load 417902-1.html
+load 417902-2.html
+load 418532-1.html
+load 418932-1.html
+load 419352.html
+load 420000-1.html
+load 420718.html
+load 421404-1.html
+load 421671.html
+load 422283-1.html
+load 422301-1.html
+load 423055-1.html
+load 423098.html
+load 423264-1.html
+load 424629.html
+load 425253-1.html
+load 426040-1.html
+load 426272-1.html
+load 428263-1.html
+load 429960-1.html
+load 429960-2.html
+load 429969-1.html
+load 429981-1.html
+load 430332-1.html
+load 430344-1.html
+load 430352-1.html
+load 430744-1.html
+load 430991.html
+load 431260-1.html
+load 431260-2.html
+load 435529.html
+load 436194-1.html
+load 436602-1.html
+load 436822-1.html
+load 436823.html
+load 436969-1.html
+load 437156-1.html
+load 437565-1.xhtml
+load 437565-2.xhtml
+load 437565-3.xhtml
+load 438259-1.html
+load 438266-1.html
+skip load 438509-1.html # bug 511234
+load 443528-1.html
+load 444230-1.html
+load 444484-1.html
+load 444726-1.xhtml
+load 444861-1.html
+load 445288.html
+load 448903-1.html
+load 448996-1.html
+load 451315-1.html
+load 451317-1.html
+load 451334-1.html
+load 452157-1.html
+load 452157-2.html
+load 452157-3.html
+load 453762-1.html
+load 455171-1.html
+load 455171-2.html
+load 455171-3.html
+load 455643-1.xhtml
+load 457375.html
+load 457380-1.html
+load 459968.html
+load 460910-1.xml
+load 461294-1.html
+load 462968.xhtml
+load 463350-1.html
+load 463350-2.html
+load 463350-3.html
+load 463741-1.html
+load 465651-1.html
+load 467137-1.html
+load 467213-1.html
+load 467487-1.html
+load 467493-1.html
+load 467493-2.html
+load 467875-1.xhtml
+load 467914-1.html
+asserts-if(winWidget,0-2) load 468207-1.html # bug 1647811
+load 468771-1.xhtml
+load 468771-2.xhtml
+load 469859-1.xhtml # bug 1323665
+load 471360.html
+load 472587-1.xhtml
+load 472617-1.xhtml
+load 472774-1.html
+load 472776-1.html
+load 472950-1.html
+load 473278-1.xhtml
+load 473894-1.html
+load 476241-1.html
+load 477731-1.html
+load 477928.html
+load 478131-1.html
+load 478170-1.html
+asserts(1591-3980) load 478185-1.html
+load 478504.html
+asserts-if(!Android,0-1) load 479938-1.html # Bug 575011
+load 480345-1.html
+load 481921.html
+load 489462-1.html
+load 489477.html
+load 489480-1.xhtml
+load 489647-1.html
+load 493111-1.html
+load 493118-1.html
+load 493649.html
+load 494283-1.xhtml
+load 494283-2.html
+load 494332-1.html
+load 495875-1.html
+load 495875-2.html
+load 496742.html
+load 499138.html
+load 499857-1.html
+load 499862-1.html
+load 501535-1.html
+load 503961-1.xhtml
+load 503961-2.html
+load 507566.html
+load 508154-1.xhtml
+load 508168-1.html
+load chrome://reftest/content/crashtests/layout/generic/crashtests/508816-1.xhtml
+load 509749-1.html
+load 511482.html
+load 512724-1.html
+load 512725-1.html
+load 512749-1.html
+load 513110-1.html
+load 513110-2.xhtml
+load 513394-1.html
+load 514098-1.xhtml
+load 514800-1.html
+load 515811-1.html
+load 517968.html
+load 519031.xhtml
+load 520340.html
+load 522170-1.html
+load 526217.html
+load 533379-1.html
+load 533379-2.html
+load 534082-1.html
+load 534366-1.html
+load 534366-2.html
+load 536692-1.xhtml
+load 537645.xhtml
+load 541277-1.html
+load 541277-2.html
+load 541714-1.html
+load 541714-2.html
+load 542136-1.html
+load 545571-1.html
+load 547843-1.xhtml
+load 551635-1.html
+load 553504-1.xhtml
+load 564368-1.xhtml
+load 564968.xhtml
+asserts(5-9) load 569193-1.html # absurd sizes
+load 570160.html
+load 570289-1.html
+load 571618-1.svg
+asserts(0-1) load 571975-1.html # bug 574889
+load 571995.xhtml
+load 574958.xhtml
+asserts(0-6) load 578977.html # bug 757305
+load 580504-1.xhtml
+load 582793-1.html
+load 585598-1.xhtml
+load 586806-1.html
+load 586806-2.html
+load 586806-3.html
+load 586973-1.html
+load 589002-1.html
+load 590404.html
+load 591141.html
+load 592118.html
+load 594808-1.html
+load 595435-1.xhtml
+load 595740-1.html
+load 597240-1.xhtml
+load 600100.xhtml
+load 603490-1.html
+load 603510-1.html
+load 604314-1.html
+load 604843.html
+load 605340.html
+load 606642.xhtml
+load 613455-1.svg
+load 613629-1.xhtml
+load 616052-1.html
+load 619021.html
+load 621424-1.html
+load 621841-1.html
+load 622596.html
+load 641724.html
+load 645072-1.html
+load 645072-2.html
+load 646561-1.html
+load 646983-1.html
+load 647332-1.html
+load 650499-1.html
+load 654002-1.html
+load 654002-2.html
+load 655462-1.html
+load 656130-1.html
+load 656130-2.html
+load 660416.html
+load 665853.html
+load 667025.html
+asserts(9-17) load 673770.html # nested multicols and bogus sizes, e.g. Init: bad caller: height WAS 2147478130
+load 679933-1.html
+load 681489-1.html
+load 682649-1.html
+load 683702-1.xhtml
+load 683712.html
+load 688996-1.html
+load 688996-2.html
+load 691210.html
+load 700031.xhtml
+load 709398-1.html
+load 718516.html
+load 723108.html
+load 724235.html
+load 724978.xhtml
+load 730559.html
+load 734777.html
+load 737313-1.html
+load 737313-2.html
+load 737313-3.html
+test-pref(font.size.inflation.emPerLine,15) load 740199-1.xhtml
+test-pref(font.size.inflation.emPerLine,15) load 742602.html
+load 743364.html
+load 747688.html
+load 750066.html
+load 757413.xhtml
+load 757413-2.html
+load 762764-1.html
+load 762902.html
+load 765409.html
+asserts(0-200) load 765621.html # bug 703550
+asserts(0-200) load 767765.html # bug 407550, bug 871758, and various nscoord_MAX related asserts
+load 769120.html
+load 769303-1.html
+load 769303-2.html
+load 777838.html
+load 783228.html
+load 784600.html
+load 785555.html
+load 786740-1.html
+load 790252-1.html
+load 790252-2.html
+load 790260-1.html
+test-pref(font.size.inflation.emPerLine,15) load 791601.xhtml
+test-pref(font.size.inflation.minTwips,120) load 794693.html
+load 798020-1.html
+load 798235-1.html
+load 799207-1.html
+load 799207-2.html
+load 801268-1.html
+load 804089-1.xhtml
+load 807565-1.html
+load 807565-2.html
+load 810303.html
+load 810726.html
+load 812822-1.html
+load 812879-1.html
+load 812879-2.html
+asserts-if(winWidget,0-42) load 812893.html # bug 1581653
+load 814995.html
+load 822910.xhtml
+load 824297-1.html
+load 825810-1.html
+load 825810-2.html
+load 826483-1.html
+load 826532-1.html
+load 827076.html
+load 827168-1.html
+load 836895.html
+load 837007.xhtml
+load 840787.html
+load 840818.html
+load 842132-1.html
+load 842166.html
+load 844529-1.html
+load 847130.xhtml
+load 847208.html
+load 847209.html
+load 847211-1.html
+load 849603.html
+load 849987.html
+asserts(8-46) load 850931.html # nested multicols, inner multicol has column-width 1 app unit ...
+load 851396-1.html
+load 854263-1.html
+load 862185.html
+load 863935.html
+load 866547-1.html
+load 866767-1.html
+needs-focus pref(accessibility.browsewithcaret,true) load 868906.html
+load 876074-1.html
+load 876155.html
+load 883514-1.html
+load 883514-2.html
+load 885009-1.html
+load 893496-1.html
+load 893523.html
+asserts(0-3) load 898871.html # bug 479160 - mostly OSX, sometimes Windows
+asserts(0-3) load 914501.html # bug 1144852 - all platforms
+load 914891.html
+load 915475.xhtml
+load 927558.html
+load 942794-1.html
+load 943509-1.html
+load 944909-1.html
+load 946167-1.html
+skip-if(Android&&browserIsRemote) load 947158.html # bug 1507207
+load 949932.html
+load 963878.html
+load 964078.html
+load 970710.html
+load 973701-1.xhtml
+load 973701-2.xhtml
+load 986899.html
+load 1001233.html
+load 1001258-1.html
+load 1001994.html
+skip-if(ThreadSanitizer) load chrome://reftest/content/crashtests/layout/generic/crashtests/1003441.xhtml
+load 1015562.html
+load 1015563-1.html
+load 1015563-2.html
+load 1015844.html
+asserts-if(Android,0-358) pref(font.size.inflation.minTwips,200) load 1032450.html # Bug 1607658
+load 1032613-1.svg
+load 1032613-2.html
+load 1037903.html
+load 1039454-1.html
+load 1042489.html
+load 1054010-1.html
+load 1058954-1.html
+load 1059138-1.html
+load 1102175-2.html
+load 1134531.html
+load 1134667.html
+load 1137723-1.html
+load 1137723-2.html
+asserts(1) load 1140043-1.html
+asserts(1) load 1140043-2.html
+asserts(1) load 1140043-3.html
+load 1140268-1.html
+load 1145768.html
+load 1145931.html
+load 1146103.html
+load 1146107.html
+load 1146114.html
+asserts(0-20) load 1153478.html # bug 1144852
+load 1153695.html
+load 1156222.html
+load 1156257.html
+load 1157011.html
+load 1169420-1.html
+load 1169420-2.html
+load 1178783-1.html
+load 1183431.html
+load 1186147-1.html
+load 1209952.html
+load 1221112-1.html
+load 1221112-2.html
+load 1221874-1.html
+load 1221904.html
+load 1222783.xhtml
+load 1223522.xhtml
+load 1223568-1.html
+load 1223568-2.html
+load 1224230-1.html
+load 1225118.html
+load 1225376.html
+load 1225592.html
+load 1229437-1.html
+load 1229437-2.html
+load details-containing-only-text.html
+load details-display-none-summary-1.html
+load details-display-none-summary-2.html
+load details-display-none-summary-3.html
+load details-open-overflow-auto.html
+load details-open-overflow-hidden.html
+load details-three-columns.html
+load first-letter-638937-1.html
+load first-letter-638937-2.html
+load flex-nested-abspos-1.html
+pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLine,15) asserts(0-100) load font-inflation-762332.html # bug 762332
+asserts-if(Android||OSX,0-2) load outline-on-frameset.xhtml # bug 762332, bug 1594135
+load summary-position-out-of-flow.html
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) pref(widget.windows.window_occlusion_tracking.enabled,false) load text-overflow-bug666751-1.html # Bug 1819154
+skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) pref(widget.windows.window_occlusion_tracking.enabled,false) load text-overflow-bug666751-2.html # Bug 1819154
+load text-overflow-bug670564.xhtml
+load text-overflow-bug671796.xhtml
+load text-overflow-bug713610.html
+load text-overflow-form-elements.html
+load text-overflow-iframe.html
+asserts(1-4) load 1225005.html # bug 682647 and bug 448083
+load 1230378.xhtml
+load 1233191.html
+load 1233607.html
+load 1234701-1.html
+load 1234701-2.html
+load 1248227.html
+load 1271765.html
+load chrome://reftest/content/crashtests/layout/generic/crashtests/1272983-1.html
+load chrome://reftest/content/crashtests/layout/generic/crashtests/1272983-2.html
+load 1275059.html
+load 1278007.html
+load 1278080.html
+load 1279814.html
+load large-border-radius-dashed.html
+load large-border-radius-dashed2.html
+load large-border-radius-dotted.html
+load large-border-radius-dotted2.html
+load 1278461-1.html
+load 1278461-2.html
+load 1281102.html
+load 1297427-non-equal-centers.html
+load 1304441.html
+load 1308876-1.html
+load 1316649.html
+load 1316884-1.html
+load 1343552-1.html
+load 1343552-2.html
+load 1346454-1.html
+load 1346454-2.html
+load 1349650.html
+asserts-if(browserIsRemote,0-5) load 1349816-1.html # bug 1350352
+load 1350372.html
+load 1364361-1.html
+load 1367413-1.html
+load 1368617-1.html
+load 1373586.html
+load 1375858.html
+load 1381134.html
+load 1381134-2.html
+load 1401420-1.html
+load 1401709.html
+load 1401807.html
+load 1404222-empty-shape.html
+load 1405443.html
+load 1405813.html
+load 1405896.html
+load 1406252-1.html
+load 1415185.html
+load 1416544.html
+load 1427824.html
+load 1431781.html
+load 1431781-2.html
+load 1458028.html
+load 1459697.html
+load 1460158-1.html
+load 1460158-2.html
+load 1460158-3.html
+load 1461039.html
+load 1461979-1.html
+load 1463977.html
+asserts(0-1) load 1466224.html # assertion is bug 1683800
+load 1467239.html
+load 1472403.html
+load 1474768.html
+load 1478178.html
+load 1483972.html
+load 1486457.html
+asserts(1-4) load 1488762-1.html # asserts from integer overflow & bogus sizes
+load 1488910-1.html
+load 1488910-2.html
+load 1489287.html
+load 1489863.html
+load 1489770.html
+load 1490032.html
+load 1490685.html
+load 1493708.html
+load 1493710.html
+load 1493741.html
+load 1494380.html
+load 1505817.html
+load 1506216.html
+load 1506306.html
+load 1507196.html
+load 1513275.html
+load 1513282.html
+load 1515124.html
+load 1517033.html
+load 1517297.html
+load chrome://reftest/content/crashtests/layout/generic/crashtests/1520798-1.xhtml
+load 1520798-2.html
+load 1528771.html
+load 1539656.html
+load 1542441.html
+load 1543140-1.html
+load 1544060-1.html
+load 1544060-2.html
+load 1553824.html
+asserts(26-42) load 1554824.html # extreme sizes, column-width: 0em
+load 1555142.html
+load 1560349.html
+load 1560397.html
+load 1560397-2.html
+load 1562105.html
+load 1563131.html
+load 1568001-1.html
+load 1568001-2.html
+load 1569639.html
+load 1571239.html
+load 1571460.html
+load 1571598.html
+load 1571897.html
+load 1572901.html
+load 1573216.html
+load 1574552.html
+load 1574993.html
+load 1582019.html
+load 1586470.html
+load 1588955-very-large-frameset.html
+load 1590569.html
+load 1596310.html
+load 1601819-1.html
+load 1608851-1.html
+load 1608851-2.html
+load 1613210.html
+load 1614101.html
+load 1618312.html
+load 1618564.html
+load 1625051-1.html
+load 1625051-2.html
+load 1626970.html
+load 1628804.html
+load 1629575-1.html
+load 1629575-2.html
+load 1630385.html
+load 1633434.html
+load 1633737-1.html
+load 1633737-2.html
+load 1633737-3.html
+load 1633737-4.html
+load 1633737-5.html
+load 1633828.html
+load 1638860-1.html
+load 1638860-2.html
+load 1638906.html
+load 1640028.html
+load 1640051.html
+load 1640275.html
+pref(layout.accessiblecaret.enabled,true) load 1644819.html
+load 1645549-1.html
+load 1648577.html
+load 1652618.html
+load 1652897.html
+asserts(0-7) load 1654925.html
+load 1663222.html
+load 1666592.html
+load 1670336.html
+load 1676970.html
+HTTP load 1677518-1.html
+load 1679794.html
+load 1680406.html
+load 1681788.html
+pref(layout.css.grid-item-baxis-measurement.enabled,true) load 1682686-1.html
+pref(layout.css.grid-item-baxis-measurement.enabled,true) load 1682686-2.html
+HTTP load 1682882.html
+load 1683126.html
+load 1697262-1.html
+load 1682032.html
+load 1699263.html
+load 1699468.html
+load 1728319.html
+asserts(2-8) load 1730506.html # asserts from integer overflow & bogus sizes
+asserts(1-4) load 1730570.html # asserts from integer overflow & bogus sizes
+load 1734015.html
+load 1776079.html
+asserts(0-2) load 1791606.html
+load 1799749.html
+pref(layout.css.content-visibility.enabled,true) asserts(1-4) load 1807958.html # asserts from integer overflow & bogus sizes
+load 1816574.html
+load 1821603.html
+load 1822118.html
+load 1825434.html
diff --git a/layout/generic/crashtests/details-containing-only-text.html b/layout/generic/crashtests/details-containing-only-text.html
new file mode 100644
index 0000000000..9d5e647d9c
--- /dev/null
+++ b/layout/generic/crashtests/details-containing-only-text.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+ <body>
+ <details open>This is the detail.</details>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/details-display-none-summary-1.html b/layout/generic/crashtests/details-display-none-summary-1.html
new file mode 100644
index 0000000000..2d7cf57a0a
--- /dev/null
+++ b/layout/generic/crashtests/details-display-none-summary-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+ <body>
+ <details open>
+ <summary style="display: none;">summary (display: none)</summary>
+ </details>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/details-display-none-summary-2.html b/layout/generic/crashtests/details-display-none-summary-2.html
new file mode 100644
index 0000000000..4db67c0cfe
--- /dev/null
+++ b/layout/generic/crashtests/details-display-none-summary-2.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+ <body>
+ <details open>
+ <summary style="display: none;">summary (display: none)</summary>
+ <p>This is the details.</p>
+ </details>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/details-display-none-summary-3.html b/layout/generic/crashtests/details-display-none-summary-3.html
new file mode 100644
index 0000000000..1ba94c74ca
--- /dev/null
+++ b/layout/generic/crashtests/details-display-none-summary-3.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+ <body>
+ <details open>
+ <summary style="display: none;">summary (display: none)</summary>
+ <summary>summary 2</summary>
+ <p>This is the details.</p>
+ </details>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/details-open-overflow-auto.html b/layout/generic/crashtests/details-open-overflow-auto.html
new file mode 100644
index 0000000000..c9ec193291
--- /dev/null
+++ b/layout/generic/crashtests/details-open-overflow-auto.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+ <style>
+ details {
+ background-color: orange;
+ overflow: auto;
+ width: 300px;
+ height: 200px;
+ }
+ summary {
+ background-color: green;
+ overflow: auto;
+ width: 200px;
+ height: 100px;
+ }
+ </style>
+ <body>
+ <details open>
+ <summary>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do
+ eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad
+ minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip
+ ex ea commodo consequat. Duis aute irure dolor in reprehenderit in
+ voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur
+ sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt
+ mollit anim id est laborum.
+ </summary>
+ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod
+ tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim
+ veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea
+ commodo consequat. Duis aute irure dolor in reprehenderit in voluptate
+ velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat
+ cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id
+ est laborum.
+ </details>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/details-open-overflow-hidden.html b/layout/generic/crashtests/details-open-overflow-hidden.html
new file mode 100644
index 0000000000..5e847ec7f1
--- /dev/null
+++ b/layout/generic/crashtests/details-open-overflow-hidden.html
@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+ <style>
+ details {
+ background-color: orange;
+ overflow: hidden;
+ width: 300px;
+ height: 200px;
+ }
+ summary {
+ background-color: green;
+ overflow: hidden;
+ width: 200px;
+ height: 100px;
+ }
+ </style>
+ <body>
+ <details open>
+ <summary>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do
+ eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad
+ minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip
+ ex ea commodo consequat. Duis aute irure dolor in reprehenderit in
+ voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur
+ sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt
+ mollit anim id est laborum.
+ </summary>
+ Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod
+ tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim
+ veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea
+ commodo consequat. Duis aute irure dolor in reprehenderit in voluptate
+ velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat
+ cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id
+ est laborum.
+ </details>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/details-three-columns.html b/layout/generic/crashtests/details-three-columns.html
new file mode 100644
index 0000000000..a82c3e6748
--- /dev/null
+++ b/layout/generic/crashtests/details-three-columns.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+ <style>
+ details {
+ column-count: 3;
+ column-rule: 1px solid lightgray;
+ -webkit-column-count: 3;
+ -webkit-column-rule: 1px solid lightgray;
+ border: 1px solid lightblue;
+ }
+ summary {
+ background-color: lightgreen;
+ }
+ </style>
+ <body>
+ <details open>
+ <summary>Summary</summary>
+ <p>line</p>
+ <p>line</p>
+ <p>line</p>
+ <p>line</p>
+ <p>line</p>
+ <p>line</p>
+ <p>line</p>
+ </details>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/empty.html b/layout/generic/crashtests/empty.html
new file mode 100644
index 0000000000..18ecdcb795
--- /dev/null
+++ b/layout/generic/crashtests/empty.html
@@ -0,0 +1 @@
+<html></html>
diff --git a/layout/generic/crashtests/file_324318-1.html b/layout/generic/crashtests/file_324318-1.html
new file mode 100644
index 0000000000..90c29362e0
--- /dev/null
+++ b/layout/generic/crashtests/file_324318-1.html
@@ -0,0 +1 @@
+<table border='1'><tr><td>tdc</td></tr></table>
diff --git a/layout/generic/crashtests/first-letter-638937-1.html b/layout/generic/crashtests/first-letter-638937-1.html
new file mode 100644
index 0000000000..039c1ad7de
--- /dev/null
+++ b/layout/generic/crashtests/first-letter-638937-1.html
@@ -0,0 +1,45 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+ <head>
+ <title>yo-lobo</title>
+ <meta http-equiv="Content-Type" content="application/xhtml+xml; charset=utf-8" />
+ <meta content="werwolf - zoquete pluscuamperfecto" name="author" />
+ <style type="text/css">
+ body {
+ font-family: sans-serif, Arial;
+ column-count: 5;
+ column-gap: 1em;
+ padding: 5px;
+ }
+ body.crash {
+ column-rule-width: thin;
+ column-rule-style: solid;
+ }
+ p {
+ margin: 10px;
+ padding: 0px;
+ }
+ p:first-letter {
+ font-size: 30pt;
+ font-weight: bold;
+ float: left;
+ padding-right: 5px;
+ padding-bottom: 5px;
+ }
+ </style>
+
+ </head>
+ <body onload="x=document.body; x.className='crash'">
+ <p>Lorem ipsum dolor sit amet consectetuer platea turpis justo Ut interdum. Wisi accumsan Vestibulum tempor vel ut nulla semper platea tincidunt consectetuer. Tristique metus ac nec turpis nibh nunc interdum ut tristique nec. Porttitor nibh sollicitudin urna fames non ultrices ipsum metus pede velit. Adipiscing amet et orci augue vel auctor amet ac Nam.</p>
+ <p>Ornare pellentesque augue leo Sed et In Donec nibh Cum tincidunt. Rutrum vel eget sagittis arcu cursus nibh Nam feugiat lacus lobortis. Suspendisse dictumst at Phasellus eu cursus sem risus dolor adipiscing metus. Lorem et Praesent Nunc Morbi Curabitur id pretium neque quis consequat. Convallis laoreet Integer et et Nulla In et et ut et. Convallis gravida ut tortor odio.</p>
+ <p>Fames pharetra et lacinia a aliquet tempor Vivamus Curabitur Vestibulum Vivamus. Duis Vestibulum nascetur sodales interdum congue a diam Lorem id In. Pede Curabitur interdum vitae nisl nunc est et ac Nulla quis. Sodales metus vitae mauris tellus Curabitur vitae dolor mauris wisi Phasellus. Pellentesque a Ut sem sapien interdum convallis Curabitur purus Aenean.</p>
+ <p>Ultrices pellentesque pretium odio vestibulum natoque natoque gravida Vivamus quis Integer. Ipsum cursus id nec cursus odio amet Vestibulum Suspendisse vitae habitasse. Leo elit eros porta volutpat laoreet commodo elit id egestas et. Curabitur arcu semper dictumst molestie Integer ligula id tellus quis Mauris. Tincidunt eget Sed amet justo porttitor egestas nibh pulvinar mauris justo. Vestibulum natoque eget hendrerit habitasse hendrerit eu purus Proin.</p>
+ <p>Lacinia Integer nec enim sem pellentesque sollicitudin sagittis Cras Sed Morbi. Vitae quis et consectetuer libero metus eros neque malesuada lacus justo. Curabitur ipsum lobortis massa lobortis consequat ut et Fusce quam augue. Laoreet id libero laoreet Curabitur interdum tempus Quisque elit amet purus. Libero sed Phasellus nec odio pede sed ac velit tincidunt id. Metus natoque.</p>
+ <p>Felis et enim at condimentum augue ut vitae In Mauris laoreet. Neque urna Morbi sapien risus nulla leo nec sed ipsum id. Id dictum eu natoque libero ac dapibus Ut sed ut dictum. Sed quis aliquet nunc vestibulum eleifend orci vestibulum Vestibulum Vivamus est. Et urna tempus montes eget Sed tristique.</p>
+ <p>Nibh id mauris ipsum Curabitur Integer velit sed Vivamus Integer laoreet. Eu semper Nulla ac Curabitur Vestibulum ut urna Sed libero In. Phasellus vitae nibh nunc eget Nam iaculis sed Phasellus mauris consectetuer. Amet dignissim natoque eget facilisi Vestibulum facilisis sit scelerisque porta adipiscing. Condimentum vel nec turpis metus est felis neque fames dapibus at. Aenean sed ac.</p>
+ <p>Malesuada hendrerit facilisis et Donec sed pellentesque Nullam est Praesent augue. Pede id orci tincidunt purus Suspendisse Vestibulum sagittis euismod sem porttitor. Lorem a convallis vestibulum condimentum Vestibulum mauris pellentesque consequat metus Vivamus. Consectetuer egestas eu Vestibulum id Morbi interdum montes eros odio Sed. Arcu Donec lacinia mauris vel tortor interdum in habitasse.</p>
+ <p>A scelerisque justo justo Vivamus eleifend velit Nullam orci tortor Nam. Nonummy ut nibh Pellentesque at pede Integer nibh metus justo scelerisque. Tincidunt consequat Curabitur porta non Morbi tincidunt egestas semper pellentesque Vestibulum. Ultrices congue In nec quis et pellentesque at vitae ipsum ridiculus. Elit fringilla ante Aenean elit Sed ut Nam pretium Aenean vel. Eu justo porta mauris congue neque pretium quis enim turpis sit. Auctor.</p>
+ <p>Scelerisque Maecenas Nunc lacinia porttitor fames Pellentesque sed urna Quisque pellentesque. Aenean eget tempus Praesent feugiat sed pretium dignissim In sapien Morbi. Velit mauris Nam Donec sollicitudin at vel mattis vitae amet laoreet. Vel at Nulla id Fusce vel interdum pellentesque Curabitur montes Phasellus. Accumsan interdum est eu ac lacus pellentesque sed Pellentesque.</p>
+</body>
+</html>
diff --git a/layout/generic/crashtests/first-letter-638937-2.html b/layout/generic/crashtests/first-letter-638937-2.html
new file mode 100644
index 0000000000..89f37c43f8
--- /dev/null
+++ b/layout/generic/crashtests/first-letter-638937-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html style="height: 600em; column-width: 1px;">
+
+<head>
+<style>p::first-letter { float:left; }</style>
+</head>
+
+<body onload="x=document.body.parentNode; x.style.columnWidth='111px'; x.offsetHeight; x.style.display='inline'; x.offsetHeight; "><p style="margin: -562949953421311em;">y
+</p><p>'</p></body>
+
+</html>
diff --git a/layout/generic/crashtests/flex-nested-abspos-1.html b/layout/generic/crashtests/flex-nested-abspos-1.html
new file mode 100644
index 0000000000..53522a36c4
--- /dev/null
+++ b/layout/generic/crashtests/flex-nested-abspos-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<div style="display:flex">
+ <div style="position: absolute">
+ <div style="position: absolute">
+ </div>
+ </div>
+</div>
diff --git a/layout/generic/crashtests/font-inflation-762332.html b/layout/generic/crashtests/font-inflation-762332.html
new file mode 100644
index 0000000000..f920d98d8d
--- /dev/null
+++ b/layout/generic/crashtests/font-inflation-762332.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<div style="column-width: 1px; font-family: monospace; width: 2ch;"><div style="position: relative;"><div style="position: absolute;">xxxxxxxxxxxxxx x xxxxxxx x xxxxxxxxxxxxxxxxxx x xxxxxxx x</div></div></div>
diff --git a/layout/generic/crashtests/image.jpg b/layout/generic/crashtests/image.jpg
new file mode 100644
index 0000000000..8433518bc9
--- /dev/null
+++ b/layout/generic/crashtests/image.jpg
Binary files differ
diff --git a/layout/generic/crashtests/large-border-radius-dashed.html b/layout/generic/crashtests/large-border-radius-dashed.html
new file mode 100644
index 0000000000..a77e3c5d94
--- /dev/null
+++ b/layout/generic/crashtests/large-border-radius-dashed.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="height: 10000000px; width: 10000000px; box-sizing: border-box; border-radius: 10000000px; border-style: dashed; border-width: 10px 20px;"></html>
diff --git a/layout/generic/crashtests/large-border-radius-dashed2.html b/layout/generic/crashtests/large-border-radius-dashed2.html
new file mode 100644
index 0000000000..ed6722579e
--- /dev/null
+++ b/layout/generic/crashtests/large-border-radius-dashed2.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="height: 6523790304542em; width: 6207636626031em; box-sizing: border-box; border-radius: 6523790304542em; border-style: dashed; border-width: 10px 20px;"></html>
diff --git a/layout/generic/crashtests/large-border-radius-dotted.html b/layout/generic/crashtests/large-border-radius-dotted.html
new file mode 100644
index 0000000000..fe530c0c05
--- /dev/null
+++ b/layout/generic/crashtests/large-border-radius-dotted.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="height: 10000000px; width: 10000000px; box-sizing: border-box; border-radius: 10000000px; border-style: dotted; border-width: 10px 20px;"></html>
diff --git a/layout/generic/crashtests/large-border-radius-dotted2.html b/layout/generic/crashtests/large-border-radius-dotted2.html
new file mode 100644
index 0000000000..8cd822cf63
--- /dev/null
+++ b/layout/generic/crashtests/large-border-radius-dotted2.html
@@ -0,0 +1 @@
+<!DOCTYPE html><html style="height: 6523790304542em; width: 6207636626031em; box-sizing: border-box; border-radius: 6523790304542em; border-style: dotted; border-width: 10px 20px;"></html>
diff --git a/layout/generic/crashtests/outline-on-frameset.xhtml b/layout/generic/crashtests/outline-on-frameset.xhtml
new file mode 100644
index 0000000000..9f72d10cc1
--- /dev/null
+++ b/layout/generic/crashtests/outline-on-frameset.xhtml
@@ -0,0 +1 @@
+<html xmlns="http://www.w3.org/1999/xhtml"><frameset style="outline-style: solid;"></frameset></html>
diff --git a/layout/generic/crashtests/solidblue.png b/layout/generic/crashtests/solidblue.png
new file mode 100644
index 0000000000..a64b6a4255
--- /dev/null
+++ b/layout/generic/crashtests/solidblue.png
Binary files differ
diff --git a/layout/generic/crashtests/summary-position-out-of-flow.html b/layout/generic/crashtests/summary-position-out-of-flow.html
new file mode 100644
index 0000000000..2c585fd497
--- /dev/null
+++ b/layout/generic/crashtests/summary-position-out-of-flow.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<!-- Any copyright is dedicated to the Public Domain.
+ - http://creativecommons.org/publicdomain/zero/1.0/ -->
+
+<html>
+ <head>
+ <style>
+ #fixed {
+ position: fixed;
+ bottom: 0;
+ right: 0;
+ }
+ #absolute {
+ position: absolute;
+ top: 100px;
+ left: 100px;
+ }
+ </style>
+ </head>
+ <body>
+ <details>
+ <summary id="fixed">Summary (position: fixed)</summary>
+ <p>This is the detail with fixed summary.</p>
+ </details>
+ <details>
+ <summary id="absolute">Summary (position: absolute)</summary>
+ <p>This is the detail with absolute summary.</p>
+ </details>
+ </body>
+</html>
diff --git a/layout/generic/crashtests/text-overflow-bug666751-1.html b/layout/generic/crashtests/text-overflow-bug666751-1.html
new file mode 100644
index 0000000000..49f1b36a12
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug666751-1.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait"><head><script>
+function finish() {
+ window.removeEventListener("MozAfterPaint", finish);
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head><body onload="window.addEventListener('MozAfterPaint', finish, false); document.body.style.backgroundColor='lime';">
+<div style="overflow: scroll; text-indent: -100px; white-space: pre; text-overflow: ellipsis;"><span style="font-family: -moz-fixed; white-space: normal;"></code><p style="position: fixed;">m
+</p>
+</div>
+
+</body></html>
diff --git a/layout/generic/crashtests/text-overflow-bug666751-2.html b/layout/generic/crashtests/text-overflow-bug666751-2.html
new file mode 100644
index 0000000000..798cfae888
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug666751-2.html
@@ -0,0 +1,12 @@
+<html class="reftest-wait"><head><script>
+function finish() {
+ window.removeEventListener("MozAfterPaint", finish);
+ document.documentElement.removeAttribute("class");
+}
+</script>
+</head><body onload="window.addEventListener('MozAfterPaint', finish, false); document.body.style.backgroundColor='lime';">
+<div style="overflow: scroll; text-indent: -100px; white-space: pre; text-overflow: ellipsis;"><span style="font-family: -moz-fixed; white-space: normal;"></code><p style="position: absolute;">m
+</p>
+</div>
+
+</body></html>
diff --git a/layout/generic/crashtests/text-overflow-bug670564.xhtml b/layout/generic/crashtests/text-overflow-bug670564.xhtml
new file mode 100644
index 0000000000..6a636a76ba
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug670564.xhtml
@@ -0,0 +1,3 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="position: relative; white-space: pre-line; direction: rtl; top: -85967203400px; text-overflow: ellipsis; text-indent: 5242870ch; padding: 224652170px; overflow-y: scroll; column-width: 74804px; letter-spacing: 687194767px;">
+
+</html>
diff --git a/layout/generic/crashtests/text-overflow-bug671796.xhtml b/layout/generic/crashtests/text-overflow-bug671796.xhtml
new file mode 100644
index 0000000000..47c2eb87ed
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug671796.xhtml
@@ -0,0 +1,5 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body style="width: 1px; text-overflow: ellipsis; overflow-y: scroll;">
+<math xmlns="http://www.w3.org/1998/Math/MathML"><msup style="display:block"/></math>
+</body>
+</html>
diff --git a/layout/generic/crashtests/text-overflow-bug713610.html b/layout/generic/crashtests/text-overflow-bug713610.html
new file mode 100644
index 0000000000..145295364a
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-bug713610.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="text-overflow: ellipsis; padding-right: 4000px; overflow: scroll;"><span style="-moz-transform: translatex(-50px); border-right-style: dashed;"></span></div>
+</body>
+</html>
diff --git a/layout/generic/crashtests/text-overflow-iframe.html b/layout/generic/crashtests/text-overflow-iframe.html
new file mode 100644
index 0000000000..ba34dc2aab
--- /dev/null
+++ b/layout/generic/crashtests/text-overflow-iframe.html
@@ -0,0 +1,115 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<title>text-overflow: Test 12</title>
+<style type="text/css">
+
+.test {
+ border: thin dashed black;
+ overflow: hidden;
+ white-space: nowrap;
+ -o-text-overflow: ellipsis;
+ text-overflow: ellipsis;
+ font: 1em bold monospace;
+ background:lime;
+ color: black;
+ margin-left:400px;
+ height: 12em;
+ text-shadow: #6374AB 5px -12px 2px;
+}
+
+body {
+ width:800px;
+}
+
+img { width: 50px; height: 50px; outline:5px dotted yellow; }
+span {
+ font-size:16px;
+ background:pink;
+ border: 5px dashed blue;
+ padding: 0 25px;
+ text-decoration: underline overline line-through;
+ color:brown;
+ text-shadow: none;
+}
+i {
+ display:inline-block;
+ height: 50px;
+ width: 5em;
+ background: blue;
+ outline:5px dotted yellow;
+ text-shadow: none;
+}
+u {
+ padding-left:140px;
+}
+v {
+ padding-right:140px;
+}
+.rtl {
+ direction:rtl;
+}
+.rlo span {
+ unicode-bidi: bidi-override; direction: rtl;
+}
+.lro span {
+ unicode-bidi: bidi-override; direction: ltr;
+}
+.h {display:none}
+iframe {
+ width: 100px;
+ height: 50px;
+}
+</style>
+<script>
+var c = "data:text/html,<style>body {white-space: nowrap;overflow:hidden;-o-text-overflow: ellipsis;text-overflow: ellipsis;}</style><body bgcolor='magenta'>CSS is awesome"
+function initIFRAME() {
+ var f = document.getElementsByTagName('iframe');
+ for (i = 0; i < f.length; ++i) {
+ f[i].setAttribute('src', c);
+ }
+ setTimeout(function(){document.body.style.width='500px'},0);
+}
+function setTextOverflow(str,quoted) {
+ var x = document.styleSheets[0];
+ var q = quoted ? '"' : '';
+ x.insertRule('.test{text-overflow:' + q + str + q +'}', x.cssRules.length);
+}
+</script>
+</head><body onload="initIFRAME()">
+text-overflow:"<input placeholder="type text then <ENTER>" onchange='setTextOverflow(this.value,1)'>" | <button onclick="setTextOverflow('ellipsis')">ellipsis</button> | <button onclick="setTextOverflow('clip')">clip</button> (Try "." or "" for example) <br>
+
+LTR / LTR
+<div class="test">
+<span><iframe></iframe>CSS is awesome CSS<i>overflowing-inline-block</i><u> is awesome</u></span><br>
+<span>CSS is awe<iframe></iframe>some CSS is awesome <i></i></span><br>
+<span>C SS is awesome<button>BUTTON</button> CSS is <iframe></iframe>awesom e </span><br>
+<span>C&shy;SS is awesome CSS is awesom&shy;e <button>BUTTON</button></span><br>
+<br><br></div>
+
+RTL / LTR
+<div class="test rtl">
+<span><iframe></iframe><v>CSS is awesome CSS</v><i>overflowing-inline-block</i> is awesome </span><br>
+<span>CSS is awe<iframe></iframe>some CSS is awesome <i></i></span><br>
+<span>C SS is awesome<button>BUTTON</button> CSS is <iframe></iframe>awesom e </span><br>
+<span>C&shy;SS is awesome CSS is awesom&shy;e <button>BUTTON</button></span><br>
+<br><br></div>
+
+
+LTR / RTL
+<div class="test rlo">
+<span><iframe></iframe>CSS is awesome CSS<i>overflowing-inline-block</i> is awesome </span><br>
+<span>CSS is awe<iframe></iframe>some CSS is awesome <i></i></span><br>
+<span>C SS is awesome<button>BUTTON</button> CSS is <iframe></iframe>awesom e </span><br>
+<span><button>BUTTON</button>C&shy;SS is awesome CSS is awesom&shy;e </span><br>
+<br><br></div>
+
+RTL / RTL
+<div class="test rtl rlo">
+<span><iframe></iframe>CSS is awesome CSS<i>overflowing-inline-block</i> is awesome </span><br>
+<span>CSS is awe<iframe></iframe>some CSS is awesome <i></i></span><br>
+<span>C SS is awesome<button>BUTTON</button> CSS is <iframe></iframe>awesom e </span><br>
+<span><button>BUTTON</button>C&shy;SS is awesome CSS is awesom&shy;e </span><br>
+<br><br></div>
+
+</body></html>