Add some crashtests
authorJesse Ruderman <jruderman@gmail.com>
Tue, 10 Feb 2009 16:36:04 -0800
changeset 24905 54417ebbaea25706897aaa1db1a0081b3ad83107
parent 24904 325db1661cbb7936a689f10b5894f594bcec27a2
child 24906 af294f0d2c6ae8932198e83f37fd3348ac38592d
push idunknown
push userunknown
push dateunknown
milestone1.9.2a1pre
Add some crashtests
content/base/crashtests/116848-1.html
content/base/crashtests/149320-1.html
content/base/crashtests/crashtests.list
content/events/crashtests/104310-1.html
content/events/crashtests/116206-1.html
content/events/crashtests/135345-1.html
content/events/crashtests/crashtests.list
content/xml/document/crashtests/136896-1.xml
content/xml/document/crashtests/crashtests.list
content/xslt/crashtests/111994.xml
content/xslt/crashtests/111994.xsl
content/xslt/crashtests/crashtests.list
content/xul/content/crashtests/107518-1.xml
content/xul/content/crashtests/crashtests.list
gfx/thebes/crashtests/122875-1.html
gfx/thebes/crashtests/crashtests.list
js/src/xpconnect/crashtests/117307-1.html
js/src/xpconnect/crashtests/crashtests.list
layout/base/crashtests/118931-1.html
layout/base/crashtests/121533-1.html
layout/base/crashtests/123049-1.html
layout/base/crashtests/123946-1.html
layout/base/crashtests/128855-1.html
layout/base/crashtests/133410-1.html
layout/base/crashtests/147320-1.html
layout/base/crashtests/148245-1.html
layout/base/crashtests/149014-1.html
layout/base/crashtests/150431-1.html
layout/base/crashtests/99776-1.html
layout/base/crashtests/crashtests.list
layout/mathml/crashtests/151054-1.xml
layout/mathml/crashtests/crashtests.list
layout/style/crashtests/105619-1.html
layout/style/crashtests/crashtests.list
layout/tables/crashtests/110523-1.html
layout/tables/crashtests/138725-1.html
layout/tables/crashtests/crashtests.list
layout/xul/base/src/crashtests/131008-1.xul
layout/xul/base/src/crashtests/137216-1.xul
layout/xul/base/src/crashtests/140218-1.xml
layout/xul/base/src/crashtests/151826-1.xul
layout/xul/base/src/crashtests/crashtests.list
modules/plugin/test/crashtests/110650-1.html
modules/plugin/test/crashtests/crashtests.list
parser/htmlparser/tests/crashtests/121591-1.html
parser/htmlparser/tests/crashtests/147179-1.html
parser/htmlparser/tests/crashtests/151956-1.html
parser/htmlparser/tests/crashtests/92647-1.html
parser/htmlparser/tests/crashtests/92788-1.html
parser/htmlparser/tests/crashtests/crashtests.list
new file mode 100644
--- /dev/null
+++ b/content/base/crashtests/116848-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+   <title>Test case boiled down from www.sjetmarka.no</title>
+</head>
+<body>
+  <table>
+    <tr>
+      <td>
+        <SCRIPT language="JavaScript1.2">
+          document.write('<div>')
+         </script>
+         Hei og velkommen til Mozilla
+         <head>
+           <script language="JavaScript1.2">
+             document.write('</div>')
+           </script>
+         </head>
+      </td>
+    </tr>
+  </table>
+  <table>
+    <tr>
+      <td>
+        God jul til alle
+      </td>
+    </tr>
+  </table>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/base/crashtests/149320-1.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+</head>
+<body>
+<div>Selection is HERE only</div>
+<script type="text/javascript">
+	selectedNode = document.getElementsByTagName("div").item(0);
+	testRange = document.createRange();
+
+	testRange.setStart(selectedNode, 13);
+	testRange.setEnd(selectedNode, 17);
+
+	document.body.appendChild(document.createTextNode("Text of Range: "+testRange));
+</script>
+</body>
+</html>
\ No newline at end of file
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -1,9 +1,11 @@
 load 43040-1.html
+load 116848-1.html
+load 149320-1.html
 load 308120-1.xul
 load 324871-1.html
 load 325730-1.html
 load 326618-1.html
 load 326646-1.html
 load 326778-1.html
 load 326865-1.html
 load 330925-1.xhtml
new file mode 100644
--- /dev/null
+++ b/content/events/crashtests/104310-1.html
@@ -0,0 +1,22 @@
+<HTML>
+
+<HEAD>
+</HEAD>
+
+<BODY onload=document.input.name.focus()>
+
+
+<form method="post" action="index.cfm" name="input">
+<CENTER><TABLE BORDER=0>
+<TD><INPUT TYPE="text" NAME="name" onClick="this.focus()" onFocus="this.select()" onSelect="this.select()"></TD>
+
+</TABLE></CENTER>
+<HR>
+
+</FORM>
+
+</BODY>
+
+</HTML>
+
+
new file mode 100644
--- /dev/null
+++ b/content/events/crashtests/116206-1.html
@@ -0,0 +1,23 @@
+<html>
+   <head>
+      <script language="JavaScript">
+	 function InitialFocus(){
+	    document.frmSelectUser.radResidence[0].focus();
+	 }
+      </script>
+   </head>
+   <body onfocus="InitialFocus();" >
+      <form name="frmSelectUser">
+	 <table>
+	    <tbody> 
+	       <tr> 
+		  <td><input name="radResidence" type="radio" value="KOR"></td> 
+	       </tr> 
+	       <tr> 
+		  <td><input name="radResidence" type="radio" value="JPN"></td>
+	       </tr> 
+	    </tbody>
+         </table>
+      </form>
+   </body> 
+</html>     
new file mode 100644
--- /dev/null
+++ b/content/events/crashtests/135345-1.html
@@ -0,0 +1,14 @@
+<html>
+<body>
+  <form name="frmlogin">
+    <input type="text" name="username" 
+           onfocus="frmlogin.username.select();" 
+           onblur="frmlogin.password.focus();">
+    <input type="password" name="password" 
+           onfocus="frmlogin.password.select();">
+  </form>
+  <script language="JavaScript">
+    document.frmlogin.username.focus();
+  </script>
+</body>
+</html>
--- a/content/events/crashtests/crashtests.list
+++ b/content/events/crashtests/crashtests.list
@@ -1,2 +1,5 @@
+load 104310-1.html
+load 116206-1.html
+load 135345-1.html
 load 422009-1.xhtml
 load 457776-1.html
new file mode 100644
--- /dev/null
+++ b/content/xml/document/crashtests/136896-1.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0" standalone="yes"?>
+<!DOCTYPE SITES
+[
+    <!ELEMENT SITES (VERSION, SITE+)>
+    <!ELEMENT VERSION (#PCDATA)>
+    <!ELEMENT SITE (ID, NAME, MAXADDR, MAXALIASES, MAXQUOTA, TYPE, DOMAINS?, USERS?, ALIASES?)>
+    <!ELEMENT DOMAINS (DOMAIN*)>
+    <!ELEMENT DOMAIN (#PCDATA)>
+
+    <!ELEMENT USERS (USER*)>
+    <!ELEMENT USER (ID, NAME, ROA, ROC, QUOTA, TYPE)>
+
+    <!ELEMENT ALIASES (ALIAS*)>
+    <!ELEMENT ALIAS (LEFTPART, RIGHTPART)>
+    
+    <!ELEMENT ID (#PCDATA)>
+    <!ELEMENT NAME (#PCDATA)>
+    <!ELEMENT MAXADDR (#PCDATA)>
+    <!ELEMENT MAXALIASES (#PCDATA)>
+    <!ELEMENT MAXQUOTA (#PCDATA)>
+    <!ELEMENT TYPE (#PCDATA)>
+
+    <!ELEMENT ROA (#PCDATA)>
+    <!ELEMENT ROC (#PCDATA)>
+    <!ELEMENT QUOTA (#PCDATA)>
+
+    <!ELEMENT LEFTPART (#PCDATA)>
+    <!ELEMENT RIGHTPART (#PCDATA)>
+]
+>
+<SITES>
+<VERSION>1</VERSION>
+<SITE>
+	<ID>60</ID>
+	<NAME>abtauchen</NAME>
+	<MAXADDR>1</MAXADDR>
+	<MAXALIASES>1</MAXALIASES>
+	<MAXQUOTA>10240</MAXQUOTA>
+	<TYPE>p</TYPE>
+	<DOMAINS>
+		<DOMAIN>abtauchen.at</DOMAIN>
+		<DOMAIN>abtauchen.com</DOMAIN>
+		<DOMAIN>abtauchen.net</DOMAIN>
+	</DOMAINS>
+	<USERS>
+		<USER>
+			<ID>83</ID>
+			<NAME>info</NAME>
+			<ROA>y</ROA>
+			<ROC>n</ROC>
+			<QUOTA>10240</QUOTA>
+			<TYPE>p</TYPE>
+		</USER>
+	</USERS>
+	<ALIASES>
+		<ALIAS>
+			<LEFTPART>*</LEFTPART>
+			<RIGHTPART>info</RIGHTPART>
+		</ALIAS>
+	</ALIASES>
+</SITE>
+</SITES>
\ No newline at end of file
--- a/content/xml/document/crashtests/crashtests.list
+++ b/content/xml/document/crashtests/crashtests.list
@@ -1,4 +1,5 @@
+load 136896-1.xml
 load 382636-1.xml
 load 382636-2.svg
 load 382636-3.xhtml
 load 382636-4.xul # Throws (bug 455856)
new file mode 100644
--- /dev/null
+++ b/content/xslt/crashtests/111994.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" standalone="yes" ?>
+<?xml-stylesheet type="text/xsl" href="111994.xsl" ?>
+<root>
+  <item id="1001" name="name" />
+</root>
new file mode 100644
--- /dev/null
+++ b/content/xslt/crashtests/111994.xsl
@@ -0,0 +1,13 @@
+<?xml version="1.0" ?>
+<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0">
+  <xsl:template match="root">
+    <html><body><xsl:apply-templates select="item" /></body></html>
+  </xsl:template>
+  <xsl:template match="item">
+    <img>
+      <xsl:attribute name="src">
+        <xsl:value-of select="@name" />
+      </xsl:attribute>
+    </img>
+  </xsl:template>
+</xsl:stylesheet>
--- a/content/xslt/crashtests/crashtests.list
+++ b/content/xslt/crashtests/crashtests.list
@@ -1,1 +1,3 @@
+load 91332.xml
+load 111994.xml
 load 406106-1.html
new file mode 100644
--- /dev/null
+++ b/content/xul/content/crashtests/107518-1.xml
@@ -0,0 +1,52 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?> 
+<!DOCTYPE window>
+
+<window
+   id         = "xulnote-main-window"
+   xmlns      = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+   xmlns:html = "http://www.w3.org/1999/xhtml" 
+   onload     = "init();"
+>
+  <scrollbox>
+   <vbox style="background-color:white;">
+      <text value="hahaha  0"/>
+      <text value="hahaha  1"/>
+      <text value="hahaha  2"/>
+      <text value="hahaha  3"/>
+      <text value="hahaha  4"/>
+      <text value="hahaha  5"/>
+      <text value="hahaha  6"/>
+      <text value="hahaha  7"/>
+      <text value="hahaha  8"/>
+      <text value="hahaha  9"/>
+      <text value="hahaha 10"/>
+      <text value="hahaha 11"/>
+      <text value="hahaha 12"/>
+      <text value="hahaha 13"/>
+      <text value="hahaha 14"/>
+      <text value="hahaha 15"/>
+      <text value="hahaha 16"/>
+      <text value="hahaha 17"/>
+      <text value="hahaha 18"/>
+      <text value="hahaha 19"/>
+   </vbox>
+<scrollbar
+    id="identifier"
+    align="horizontal"
+    curpos="20"
+    maxpos="100"
+    increment="1"
+    pageincrement="10"/>
+
+  </scrollbox>
+
+ <script type="application/x-javascript">
+  <![CDATA[
+   function init()
+   {
+   }
+ ]]>
+ </script>
+
+</window>
--- a/content/xul/content/crashtests/crashtests.list
+++ b/content/xul/content/crashtests/crashtests.list
@@ -1,8 +1,9 @@
+load 107518-1.xml
 load 326864-1.xul
 load 326875-1.xul
 load 326881-1.xul
 load 329982-1.xhtml
 load 336096-1.xhtml
 load 354611-1.html
 load 360078-1.xhtml
 load 363791-1.xul
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/122875-1.html
@@ -0,0 +1,1 @@
+<html>
	<head>
		<meta http-equiv="content-type" content="text/html; charset=Shift_JIS">
	</head>
	<body>
		│@│@
	</body>
</html>
\ No newline at end of file
--- a/gfx/thebes/crashtests/crashtests.list
+++ b/gfx/thebes/crashtests/crashtests.list
@@ -1,8 +1,9 @@
+load 122875-1.html
 load 345576-1.html   
 load 345629-1.html
 load 369688-1.html
 load 369947-1.html
 load 372094-1.xhtml
 load 377231-1.html
 load 377232-1.xhtml
 load 377461-1.xhtml
new file mode 100644
--- /dev/null
+++ b/js/src/xpconnect/crashtests/117307-1.html
@@ -0,0 +1,20 @@
+<!--/*
+Crash in error handler on invalid JavaScript
+http://bugzilla.mozilla.org/show_bug.cgi?id=117307
+*/-->
+
+<HTML><HEAD><TITLE>Bug 117307</title><SCRIPT>
+
+window.onerror=f;
+function f() {f.caller;}
+
+</script></head><BODY><SCRIPT>
+
+function syntaxError() {1=2;}
+
+</script><SCRIPT>
+
+runtimeError();
+function runtimeError() {d.d.d;}
+
+</script></body></html>
--- a/js/src/xpconnect/crashtests/crashtests.list
+++ b/js/src/xpconnect/crashtests/crashtests.list
@@ -1,8 +1,9 @@
+load 117307-1.html
 load 326615-1.html
 load 328553-1.html
 load 346258-1.html
 load 346512-1.xhtml
 load 382133-1.html
 load 386680-1.html
 load 394810-1.html
 load 400349-1.html
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/118931-1.html
@@ -0,0 +1,7 @@
+<BODY>
+
+<DIV id=container style="POSITION: absolute;"></DIV>
+
+<SCRIPT language=Javascript>
+    document.getElementById('container').style.position='relative';
+</SCRIPT>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/121533-1.html
@@ -0,0 +1,11 @@
+<html>
+<title>B#121533</title>
+<script>function writeSorry() {document.writeln("test");
+document.close();
+}
+</script>
+	
+<frameset cols="120,*" onLoad="writeSorry()">
+<frame name="topslider" src="#"> <frame name="bottomslider" src="#">
+</frameset>
+</html>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/123049-1.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<style>
+#myStyle:-moz-display-comboboxcontrol-frame {
+  -moz-user-input: none !important;
+}
+#myStyle:-moz-dropdown-list {
+  -moz-user-input: none !important;
+}
+</style>
+</head>
+<body onload="getElementById('mySelect').setAttribute('id', 'myStyle');"><select id="mySelect"></select></body></html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/123946-1.html
@@ -0,0 +1,1 @@
+<html><head>
<title>test</title></head>
<body>
<div id="test" style="position: absolute;">test</div>
<script type="application/x-javascript">document.getElementById("test").style.position = "fixed";</script>
</body>
</html>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/128855-1.html
@@ -0,0 +1,8 @@
+<HTML><HEAD><TITLE>Testcase for bug 128855</TITLE></HEAD>
+<BODY>
+
+<P style="FONT-VARIANT: small-caps">2.3&nbsp; 
+Идентификаторы......................................................................................................................................................................... 
+</P>
+
+</BODY></HTML>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/133410-1.html
@@ -0,0 +1,27 @@
+<html>
+ <head>
+  <title>Bug 133410</title>
+ </head>
+
+ <body>
+
+  <table>
+   <tr>
+    <td>
+     <form>
+      <input type="text">
+      <input type="submit" value="Search">
+     <!-- note missing form close tag -->
+    </td>
+   </tr>
+  </table>
+
+  <table>
+   <span>
+    <!-- simple animated gif -->
+    <img src="../../../testing/crashtest/images/animfish.gif">
+   </span>
+  </table>
+
+ </body>
+</html>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/147320-1.html
@@ -0,0 +1,7 @@
+<html>
+<body>
+    <fieldset style="position: absolute">
+        <legend>text</legend>
+    </fieldset>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/148245-1.html
@@ -0,0 +1,11 @@
+<html>
+<head>
+<style type="text/css">
+p:first-letter { float: left; }
+p:first-line { color: black; }
+</style>
+</head>
+<body>
+<p>Ly</p>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/149014-1.html
@@ -0,0 +1,44 @@
+<html>
+<body>
+
+<center><h2><h2></center>
+<center><h2>1<h2></center>
+<center><h2>2<h2><center>
+<center><h2>3<ul><h2><center>
+<center><h2>4<h2><center>
+<center><h2>5<h2><center> 
+<center><h2>6<h2><center> 
+<center><h2>7<h2><center> 
+<center><h2>8<h2><center> 
+<center><h2>9<h2><center> 
+<center><h2>10<h2><center>
+<center><h2>11<ul><h2><center> 
+<center><h2>12<h2><center>
+<center><h2>13<h2><center>
+<center><h2>14<h2><center>
+<center><h2>15<h2><center>
+<center><h2>16<h2><center>
+<center><h2>17<h2><center>  
+<center><h2>18<h2><center>
+<center><h2>19<h2><center>
+<center><h2>20<h2><center>
+<center><h2><h2><center>
+<center><h2><h2><center>
+<center><h2><li>Test</li><h2><center>
+<center><h2><li>Test<font color=blue>( CD )</font></li><h2><center>
+<center><h2><h2><center>
+<center><h2><h2><center>
+<center><h2><h2><center>
+<center><h2>Test<center>
+<center><h2><h2><center>
+<center><h1></h1></center>
+<center><h3>.<h3><center>
+<center><h3><h3><center>
+<center><h2>Test<center>
+<center><h2><h2><center>
+<center><h2><h2><center>
+<center><h1><center>
+
+<input type="text" name="maxbid" size="12" maxlength="12">
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/150431-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+<title>bug 150431</title>
+</head>
+<p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1><p><font size=1>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/99776-1.html
@@ -0,0 +1,9 @@
+
+
+
+<html><head><title>Testcase for bug 99776</title></head>
+<body>
+
+<applet style="position:absolute;left:7;top:73;"></applet>
+
+</body></html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -5,18 +5,29 @@ load 50257-1.html
 load 50395-1.html
 load 50395-1.html
 load 50395-1.html
 load 50395-1.html
 load 56746-1.html
 load 89101-1.html
 load 89358-1.html
 load 90205-1.html
+load 99776-1.html
+load 118931-1.html
+load 121533-1.html
+load 123049-1.html
+load 123946-1.html
+load 128855-1.html
+load 133410-1.html
 load 143862-1.html
 load 143862-2.html
+load 147320-1.html
+load 148245-1.html
+load 149014-1.html
+load 150431-1.html
 load 241300-1.html
 load 243159-1.html
 load 243159-2.xhtml
 load 243519-1.html
 load 275746-1.html
 load 280708-1.html
 load 280708-2.html
 load 306940-1.html
new file mode 100644
--- /dev/null
+++ b/layout/mathml/crashtests/151054-1.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/xsl" href="http://www.w3.org/Math/XSL/mathml.xsl"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+  <meta http-equiv="Content-Type" content="text/html" />
+  <title>Math with position: absolute</title>
+  <style>
+   math { position: absolute; }
+  </style>
+</head>
+<body>
+ <math xmlns="http://www.w3.org/1998/Math/MathML">
+  <infinity/>
+ </math>
+</body>
+</html>
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@@ -1,8 +1,9 @@
+load 151054-1.xml
 load 307826-1.xhtml
 load 307839-1.xhtml
 load 307839-2.xhtml
 load 323733-1.xml
 load 323737-1.xml
 load 323738-1.xml
 load 323741-1.xml
 load 323742-1.xml
new file mode 100644
--- /dev/null
+++ b/layout/style/crashtests/105619-1.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
+<html>
+<head>
+	<title>International Herald Tribune</title>
+	
+	<script type="text/javascript">
+
+	function displayFix() {
+		document.getElementById("bodyNode").style.display = "block";
+	}
+
+	</script>
+	<style type="text/css">
+
+	#clippingsContainer {overflow:auto;}
+	#menuSearch {position:absolute;}
+
+	</style>
+	
+</head>
+
+<body id="bodyNode" onload="displayFix()">
+	<div>
+		<div id="menuSearch"><input type="text"></div>
+		<div id="clippingsContainer"></div>
+	</div>
+
+	<table>
+		<tr><td></td><td></td><td></td></tr>
+		<tr><td></td><td></td><td></td></tr>
+	</table>
+
+</body></html>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -1,8 +1,9 @@
+load 105619-1.html
 load 187671-1.html
 load 286707-1.html
 load 285727-1.html
 load 330998-1.html
 load 368175-1.html
 load 379788-1.html
 load 383979-1.xhtml
 load 383979-2.html
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/110523-1.html
@@ -0,0 +1,45 @@
+<html>
+<head>
+<title></title>
+<script type="text/javascript">
+function toggle(b) {		
+	var adv = document.getElementById("it_guru");
+	var ns = 'none';
+	if (b) {
+			ns= "table-row";
+	}
+	adv.style.display = ns;
+}
+function boom()
+{
+  toggle(true);
+  document.documentElement.offsetHeight;
+  toggle(false);
+  document.documentElement.offsetHeight;
+  toggle(true);
+  document.documentElement.offsetHeight;
+  toggle(false);
+  document.documentElement.offsetHeight;
+}
+</script></head><body onload="boom();">
+<form action="http://localhost/">
+<table>
+<tbody>
+<tr>
+<td>Without the &lt;tbody&gt; tags Mozilla doesn't crash
+		</td>
+</tr>
+</tbody>
+<tr id="it_guru">
+<td>I disappear
+		</td>
+</tr>
+<tr>
+<td>Without this row Mozilla doesn't crash
+		</td>
+</tr>
+</table>
+</form>
+</body>
+</html>
+
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/138725-1.html
@@ -0,0 +1,32 @@
+<html>
+   <body>
+      <table>
+         <tr>
+            <td>
+               <span>
+                  <span>
+                     <head>
+                        <title></title>
+                     </head>
+                     <table>
+                        <tr>
+                           <td>
+                              <table align="left">
+                                 <tr>
+                                    <td>
+                                       <form>
+                                          <input type="submit" value="ApplyForThisPosition">
+                                       </form>
+                                    </td>
+                                 </tr>
+                              </table>
+                           </td>
+                        </tr>
+                     </table>
+                  </span>
+               </span>
+            </td>
+         </tr>
+      </table>
+   </body>
+</html>
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -1,13 +1,15 @@
 load 28933-1.html
 load 29157-1.html
 load 32447-1.html
 load 55789-1.html
 load 78623-1.html
+load 110523-1.html
+load 138725-1.html
 load 284844-1.html
 load 284852.html
 load 300912.html
 load 322779-1.xul
 load 323489-1.html
 load 331344-1.html
 load 331446-1.xhtml
 load 331690-1.html
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/131008-1.xul
@@ -0,0 +1,11 @@
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+
+<window xmlns:html="http://www.w3.org/1999/xhtml"
+	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+	xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+	id="MainWindow"
+	title="IWindow Test">
+<div style="position:absolute">abc</div>
+
+
+</window>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/137216-1.xul
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+	<iframe style="position:absolute;"/>
+</window>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/140218-1.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+      <treechildren style = " display: block; " />
+</window>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/151826-1.xul
@@ -0,0 +1,27 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window
+   title      = "Arrowscrollbox->Splitter Crash Testcase"
+   xmlns      = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+   xmlns:html="http://www.w3.org/1999/xhtml"
+   width      = "300"
+   height     = "200"
+   orient     = "vertical"
+>
+<vbox flex="1">
+
+<scrollbox flex="1">
+<vbox flex="1">
+<vbox id="box_1">
+<hbox><label value="Test"/></hbox>
+</vbox>
+<splitter collapse="none"/>
+<vbox id="box_2">
+<hbox><label value="Test"/></hbox>
+</vbox>
+</vbox>
+</scrollbox>
+
+</vbox>
+</window>
\ No newline at end of file
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@@ -1,8 +1,12 @@
+load 131008-1.xul
+load 137216-1.xul
+load 140218-1.xml
+load 151826-1.xul
 load 311457-1.html
 load 322786-1.xul
 load 326879-1.xul
 load 327776-1.html
 load 328135-1.xul
 load 329327-1.xul
 load 329407-1.xml
 load 329477-1.xhtml
@@ -25,9 +29,9 @@ load 402912-1.xhtml
 load 408904-1.xul
 load 412479-1.xhtml
 load 430356-1.xhtml
 load 431738.xhtml
 load 433296-1.xul
 load 434458-1.xul
 load 467481-1.xul
 load 470063-1.html
-load 472189.xul
\ No newline at end of file
+load 472189.xul
new file mode 100644
--- /dev/null
+++ b/modules/plugin/test/crashtests/110650-1.html
@@ -0,0 +1,11 @@
+<HTML>
+<HEAD>
+<TITLE>123246 testcase</TITLE>
+</HEAD>
+<BODY>
+<object align="right" width=100>
+</object> 
+</BODY >
+</HTML>
+
+
--- a/modules/plugin/test/crashtests/crashtests.list
+++ b/modules/plugin/test/crashtests/crashtests.list
@@ -1,2 +1,4 @@
 load 41276-1.html
 load 48856-1.html
+
+load 110650-1.html
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/121591-1.html
@@ -0,0 +1,22 @@
+<HTML>
+<body>
+<span>
+<head><link></head>
+   <table border=1>
+    <tr><td>
+     <table border=1 align="left">
+      <tr><td></td></tr>
+      <tr><td> 
+	  <form>
+	    <button></button>
+      </form>
+      </td></tr>
+     </table>
+    </td></tr>
+   </table>
+</span>
+</body>
+</html>
+
+
+
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/147179-1.html
@@ -0,0 +1,7 @@
+<html><head><title>Testcase for bug 141561</title></head>
+<body>
+
+<script>document.write("<form><input type='password'></form>");</script>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/151956-1.html
@@ -0,0 +1,18 @@
+<html>
+<body>
+<!-- script isn't actually required for the crash of bug 151956 -->
+<table border>
+  <tbody>
+    <form>
+      <script>
+        var foo = 42;
+      </script>
+    </form>
+    <tr>
+      <td> X </td>
+    </tr>
+  </tbody>
+</table>
+</body>
+</html>
+
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/92647-1.html
@@ -0,0 +1,33 @@
+<HTML>
+<BODY>
+ <form> 
+<TABLE border="1">
+ <TR>
+  <TD>
+   <TABLE border="2">
+    <TR>
+     <TD WIDTH="30%">
+       Member Number:
+     </TD>
+	 <TD WIDTH="70%">
+      <INPUT NAME="EchoUser" TYPE="TEXT">
+	 </TD>
+    </TR>
+    <TR>
+     <TD>
+      PIN:
+     </TD>
+     <TD>
+      <INPUT TYPE="password">
+	 </TD>
+     <TD>
+     </TD>
+    </TR>
+   </TABLE>
+  </TD>
+ </TR>
+</TABLE>
+</Form>
+</BODY>
+</HTML>
+
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/92788-1.html
@@ -0,0 +1,20 @@
+<HTML><HEAD><TITLE>Bug #92788</TITLE></HEAD>
+<BODY>
+<TABLE>
+  <TR>
+    <TD>
+      <CENTER>
+              <TR>
+                <TD>
+                <IFRAME 
+                  marginWidth=0 marginHeight=0 src="foo" frameBorder=0 width=125 scrolling=no 
+                  height=125><SCRIPT LANGUAGE="JavaScript">document.write('<SCR'+'IPT LANGUAGE="JavaScript" SRC="http://ads1.ad-flow.com/?DC=tweak3d+-+rst&JS=Y&TARGET=_blank"></SCR'+'IPT>');</SCRIPT><NOSCRIPT><A HREF="http://ads1.ad-flow.com/?SHT=tweak3d+-+rst" TARGET="_blank"><IMG SRC="http://ads1.ad-flow.com/?SIT=tweak3d+-+rst" HEIGHT="125" WIDTH="125"></A></NOSCRIPT></IFRAME>--&gt; 
+                  <FORM name=EmailSub onsubmit="if ( (document.EmailSub.email.length == 0) ||  (document.EmailSub.email.value.indexOf('@') == -1) || (document.EmailSub.email.value.indexOf('.') == -1) ) {('Invalid Email address');return false;} window.open('http://www.pluginnewsletter.com/nl-popsub.cfm?wsnum=369&amp;' + 'Email=' + document.EmailSub.email.value,'WinOpen','toolbar=no,scrollbars=yes,resizable=yes,width=666,height=666'); return false;">
+                  <SCRIPT language=JavaScript src="foo.js"></SCRIPT>
+                  <NOSCRIPT><A target=_blank href="http://ads1.ad-flow.com/?SHT=tweak3d-lst" WIDTH="468" HEIGHT="60"><IMG src="Tweak3D_net - Your Freakin' Tweakin' Source!_fichiers/ads1.ad-flow.gif"></A> 
+                  </NOSCRIPT></CENTER>
+
+              <TR bgColor=#ffffff>
+                <CENTER><IFRAME marginWidth=0 marginHeight=0 src="foo" frameBorder=0 width=468 scrolling=no height=60><SCRIPT LANGUAGE="JavaScript">document.write('<SCR'+'IPT LANGUAGE="JavaScript" SRC="http://ads1.ad-flow.com/?DC=tweak3d-top&JS=Y&TARGET=_blank"></SCR'+'IPT>');</SCRIPT><NOSCRIPT><A HREF="http://ads1.ad-flow.com/?SHT=tweak3d-top" TARGET="_blank"><IMG SRC="http://ads1.ad-flow.com/?SIT=tweak3d-top&SC=Y" HEIGHT="60" WIDTH="468"></A></NOSCRIPT></IFRAME>
+</CENTER></TR>
+</BODY></HTML>
--- a/parser/htmlparser/tests/crashtests/crashtests.list
+++ b/parser/htmlparser/tests/crashtests/crashtests.list
@@ -9,11 +9,16 @@ load 34168-1.xml
 load 41427-1.html
 load 44178-1.html
 load 46495-1.html
 load 50134-1.html
 load 50994-1.html
 load 58455-1.html
 load 60110-1.html
 load 73331-1.html
+load 92647-1.html
+load 92788-1.html
+load 121591-1.html
+load 147179-1.html
+load 151956-1.html
 load 423373-1.html
 # load 460706-1.xhtml
 load 468538-1.xhtml