Add crashtests
authorJesse Ruderman <jruderman@gmail.com>
Fri, 13 Feb 2009 14:54:17 -0800
changeset 24982 b0337b6287f3517114bf78243c78b429e68894c4
parent 24981 87b0a5610a8d1ba1c999f23292ae5161fb6b5368
child 24983 57e90548526491f7c51ce22e5828cd76d0ba68b8
push idunknown
push userunknown
push dateunknown
milestone1.9.2a1pre
Add crashtests
content/base/crashtests/293388-1.html
content/base/crashtests/crashtests.list
content/html/document/crashtests/285166-1.html
content/html/document/crashtests/294235-1.html
content/html/document/crashtests/crashtests.list
content/xbl/crashtests/232095-1.xul
content/xbl/crashtests/277523-1.xhtml
content/xbl/crashtests/277950-1.xhtml
content/xbl/crashtests/crashtests.list
content/xul/content/crashtests/236853.rdf
content/xul/content/crashtests/236853.xul
content/xul/content/crashtests/252448-1.xul
content/xul/content/crashtests/253479-1.xul
content/xul/content/crashtests/253479-2.xul
content/xul/content/crashtests/crashtests.list
dom/src/base/crashtests/244933-1.html
dom/src/base/crashtests/275912-1.html
dom/src/base/crashtests/crashtests.list
gfx/thebes/crashtests/248518-1.html
gfx/thebes/crashtests/crashtests.list
js/src/xpconnect/crashtests/290162-1.html
js/src/xpconnect/crashtests/crashtests.list
layout/base/crashtests/234851-1.html
layout/base/crashtests/234851-2.html
layout/base/crashtests/244490-1.html
layout/base/crashtests/254367-1.html
layout/base/crashtests/265027-1.html
layout/base/crashtests/265736-1.html
layout/base/crashtests/265736-2.html
layout/base/crashtests/265899-1.html
layout/base/crashtests/265973-1.html
layout/base/crashtests/265986-1.html
layout/base/crashtests/265999-1.html
layout/base/crashtests/266222-1.html
layout/base/crashtests/266360-1.html
layout/base/crashtests/266445-1.html
layout/base/crashtests/268157-1.html
layout/base/crashtests/269566-1.html
layout/base/crashtests/272647-1.html
layout/base/crashtests/276053-1.html
layout/base/crashtests/281333-1.html
layout/base/crashtests/285212-1.html
layout/base/crashtests/286813-1.html
layout/base/crashtests/crashtests.list
layout/forms/crashtests/258101-1.html
layout/forms/crashtests/266225-1.html
layout/forms/crashtests/crashtests.list
layout/generic/crashtests/264937-1.html
layout/generic/crashtests/265867-1.html
layout/generic/crashtests/265867-2.html
layout/generic/crashtests/295292-1.html
layout/generic/crashtests/295292-2.html
layout/generic/crashtests/crashtests.list
layout/mathml/crashtests/289180-1.xml
layout/mathml/crashtests/crashtests.list
layout/svg/crashtests/267650-1.svg
layout/svg/crashtests/294022-1.svg
layout/svg/crashtests/crashtests.list
layout/tables/crashtests/237421-1.html
layout/tables/crashtests/237421-2.html
layout/tables/crashtests/238909-1.html
layout/tables/crashtests/239294-1.html
layout/tables/crashtests/240854-1.html
layout/tables/crashtests/266015-1.html
layout/tables/crashtests/277062-1.html
layout/tables/crashtests/278385-1.html
layout/tables/crashtests/282175-1.html
layout/tables/crashtests/crashtests.list
layout/xul/base/src/crashtests/289410-1.xul
layout/xul/base/src/crashtests/291702-1.xul
layout/xul/base/src/crashtests/291702-2.xul
layout/xul/base/src/crashtests/291702-3.xul
layout/xul/base/src/crashtests/294371-1.xul
layout/xul/base/src/crashtests/crashtests.list
parser/htmlparser/tests/crashtests/220542-1.html
parser/htmlparser/tests/crashtests/253979-1.html
parser/htmlparser/tests/crashtests/269095-1.html
parser/htmlparser/tests/crashtests/286733-1.html
parser/htmlparser/tests/crashtests/286733-2.html
parser/htmlparser/tests/crashtests/299036-1.html
parser/htmlparser/tests/crashtests/crashtests.list
view/crashtests/281743-1.html
view/crashtests/crashtests.list
new file mode 100644
--- /dev/null
+++ b/content/base/crashtests/293388-1.html
@@ -0,0 +1,26 @@
+<html class="reftest-wait"><head><title>Testcase bug 293388 - Overwriting of div innerHTML cause starting of the loading icon(circle) and some times browser can crash [@ nsRange::DeleteContents]</title></head>
+<script>
+function reallyClear()
+{
+  var par = document.getElementById("par");
+  var range = document.createRange();
+  range.selectNodeContents(par);
+  range.deleteContents();
+  document.documentElement.removeAttribute("class");
+}
+
+function clear()
+{
+  document.body.removeEventListener("DOMNodeRemoved", clear, false);
+  reallyClear();
+}
+
+function init()
+{
+  document.body.addEventListener("DOMNodeRemoved", clear, false);
+}
+
+</script>
+<body onload="init(); setTimeout(reallyClear, 10);">
+<div id="par"><span>1</span><span>2</span></div>
+</body></html>
\ No newline at end of file
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -1,13 +1,14 @@
 load 43040-1.html
 load 116848-1.html
 load 149320-1.html
 load 205225-1.html
 load 231475-1.html
+load 293388-1.html
 load 308120-1.xul
 load 324871-1.html
 load 325730-1.html
 load 326618-1.html
 load 326646-1.html
 load 326778-1.html
 load 326865-1.html
 load 330925-1.xhtml
new file mode 100644
--- /dev/null
+++ b/content/html/document/crashtests/285166-1.html
@@ -0,0 +1,3 @@
+<script>
+document.createElement("#text");
+</script>
new file mode 100644
--- /dev/null
+++ b/content/html/document/crashtests/294235-1.html
@@ -0,0 +1,14 @@
+<html>
+   <head>
+      <title>bug 294235</title>
+      <script>
+         function countdown(){
+            count2.innerHTML="foo";
+         }
+         document.links.length;
+      </script>
+   </head>
+   <body>
+      <strong><div id="count2"><script>countdown();</script><noscript>bar</noscript></div></strong>
+   </body>
+</html>
--- a/content/html/document/crashtests/crashtests.list
+++ b/content/html/document/crashtests/crashtests.list
@@ -1,7 +1,9 @@
+load 285166-1.html
+load 294235-1.html
 skip load 353713-1.html # Bug 469626
 load 388183-1.html
 load 395340-1.html
 load 407053.html
 load 448564.html
 load 468562-1.html
 load 468562-2.html
new file mode 100644
--- /dev/null
+++ b/content/xbl/crashtests/232095-1.xul
@@ -0,0 +1,44 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+<window
+  xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  xmlns:xbl="http://www.mozilla.org/xbl"
+  xmlns:html="http://www.w3.org/1999/xhtml"
+  >
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="serverpost_base">
+    <implementation>
+      <method name="getSuccessfulControls">
+        <parameter name="aNode"/>
+        <body><![CDATA[
+          dump("<html:input type="file"/> has not been tested yet!  This may not work!!!\n");
+        ]]></body>
+      </method>
+
+      <method name='finalizeAndSubmit'>
+        <body>
+	  return true;
+        </body>
+      </method>
+    </implementation>
+  </binding>
+</bindings>
+
+  <html:style type="text/css"><![CDATA[
+  @namespace xbl url("http://www.mozilla.org/xbl");
+  @namespace xul url("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul");
+
+  xbl|bindings {
+    display: none;
+  }
+
+  xul|serverpost {
+    -moz-binding: url("#serverpost_base");
+  }
+
+  ]]></html:style>
+
+  <serverpost/>
+  <serverpost/>
+</window>
new file mode 100644
--- /dev/null
+++ b/content/xbl/crashtests/277523-1.xhtml
@@ -0,0 +1,24 @@
+<?xml version="1.0"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl">
+<head>
+<title>Testcase bug 277208 - appendChild to a hidden box from a binding crashes</title>
+
+<xbl:bindings><xbl:binding id="crash"><xbl:content>
+<span style="display:none"><xbl:children includes="span"/></span>
+</xbl:content></xbl:binding></xbl:bindings>
+
+<style type="text/css">
+#test{-moz-binding:url(#crash);}
+</style>
+</head>
+<body onload="init()">
+<span id="test"></span>
+<script>
+function init(){
+         document.getElementById('test').appendChild(document.createElement('span'));
+}
+</script>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/xbl/crashtests/277950-1.xhtml
@@ -0,0 +1,20 @@
+<?xml version="1.0"?>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title>Testcase</title>
+<xbl:bindings xmlns="http://www.mozilla.org/xbl"
+  xmlns:xbl="http://www.mozilla.org/xbl">
+  <binding id="test">
+    <implementation>
+      <property/>
+    </implementation>
+  </binding>
+</xbl:bindings>
+<style type="text/css">
+  p{ -moz-binding: url(#test); }
+</style>
+</head>
+<body>
+<p></p>
+</body>
+</html>
--- a/content/xbl/crashtests/crashtests.list
+++ b/content/xbl/crashtests/crashtests.list
@@ -1,11 +1,14 @@
 load 205735-1.xhtml
 load 223799-1.xul
 load 226744-1.xhtml
+load 232095-1.xul
+load 277523-1.xhtml
+load 277950-1.xhtml
 load 342954-1.xhtml
 load 342954-2.xhtml
 load 368276-1.xhtml
 load 368641-1.xhtml
 load 378521-1.xhtml
 load 382376-1.xhtml
 load 382376-2.xhtml
 load 406900-1.xul
new file mode 100644
--- /dev/null
+++ b/content/xul/content/crashtests/236853.rdf
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+	xmlns:ex="http://www.ex.org/ex-rdf#">
+
+	<rdf:Description about="urn:root">
+		<ex:nodes>
+			<rdf:Bag about="http://www.ex.org/nodes">
+				<rdf:li>
+					<rdf:Description about="http://www.ex.org/nodes/A"/>
+				</rdf:li>
+			</rdf:Bag>
+		</ex:nodes>
+	</rdf:Description>		
+</rdf:RDF>
new file mode 100644
--- /dev/null
+++ b/content/xul/content/crashtests/236853.xul
@@ -0,0 +1,26 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin" type="text/css"?>
+<window
+	xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+	xmlns:svg="http://www.w3.org/2000/svg">
+	<vbox flex="1">
+		<svg:svg datasources="236853.rdf" ref="urn:root"> 
+			<template>
+				<rule>
+					<conditions>
+						<content uri="?root"/>
+						<triple	subject="?root"
+								predicate="http://www.ex.org/ex-rdf#nodes"
+								object="?nodes"/>
+						<member container="?nodes" child="?node"/>
+					</conditions>
+					<action>
+						<!-- The line below causes Mozilla to crash -->
+						<svg:text uri="?node" x="64" y="64">Text</svg:text>
+					</action>
+				</rule>
+			</template>
+			<!--<svg:text x="64" y="64">Text</svg:text>-->
+		</svg:svg>
+	</vbox>
+</window>
new file mode 100644
--- /dev/null
+++ b/content/xul/content/crashtests/252448-1.xul
@@ -0,0 +1,10 @@
+<?xml version="1.0"?>
+<?xml-stylesheet type="text/css" href="chrome://global/skin/"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+  onload="document.documentElement.firstChild.focus();">
+  <menulist>
+    <menupopup style="-moz-binding: none;">
+      <spacer/>
+    </menupopup>
+  </menulist>
+</window>
new file mode 100644
--- /dev/null
+++ b/content/xul/content/crashtests/253479-1.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+        xmlns:html="http://www.w3.org/1999/xhtml"
+>
+<html:div style="position:fixed;"/>
+</window>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/content/xul/content/crashtests/253479-2.xul
@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <x style="position:fixed;"/>
+</window>
\ No newline at end of file
--- a/content/xul/content/crashtests/crashtests.list
+++ b/content/xul/content/crashtests/crashtests.list
@@ -1,9 +1,13 @@
 load 107518-1.xml
+load 236853.xul
+load 252448-1.xul
+load 253479-1.xul
+load 253479-2.xul
 load 326864-1.xul
 load 326875-1.xul
 load 326881-1.xul
 load 329982-1.xhtml
 load 336096-1.xhtml
 load 354611-1.html
 load 360078-1.xhtml
 load 363791-1.xul
new file mode 100644
--- /dev/null
+++ b/dom/src/base/crashtests/244933-1.html
@@ -0,0 +1,13 @@
+<html>
+<body>
+<pre>
+<script>
+document.write(window.sidebar.something);
+for (i in window.sidebar)
+{
+	break
+}
+</script>
+</pre>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/src/base/crashtests/275912-1.html
@@ -0,0 +1,2 @@
+<HTML>
+><><BODY onLoad=*><
\ No newline at end of file
--- a/dom/src/base/crashtests/crashtests.list
+++ b/dom/src/base/crashtests/crashtests.list
@@ -1,9 +1,11 @@
 load 90613-1.html
+load 244933-1.html
+load 275912-1.html
 load 327571-1.html
 load 327695-1.html
 load 329481-1.xhtml
 load 338674-1.xhtml
 load 346381-1.html
 load 359432-1.xhtml
 load 369413-1.html
 load 372554-1.html
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/248518-1.html
@@ -0,0 +1,7 @@
+<html><head>
+	<style type="text/css">
+		<!--
+		body{font: 10pt lucida;}
+		-->
+	</style>
+</head><body>Hello.</body></html>
--- a/gfx/thebes/crashtests/crashtests.list
+++ b/gfx/thebes/crashtests/crashtests.list
@@ -1,13 +1,14 @@
 load 122875-1.html
 load 156882-1.html
 load 157320-1.html
 load 199379-1.html
 load 206561-1.html
+load 248518-1.html
 load 345576-1.html   
 load 345629-1.html
 load 369688-1.html
 load 369947-1.html
 load 372094-1.xhtml
 load 377231-1.html
 load 377232-1.xhtml
 load 377461-1.xhtml
new file mode 100644
--- /dev/null
+++ b/js/src/xpconnect/crashtests/290162-1.html
@@ -0,0 +1,5 @@
+<script>
+	InstallTrigger.install.call(document,"a","a");
+</script>
+
+
--- a/js/src/xpconnect/crashtests/crashtests.list
+++ b/js/src/xpconnect/crashtests/crashtests.list
@@ -1,10 +1,11 @@
 load 117307-1.html
 load 193710.html
+load 290162-1.html
 load 326615-1.html
 load 328553-1.html
 load 346258-1.html
 load 346512-1.xhtml
 load 382133-1.html
 load 386680-1.html
 load 394810-1.html
 load 400349-1.html
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/234851-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<head>
+<title>Testcase</title>
+<style type="text/css">
+ html{
+   overflow:scroll;
+ }
+</style>
+</head>
+
+<body onload="var sheet = document.styleSheets[0]; sheet.disabled = true; sheet.disabled = false;">
+  Load this page to crash
+</body>
+</html>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/234851-2.html
@@ -0,0 +1,35 @@
+<html style="overflow:scroll">
+<body>
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+<p>Dum de doo
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/244490-1.html
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xml:lang="de" xmlns="http://www.w3.org/1999/xhtml">
+	<head>
+		<title>Crash Test</title>
+		<base href="D:\CSS Test Files\" />
+		<style type="text/css">
+			p { border: 1px red solid }
+			p:before { content: url("images/quote_end.png") }
+		</style>
+	</head>
+	<body>
+		<p>Did it crash?</p>
+	</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/254367-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html><head>
+    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+    <title>Testcase for bug 254367</title>
+</head>
+<body>text<img> </body></html>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/265027-1.html
@@ -0,0 +1,19 @@
+<HTML>
+<HEAD>
+<MARQUEE>
+<TABLE>
+<MARQUEE HEIGHT=100000000>
+<MARQUEE HEIGHT=100000000>
+<MARQUEE HEIGHT=100000000>
+<MARQUEE HEIGHT=100000000>
+<MARQUEE HEIGHT=100000000>
+<MARQUEE HEIGHT=100000000>
+<MARQUEE HEIGHT=100000000>
+<MARQUEE HEIGHT=100000000>
+<MARQUEE HEIGHT=100000000>
+<MARQUEE HEIGHT=100000000>
+<MARQUEE HEIGHT=100000000>
+<TBODY>
+Attack of the marquees!
+
+
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/265736-1.html
@@ -0,0 +1,2 @@
+<HTML>
+<HR WIDTH=4444444 COLOR="#000000">
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/265736-2.html
@@ -0,0 +1,8 @@
+<html>
+<head>
+</head>
+
+<body>
+<iframe style="border-top-width: 31378748; -moz-border-radius-bottomright: 23895784; ">
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/265899-1.html
@@ -0,0 +1,5 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY STYLE="float:right; HEIGHT:0pt; PADDING:99999999999px;"></BODY>
+</HTML>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/265973-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.0 Transitional//EN'>
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<DIV STYLE="MARGIN:-99999999999px; PADDING:99999999999px; float:left; HEIGHT:0;"></DIV>
+</BODY>
+</HTML>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/265986-1.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.0 Transitional//EN'>
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<IFRAME STYLE="MARGIN:99999999999px; PADDING:-99999999999px;"></IFRAME>
+<APPLET STYLE="HEIGHT:9999999999pt; float:left; MARGIN:-99999999999px; border:99999999999px solid blue;"></APPLET>
+<MARQUEE STYLE=" WIDTH:9999999999px;">W</MARQUEE>
+</BODY>
+</HTML>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/265999-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.0 Transitional//EN'>
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<MARQUEE STYLE="HEIGHT:9999999999px; float:right; border:99999999999px solid blue;"></MARQUEE>
+</BODY>
+</HTML>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/266222-1.html
@@ -0,0 +1,7 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<NOFRAMES STYLE="DISPLAY:BLOCK; float:left; overflow:inherit;"></NOFRAMES>
+</BODY>
+</HTML>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/266360-1.html
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<BODY STYLE=" border:10391122102cm solid #FFFFFF; float:right;">
+<SPAN STYLE=" border:inherit;"></SPAN>
+<H1 STYLE="float:right; HEIGHT:613927841cm; border:inherit;">Test</H1>
+</BODY>
+</HTML>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/266445-1.html
@@ -0,0 +1,9 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<BODY STYLE="overflow:hidden;">
+<HR STYLE="float:right; padding:71155995130em;">
+<OL STYLE="position:static;"><LI>Test</LI></OL>
+</BODY>
+</HTML>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/268157-1.html
@@ -0,0 +1,15 @@
+ 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8
+<object>
+<div>
+</div>
+</object>
+ 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8
+
+<span>
+ 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0
+<object>
+<div>
+</div>
+</object>
+ 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0
+</span>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/269566-1.html
@@ -0,0 +1,11 @@
+<html><head>
+<style>
+BODY { display:table; }
+</style>
+</head>
+<body>
+<div><iframe src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%3E%3C/body%3E%3C/html%3E"></iframe>
+</div>
+</body></html>
+
+
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/272647-1.html
@@ -0,0 +1,18 @@
+<html>
+ <header>
+  <title>Defects </title>
+ </header>
+<body>
+<center><table>
+<caption>
+</caption>
+
+<p>
+<caption>
+</tr></td>
+</center>
+<center><table>
+<td><tr>
+delete me and the problem goes away
+</body>
+</html>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/276053-1.html
@@ -0,0 +1,21 @@
+<html><head><title>Testcase bug 276053 - Closeing a tab with http://linuxblog.sytes.net loaded in it causes Firefox to crash [@ nsView::GetDimensions]</title>
+<style>
+#serendipityRightSideBar {
+  display: block;
+}
+</style>
+</head>
+
+<body>
+<table><tbody><tr>
+<td>
+You should be able to see a green block at the right of this text<br>
+Closing this page, should not cause a crash.<br>
+
+<script>var x=document.body.offsetHeight;</script>
+</td>
+<td id="serendipityRightSideBar">
+ <iframe src="data:text/html;charset=utf-8,%3Chtml%3E%3Chead%3E%3C/head%3E%3Cbody%20style%3D%22background-color%3Agreen%22%3EYou%20should%20be%20able%20to%20see%20this%20text%3C/body%3E%3C/html%3E"></iframe>           
+</td>
+</tr></tbody></table>
+</body></html>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/281333-1.html
@@ -0,0 +1,1 @@
+<NOFRAMES STYLE="display:table-header-group; clear:inherit;"></NOFRAMES>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/285212-1.html
@@ -0,0 +1,13 @@
+<BODY STYLE="margin:500px;">
+<DD>
+<OBJECT STYLE="width:500px;">
+<BODY>
+ 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0
+ 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0 2 4 6 8 0
+<UL>
+</UL>
+</BODY>
+</OBJECT>
+1
+</DD>
+</BODY>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/286813-1.html
@@ -0,0 +1,9 @@
+<HTML><HEAD><TITLE>286813</TITLE></HEAD><BODY>
+	<OBJECT>
+		<EMBED>12345678901234567890123456789123456789F<EMBED>
+		<OBJECT>
+			<IFRAME WIDTH="100"> frame </IFRAME>
+		</OBJECT>
+	</OBJECT>
+</BODY></HTML>
+		
\ No newline at end of file
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -1,16 +1,13 @@
 load 46043-1.html
 load 47843-1.html
 load 49122-1.html
 load 50257-1.html
 load 50395-1.html
-load 50395-1.html
-load 50395-1.html
-load 50395-1.html
 load 56746-1.html
 load 89101-1.html
 load 89358-1.html
 load 90205-1.html
 load 99776-1.html
 load 118931-1.html
 load 121533-1.html
 load 123049-1.html
@@ -23,23 +20,44 @@ load 147320-1.html
 load 148245-1.html
 load 149014-1.html
 skip load 150431-1.html # slow test
 load 176915-1.html
 load 191272-1.html
 load 199696-1.html
 load 217903-1.html
 load 223064-1.html
+load 234851-1.html
+load 234851-2.html
 load 241300-1.html
 load 243159-1.html
 load 243159-2.xhtml
 load 243519-1.html
+load 244490-1.html
+load 254367-1.html
+load 265027-1.html
+load 265736-1.html
+load 265736-2.html
+load 265899-1.html
+load 265973-1.html
+load 265986-1.html
+load 265999-1.html
+load 266222-1.html
+load 266360-1.html
+load 266445-1.html
+load 268157-1.html
+load 269566-1.html
+load 272647-1.html
 load 275746-1.html
+load 276053-1.html
 load 280708-1.html
 load 280708-2.html
+load 281333-1.html
+load 285212-1.html
+load 286813-1.html
 load 306940-1.html
 load 310267-1.xml
 load 310638-1.svg
 load 310638-2.html
 load 313086-1.xml
 load 321058-1.xul
 load 321058-2.xul
 load 321077-1.xul
new file mode 100644
--- /dev/null
+++ b/layout/forms/crashtests/258101-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
+<html>
+<head>
+  <meta content="text/html; charset=ISO-8859-1"
+ http-equiv="content-type">
+  <title>Crash Testcase</title>
+  <script type="text/javascript">
+function crash()
+{
+  var inp = document.getElementById("theinp");
+  inp.type = "file";
+}
+  </script>
+</head>
+<body onload="crash();">
+<input id="theinp" type="text">
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/forms/crashtests/266225-1.html
@@ -0,0 +1,7 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<FIELDSET STYLE="float:right; text-indent:999px;">Test</FIELDSET>
+</BODY>
+</HTML>
--- a/layout/forms/crashtests/crashtests.list
+++ b/layout/forms/crashtests/crashtests.list
@@ -1,12 +1,14 @@
 load 166750-1.html
 load 200347-1.html
 load 203041-1.html
 load 213390-1.html
+load 258101-1.html
+load 266225-1.html
 load 310426-1.xhtml
 load 310520-1.xhtml
 load 315752-1.xhtml
 load 323499-1.html
 load 363696-1.xul
 load 363696-2.html
 load 363696-3.html
 load 366205-1.html
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/264937-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html><head>
+    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
+    <title>Testcase for bug 264937</title>
+
+<style type="text/css">
+        p:first-letter { 
+                background-color: lime;
+        }
+</style>
+
+</head>
+<body>
+
+	<p>"Test word</p>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/265867-1.html
@@ -0,0 +1,11 @@
+<HTML>
+<HEAD>
+</HEAD>
+<BODY>
+<BODY STYLE="FLOAT:RIGHT;"></BODY>
+<MARQUEE STYLE="MARGIN:99999999999px;"></MARQUEE>
+<B STYLE="FLOAT:RIGHT; PADDING:99999999999px;"></B>
+</BODY>
+</HTML>
+
+
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/265867-2.html
@@ -0,0 +1,3 @@
+<DIV STYLE="display:table-column-group;">
+  <DIV>Hello</DIV>
+</DIV>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/295292-1.html
@@ -0,0 +1,13 @@
+<html>
+ <head>
+  <style type="text/css">
+   div{overflow:hidden;}
+   div.menubar{position:fixed;width:100%;}
+  </style>
+ </head>
+ <body>
+  <div class="menubar">
+  </div>
+  if you can't see this, it crashed.
+ </body>
+</html>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/295292-2.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<title>Test Page</title>
+<style>
+#problem {
+  left:0;
+  top:0;
+  width: 0;
+  overflow: hidden;
+  position: fixed;
+}
+</style>
+</head>
+<body>
+
+<div id="problem">
+this should be hidden
+</div>
+
+page loaded
+
+</body>
+</html>
\ No newline at end of file
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -1,10 +1,15 @@
 load 37757-1.html
 load 225868-1.html
+load 264937-1.html
+load 265867-1.html
+load 265867-2.html
+load 295292-1.html
+load 295292-2.html
 load 302260-1.html
 load 307979-1.html
 load 310556-1.xhtml
 load 322780-1.xul
 load 323386-1.html
 load 323389-1.html
 load 323389-2.html
 load 323493-1.html
new file mode 100644
--- /dev/null
+++ b/layout/mathml/crashtests/289180-1.xml
@@ -0,0 +1,16 @@
+
+
+    <math xmlns="http://www.w3.org/1998/Math/MathML" mode="inline">
+      <mfrac>
+        <mi>x</mi>
+        <mi>y</mi>
+      </mfrac>
+    </math>
+    <math xmlns="http://www.w3.org/1998/Math/MathML" mode="display">
+      <mfrac>
+
+        <mi>x</mi>
+        <mi>y</mi>
+      </mfrac>
+    </math>
+
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@@ -1,9 +1,10 @@
 load 151054-1.xml
+load 289180-1.xml
 load 307826-1.xhtml
 load 307839-1.xhtml
 load 307839-2.xhtml
 load 323733-1.xml
 load 323737-1.xml
 load 323738-1.xml
 load 323741-1.xml
 load 323742-1.xml
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/267650-1.svg
@@ -0,0 +1,4 @@
+<?xml version='1.0'?>
+<svg xmlns='http://www.w3.org/2000/svg'>
+  <text fill='none' stroke='black'>TESTCASE</text>
+</svg>
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/294022-1.svg
@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" 
+         "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg"
+        xmlns:xlink="http://www.w3.org/1999/xlink"
+        >
+
+                    <g>
+                       <clipPath id="action_box_cp">
+                            <rect width="100" height="46"/>
+                        </clipPath>
+                        <text style="clip-path:url(#action_box_cp); " y="10" id="action_boxtext" pointer-events="none"  class="TextBoxText">
+                            <tspan x="0" dy="0">Action</tspan>
+                        </text>
+                    </g>
+      
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -1,9 +1,11 @@
 load 220165-1.svg
+load 267650-1.svg
+load 294022-1.svg
 load 307314-1.svg
 load 308615-1.svg
 load 308917-1.svg
 load 310436-1.svg
 load 322185-1.svg
 load 326495-1.svg
 load 326974-1.svg
 load 327711-1.svg
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/237421-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html lang="en">
+   <head>
+      <title>bug 237421: test1</title>
+   </head>
+   <body>
+      <table>
+         <tr id="foo"><td></td></tr>
+         <tr><td colspan="2"></td></tr>
+      </table>
+      <script>
+         document.getElementById("foo").style.display="table-row";
+         document.getElementById("foo").style.display="none";
+      </script>
+   </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/237421-2.html
@@ -0,0 +1,47 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html lang="en" class="reftest-wait">
+   <head>
+      <title>bug 237421: test2a</title>
+
+     <script type="text/javascript">
+
+
+
+       function remove_second_row() {
+
+         var r2 = document.getElementById("row2");
+
+         r2.style.display ="none";
+
+        setTimeout('remove_first_row()', 10);
+
+       }
+
+
+
+      function remove_first_row() {
+
+         var r1 = document.getElementById("row1");
+
+         r1.style.display ="none";
+         
+         document.documentElement.removeAttribute("class");
+
+       }
+
+
+
+     </script>
+
+  
+   </head>
+   <body onload="setTimeout( 'remove_second_row()', 10)">
+      <table border>
+         <tr id="row1"><td rowspan="3">a</td><td rowspan="3">b</td></tr>
+         <tr id="row2"></tr>
+         <tr></tr>
+         <tr><td>c</td></tr>
+      </table>
+      
+   </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/238909-1.html
@@ -0,0 +1,8 @@
+<html>
+   <head>
+      <title>bug 238909</title>
+   </head>
+   <body>
+      <table style="border-collapse: collapse;" width="100" height="100"></table>
+   </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/239294-1.html
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="ISO-8859-1"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html>
+<head>
+  <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"/>
+  <title>Watch Mozilla Go Boom</title>
+</head>
+
+<body>
+
+<!--
+  To make mozilla render this properly, take out the "display: inline"
+  style, or take out the colgroup - getting rid of either makes
+  everything work fine!!!
+-->
+<table style="display: inline">
+  <col></col>
+  <colgroup span="12"></colgroup>
+  <tr>
+    <th>Year</th>
+    <th colspan="12">Month</th>
+  </tr><tr>
+    <td>2001</td>
+    <td colspan="8">&nbsp;</td>
+    <td>Sep</td>
+    <td>Oct</td>
+    <td>Nov</td>
+    <td>Dec</td>
+  </tr><tr>
+    <td>2002</td>
+    <td>Jan</td>
+    <td>Feb</td>
+    <td>Mar</td>
+    <td colspan="9">&nbsp;</td>
+  </tr></table>
+
+</body></html>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/240854-1.html
@@ -0,0 +1,40 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html lang="en">
+ <head>
+    <title>Table dom Column Handling crash</title>
+
+<SCRIPT>
+function doIt() {
+  var t = document.getElementById('t1');
+  var c1 =document.getElementById('col2');
+  t.removeChild(c1);
+}
+</SCRIPT>  
+</HEAD>
+<BODY onload="doIt()">
+The 2 tables should look the same
+<table id="t1" bgcolor=orange border>
+ <col width=100>
+ <col width=200>
+ <col id="col2" width=300>
+ <tr>
+  <td>100</td><td>200</td><td>auto</td>
+ </tr>
+</table>
+<BR>
+<table bgcolor=orange border>
+ <col width=100>
+ <col width=200>
+ <tr>
+  <td>100</td><td>200</td><td>auto</td>
+ </tr>
+</table>
+
+ </BODY>
+</HTML>
+
+
+
+
+
+
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/266015-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head>
+<meta http-equiv="Content-type" content="text/html;  charset=ISO-8859-1">
+
+<title>col crash 1</title><style type="text/css">
+#table { display: table}
+#col {display: table-column}
+</style></head>
+
+
+<body>
+<div id="table">
+ <div id="col">
+</div>
+ <div>this text should be visible</div>
+
+
+</div></body></html>
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/277062-1.html
@@ -0,0 +1,4 @@
+<html>
+<body>
+
+<TABLE><bla><TD><TD><COLGROUP></COLGROUP><COLGROUP></COLGROUP>
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/278385-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+	<head>
+		<meta http-equiv="content-type" content="text/html;charset=iso-8859-1">
+		<title>Firefox Test</title>
+	</head>
+	<body>
+		<table border=1>
+			<tr>
+				<th>
+					<td>
+						<p>TWO</p>
+					</td>
+						<title>Firefox Test</title>
+			</tr>
+			<col>
+				<tr>
+					<td>
+						<p>ONE</p>
+					</td>
+				</tr>
+			<col>
+		</table>
+	</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/tables/crashtests/282175-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+   <head>
+      <title>bug 282175</title>
+      <script type="text/javascript">
+         function modifyPosition2()
+         {
+            document.getElementById("table").style.position = "inherit";
+            document.body.offsetHeight;
+            document.getElementById("tr").style.position = "inherit";
+            document.getElementById("table").style.position = "fixed";
+            document.body.offsetHeight;
+            document.getElementById("table").style.position = "inherit";
+         }
+      </script>
+   </head>
+   <body onload="modifyPosition2()">
+      <table style="position: fixed" id="table">
+         <tbody style="position: inherit">
+            <tr style="position: fixed" id="tr">
+               <td>0.2 miles</td>
+            </tr>
+         </tbody>
+      </table>
+   </body>
+</html>
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -6,16 +6,26 @@ load 78623-1.html
 load 110523-1.html
 load 138725-1.html
 load 159359-1.html
 load 187779-1.html
 load 189751-1.html
 load 197015-1.html
 load 220536-1.html
 load 223458-1.html
+load 237421-1.html
+load 237421-2.html
+load 238909-1.html
+load 239294-1.html
+load 240854-1.html
+load 266015-1.html
+load 277062-1.html
+load 278385-1.html
+load 282175-1.html
+load 284844-1.html
 load 284844-1.html
 load 284852.html
 load 300912.html
 load 322779-1.xul
 load 323489-1.html
 load 331344-1.html
 load 331446-1.xhtml
 load 331690-1.html
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/289410-1.xul
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window id="crash-window"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+  <scrollbox>
+    <tree id="crash-tree">
+      <treecols/>
+      <treechildren/>
+    </tree>
+  </scrollbox>
+
+</window>
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/291702-1.xul
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window title="Negative flex bug #2"
+		orient="horizontal"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <button label="Button" flex="2"/>
+  <label value="This is a label" flex="1"/>
+  <label value="This is the second label" flex="-2"/>
+  <label value="This is another label" flex="-1"/>
+</window>
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/291702-2.xul
@@ -0,0 +1,11 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window title="Negative flex bug #2"
+		orient="horizontal"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <button label="Button" flex="1073741824"/>
+  <label value="This is a label" flex="1073741824"/>
+  <label value="This is the second label" flex="1073741824"/>
+  <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+</window>
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/291702-3.xul
@@ -0,0 +1,137 @@
+<?xml version="1.0"?>
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window title="Negative flex bug #2"
+		orient="vertical"
+        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+  </hbox>
+
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+  </hbox>
+
+
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="1"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="1"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="1"/>
+    <label value="This is another label" style="-moz-box-flex: 1;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741823"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741823;"/>
+    <button label="Button" flex="2"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741824"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741824;"/>
+    <button label="Button" flex="2"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+  <hbox>
+    <button label="Button" flex="1073741825"/>
+    <label value="This is another label" style="-moz-box-flex: 1073741825;"/>
+    <button label="Button" flex="2"/>
+    <label value="This is another label" style="-moz-box-flex: 2;"/>
+  </hbox>
+</window>
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/294371-1.xul
@@ -0,0 +1,53 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/global.css" type="text/css"?>
+
+<window
+  id    = "overflow crash"
+  title = "scrollbox crasher"
+  xmlns = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
+	persist="sizemode width height screenX screenY"
+	width="320"
+	height="240">
+
+	<scrollbox flex="1">
+			<grid style="overflow: auto">
+				<columns>
+					<column flex="0"/>
+				</columns>
+				<rows>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+					<row><label value="Date"/></row>
+				</rows>
+			</grid>
+		</scrollbox>
+
+</window>
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@@ -1,13 +1,18 @@
 load 131008-1.xul
 load 137216-1.xul
 load 140218-1.xml
 load 151826-1.xul
 load 168724-1.xul
+load 289410-1.xul
+load 291702-1.xul
+load 291702-2.xul
+load 291702-3.xul
+load 294371-1.xul
 load 311457-1.html
 load 322786-1.xul
 load 326879-1.xul
 load 327776-1.html
 load 328135-1.xul
 load 329327-1.xul
 load 329407-1.xml
 load 329477-1.xhtml
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/220542-1.html
@@ -0,0 +1,2 @@
+<script>document.write('<link href="l:\\" rel=stylesheet>')</script>
+
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/253979-1.html
@@ -0,0 +1,4 @@
+<html><head></head><body>
+<a><a><p><font><p><font><b><a></font></a>
+</body></html>
+
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/269095-1.html
@@ -0,0 +1,1 @@
+<TABLE >
<FRAMESET>
<PARAM>
<FORM>
<MAP>
<FORM>
<TABLE>
<RTABLE>
\ No newline at end of file
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/286733-1.html
@@ -0,0 +1,4 @@
+<TABLE>
+<FRAMESET><FRAME></FRAMESET>
+<TR><TD><TABLE>
+          <TR><BR><TD><MAP><TABLE><BR></MAP>
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/286733-2.html
@@ -0,0 +1,4 @@
+<TABLE>
+<FRAMESET><FRAME></FRAMESET>
+<TR><TD><TABLE>
+          <TR><BR><TD><MAP><TABLE><TR><BR></MAP>
new file mode 100644
--- /dev/null
+++ b/parser/htmlparser/tests/crashtests/299036-1.html
@@ -0,0 +1,2 @@
+<table><textarea></textarea></table>
+
--- a/parser/htmlparser/tests/crashtests/crashtests.list
+++ b/parser/htmlparser/tests/crashtests/crashtests.list
@@ -19,11 +19,17 @@ load 92788-1.html
 load 121591-1.html
 load 147179-1.html
 load 151956-1.html
 load 152444-1.html
 load 185073-1.html
 load 188474-1.html
 load 194329-1.html
 load 197052-1.html
+load 220542-1.html
+load 253979-1.html
+load 269095-1.html
+load 286733-1.html
+load 286733-2.html
+load 299036-1.html
 load 423373-1.html
 skip load 460706-1.xhtml
 load 468538-1.xhtml
new file mode 100644
--- /dev/null
+++ b/view/crashtests/281743-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html>
+<head>
+<title>Testcase bug 281743</title>
+<style type="text/css">
+#header   { position: fixed; top: 0; left: 0; z-index: 100; }
+#mainmenu { position: fixed; top: 0; left: 0; z-index: 200; }
+</style>
+<script type="text/javascript">
+window.onload = function(e) {
+  var e = document.getElementsByTagName("style")[0];
+  e.disabled = true;
+  e.disabled = false;
+}
+</script>
+</head><body><div id="page"><div id="header"></div><div id="mainmenu"></div></div></body></html>
--- a/view/crashtests/crashtests.list
+++ b/view/crashtests/crashtests.list
@@ -1,6 +1,7 @@
 load 38589-1.xul
 load 64049-1.html
+load 281743-1.html
 load 323497-1.html
 load 382756-1.xul
 load 387745-1.svg
 load 429315-1.html