Add a bunch of crashtests
authorJesse Ruderman <jruderman@gmail.com>
Tue, 08 Jun 2010 17:53:08 -0700
changeset 43349 e5dd52dd3cb54a2f3b3315347f23f35c86d7b2f6
parent 43348 6083525fa4beaf2dacf7cae577643961ffbbb908
child 43350 1f7ffae6e51e04c54b78a73433abe134709a147e
push id1
push userroot
push dateTue, 26 Apr 2011 22:38:44 +0000
treeherdermozilla-beta@bfdb6e623a36 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
milestone1.9.3a5pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Add a bunch of crashtests
content/base/crashtests/448615-1.html
content/base/crashtests/crashtests.list
content/html/content/crashtests/465466-1.xhtml
content/html/content/crashtests/crashtests.list
content/media/test/crashtests/481136-1.html
content/media/test/crashtests/crashtests.list
content/smil/crashtests/551620-1.svg
content/smil/crashtests/crashtests.list
content/xbl/crashtests/463511-1.xhtml
content/xbl/crashtests/477878-1.html
content/xbl/crashtests/493123-1.xhtml
content/xbl/crashtests/crashtests.list
editor/txmgr/tests/crashtests/407072-1.html
editor/txmgr/tests/crashtests/crashtests.list
gfx/thebes/crashtests/419255-1.html
gfx/thebes/crashtests/474410-1.html
gfx/thebes/crashtests/483120-1.xhtml
gfx/thebes/crashtests/483120-2.xhtml
gfx/thebes/crashtests/532726-1.html
gfx/thebes/crashtests/546870-1.html
gfx/thebes/crashtests/crashtests.list
layout/base/crashtests/369176-1.html
layout/base/crashtests/455623-1.html
layout/base/crashtests/468555-1.xhtml
layout/base/crashtests/crashtests.list
layout/forms/crashtests/498698-1.html
layout/forms/crashtests/crashtests.list
layout/generic/crashtests/323381-1.html
layout/generic/crashtests/323381-2.html
layout/generic/crashtests/339769-1.html
layout/generic/crashtests/389635-1.html
layout/generic/crashtests/460910-1.xml
layout/generic/crashtests/467137-1.html
layout/generic/crashtests/467213-1.html
layout/generic/crashtests/467875-1.xhtml
layout/generic/crashtests/472617-1.xhtml
layout/generic/crashtests/473894-1.html
layout/generic/crashtests/478131-1.html
layout/generic/crashtests/489480-1.xhtml
layout/generic/crashtests/499885-1.xhtml
layout/generic/crashtests/crashtests.list
layout/mathml/crashtests/431072-1.xhtml
layout/mathml/crashtests/477740-1.xhtml
layout/mathml/crashtests/crashtests.list
layout/svg/crashtests/384499-1.svg
layout/svg/crashtests/478511-1.svg
layout/svg/crashtests/crashtests.list
layout/xul/base/src/crashtests/464407-1.xhtml
layout/xul/base/src/crashtests/crashtests.list
new file mode 100644
--- /dev/null
+++ b/content/base/crashtests/448615-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div:first-letter { float: right; }
+
+</style>
+</head>
+
+<body><div>A</div></body>
+
+</html>
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -44,16 +44,17 @@ load 401993-1.html
 load 407818.html
 load 410860-1.xml
 load 416734-1.html
 load 418928-1.html
 load 420620-1.html
 asserts(2) load 424276-1.html # bug 462897
 load 426987-1.html
 load 443538-1.svg
+load 448615-1.html
 load 450383-1.html
 load 450385-1.html
 skip load 458637-1.html # sporadically times out (bug 473680)
 load 472593-1.html
 load 474041-1.svg
 load 483818-1.html
 load 493281-1.html
 load 493281-2.html
new file mode 100644
--- /dev/null
+++ b/content/html/content/crashtests/465466-1.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="u">
+<content><foopy><children xmlns="http://www.mozilla.org/xbl"/></foopy></content>
+</binding></bindings>
+
+
+<script type="text/javascript">
+
+function boom()
+{
+  var f = document.getElementById("f");
+  var anon = document.getAnonymousNodes(f)[0];
+  document.body.removeChild(f);
+  anon.appendChild(document.createElement("label"));
+}
+
+</script>
+</head>
+
+<body onload="boom();"><form id="f" style="-moz-binding: url(#u);"><label></label></form></body>
+</html>
--- a/content/html/content/crashtests/crashtests.list
+++ b/content/html/content/crashtests/crashtests.list
@@ -5,11 +5,12 @@ load 324918-1.xhtml
 load 338649-1.xhtml
 load 339501-1.xhtml
 load 339501-2.xhtml
 load 382568-1.html
 load 423371-1.html
 load 451123-1.html
 load 453406-1.html
 load 464197-1.html
+load 465466-1.xhtml
 load 504183-1.html
 load 515829-1.html
 load 515829-2.html
new file mode 100644
--- /dev/null
+++ b/content/media/test/crashtests/481136-1.html
@@ -0,0 +1,3 @@
+<html>
+<div><object data='sound.ogg'></div>
+</html>
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@@ -1,8 +1,9 @@
 load 459439-1.html
 load 466607-1.html
 load 466945-1.html
 load 468763-1.html
 load 474744-1.html
+HTTP load 481136-1.html # needs to be HTTP to recognize the ogg as an audio file?
 load 493915-1.html
 load 495794-1.html
 load 492286-1.xhtml
new file mode 100644
--- /dev/null
+++ b/content/smil/crashtests/551620-1.svg
@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<animate id="x" begin="y.end"/>
+<animate id="y"/>
+
+<script>
+
+function boom()
+{
+  var x = document.getElementById("x");
+  var y = document.getElementById("y");
+  y.appendChild(x);
+  y.setAttributeNS(null, "dur", "0.5s");
+  y.removeAttributeNS(null, "dur");
+}
+
+window.addEventListener("load", boom, false);
+
+</script>
+
+</svg>
--- a/content/smil/crashtests/crashtests.list
+++ b/content/smil/crashtests/crashtests.list
@@ -5,13 +5,14 @@ load 525099-1.svg
 load 526536-1.svg
 load 526875-1.svg
 load 526875-2.svg
 load 529387-1.xhtml
 load 537157-1.svg
 load 541297-1.svg
 load 547333-1.svg
 load 548899-1.svg
+load 551620-1.svg
 load 554202-1.svg
 load 554202-2.svg
 load 554141-1.svg
 load 555026-1.svg
 load 556841-1.svg
new file mode 100644
--- /dev/null
+++ b/content/xbl/crashtests/463511-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-binding: url(#foo)">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl">
+<binding id="foo"><content><listcell xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"><children xmlns="http://www.mozilla.org/xbl"/></listcell></content></binding>
+</bindings>
+</head>
+
+<body onload="document.documentElement.innerHTML = 'x';"></body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/xbl/crashtests/477878-1.html
@@ -0,0 +1,4 @@
+<html>
+<head></head>
+<body><iframe style="display:none" src="data:text/html,<marquee>Marquee</marquee>" onload="this.style.display = '';"></iframe></body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/xbl/crashtests/493123-1.xhtml
@@ -0,0 +1,34 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="a"><content></content></binding>
+  <binding id="b"><content><style xmlns="http://www.w3.org/1999/xhtml" style="display: none;">* { overflow: hidden; }</style><children xmlns="http://www.mozilla.org/xbl"/></content></binding>
+</bindings>
+
+<script type="text/javascript" style="display: none">
+
+function one()
+{
+  while (document.documentElement.firstChild) document.documentElement.removeChild(document.documentElement.firstChild)
+  document.documentElement.style.MozBinding = 'url("#a")';
+  setTimeout(two, 1);
+}
+
+function two()
+{
+  document.documentElement.style.MozBinding = 'url("#b")';
+  setTimeout(three, 1);
+}
+
+function three()
+{
+  document.documentElement.style.MozBinding = 'url("#a")';
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="one();"></body>
+</html>
--- a/content/xbl/crashtests/crashtests.list
+++ b/content/xbl/crashtests/crashtests.list
@@ -21,14 +21,17 @@ load 406904-2.xhtml
 load 415301-1.xul
 load 418133-1.xhtml
 load 415192-1.xul
 load 420233-1.xhtml
 load 421997-1.xhtml
 load 432813-1.xhtml
 load 454820-1.html
 load 460665-1.xhtml
+load 463511-1.xhtml
 load 464863-1.xhtml
 load 472260-1.xhtml
+load 477878-1.html
 load 492978-1.xul
+load 493123-1.xhtml
 load 495354-1.xhtml
 load 507628-1.xhtml
 load 507991-1.xhtml
new file mode 100644
--- /dev/null
+++ b/editor/txmgr/tests/crashtests/407072-1.html
@@ -0,0 +1,22 @@
+<html>
+<head>
+<script>
+
+function boom()
+{
+  var br = document.getElementById("br");
+  br.contentEditable = "true";
+  br.focus();
+
+  try { document.execCommand("justifyfull", false, null);  } catch(e) { }
+  try { document.execCommand("justifyfull", false, null);  } catch(e) { }
+        document.execCommand("underline",   false, null);
+        document.execCommand("insertimage", false, "foo");
+  try { document.execCommand("outdent",     false, null);  } catch(e) { }
+}
+
+</script>
+</head>
+
+<body onload="boom();"><br id="br"></body>
+</html>
--- a/editor/txmgr/tests/crashtests/crashtests.list
+++ b/editor/txmgr/tests/crashtests/crashtests.list
@@ -1,1 +1,2 @@
+asserts(3) load 407072-1.html # bug 382210?
 load 449006-1.html
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/419255-1.html
@@ -0,0 +1,4 @@
+<html>
+<head></head>
+<body><div style="text-transform: capitalize">&#x5426; &#x200C;</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/474410-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style type="text/css">
+
+div { -moz-transform: matrix(3, 1, 16.8, 5.6, 0, 0); }
+div > div { border: 1px dashed #9ab; }
+
+</style>
+</head>
+<body>
+
+<div><div></div></div>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/483120-1.xhtml
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="font-family: monospace;">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="w"><content><div xmlns="http://www.w3.org/1999/xhtml"><children xmlns="http://www.mozilla.org/xbl"/></div></content></binding>
+  <binding id="empty"><content/></binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.createElementNS("http://www.w3.org/2000/svg", "rect");
+  document.getElementById("d").previousSibling.data += "C";
+  document.getElementById("d").style.MozBinding = "url('#empty')";
+}
+
+</script>
+
+</head>
+
+<body onload="boom();"><span>A&#x202E;<span style="-moz-binding: url('#w');"></span>B<span id="d" style="font-size: 80%; color: green;">D</span></span></body>
+</html>
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/483120-2.xhtml
@@ -0,0 +1,22 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="font-family: monospace;">
+<head>
+
+<bindings xmlns="http://www.mozilla.org/xbl">
+  <binding id="w"><content><div xmlns="http://www.w3.org/1999/xhtml"><children xmlns="http://www.mozilla.org/xbl"/></div></content></binding>
+  <binding id="empty"><content/></binding>
+</bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("d").previousSibling.data += "C";
+  document.getElementById("d").style.MozBinding = "url('#empty')";
+}
+
+</script>
+
+</head>
+
+<body onload="boom();"><span>A&#x202E;<span style="-moz-binding: url('#w');"></span>B<span id="d" style="font-size: 80%; color: green;">D</span></span></body>
+</html>
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/532726-1.html
@@ -0,0 +1,5 @@
+<html>
+<body style="word-spacing: 10px">
+<div>X &#x0301;&#x0000;</div>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/gfx/thebes/crashtests/546870-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body onload="document.getElementById('button').value='';">
+<input id="button" type="button" value="Should not crash" style="width: 1px; white-space: normal;">
+</body>
+</html>
--- a/gfx/thebes/crashtests/crashtests.list
+++ b/gfx/thebes/crashtests/crashtests.list
@@ -45,24 +45,30 @@ load 404112-1.html
 load 404112-2.html
 load 405268-1.xhtml
 load 407761-1.html
 load 407842.html
 load 408754-1.html
 load 410728-1.xml
 load 416637-1.html
 load 419095-1.html
+load 419255-1.html
 load 420945-1.html
 load 420962-1.html
 load 421393-1.html
 load 421813-1.html
 load 423270-1.html
 load 429899-1.html
 load 441360.html
 load 463307-1.html
 load 467703-1.xhtml
 load 467873-1.html
 load 470418-1.html
+load 474410-1.html
+load 483120-1.xhtml
+load 483120-2.xhtml
 load 487549-1.html
 load 487724-1.html
 load 490777-1.html
+load 532726-1.html
 load 538065-1.html
+load 546870-1.html
 load balinese-letter-spacing.html
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/369176-1.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+
+<script>
+
+function boom()
+{
+  document.getElementById("f").className = 'q';
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+
+<style>
+
+body {
+  width: 10em;
+}
+
+#f:after {
+  content: "TTT";
+}
+
+</style>
+
+</head>
+
+<body onload="setTimeout(boom, 0);">
+
+<span id="f">foo foo foo foo foo foo foo foo foo foo<span style="display: block"></span></span>
+
+
+</div>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/455623-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var i = document.getElementById("i");
+  i.contentDocument.designMode = "on";
+  i.previousSibling.data += "x\n";
+  i.style.counterReset = "c";
+}
+
+</script>
+</head>
+
+<body onload="boom();">&#x202E;<iframe id="i" src="data:text/html,a"></body>
+
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/468555-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style type="text/css">
+* { content: 'Y'; }
+table:after { content: inherit; }
+</style>
+</head>
+<body onload="document.getElementById('t').appendChild(document.createElement('span'));"><table id="t"></table></body>
+</html>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -121,16 +121,17 @@ load 360339-2.xul
 load 364427-1.html
 load 365909-1.xhtml
 load 365909-2.xhtml
 load 366128-1.xhtml
 load 366271-1.html
 load 366967-1.html
 load 367015-1.html
 load 367243-1.html
+load 369176-1.html
 load 369945-1.xhtml
 load 371681-1.xhtml
 load 372237-1.html
 load 372475-1.xhtml
 load 372550-1.html
 load 374193-1.xhtml
 load 374297-1.html
 load 374297-2.html
@@ -230,21 +231,23 @@ load 446328.html
 load 448488-1.html
 load 450319-1.xhtml
 asserts(3) load 453894-1.xhtml
 load 454751-1.xul
 load 455063-1.html
 load 455063-2.html
 load 455063-3.html
 load 455171-4.html
+load 455623-1.html
 load 457362-1.xhtml
 load 466763-1.html
 load 467881-1.html
 load 468491-1.html
 load 468546-1.xhtml
+load 468555-1.xhtml
 load 468578-1.xhtml
 # These three didn't actually crash without the resizing that the
 # browser does when setting up print preview, but adding them anyway.
 load 468645-1.xhtml
 load 468645-2.xhtml
 load 468645-3.xhtml
 load 469861-1.xhtml
 load 469861-2.xhtml
new file mode 100644
--- /dev/null
+++ b/layout/forms/crashtests/498698-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<select style="height: 3401091640591pc"></select>
+</body>
+</html>
--- a/layout/forms/crashtests/crashtests.list
+++ b/layout/forms/crashtests/crashtests.list
@@ -33,8 +33,9 @@ load 393656-2.xhtml
 load 402852-1.html
 load 403148-1.html
 load 404118-1.html
 load 404123-1.html
 load 455451-1.html
 load 457537-1.html
 load 457537-2.html
 load 478219-1.xhtml
+load 498698-1.html
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/323381-1.html
@@ -0,0 +1,1 @@
+<iframe src="data:text/html,foo" width="808080"></iframe>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/323381-2.html
@@ -0,0 +1,1 @@
+<div style="width: 808080px;">foo</div>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/339769-1.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function foo()
+{
+  var div = document.getElementById("div");
+  div.parentNode.removeChild(div);
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(foo, 0);">
+
+  <div id="div" style="display: inline;"><p>x</p></div>
+
+  <iframe src='data:text/html,<html><body><input value="q">'></iframe>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/389635-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="position: fixed; overflow-x: scroll;">
+  <div style="padding: 0%;">
+    <div style="position: fixed;"></div>
+  </div>
+</div>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/460910-1.xml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML">
+<head>
+<style type="text/css">
+
+[class~='t'] { display: table; }
+
+</style>
+</head>
+<body>
+
+<m:math><m:math class="t"/></m:math>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/467137-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+function z()
+{
+  var q = document.getElementById("q");
+
+  for (var r = 0; r < 100; ++r) {
+    // dump(r + "\n");
+    q.style.width = r + "px";
+    document.documentElement.offsetHeight;
+  }
+}
+
+</script>
+</head>
+<body onload="z();">
+
+<div style="font-family: monospace;" id="q"><div id="w" style="word-spacing: 1px">AAA <span style="white-space: pre-line; font-weight: 500;">BB C 
+ </span></div></div>
+ 
+</body></html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/467213-1.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<html>
+<head></head>
+<body>
+
+<div style="direction: rtl;"><span style="direction: ltr;"><div></div><span style="position: absolute;"></span><span style="display: -moz-box;"></span></span></div>
+
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/467875-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head></head>
+<body>
+<span style="direction: rtl;">
+  <span style="display: -moz-box"/>
+  <span style="position: fixed;"/>
+  <span style="display: -moz-box"/>
+</span>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/472617-1.xhtml
@@ -0,0 +1,4 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head></head>
+<body style="-moz-column-width: 2351490cm;"><div style="height: 0;"><xul:hbox/><xul:button/><span style="float: right;"/></div><xul:button/><div/><span style="float: right;"/></body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/473894-1.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div style="margin: -10000px">X</div>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/478131-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style id="s"></style>
+</head>
+<body onload="document.getElementById('s').textContent = '* { font-size: 8193%; }';" style="-moz-column-count: 2;"><div><div>A B C</div></div><div><p>D E F</p></div><p>G H I</p><div><p>.</p></div> <p>J K L</p></body>
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/489480-1.xhtml
@@ -0,0 +1,1 @@
+<html xmlns="http://www.w3.org/1999/xhtml" style="-moz-column-count: 2; width: 0pt;"><body style="height: 5003810179.579391in;"><br/><div style="direction: rtl;"><select style="float: right;"></select><option style="width: 0.6600934846211504px; margin: 22367196.5776782cm;"><option style="-moz-column-count: 2;"></option></option></div></body></html>
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/499885-1.xhtml
@@ -0,0 +1,6 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="emptybinding"><content></content></binding></bindings>
+</head>
+<body style="-moz-column-width: 1px;"><select/><li/><select style="height: 1777px; padding: 8796093022208pt; display: inherit; -moz-binding: url(#emptybinding);"/></body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -7,32 +7,35 @@ asserts(9) load 265867-1.html
 load 265867-2.html
 load 289864-1.html
 load 295292-1.html
 load 295292-2.html
 load 302260-1.html
 load 307979-1.html
 load 310556-1.xhtml
 load 322780-1.xul
+load 323381-1.html
+load 323381-2.html
 asserts(2) asserts-if(MOZ_WIDGET_TOOLKIT=="gtk2",12) load 323386-1.html
 load 323389-1.html
 load 323389-2.html
 load 323493-1.html
 load 323495-1.html
 load 324318-1.html
 load 328946-1.html
 load 331284-1.xhtml
 load 334105-1.xhtml
 load 334107-1.xhtml
 load 334147-1.xhtml
 load 334148-1.xhtml
 load 334602-1.html
 load 337412-1.html
 load 337883-1.html
 load 337883-2.html
+load 339769-1.html
 load 342322-1.html
 load 343206-1.xhtml
 load 345139-1.xhtml
 load 345617-1.html
 load 348887-1.html
 load 348991-1.xhtml
 load 354458-1.html
 load 354458-2.html
@@ -98,16 +101,17 @@ load 387209-1.html
 load 387213-1.html
 load 387215-1.xhtml
 load 387219-1.xhtml
 load 387233-1.html
 load 387233-2.html
 load 387282-1.html
 load 388175-1.html
 load 388709-1.html
+load 389635-1.html
 load 390050-1.html
 load 390050-2.html
 load 390050-3.html
 load 390762-1.html
 load 391053-1.xhtml
 load 391894-1.html
 load 392698-1.html
 load 393758-1.xhtml
@@ -240,52 +244,61 @@ load 452157-2.html
 load 452157-3.html
 load 453762-1.html
 load 455171-1.html
 load 455171-2.html
 load 455171-3.html
 load 455643-1.xhtml
 load 457375.html
 load 457380-1.html
+load 460910-1.xml
 load 461294-1.html
 load 463350-1.html
 load 463350-2.html
 load 463350-3.html
 asserts(4) load 463741-1.html
 load 465651-1.html
+load 467137-1.html
+load 467213-1.html
 load 467487-1.html
 load 467493-1.html
 load 467493-2.html
+load 467875-1.xhtml
 load 467914-1.html
 load 468207-1.html
 load 468771-1.xhtml
 load 468771-2.xhtml
 load 469859-1.xhtml
 load 472587-1.xhtml
+load 472617-1.xhtml
 load 472774-1.html
 load 472776-1.html
 load 472950-1.html
 load 473278-1.xhtml
+load 473894-1.html
 load 476241-1.html
 load 477731-1.html
 load 477928.html
+load 478131-1.html
 load 478170-1.html
 load 478185-1.html
 asserts(1) load 479938-1.html
 load 480345-1.html
 load 481921.html
 load 489462-1.html
+load 489480-1.xhtml
 load 493111-1.html
 load 493118-1.html
 load 494300-1.xul
 load 494332-1.html
 load 495875-1.html
 load 495875-2.html
 load 499862-1.html
 load 499857-1.html
+asserts(15) asserts-if(MOZ_WIDGET_TOOLKIT=="windows",18) load 499885-1.xhtml # nscoord_MAX assertions, plus bug 570436 on windows
 load 501535-1.html
 load 503961-1.xhtml
 load 503961-2.html
 load 508908-1.html
 load 505912-1.html
 load 509749-1.html
 load 511482.html
 load 513394-1.html
new file mode 100644
--- /dev/null
+++ b/layout/mathml/crashtests/431072-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script type="text/javascript">
+
+function boom()
+{
+  document.getElementById("math").setAttribute("class", "li");
+  document.documentElement.offsetHeight;
+  document.documentElement.appendChild(document.createTextNode("\n"));
+}
+
+</script>
+
+<style type="text/css">
+
+[class="li"] { display: list-item; }
+
+</style>
+
+</head>
+
+<body onload="boom();"><math xmlns="http://www.w3.org/1998/Math/MathML" id="math"/></body>
+
+</html>
new file mode 100644
--- /dev/null
+++ b/layout/mathml/crashtests/477740-1.xhtml
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xbl="http://www.mozilla.org/xbl" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+
+<xbl:bindings><xbl:binding id="res"><xbl:content><xul:resizer><xbl:children/></xul:resizer></xbl:content></xbl:binding></xbl:bindings>
+
+<script type="text/javascript">
+
+function boom()
+{
+  var x = document.getElementById("x");
+
+  var r = document.createRange();
+  r.setEnd(x, 1);
+  r.extractContents();
+
+  x.appendChild(document.createElement('span'));
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+<xul:rows id="x" style="-moz-binding: url(#res);"><math:ms/></xul:rows>
+</body>
+</html>
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@@ -39,12 +39,14 @@ load 402400-1.xhtml
 load 403156-1.xhtml
 load 404485-1.xhtml
 load 405187-1.xhtml
 load 405271-1.xml
 load 412237-1.xml
 load 413063-1.xhtml
 load 416907-1.xhtml
 load 420420-1.xhtml
+load 431072-1.xhtml
 load 443089-1.xhtml
 load 463763-1.xhtml
 load 463763-2.xhtml
 load 476547-1.xhtml
+load 477740-1.xhtml
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/384499-1.svg
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:html="http://www.w3.org/1999/xhtml">
+
+<html:style>
+  #mathy { display: table}
+</html:style>
+
+<foreignObject width="500" height="500" y="50">
+  <div xmlns="http://www.w3.org/1999/xhtml">
+    <p>Foo</p>
+    <div>
+      <math xmlns="http://www.w3.org/1998/Math/MathML" id="mathy" display="block">
+        <mrow>
+          <mi>x</mi>
+        </mrow>
+      </math>
+    </div>
+  </div>
+</foreignObject>
+
+</svg>
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/478511-1.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg" version="1.0">
+  <defs>
+    <pattern id="pattern"
+             x="0" y="0" width="200" height="200">
+      <circle fill="lime" r="100" cx="100" cy="100"/>
+    </pattern>
+  </defs>
+  <rect width="200" height="200" fill="url(#pattern)"/>
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -39,16 +39,17 @@ load 367111-1.svg
 load 369233-1.svg
 load 369438-1.svg
 load 369438-2.svg
 load 371463-1.xhtml
 load 371563-1.xhtml
 load 375775-1.svg
 load 380691-1.svg
 load 384391-1.xhtml
+load 384499-1.svg
 load 384637-1.svg
 load 384728-1.svg
 load 385246-1.svg
 load 385246-2.svg
 asserts(1) load 385840-1.svg # bug 385845
 load 385852-1.svg
 load 386475-1.xhtml
 load 386566-1.svg
@@ -71,16 +72,17 @@ load 466585-1.svg
 load 467323-1.svg
 load 470124-1.svg
 load 474700-1.svg
 load 472782-1.svg
 load 475181-1.svg
 load 475193-1.html
 load 477935-1.html
 load 478128-1.svg
+load 478511-1.svg
 load 492186-1.svg
 load 508247-1.svg
 load 512890-1.svg
 load 515288-1.html
 load 522394-1.svg
 load 522394-2.svg
 load 522394-3.svg
 load extref-test-1.xhtml
new file mode 100644
--- /dev/null
+++ b/layout/xul/base/src/crashtests/464407-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<head>
+</head>
+<body>
+
+<xul:radio style="overflow: auto; height: 72057594037927940pt; display: table-cell;"/>
+
+</body>
+</html>
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@@ -55,16 +55,17 @@ load 430356-1.xhtml
 load 431738.xhtml
 asserts(1) load 432058-1.xul
 load 432068-1.xul
 load 432068-2.xul
 load 433296-1.xul
 load 434458-1.xul
 load 460900-1.xul
 load 464149-1.xul
+load 464407-1.xhtml
 load 467481-1.xul
 load 470063-1.html
 load 472189.xul
 load 475133.html
 load 488210-1.xhtml
 load 495728-1.xul
 load 508927-1.xul
 load 508927-2.xul