diff --git a/content/base/crashtests/401993-1.html b/content/base/crashtests/401993-1.html
new file mode 100644
index 000000000000..ba071e2b334e
--- /dev/null
+++ b/content/base/crashtests/401993-1.html
@@ -0,0 +1,38 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function s()
+{
+  var x = document.getElementById("x");
+  x.style.MozBinding = "url(401993-1.xml#foo)";
+  
+  setTimeout(boom, 0);
+  
+  function boom()
+  {
+    var nodes = document.getAnonymousNodes(x);
+    if (!nodes) {
+      setTimeout(boom, 10);
+      return;
+    }
+
+    var newSpan = document.createElement("span");
+    newSpan.contentEditable = "true";
+    nodes[0].appendChild(newSpan);
+    x.parentNode.removeChild(x);
+    
+    document.documentElement.removeAttribute("class");
+  }
+}
+</script>
+</head>
+
+<body onload="s();">
+
+<span contenteditable="true"></span>
+
+<div id="x"></div>
+
+</body>
+</html>
diff --git a/content/base/crashtests/401993-1.xml b/content/base/crashtests/401993-1.xml
new file mode 100644
index 000000000000..747f8a5f8955
--- /dev/null
+++ b/content/base/crashtests/401993-1.xml
@@ -0,0 +1 @@
+<bindings xmlns="http://www.mozilla.org/xbl"><binding id="foo"><content><span xmlns="http://www.w3.org/1999/xhtml"><children xmlns="http://www.mozilla.org/xbl"/></span></content></binding></bindings>
\ No newline at end of file
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index a0b1e6868abf..3a64c283a78e 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -39,6 +39,7 @@ load 395469-2.xhtml
 load 399712-1.html
 load 398088-1.xul
 load 400763-1.html
+load 401993-1.html
 load 407818.html
 load 410860-1.xml
 load 416734-1.html
diff --git a/content/html/document/crashtests/378993-1.xhtml b/content/html/document/crashtests/378993-1.xhtml
new file mode 100644
index 000000000000..99cbb01daeef
--- /dev/null
+++ b/content/html/document/crashtests/378993-1.xhtml
@@ -0,0 +1,7 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<script>
+document.createElement('AREA');
+</script>
+</body>
+</html>
diff --git a/content/html/document/crashtests/crashtests.list b/content/html/document/crashtests/crashtests.list
index 2a8d8e29be9e..f8ce49380d68 100644
--- a/content/html/document/crashtests/crashtests.list
+++ b/content/html/document/crashtests/crashtests.list
@@ -1,6 +1,7 @@
 load 285166-1.html
 load 294235-1.html
 skip load 353713-1.html # Bug 469626
+load 378993-1.xhtml
 load 388183-1.html
 load 395340-1.html
 load 407053.html
diff --git a/content/svg/content/src/crashtests/396618-1.html b/content/svg/content/src/crashtests/396618-1.html
new file mode 100644
index 000000000000..72c63a0f0b63
--- /dev/null
+++ b/content/svg/content/src/crashtests/396618-1.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script>
+function boom()
+{
+  var svgText = document.createElementNS("http://www.w3.org/2000/svg", "text");
+  svgText.setAttribute("dx", "foo");
+  svgText.removeAttribute("dx");
+}
+</script>
+</head>
+<body onload="boom();">
+</body>
+</html>
diff --git a/content/svg/content/src/crashtests/crashtests.list b/content/svg/content/src/crashtests/crashtests.list
index 283d8404c5f7..736fc4cd8ee5 100644
--- a/content/svg/content/src/crashtests/crashtests.list
+++ b/content/svg/content/src/crashtests/crashtests.list
@@ -21,6 +21,7 @@ load 385554-1.html
 load 385554-2.xul
 load 388712-1.svg
 load 395616-1.html
+load 396618-1.html
 load 397017-1.html
 load 397551-1.svg
 load 397704-1.svg
diff --git a/dom/base/crashtests/369219-1.xhtml b/dom/base/crashtests/369219-1.xhtml
new file mode 100644
index 000000000000..b44242d26286
--- /dev/null
+++ b/dom/base/crashtests/369219-1.xhtml
@@ -0,0 +1,19 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+
+function boom()
+{
+  var select = document.getElementById("sss");
+  select.options.add.call(null, 0);
+}
+
+</script>
+</head>
+
+<body onload="boom();">
+
+<select id="sss"><option>foo</option></select>
+
+</body>
+</html>
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index 070d6d311b48..22682d16015c 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -7,6 +7,7 @@ load 329481-1.xhtml
 load 338674-1.xhtml
 load 346381-1.html
 load 359432-1.xhtml
+load 369219-1.xhtml
 load 369413-1.html
 load 371124-1.html
 load 371124-2.html
diff --git a/gfx/thebes/crashtests/306649-1.xml b/gfx/thebes/crashtests/306649-1.xml
new file mode 100644
index 000000000000..c9861807c90e
--- /dev/null
+++ b/gfx/thebes/crashtests/306649-1.xml
@@ -0,0 +1 @@
+<?xml version="1.0"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"         "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg xmlns="http://www.w3.org/2000/svg">    <g transform="scale(1e10)">        <rect x="0" y="0" width="400" height="200" rx="50" ry="50"            fill="none" stroke="purple" stroke-width="30"/>    </g></svg>
\ No newline at end of file
diff --git a/gfx/thebes/crashtests/crashtests.list b/gfx/thebes/crashtests/crashtests.list
index 48743f2ad5c4..f995d89ce9a4 100644
--- a/gfx/thebes/crashtests/crashtests.list
+++ b/gfx/thebes/crashtests/crashtests.list
@@ -4,6 +4,7 @@ load 157320-1.html
 load 199379-1.html
 load 206561-1.html
 load 248518-1.html
+load 306649-1.xml
 load 333861-1.html
 load 345576-1.html   
 load 345629-1.html
diff --git a/layout/base/crashtests/342145-1.xhtml b/layout/base/crashtests/342145-1.xhtml
new file mode 100644
index 000000000000..8d87cb818622
--- /dev/null
+++ b/layout/base/crashtests/342145-1.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml" class="reftest-wait">
+<head>
+<script type="text/javascript">
+<![CDATA[
+
+function boom()
+{ 
+  var img = document.getElementById("img");
+  var t1 = img.childNodes[1]; // a whitespace text node
+  var t2 = document.createTextNode(' ');
+  
+  img.insertBefore(t2, t1);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+]]>
+</script>
+</head>
+
+<body onload="setTimeout(boom, 0);">
+
+<map name="map" id="map"><img src="data:image/gif,GIF89a1%00%3C%00%D5%FF%00%9D%B6%85%18%1C%14%8E%A4xz%8Dg%3AC1%9F%B6%86%A3%B8%89%1F%23%1A%9C%AD%85(%2C!%AD%BC%93%0A%0B%08bkP%BC%C2%A0PP%3E%C7%C5%A9%BD%B4%85%13%11%0C%CA%B8%8A%CE%B6%85%B7%A2v3.%24%D0%B7%88%9F%8Ch%82rU%D2%BA%8D%D8%BF%9B%A2%94%80%D7%C9%B5%26!%1AC9.%C7%AD%96%EB%C6%B5%E6%CB%BE%AD%8F%88%F1%CB%C2%C0%C0%C0%F6%CC%C7%BF%9B%99%D2%A9%A8%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00!%F9%04%01%00%00%24%00%2C%00%00%00%001%00%3C%00%00%06%FF%40%92pH%2C%1A%8F%C4%D2%A8%84l%3AI%A5(%D3Y%0A%3D%14%06%83%E2%11%9A%3E%8DU%0E%E7%F1h4%1E%9CPh%09%25%86%1A%06%80%1CP0%9CC%DFa%89%03%2F%CC%FFu%0Af%0D%1CL%23%0F%06~%7Fru%1Cy%24%1C%0As%03%94%95%03%07%98%07%04%0C%08gp%02%0C%15%09%A3%A3%15%0C%00%06xO%23%0D~%03%09%04%B1%B1%07%0B%A7r%03%B1u%05%A0%0C%02%8B%02%0E%0E%00%0D_%1Cq%B8%03%8B%09%C9%8B%0E%B6%CE%8B%93%09%00%0A%5EG%25%0D%A0%04%CC%7F%CB%D1%03%0E%A2%0B%A4%DB%8B(%A8%23N%23%0A%0C%E5%D1%DE%8B%ED%B6%93%04%E6%E8N!%02%F0%D1%FC%97%DC%DD%F6%14%A4k%12%02%1A%BF%83%B8%0EN%FBsNA%17%82%0B%0F%F2%13%F0%EF%8F0%00%95%CE%D9)%84%24DD%89%20%0F%3A%20%B0%60%5B%1D%03%8E%8Ex%0C%C9%12%24%B2%2C)%8B%1C%FA%D8%B2%E6%1Cg0eF2%F0%D1AE%FF%9B%08%094J%82HN%C4K%BE%80%86%C45t%88%B19%A6%7C%05S%CA%92)%CA!%EB%E48%40%C1U%DCO%AA%8B%12*%88%19%E2X%BDn%F3%C0%F2cp%D1%A1%90%B2%006%85%25%90%14%A3Z%06%A7%F0%26-%F0%40%08%079%07%EA%CEa%9B%F4%80Z%01%01%128%10%80%82Y5H%80E%1A%06%10%400P%C6%B7%CA%09%84%0C%60r%3F9l%D5%02%80%970%15%24%3F%9EA%5E%04%BB%CF%F0U%B8%A9EK%C4%3C%C70_%12Y%DD%C9%3E%08%2C%ED%E4%06Q%1A%00%60%40s%F7%9F%D0%7Flo~%3A%A0%B2qs4%05(%C7S%02Q%01%06%07%02%60%FA%FA%BC%1D%1D%B7%B8%AF%F8%D1%FD%FC%97%BB%CDB%F6H%22_%1E%B4w%3A%C4%88%16%60%DF%3E%163%D3E%CA%D2%07%E0%93Q%81%FF%00%D6%A4%5B%7C2)%B0_9%06%40%A0%E0%82Y(%F2%07Es%08%40%17*%0D%0Cd%C4%03%84E%B3%8D%01%1B%400%FF%C1%87%1FZ%20%01%0A%13%CA%01L%89xi%F1%80%85F%84%60%E0j%B5%09%A0%803%20%D6%88%C2T%A0%05%93%89%03%08p%C0%06%3E%08%8C%C4%CD%2B%09h%40%81%075%82%88%82%04%09%90h_%16*%B2%F8%84%8B%EDd'K%05%1ALPA%92%1F%A20%81%06%0Dl%B0%81%09j%A8!e%1Ea%5C!%E6%06%1D0p%C1%96%5Czy%E6%23Txq%82%08or9%81%97t%F6y%84%96z%F2%E9%E7%A0B%00%1A%A7%05%84%12jh%92(d%90%E8%A0%8B%DA%98%C1%9C%8F6%11%A9%92%93V%FA%C8%08G%06j%01%A5%9A%16%A1%01%5E%81N%00B%A8_P%E0%00%05%A5%9E%8Aj%13%20%60%E0%00%88%16%D4X%C1%05%1A%BCz%C4%08%20%A8z%C1%87%17%D4z%EB%04oZ%E0%EA%A0'%0Ct%82%09%CC6%CB%EC%05%0E%60%F0!%04%1D%7C%D8A%02%AC%B2u%81%AB%234%7B%C2%17%A1TPA0%E4%92%EBA%04%B3N%20%91k%BA%1D%60%80%E4%04%1E%5C%2B%EE%B8%C1T%E0%C1%BD%F8z%80A%1E%BC%C2%1B%01%B1%15D%F0.%BC%D0%FEJA%05%18%80%60%CD%A3%C4u%D0%81%BE%F6b%F0%26%AB%EA%3A%00-%AB%05%7F8%02%A8%AB%88%90%80%87%D0zpA%06%19X%80A%02%BFB%20%F2%C9%F7%BA%E9%E1%87%99%FA%99%A5%06%25%5B%AC%01%1B%BC%BEy%AB%AC%C0%5E%20%2B%0A%F3N%60A%AE%BA%0A1%82%05%17%24%20%B1%D0!f%A0%C1%9A%1Ahpl%D1%24%80%F0A%07NS%ED%A7%09%95%06%01%00%3B" usemap="#map" id="img"><area href="http://www.mozilla.org/" shape="rect" coords="0,0,100,100" id="hhh" /> </img></map>
+
+</body>
+</html>
diff --git a/layout/base/crashtests/405049-1.xul b/layout/base/crashtests/405049-1.xul
new file mode 100644
index 000000000000..fb68de11eb9b
--- /dev/null
+++ b/layout/base/crashtests/405049-1.xul
@@ -0,0 +1,3 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" style="display: table;">
+<box style="display: -moz-popup;"/>
+</window>
\ No newline at end of file
diff --git a/layout/base/crashtests/413587-1.svg b/layout/base/crashtests/413587-1.svg
new file mode 100644
index 000000000000..7781d5ef95c9
--- /dev/null
+++ b/layout/base/crashtests/413587-1.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+  <symbol id="foo">
+    <style type="text/css">
+      svg { counter-increment: x; }
+    </style>
+  </symbol>
+  
+  <use xlink:href="#foo"/>
+
+</svg>
diff --git a/layout/base/crashtests/420219-1.html b/layout/base/crashtests/420219-1.html
new file mode 100644
index 000000000000..6db7fd66ee6d
--- /dev/null
+++ b/layout/base/crashtests/420219-1.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<head>
+<script>
+
+function boom() 
+{ 
+  document.getElementById("a").style.counterReset = "s";
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 30);">
+
+<map name="m"><area id="a"></map>
+
+<img usemap="#m" src="data:image/gif,GIF89a1%00%3C%00%D5%FF%00%9D%B6%85%18%1C%14%8E%A4xz%8Dg%3AC1%9F%B6%86%A3%B8%89%1F%23%1A%9C%AD%85(%2C!%AD%BC%93%0A%0B%08bkP%BC%C2%A0PP%3E%C7%C5%A9%BD%B4%85%13%11%0C%CA%B8%8A%CE%B6%85%B7%A2v3.%24%D0%B7%88%9F%8Ch%82rU%D2%BA%8D%D8%BF%9B%A2%94%80%D7%C9%B5%26!%1AC9.%C7%AD%96%EB%C6%B5%E6%CB%BE%AD%8F%88%F1%CB%C2%C0%C0%C0%F6%CC%C7%BF%9B%99%D2%A9%A8%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00!%F9%04%01%00%00%24%00%2C%00%00%00%001%00%3C%00%00%06%FF%40%92pH%2C%1A%8F%C4%D2%A8%84l%3AI%A5(%D3Y%0A%3D%14%06%83%E2%11%9A%3E%8DU%0E%E7%F1h4%1E%9CPh%09%25%86%1A%06%80%1CP0%9CC%DFa%89%03%2F%CC%FFu%0Af%0D%1CL%23%0F%06~%7Fru%1Cy%24%1C%0As%03%94%95%03%07%98%07%04%0C%08gp%02%0C%15%09%A3%A3%15%0C%00%06xO%23%0D~%03%09%04%B1%B1%07%0B%A7r%03%B1u%05%A0%0C%02%8B%02%0E%0E%00%0D_%1Cq%B8%03%8B%09%C9%8B%0E%B6%CE%8B%93%09%00%0A%5EG%25%0D%A0%04%CC%7F%CB%D1%03%0E%A2%0B%A4%DB%8B(%A8%23N%23%0A%0C%E5%D1%DE%8B%ED%B6%93%04%E6%E8N!%02%F0%D1%FC%97%DC%DD%F6%14%A4k%12%02%1A%BF%83%B8%0EN%FBsNA%17%82%0B%0F%F2%13%F0%EF%8F0%00%95%CE%D9)%84%24DD%89%20%0F%3A%20%B0%60%5B%1D%03%8E%8Ex%0C%C9%12%24%B2%2C)%8B%1C%FA%D8%B2%E6%1Cg0eF2%F0%D1AE%FF%9B%08%094J%82HN%C4K%BE%80%86%C45t%88%B19%A6%7C%05S%CA%92)%CA!%EB%E48%40%C1U%DCO%AA%8B%12*%88%19%E2X%BDn%F3%C0%F2cp%D1%A1%90%B2%006%85%25%90%14%A3Z%06%A7%F0%26-%F0%40%08%079%07%EA%CEa%9B%F4%80Z%01%01%128%10%80%82Y5H%80E%1A%06%10%400P%C6%B7%CA%09%84%0C%60r%3F9l%D5%02%80%970%15%24%3F%9EA%5E%04%BB%CF%F0U%B8%A9EK%C4%3C%C70_%12Y%DD%C9%3E%08%2C%ED%E4%06Q%1A%00%60%40s%F7%9F%D0%7Flo~%3A%A0%B2qs4%05(%C7S%02Q%01%06%07%02%60%FA%FA%BC%1D%1D%B7%B8%AF%F8%D1%FD%FC%97%BB%CDB%F6H%22_%1E%B4w%3A%C4%88%16%60%DF%3E%163%D3E%CA%D2%07%E0%93Q%81%FF%00%D6%A4%5B%7C2)%B0_9%06%40%A0%E0%82Y(%F2%07Es%08%40%17*%0D%0Cd%C4%03%84E%B3%8D%01%1B%400%FF%C1%87%1FZ%20%01%0A%13%CA%01L%89xi%F1%80%85F%84%60%E0j%B5%09%A0%803%20%D6%88%C2T%A0%05%93%89%03%08p%C0%06%3E%08%8C%C4%CD%2B%09h%40%81%075%82%88%82%04%09%90h_%16*%B2%F8%84%8B%EDd'K%05%1ALPA%92%1F%A20%81%06%0Dl%B0%81%09j%A8!e%1Ea%5C!%E6%06%1D0p%C1%96%5Czy%E6%23Txq%82%08or9%81%97t%F6y%84%96z%F2%E9%E7%A0B%00%1A%A7%05%84%12jh%92(d%90%E8%A0%8B%DA%98%C1%9C%8F6%11%A9%92%93V%FA%C8%08G%06j%01%A5%9A%16%A1%01%5E%81N%00B%A8_P%E0%00%05%A5%9E%8Aj%13%20%60%E0%00%88%16%D4X%C1%05%1A%BCz%C4%08%20%A8z%C1%87%17%D4z%EB%04oZ%E0%EA%A0'%0Ct%82%09%CC6%CB%EC%05%0E%60%F0!%04%1D%7C%D8A%02%AC%B2u%81%AB%234%7B%C2%17%A1TPA0%E4%92%EBA%04%B3N%20%91k%BA%1D%60%80%E4%04%1E%5C%2B%EE%B8%C1T%E0%C1%BD%F8z%80A%1E%BC%C2%1B%01%B1%15D%F0.%BC%D0%FEJA%05%18%80%60%CD%A3%C4u%D0%81%BE%F6b%F0%26%AB%EA%3A%00-%AB%05%7F8%02%A8%AB%88%90%80%87%D0zpA%06%19X%80A%02%BFB%20%F2%C9%F7%BA%E9%E1%87%99%FA%99%A5%06%25%5B%AC%01%1B%BC%BEy%AB%AC%C0%5E%20%2B%0A%F3N%60A%AE%BA%0A1%82%05%17%24%20%B1%D0!f%A0%C1%9A%1Ahpl%D1%24%80%F0A%07NS%ED%A7%09%95%06%01%00%3B">
+
+</body>
+
+</html>
diff --git a/layout/base/crashtests/crashtests.list b/layout/base/crashtests/crashtests.list
index f9cf825c105a..698f13976102 100644
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -90,6 +90,7 @@ load 338703-1.html
 load 339651-1.html
 load 340093-1.xul
 load 341858-1.html
+load 342145-1.xhtml
 load 343293-1.xhtml
 load 343293-2.xhtml
 load 343540-1.html
@@ -185,6 +186,7 @@ load 404218-1.xhtml
 load 404491-1.html
 load 404721-1.xhtml
 load 404721-2.xhtml
+load 405049-1.xul
 load 405184-1.xhtml
 load 405186-1.xhtml
 load 406675-1.html
@@ -195,10 +197,12 @@ load 409513.html
 load 410967.html
 load 411870-1.html
 load 412651-1.html
+load 413587-1.svg
 load 414058-1.html
 load 414175-1.xul
 load 420031-1.html
 load 420213-1.html
+load 420219-1.html
 load 420651-1.xhtml
 load 421203-1.xul
 load 423107-1.xhtml
diff --git a/layout/forms/crashtests/402852-1.html b/layout/forms/crashtests/402852-1.html
new file mode 100644
index 000000000000..e5ba9adb133e
--- /dev/null
+++ b/layout/forms/crashtests/402852-1.html
@@ -0,0 +1,2 @@
+<body style="text-indent: 99999999999999999999px;">
+<fieldset>
diff --git a/layout/forms/crashtests/crashtests.list b/layout/forms/crashtests/crashtests.list
index 921cd79800fd..d59a3f5558fa 100644
--- a/layout/forms/crashtests/crashtests.list
+++ b/layout/forms/crashtests/crashtests.list
@@ -30,6 +30,7 @@ load 388374-1.xhtml
 load 388374-2.html
 load 393656-1.xhtml
 load 393656-2.xhtml
+load 402852-1.html
 load 403148-1.html
 load 404118-1.html
 load 404123-1.html
diff --git a/layout/generic/crashtests/370884-1.xhtml b/layout/generic/crashtests/370884-1.xhtml
new file mode 100644
index 000000000000..3959d4b1781e
--- /dev/null
+++ b/layout/generic/crashtests/370884-1.xhtml
@@ -0,0 +1,14 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:math="http://www.w3.org/1998/Math/MathML">
+<head>
+</head>
+
+<body>
+
+<math:mroot>
+  <div>
+    <div style="position: fixed;">Y</div>
+  </div>
+</math:mroot>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/381786-1.html b/layout/generic/crashtests/381786-1.html
new file mode 100644
index 000000000000..fd2bc7dc998c
--- /dev/null
+++ b/layout/generic/crashtests/381786-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<body>
+
+<div style="display:-moz-deck">
+  <div>
+    <span style="float: right; width: 0;">x</span>
+  </div>
+  <div style="position: relative;">
+    <span style="float: right;">
+      <span style="position: absolute;">y</span>
+    </span>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/387088-1.html b/layout/generic/crashtests/387088-1.html
new file mode 100644
index 000000000000..a9270818855e
--- /dev/null
+++ b/layout/generic/crashtests/387088-1.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<div style="line-height: 30760827em;">x</div>
+</body>
+</html>
\ No newline at end of file
diff --git a/layout/generic/crashtests/387233-1.html b/layout/generic/crashtests/387233-1.html
new file mode 100644
index 000000000000..3ea2c0544347
--- /dev/null
+++ b/layout/generic/crashtests/387233-1.html
@@ -0,0 +1,21 @@
+﻿<!DOCTYPE html>
+<html>
+<head>
+</head>
+<body>
+
+<div style="display: -moz-inline-box;">
+  <table style="height: 200%;">
+    <tr>
+      <td></td>
+    </tr>
+  </table>
+  <div>
+    c
+    <div style="height: 200%;">
+    </div>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/387233-2.html b/layout/generic/crashtests/387233-2.html
new file mode 100644
index 000000000000..fdad7e872ae9
--- /dev/null
+++ b/layout/generic/crashtests/387233-2.html
@@ -0,0 +1,18 @@
+<html>
+<body>
+
+<div style="display: -moz-inline-box; background: yellow;">
+  <table style="height: 101%; background: lightgreen;">
+    <tr>
+      <td></td>
+    </tr>
+  </table>
+  <div>
+    c
+    <div style="height: 100%; background: lightblue;">
+    </div>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/400078-1.html b/layout/generic/crashtests/400078-1.html
new file mode 100644
index 000000000000..3c2f0552ee93
--- /dev/null
+++ b/layout/generic/crashtests/400078-1.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+html, body, table, tbody, tr, td, #colset, #e, #s { height: 100%; }
+
+#colset { -moz-column-count: 2; -moz-column-width: 200px; border: 2px solid black; text-indent: 500px; }
+
+#s { display: inline-block; width: 30px; border: 1px solid red; }
+
+</style>
+</head>
+
+<body>
+
+<table><tbody><tr><td><div id="colset">XXX<span id="s"></span><div id="e"></div></div></td></tr></tbody></table>
+
+</body>
+</html>
diff --git a/layout/generic/crashtests/410595-1.html b/layout/generic/crashtests/410595-1.html
new file mode 100644
index 000000000000..0ee6e36c97fc
--- /dev/null
+++ b/layout/generic/crashtests/410595-1.html
@@ -0,0 +1,7 @@
+<html>
+<head>
+</head>
+
+<body><div style="padding: 12em 0; position: absolute; font-size: 10000000px;"><div style="position: absolute;"></div></div></body>
+
+</html>
diff --git a/layout/generic/crashtests/476241-1.html b/layout/generic/crashtests/476241-1.html
new file mode 100644
index 000000000000..405802a9a99a
--- /dev/null
+++ b/layout/generic/crashtests/476241-1.html
@@ -0,0 +1,2 @@
+<!DOCTYPE html>
+<html><body><div style="-moz-column-gap: 1px; -moz-column-width: 1px;"><div style="-moz-column-width: 1px;"><div><div style="margin: 15000px 0pt; -moz-column-width: 1px;"><div style="height: 1px;">G P X</div></div><div style="padding: 10px; height: 200px;"></div></div> </div></div></body></html>
diff --git a/layout/generic/crashtests/489462-1.html b/layout/generic/crashtests/489462-1.html
new file mode 100644
index 000000000000..5a57647ece98
--- /dev/null
+++ b/layout/generic/crashtests/489462-1.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  document.body.style.whiteSpace = "";
+  document.getElementById("b").style.direction = "";
+}
+
+</script>
+
+<style type="text/css">
+
+#c:first-letter { font-size-adjust: 8388609; }
+
+</style>
+</head>
+
+<body onload="boom();" style="white-space: pre;"><div id="b" style="direction: rtl;"><div id="c">Qqq Rrr Sss.</div></div></body>
+</html>
diff --git a/layout/generic/crashtests/494300-1.xul b/layout/generic/crashtests/494300-1.xul
new file mode 100644
index 000000000000..8aa9701ddd50
--- /dev/null
+++ b/layout/generic/crashtests/494300-1.xul
@@ -0,0 +1,49 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="boom();" class="reftest-wait">
+<script type="text/javascript">
+// <![CDATA[
+
+var HTML_NS   = "http://www.w3.org/1999/xhtml";
+var MATHML_NS = "http://www.w3.org/1998/Math/MathML";
+var XUL_NS    = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+function boom()
+{
+    var listbox = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listbox");
+    var listitem = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", "listitem");
+    listbox.appendChild(listitem);
+    document.documentElement.appendChild(listbox);
+    var hbox = document.createElementNS(XUL_NS, "hbox");
+    listbox.appendChild(hbox);
+    var mphantom = document.createElementNS(MATHML_NS, 'mphantom');
+    listbox.appendChild(mphantom);
+    var wax = document.createElementNS(MATHML_NS, 'wax');
+    hbox.appendChild(wax);
+    var msub = document.createElementNS(MATHML_NS, 'msub');
+    wax.appendChild(msub);
+    var merror = document.createElementNS(MATHML_NS, 'merror');
+    wax.appendChild(merror);
+    var span = document.createElementNS(HTML_NS, 'span');
+    mphantom.appendChild(span);
+    var vbox = document.createElementNS(XUL_NS, 'vbox');
+    span.appendChild(vbox);
+
+    setTimeout(boom2, 0);
+
+    function boom2()
+    {
+        var munderover = document.createElementNS(MATHML_NS, 'munderover'); 
+        msub.appendChild(munderover);
+        var mtext = document.createElementNS(MATHML_NS, 'mtext');
+        span.appendChild(mtext);
+
+        document.documentElement.removeAttribute("class");
+    }
+}
+
+// ]]>
+</script>
+</window>
diff --git a/layout/generic/crashtests/crashtests.list b/layout/generic/crashtests/crashtests.list
index d10ec4fc5f6d..1efdf1105b78 100644
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -60,6 +60,7 @@ load 369547-1.html
 load 370699-1.html
 load 370794-1.html
 load 370866-1.xhtml
+load 370884-1.xhtml
 load 371348-1.xhtml
 load 371561-1.html
 load 371566-1.xhtml
@@ -71,6 +72,7 @@ load 379217-2.xhtml
 load 379917-1.xhtml
 load 380012-1.html
 load 381152-1.html
+load 381786-1.html
 load 382129-1.xhtml
 load 382131-1.html
 load 382199-1.html
@@ -91,9 +93,12 @@ load 386812-1.html
 load 386827-1.html
 load 387058-1.html
 load 387058-2.html
+load 387088-1.html
 load 387209-1.html
 load 387215-1.xhtml
 load 387219-1.xhtml
+load 387233-1.html
+load 387233-2.html
 load 387282-1.html
 load 388175-1.html
 load 388709-1.html
@@ -127,6 +132,7 @@ load 398181-2.html
 load 399407-1.xhtml
 load 399412-1.html
 load 399843-1.html
+load 400078-1.html
 load 400223-1.html
 load 400232-1.html
 load 400244-1.html
@@ -154,6 +160,7 @@ load 408749-1.xhtml
 load 408883-1.html
 load 410228-1.html
 load 410232-1.html
+load 410595-1.html
 load 411213-1.html
 load 411213-2.xml
 load 411851-1.html
@@ -245,13 +252,16 @@ load 472774-1.html
 load 472776-1.html
 load 472950-1.html
 load 473278-1.xhtml
+load 476241-1.html
 load 477731-1.html
 load 477928.html
 load 478170-1.html
 load 478185-1.html
 load 479938-1.html
 load 480345-1.html
+load 489462-1.html
 load 493118-1.html
+load 494300-1.xul
 load 494332-1.html
 load 501535-1.html
 load 505912-1.html
diff --git a/layout/mathml/crashtests/373472-1.xhtml b/layout/mathml/crashtests/373472-1.xhtml
new file mode 100644
index 000000000000..6c6a304a734d
--- /dev/null
+++ b/layout/mathml/crashtests/373472-1.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script>
+function boom()
+{
+  document.getElementById("mo").appendChild(document.getElementById("mo2"));
+  document.body.offsetWidth;
+  document.getElementById("span").appendChild(document.createTextNode("baz"));
+}
+</script>
+</head>
+
+<body onload="boom();">
+
+Foo <math xmlns="http://www.w3.org/1998/Math/MathML"><mo id="mo2">-</mo></math></p>
+
+<p><math xmlns="http://www.w3.org/1998/Math/MathML"><msub id="msub"><mo id="mo">+</mo></msub></math> <span id="span">bar</span></p>
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/373472-2.xhtml b/layout/mathml/crashtests/373472-2.xhtml
new file mode 100644
index 000000000000..1c7e1c7ade09
--- /dev/null
+++ b/layout/mathml/crashtests/373472-2.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+</head>
+<body>
+
+<p><math xmlns="http://www.w3.org/1998/Math/MathML"><mroot><mo>k</mo></mroot></math></p>
+
+</body>
+</html>
diff --git a/layout/mathml/crashtests/crashtests.list b/layout/mathml/crashtests/crashtests.list
index 628c0f72a63a..20b5d7039802 100644
--- a/layout/mathml/crashtests/crashtests.list
+++ b/layout/mathml/crashtests/crashtests.list
@@ -26,6 +26,8 @@ load 368430-1.xhtml
 load 370791-1.xhtml
 load 370862-1.xhtml
 load 372483-1.xhtml
+load 373472-1.xhtml
+load 373472-2.xhtml
 load 375562-1.xhtml
 load 377824-1.xhtml
 load 379418-1.xhtml
diff --git a/layout/style/crashtests/412588-1.html b/layout/style/crashtests/412588-1.html
new file mode 100644
index 000000000000..561aed564dec
--- /dev/null
+++ b/layout/style/crashtests/412588-1.html
@@ -0,0 +1,5 @@
+<html><head>
+<link rel="stylesheet" href="data:text/css;charset=utf-8,@media%20print%20%7B%7B%7D%0Aa%20%7B%20%7D%0Aa%7Bfont-size%3A%20200%25%3B%7D" type="text/css">
+<style>
+</style>
+</head><body></body></html>
\ No newline at end of file
diff --git a/layout/style/crashtests/469432-1.xhtml b/layout/style/crashtests/469432-1.xhtml
new file mode 100644
index 000000000000..9b11a88c42b7
--- /dev/null
+++ b/layout/style/crashtests/469432-1.xhtml
@@ -0,0 +1,8 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:html="http://www.w3.org/1999/xhtml" xmlns:mathml="http://www.w3.org/1998/Math/MathML" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+
+<xul:menuitem>
+<select/>
+<xul:tooltip/>
+<mathml:msup/>
+</xul:menuitem>
+</html>
\ No newline at end of file
diff --git a/layout/style/crashtests/crashtests.list b/layout/style/crashtests/crashtests.list
index 445c1b0e0137..9fad636a9f8a 100644
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@@ -15,6 +15,7 @@ load 397022-1.html
 load 399289-1.svg
 load 404470-1.html
 load 411603-1.html
+load 412588-1.html
 load 413274-1.xhtml
 load 416461-1.xul
 load 418007-1.xhtml
@@ -33,6 +34,7 @@ load 452150-1.xhtml
 load 456196.html
 load 460217-1.html
 load 466845-1.html
+load 469432-1.xhtml
 load 472195-1.html
 load 472237-1.html # will fail, test for leak (474704)
 HTTP(..) load 472237-1.html
diff --git a/layout/tables/crashtests/373946-1.html b/layout/tables/crashtests/373946-1.html
new file mode 100644
index 000000000000..d332d722c0c5
--- /dev/null
+++ b/layout/tables/crashtests/373946-1.html
@@ -0,0 +1,6 @@
+<html><head>
+<title>ASSERTION: no common ancestor at all??? with iframe in display: table-caption</title>
+</head>
+<body style="display: table-caption;">
+<iframe></iframe>
+</body></html>
\ No newline at end of file
diff --git a/layout/tables/crashtests/380200-1.xhtml b/layout/tables/crashtests/380200-1.xhtml
new file mode 100644
index 000000000000..d9cda291aa08
--- /dev/null
+++ b/layout/tables/crashtests/380200-1.xhtml
@@ -0,0 +1,24 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<body onload="document.getElementById('table1').style.position = 'fixed';">
+
+<table border="1" id="table1" style="border-collapse: collapse; color: red">
+ <tr>
+  <td style="float: left; overflow: auto;">1</td>
+ </tr>
+</table>
+
+<table border="1" style="border-collapse: collapse; color: green">
+ <tr>
+   <td>x</td>
+ </tr>
+ <tr style="display: inline-table">
+  <td>a</td>
+  <td style="display: table-column-group">b</td>
+  <td style="display: inline-table">c</td>
+ </tr>
+</table>
+
+</body>
+
+</html>
diff --git a/layout/tables/crashtests/410426-1.html b/layout/tables/crashtests/410426-1.html
new file mode 100644
index 000000000000..c9d2f33da621
--- /dev/null
+++ b/layout/tables/crashtests/410426-1.html
@@ -0,0 +1,16 @@
+<html>
+
+<head>
+<script>
+function boom()
+{
+  document.body.appendChild(document.createTextNode("a"));
+  document.body.appendChild(document.createTextNode("b"));
+  document.body.appendChild(document.createTextNode("c"));
+}
+</script>
+</head>
+
+<body onload="boom();" style="display: table-row; text-indent: 17895702px;"></body>
+
+</html>
diff --git a/layout/tables/crashtests/444431-1.html b/layout/tables/crashtests/444431-1.html
new file mode 100644
index 000000000000..821d390b54fc
--- /dev/null
+++ b/layout/tables/crashtests/444431-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<script type="text/javascript">
+
+function boom()
+{
+  var c = document.createElementNS("http://www.w3.org/1999/xhtml", "caption");
+  var m = document.getElementById("m");
+  
+  m.insertBefore(c, m.firstChild);
+  m.removeChild(c);
+  document.body.style.visibility = "collapse";
+  
+  document.documentElement.removeAttribute("class");
+}
+
+</script>
+</head>
+
+<body onload="setTimeout(boom, 0);">
+  <img usemap="#m" src="data:image/gif,GIF87a%02%00%02%00%B3%00%00%00%00%00%FF%FF%FF%00%00%00%00%00%00%FF%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%2C%00%00%00%00%02%00%02%00%00%04%03%90H%12%00%3B">
+  <map name="m" id="m"><area></map>
+</body>
+
+</html>
diff --git a/layout/tables/crashtests/crashtests.list b/layout/tables/crashtests/crashtests.list
index f1631ff6d24c..1aa1c2eeeb67 100644
--- a/layout/tables/crashtests/crashtests.list
+++ b/layout/tables/crashtests/crashtests.list
@@ -58,12 +58,14 @@ load 370360-1.html
 load 370876-1.html
 load 370897-1.html
 load 373611-1.html
+load 373946-1.html
 load 374356-1.html
 load 374819-1.html
 load 374819-2.html
 load 375058-1.xhtml
 load 378240-1.html
 load 379687-1.html
+load 380200-1.xhtml
 load 385132-1.xhtml
 load 385132-2.html
 load 387051-1.html
@@ -78,6 +80,7 @@ load 403249-1.html
 load 403579-1.html
 load 404301-1.xhtml
 load 408753-1.xhtml
+load 410426-1.html
 load 411582.xhtml
 load 413091.xhtml
 load 413180-1.html
@@ -87,6 +90,7 @@ load 416845-3.html
 load 420654-1.xhtml
 load 423514-1.xhtml
 load 430374.html
+load 444431-1.html
 load 448988-1.xhtml
 load 450311-1.html
 load 456041.html
diff --git a/layout/xul/base/src/crashtests/321056-1.xhtml b/layout/xul/base/src/crashtests/321056-1.xhtml
new file mode 100644
index 000000000000..a7ba117938c6
--- /dev/null
+++ b/layout/xul/base/src/crashtests/321056-1.xhtml
@@ -0,0 +1,10 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+<xul:titlebar id="a"/>
+
+<script>
+var html = document.firstChild;
+var a = document.getElementById('a')
+document.removeChild(html)
+document.appendChild(a)
+</script>
+</html>
diff --git a/layout/xul/base/src/crashtests/376137-1.html b/layout/xul/base/src/crashtests/376137-1.html
new file mode 100644
index 000000000000..23b39d900cbe
--- /dev/null
+++ b/layout/xul/base/src/crashtests/376137-1.html
@@ -0,0 +1,18 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<style>
+span { display:block; outline: 10px solid yellow; }
+</style>
+</head>
+
+<body>
+
+<div>
+  <div style="display: -moz-inline-grid">
+    <span>M</span>
+    <span>N</span>
+  </div>
+</div>
+
+</body>
+</html>
diff --git a/layout/xul/base/src/crashtests/376137-2.html b/layout/xul/base/src/crashtests/376137-2.html
new file mode 100644
index 000000000000..160c61ed3146
--- /dev/null
+++ b/layout/xul/base/src/crashtests/376137-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<title>Bug 376137</title>
+<style>
+p { width: 100%; border: solid 1px;}
+</style>
+
+<div style="display: -moz-inline-grid">
+  <div><p>M</p></div>
+  <div><p>N</p></div>
+</div>
+
diff --git a/layout/xul/base/src/crashtests/387080-1.xul b/layout/xul/base/src/crashtests/387080-1.xul
new file mode 100644
index 000000000000..4eb9bd784b83
--- /dev/null
+++ b/layout/xul/base/src/crashtests/387080-1.xul
@@ -0,0 +1,6 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <description>
+    <foo height="1793689537164611773" width="20000238421986669650" />
+  </description>
+</window>
\ No newline at end of file
diff --git a/layout/xul/base/src/crashtests/crashtests.list b/layout/xul/base/src/crashtests/crashtests.list
index 9e6345761b2f..46c9ef44a856 100644
--- a/layout/xul/base/src/crashtests/crashtests.list
+++ b/layout/xul/base/src/crashtests/crashtests.list
@@ -9,6 +9,7 @@ load 291702-2.xul
 load 291702-3.xul
 load 294371-1.xul
 load 311457-1.html
+load 321056-1.xhtml
 load 326834-1.html
 load 322786-1.xul
 load 326879-1.xul
@@ -25,6 +26,8 @@ load 360642-1.xul
 load 366112-1.xul
 load 369942-1.xhtml
 load 374102-1.xul
+load 376137-1.html
+load 376137-2.html
 load 377592-1.svg
 load 382746-1.xul
 load 382899-1.xul
@@ -34,6 +37,7 @@ load 384105-1.html
 load 384491-1.xhtml
 load 384871-1.html
 load 387033-1.xhtml
+load 387080-1.xul
 load 391974-1.html
 load 394120-1.xhtml
 load 397304-1.html
