Added security tests for webkit crashes.

These tests are based off of the upstream webkit tests with a bit
of java glue to plug them into CTS.

Change-Id: If9900c1ebfe2023a17d9730db6e3a05b67b4b9ca
diff --git a/tests/tests/webkitsecurity/Android.mk b/tests/tests/webkitsecurity/Android.mk
new file mode 100644
index 0000000..7223766
--- /dev/null
+++ b/tests/tests/webkitsecurity/Android.mk
@@ -0,0 +1,31 @@
+# Copyright (C) 2012 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH:= $(call my-dir)
+
+include $(CLEAR_VARS)
+
+LOCAL_MODULE_TAGS := optional
+
+LOCAL_JAVA_LIBRARIES := android.test.runner
+
+LOCAL_SRC_FILES := $(call all-java-files-under, src)
+
+LOCAL_PACKAGE_NAME := CtsWebkitSecurityTestCases
+
+LOCAL_STATIC_JAVA_LIBRARIES := ctsutil ctstestserver
+
+LOCAL_SDK_VERSION := current
+
+include $(BUILD_CTS_PACKAGE)
diff --git a/tests/tests/webkitsecurity/AndroidManifest.xml b/tests/tests/webkitsecurity/AndroidManifest.xml
new file mode 100644
index 0000000..468a704
--- /dev/null
+++ b/tests/tests/webkitsecurity/AndroidManifest.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="com.android.cts.webkitsecurity">
+
+    <application>
+        <uses-library android:name="android.test.runner" />
+        <activity android:name="android.webkitsecurity.cts.WebViewStubActivity" />
+    </application>
+
+    <instrumentation android:name="android.test.InstrumentationTestRunner"
+                     android:targetPackage="com.android.cts.webkitsecurity"
+                     android:label="CTS tests of android.webkitsecurity"/>
+
+</manifest>
+
diff --git a/tests/tests/webkitsecurity/assets/2d.text-custom-font-load-crash.html b/tests/tests/webkitsecurity/assets/2d.text-custom-font-load-crash.html
new file mode 100644
index 0000000..c24b0cb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/2d.text-custom-font-load-crash.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>

+<div>Test passes if it does not crash.</div>

+<script src="../tests.js"></script>

+<style>

+@font-face {

+font-family: CanvasTest; 

+  src: url("does_not_exist.ttf");

+}

+</style>

+<applet>

+<canvas id="c">

+</applet>

+<ul id="d"></ul>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+_addTest(function(canvas, ctx) {

+

+ctx.fillRect(0, 0, 100, 50);

+ctx.font = '1px CanvasTest';

+ctx.fillText('AA', 0, 50);

+deferTest();

+

+setTimeout(wrapFunction(function () {

+    ctx.fillText('AA', 0, 50);

+

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}), 500);

+

+});

+</script>

diff --git a/tests/tests/webkitsecurity/assets/4145535Crash-expected.png b/tests/tests/webkitsecurity/assets/4145535Crash-expected.png
new file mode 100644
index 0000000..dc14b60
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/4145535Crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/4145535Crash.html b/tests/tests/webkitsecurity/assets/4145535Crash.html
new file mode 100644
index 0000000..3dfaf1f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/4145535Crash.html
@@ -0,0 +1,3 @@
+<table
+CELLSPACING=8888888888>
+<EMBED UNITS="4">
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/5725058-crash-scenario-1.html b/tests/tests/webkitsecurity/assets/5725058-crash-scenario-1.html
new file mode 100644
index 0000000..19d08d7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/5725058-crash-scenario-1.html
@@ -0,0 +1,25 @@
+<p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>
+
+<span>
+    <div name='test'></div>
+</span>
+<script type='text/javascript'>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function triggerGarbageCollection()
+    {
+        if (window.GCController) {
+            GCController.collect();
+            return;
+        }
+        for (var i = 0; i < 10000; ++i)
+            ({})
+    }
+
+    document.getElementsByName('test')[0];
+    triggerGarbageCollection();
+    document.getElementsByTagName('span')[0].innerHTML = '';
+    triggerGarbageCollection();
+    document.getElementsByName('test')[0];
+</script>
diff --git a/tests/tests/webkitsecurity/assets/5725058-crash-scenario-2.html b/tests/tests/webkitsecurity/assets/5725058-crash-scenario-2.html
new file mode 100644
index 0000000..147b2df
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/5725058-crash-scenario-2.html
@@ -0,0 +1,42 @@
+<p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>
+
+<p id="a">paragraph a</p>
+<p id="b">paragraph b</p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function triggerGarbageCollection()
+{
+    if (window.GCController) {
+        GCController.collect();
+        return;
+    }
+    for (var i = 0; i < 10000; ++i)
+        ({})
+}
+
+function setUp()
+{
+    // This only works if in a function. I'm not sure why.
+
+    // Get node and length from paragraph A into the cache.
+    document.getElementById("a").childNodes[0];
+    document.getElementById("a").childNodes.length;
+}
+
+setUp();
+
+// Get back to "zero node lists".
+triggerGarbageCollection();
+
+// Remove the child node of paragraph A. Use innerHTML to avoid getting a reference to the node being removed.
+document.getElementById("a").innerHTML = "";
+
+// Get back to "one node list".
+var childNodesB = document.getElementById("b").childNodes;
+
+// Now try the original list.
+var x = document.getElementById("a").childNodes[0];
+x = document.getElementById("a").childNodes.length;
+</script>
diff --git a/tests/tests/webkitsecurity/assets/5725058-crash-scenario-3.html b/tests/tests/webkitsecurity/assets/5725058-crash-scenario-3.html
new file mode 100644
index 0000000..e3b8d61
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/5725058-crash-scenario-3.html
@@ -0,0 +1,18 @@
+<p>Test for (rdar://problem/5725058). If you see this text, then all is well and no crash has occurred.</p>
+
+<p id="a"><a name="anchor">paragraph a</a></p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var list = document.getElementsByName("anchor");
+var x = list.length
+x = list[0];
+
+// Remove the child node of paragraph A. Use innerHTML to avoid getting a reference to the node being removed.
+document.getElementById("a").innerHTML = "";
+
+// Now try the original list.
+x = list.length;
+x = list[0];
+</script>
diff --git a/tests/tests/webkitsecurity/assets/EmptyMFracCrash.xhtml b/tests/tests/webkitsecurity/assets/EmptyMFracCrash.xhtml
new file mode 100644
index 0000000..1bc3edf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/EmptyMFracCrash.xhtml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML" xml:lang="en">
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+    <math xmlns="http://www.w3.org/1998/Math/MathML"> 
+        <mtext>This test passes if it does not crash.</mtext>
+        <mrow> 
+            <mfrac></mfrac> 
+        </mrow> 
+    </math>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/EmptyMunderOverCrash.xhtml b/tests/tests/webkitsecurity/assets/EmptyMunderOverCrash.xhtml
new file mode 100644
index 0000000..e897c8c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/EmptyMunderOverCrash.xhtml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML" xml:lang="en">
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<math xmlns="http://www.w3.org/1998/Math/MathML"> 
+    <mtext>This test passes if it does not crash.</mtext> 
+    <mrow> 
+        <munderover></munderover> 
+    </mrow> 
+</math>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/NamedNodeMap-setNamedItem-crash.html b/tests/tests/webkitsecurity/assets/NamedNodeMap-setNamedItem-crash.html
new file mode 100644
index 0000000..0efda6f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/NamedNodeMap-setNamedItem-crash.html
@@ -0,0 +1,10 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    onload = function()
+    {
+        document.body.attributes.setNamedItem(null);
+    }
+</script>
+This passes if it does not crash.  (see https://bugs.webkit.org/show_bug.cgi?id=18958)
diff --git a/tests/tests/webkitsecurity/assets/Range-insertNode-crash.html b/tests/tests/webkitsecurity/assets/Range-insertNode-crash.html
new file mode 100644
index 0000000..72ccb0a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/Range-insertNode-crash.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script type="text/javascript">
+        function log(msg)
+        {
+            document.getElementById('console').appendChild(document.createTextNode(msg + '\n'));
+        }
+
+        function runTests()
+        {
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            var r = document.createRange();
+            try {
+                r.insertNode(r);
+            } catch(e) {
+            }
+
+            log('PASS: No crash.');
+        }
+    </script>
+</head>
+<body onload="runTests();">
+    <p>This tests that we don't crash when passing null to Range.insertNode().  (rdar://problem/5488478)</p>
+    <pre id="console"></pre>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/SVGPolygonElement-baseVal-list-removal-crash.html b/tests/tests/webkitsecurity/assets/SVGPolygonElement-baseVal-list-removal-crash.html
new file mode 100644
index 0000000..dd44f35
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/SVGPolygonElement-baseVal-list-removal-crash.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function go() {
+    var oSVGPolygon = document.createElementNS("http://www.w3.org/2000/svg", "polygon");
+    var oSVGPath = document.createElementNS("http://www.w3.org/2000/svg", "path");
+    var oSVGPoint1 = oSVGPath.getPointAtLength();
+    oSVGPolygon.points.initialize(oSVGPoint1);
+    oSVGPolygon.points.removeItem(-9223372036854775802);
+    alert("Accessing old oSVGPoint1.x: " + oSVGPoint1.x);
+}
+</script>
+</head>
+<body onload="go()">
+This test passes if it doesn't crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.html b/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.html
new file mode 100755
index 0000000..816b4a2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html >
+    <script>
+        function body_start() {
+            var q = document.getElementById('root').contentDocument;
+            q.getElementsByTagName('svg')[0].replaceChild(q.getElementById('refImage'), q.getElementById('d'));
+            q.getElementsByTagName('use')[0].setAttribute('xlink:href', '#testName');
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+            }
+            setTimeout(function () {
+                    document.body.innerHTML = "PASS, if DumpRenderTree doesn't crash, and no assertion in a Debug build.";
+                    if (window.layoutTestController)
+                        layoutTestController.notifyDone();
+               }, 0);
+        }
+    </script>
+    <object data="resources/SVGStyledElement-pendingResource-crash.svg" id="root" onload="body_start();" type="image/svg+xml"/></object>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.svg b/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.svg
new file mode 100755
index 0000000..fcd5b2c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/SVGStyledElement-pendingResource-crash.svg
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>

+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">

+	<image id="refImage"/>

+	<g>

+		<text id="testName">X</text>

+		<use xlink:href="#navigationGroup" />

+	</g>

+	<defs id="d">

+		<g id="navigationGroup" fill='url(#testName)'>

+			<a stroke='url(#refImage)'><text id="ABC">A</text></a>

+        </g>

+    </defs>

+</svg>

diff --git a/tests/tests/webkitsecurity/assets/abort-crash.html b/tests/tests/webkitsecurity/assets/abort-crash.html
new file mode 100644
index 0000000..2db7e74
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/abort-crash.html
@@ -0,0 +1,39 @@
+<html>
+<head>
+<script>
+    
+function f() {
+    var req = new XMLHttpRequest();
+    req.open("GET", "hello-world.cgi"); 
+    req.setRequestHeader("Cache-Control", "no-cache");
+    req.send(null);  
+    req.abort();
+}
+
+function runTest() {
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+    }
+    
+    f();
+    
+    // create lots of objects to force a garbage collection
+    var i = 0;
+    var s;
+    while (i < 5000) {
+        i = i+1.11;
+        s = s + " ";
+    }
+     
+     // Add a small timeout to give the callbacks a chance to fire
+     if (window.layoutTestController)
+        setTimeout("layoutTestController.notifyDone()", 100)
+}         
+</script>
+</head>
+<body onload="runTest()">
+    This tests that aborting and then garbage collecting an XMLHttpRequest does not cause a crash.
+    SUCCESS! Didn't crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/absolute-position-foreign-object-child-crash.html b/tests/tests/webkitsecurity/assets/absolute-position-foreign-object-child-crash.html
new file mode 100755
index 0000000..13123cf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/absolute-position-foreign-object-child-crash.html
@@ -0,0 +1,25 @@
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+
+<svg>
+    <foreignObject>
+        <div style="position: absolute;">
+            <div id="div1"></div>
+            <div id="div2" style="overflow:hidden; width:100px; height:100px;">x</div>
+        </div>
+    </foreignObject>
+</svg>
+<script>
+function RemoveNode(n) { n.parentNode.removeChild(n) }
+    window.onload = function() {
+        document.body.offsetTop; // Force layout.
+        RemoveNode(document.getElementById('div1'));
+        document.body.offsetTop; // Force layout.
+        RemoveNode(document.getElementById('div2'));
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+}
+</script>
+<body>
+    PASS
+</body>
+
diff --git a/tests/tests/webkitsecurity/assets/adopt-node-crash.html b/tests/tests/webkitsecurity/assets/adopt-node-crash.html
new file mode 100644
index 0000000..4413edd
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/adopt-node-crash.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<div>Tests for a crash due to modifying the DOM during mutation events due to an adoptNode call. If this page doesn't crash and DOMSubtreeModified is fire, this test succeeds.</div>
+<div id="result"></div>
+<div id="node-to-adopt"></div>
+<iframe></iframe>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var nodeToAdopt = document.getElementById('node-to-adopt');
+
+var mutationHandler = function() {
+    document.getElementById('result').innerHTML = "DOMSubtreeModified fired";
+    document.body.removeEventListener('DOMSubtreeModified', mutationHandler, true);
+    document.body.appendChild(nodeToAdopt);
+};
+document.body.addEventListener('DOMSubtreeModified', mutationHandler, true);
+
+var iframe = document.querySelector('iframe');
+var iframeDoc = iframe.contentDocument;
+iframeDoc.adoptNode(nodeToAdopt);
+// The crash happens when the iframe's document is getting detached.
+document.body.removeChild(iframe);
+</script>
diff --git a/tests/tests/webkitsecurity/assets/after-block-doesnt-crash.html-disabled b/tests/tests/webkitsecurity/assets/after-block-doesnt-crash.html-disabled
new file mode 100644
index 0000000..4184e17
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/after-block-doesnt-crash.html-disabled
@@ -0,0 +1,23 @@
+<meta http-equiv="refresh" content="1;url=" />
+<style>
+    ruby::after {
+        display: block;
+        content: url("http://yy");
+    }
+</style>
+<ruby>
+    <ruby>
+        <ruby>
+            <style>
+                ruby {
+                    float: right;	
+                }
+            </style>
+        </ruby>
+    </ruby>
+</ruby>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/after-doesnt-crash.html b/tests/tests/webkitsecurity/assets/after-doesnt-crash.html
new file mode 100644
index 0000000..1eaf04f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/after-doesnt-crash.html
@@ -0,0 +1,22 @@
+<html>
+  <head>
+    <style>
+      :after {
+        content: ""
+      }
+    </style>
+  </head>
+  <body onload="document.linkColor=0;">
+    <ruby>
+      <rt></rt>
+    </ruby>
+    <ruby style="float: left">
+      <rt></rt>
+    </ruby>
+    <script>
+      if (window.layoutTestController)
+          layoutTestController.dumpAsText();
+    </script>
+    This test passes if it doesn't crash.
+  </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/after-table-doesnt-crash.html-disabled b/tests/tests/webkitsecurity/assets/after-table-doesnt-crash.html-disabled
new file mode 100644
index 0000000..5edf7f1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/after-table-doesnt-crash.html-disabled
@@ -0,0 +1,23 @@
+<meta http-equiv="refresh" content="1;url=" />
+<style>
+    ruby::after {
+        display: table;
+        content: url("http://yy");
+    }
+</style>
+<ruby>
+    <ruby>
+        <ruby>
+            <style>
+                ruby {
+                    float: right;	
+                }
+            </style>
+        </ruby>
+    </ruby>
+</ruby>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/after-with-first-letter-float-crash.html b/tests/tests/webkitsecurity/assets/after-with-first-letter-float-crash.html
new file mode 100755
index 0000000..6acc2d3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/after-with-first-letter-float-crash.html
@@ -0,0 +1,19 @@
+<html>
+    <body>
+        <style type="text/css">
+            div::first-letter { float: right; content: "AB" }
+            div::after { display: table; content: "CD" }
+        </style>
+        <div></div>
+        PASS, if the script does not cause a crash or ASSERT failure
+        <script>
+            function runTest() {
+                document.body.offsetTop;
+                document.body.style.color = "blue";
+                if (window.layoutTestController)
+                    layoutTestController.dumpAsText();
+            }
+            window.onload = runTest;
+        </script>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/anchor-linked-anonymous-block-crash.html b/tests/tests/webkitsecurity/assets/anchor-linked-anonymous-block-crash.html
new file mode 100644
index 0000000..bdfc478
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/anchor-linked-anonymous-block-crash.html
@@ -0,0 +1,8 @@
+<html>

+Test passes if it does not crash.

+<script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+</script>

+<details>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/animate-calcMode-spline-crash-bad-array-length.xhtml b/tests/tests/webkitsecurity/assets/animate-calcMode-spline-crash-bad-array-length.xhtml
new file mode 100755
index 0000000..9cb6ae4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/animate-calcMode-spline-crash-bad-array-length.xhtml
@@ -0,0 +1,30 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+    <body>
+        <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+            <path
+                d="m 65.912454,142.33657 c 32.971728,0.47546 54.353006,2.31459 71.732026,10.88083 17.37902,8.56625 34.29132,22.84947 51.25404,50.23341 13.77183,26.13619 16.30585,56.55141 24.4592,84.76493 10.69173,38.71495 20.90606,82.87651 67.29492,88.93182 41.52078,0.3788 52.41155,-41.57971 59.06828,-62.96039 6.46861,-20.7765 10.67334,-53.22798 17.38318,-74.37414 13.10483,-41.30006 19.81437,-45.96631 29.91229,-57.75202"
+                id="path_a"
+                style="fill:none;stroke:none;stroke-width:0.2;marker-mid:none;marker-end:none" />
+
+                <circle id="mycircle" cx="0" cy="0" r="12" >
+                    <animateMotion id="A" dur="2s" keyTimes="0; 0.6; 1"
+                        calcMode="spline" keySplines="1 0 1 0;0 1 0 1;"
+                        repeatCount="1" rotate="auto" fill="freeze">
+                            <mpath xlink:href="#path_a" />
+                    </animateMotion>
+                </circle>
+            </svg>
+        <script>
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+	    }
+            setTimeout(function () {
+                    document.body.innerHTML = "PASS, if DumpRenderTree doesn't crash, and no assertion in a Debug build.";
+                    if (window.layoutTestController)
+                        layoutTestController.notifyDone();
+                }, 0);
+
+        </script>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/animate-update-crash.xhtml b/tests/tests/webkitsecurity/assets/animate-update-crash.xhtml
new file mode 100644
index 0000000..3729bf3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/animate-update-crash.xhtml
@@ -0,0 +1,20 @@
+<html xmlns="http://www.w3.org/1999/xhtml">

+    <body>

+        <svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">

+            <text>

+                PASS

+                <textPath>

+                    <tref xlink:href="#foo">

+                        <animateColor attributeName="keyPoints"></animateColor>

+                        <animateColor attributeName="xlink:href"></animateColor>

+                    </tref>

+                </textPath>

+            </text>

+        </svg>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+        </script>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/animate-use-crash.xhtml b/tests/tests/webkitsecurity/assets/animate-use-crash.xhtml
new file mode 100644
index 0000000..46ca4ae
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/animate-use-crash.xhtml
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">

+    <g>

+        <defs> 

+            <text id="text">

+                <a onmousedown="">

+                    <animateTransform attributeName="a" end=",1"></animateTransform>

+                </a>Passes if doesn't crash     

+            </text>

+        </defs> 

+        <use x="25" y="25" xlink:href="#text"/>

+        <script><![CDATA[

+        if (window.layoutTestController)

+            layoutTestController.dumpAsText();

+        ]]></script>

+    </g>

+</svg>

diff --git a/tests/tests/webkitsecurity/assets/animated-background-image-crash.html b/tests/tests/webkitsecurity/assets/animated-background-image-crash.html
new file mode 100644
index 0000000..2f92319
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/animated-background-image-crash.html
@@ -0,0 +1,48 @@
+<html>
+<head>
+    <title></title>
+    <style>
+        div {
+            width: 40px;
+            height: 40px;
+            background: url(resources/animated.gif) top left no-repeat,
+                        url(resources/animated2.gif) bottom right no-repeat;
+        }
+    </style>
+    <script>
+        function step2()
+        {
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
+
+        function step1()
+        {
+            if (window.layoutTestController)
+                layoutTestController.display();
+            document.getElementById("target").style.display="none";
+            document.body.offsetTop;
+            setTimeout("step2()", 200);
+        }
+
+        function test()
+        {
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+            }
+            setTimeout("step1()", 100);
+        }
+    </script>
+</head>
+<body onload="test()">
+    <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=12487">http://bugs.webkit.org/show_bug.cgi?id=12487</a>
+        REGRESSION: Repro crash when a second background image is animated</i>.
+    </p>
+    <p>
+        This test should not make Safari crash.
+    </p>
+    <div id="target"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/animation-on-inline-crash.html b/tests/tests/webkitsecurity/assets/animation-on-inline-crash.html
new file mode 100644
index 0000000..ef10914
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/animation-on-inline-crash.html
@@ -0,0 +1,27 @@
+<style>
+    .box {
+      position: relative; 
+      -webkit-animation-delay: 5ms;
+      -webkit-animation-name: anim;
+    }
+    @-webkit-keyframes anim {
+      from { -webkit-transform: translateX(10px); }
+    }
+</style>
+<script type="text/javascript" charset="utf-8">
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+    
+    function waitForAnimation()
+    {
+        window.setTimeout(function() {
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }, 50);
+    }
+    window.addEventListener('load', waitForAnimation, false);
+</script>
+<p>Test passes if it does not crash.</p>
+<span class="box">Hello world</span>
diff --git a/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash-expected.png b/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash-expected.png
new file mode 100644
index 0000000..e3aef79
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash.html b/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash.html
new file mode 100644
index 0000000..c4720fc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/anonymous-before-child-parent-crash.html
@@ -0,0 +1,31 @@
+<html>

+<style>

+div { 

+    border: 5px solid maroon;

+    -webkit-column-count: 2;

+    width: 750px;

+    margin: 1em 0;

+}

+span { 

+    display: block;

+    margin: 1em 0;

+}

+h2 { 

+    -webkit-column-span: all;

+    background-color: #eeeeee;

+    color: black;

+}

+</style>

+<h2 id="base">PASS</h2>

+<div>

+<span id="one">

+Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Nulla varius enim ac mi. Curabitur sollicitudin felis quis lectus. Quisque adipiscing rhoncus sem. Proin nulla purus, vulputate vel, varius ut, euismod et, nisi. Sed vitae felis vel orci sagittis aliquam. Cras convallis adipiscing sem. Nam nonummy enim. Nullam bibendum lobortis neque. Vestibulum velit orci, tempus euismod, pretium quis, interdum vitae, nulla. Phasellus eget ante et tortor condimentum vestibulum.

+Suspendisse hendrerit quam nec felis. Sed varius turpis vitae pede. Lorem ipsum dolor sit amet, consectetuer adipiscing elit.<dl>

+</span>

+</div>

+<script>

+    one.insertBefore(document.getElementById('base').cloneNode(true), one.firstChild);

+    document.body.offsetTop;

+</script>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/anonymous-block-crash.html b/tests/tests/webkitsecurity/assets/anonymous-block-crash.html
new file mode 100644
index 0000000..ff6ce54
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/anonymous-block-crash.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>

+<html>

+  <body>

+  This test verifies that no crash occurs.

+    <font>

+      <div>

+        <table>

+          <tbody>

+            <tr>

+              <td>

+                <b>

+                  <font>

+                  <p>

+                  </font>

+                </b>

+              </td>

+            </tr>

+            </tbody>

+        </table>

+      <script>

+        var i = document.body.offsetTop;    // this forces a layout

+      </script>

+    </font>

+    <div id="console"></div>

+  </body>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+document.getElementById("console").appendChild(document.createTextNode("PASS"));;

+</script>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/anonymous-block-merge-crash.html b/tests/tests/webkitsecurity/assets/anonymous-block-merge-crash.html
new file mode 100644
index 0000000..94c3e8a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/anonymous-block-merge-crash.html
@@ -0,0 +1,16 @@
+<span><object><div>PASS</div></span>
+<script src="full-screen-test.js"></script>
+<script>
+  if (Element.prototype.webkitRequestFullScreen == undefined) {
+  } else {
+    var span = document.getElementsByTagName('span')[0];
+
+    document.onwebkitfullscreenchange = function(event) {
+      document.body.appendChild(document.createElement('div'));
+      document.webkitCancelFullScreen();
+      layoutTestController.notifyDone();
+    };
+
+    runWithKeyDown(function(){span.webkitRequestFullScreen()});
+  }
+</script>
diff --git a/tests/tests/webkitsecurity/assets/anonymous-render-block-in-continuation-causes-crash.html b/tests/tests/webkitsecurity/assets/anonymous-render-block-in-continuation-causes-crash.html
new file mode 100644
index 0000000..fea7be3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/anonymous-render-block-in-continuation-causes-crash.html
@@ -0,0 +1,43 @@
+<html>
+<head>
+<link rel="stylesheet" href="../fast/js/resources/js-test-style.css">
+<script src="../fast/js/resources/js-test-pre.js"></script>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.waitUntilDone();
+
+    function walkAccessibilityTree(accessibilityObject) {
+        var count = accessibilityObject.childrenCount;
+        for (var i = 0; i < count; ++i)
+            walkAccessibilityTree(accessibilityObject.childAtIndex(i));
+    }
+
+    function runTest() {
+        description("This tests that having an anonymous render block in a continuation doesn't cause a crash when walking the accessibility tree.");
+
+        window.root = accessibilityController.rootElement;
+        walkAccessibilityTree(root);
+
+        debug('<br /><span class="pass">TEST COMPLETE</span>');
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+
+    if (window.layoutTestController && window.accessibilityController) {
+        window.addEventListener('load', function() {
+            setTimeout(runTest, 10);
+        }, false);
+    }
+</script>
+</head>
+<body>
+
+<li><span>x<ul><li>y</ul></span>z</li>
+
+End of test.
+
+<p id="description"></p>
+<div id="console"></div>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/anonymous-split-block-crash-expected.png b/tests/tests/webkitsecurity/assets/anonymous-split-block-crash-expected.png
new file mode 100644
index 0000000..da119c7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/anonymous-split-block-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/anonymous-split-block-crash.html b/tests/tests/webkitsecurity/assets/anonymous-split-block-crash.html
new file mode 100644
index 0000000..994a4c6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/anonymous-split-block-crash.html
@@ -0,0 +1,21 @@
+<html>

+<style>

+div { 

+    border: 5px solid maroon; 

+    -webkit-column-count: 2;

+    margin: 1em 0;

+}

+h2 { 

+    -webkit-column-span: all;

+    background-color: #eeeeee;

+    color: black;

+}

+</style>

+<div>

+<junk>

+<h2>PASS</h2>

+Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Nulla varius enim ac mi. Curabitur sollicitudin felis quis lectus. Quisque adipiscing rhoncus sem. Proin nulla purus, vulputate vel, varius ut, euismod et, nisi. Sed vitae felis vel orci sagittis aliquam. Cras convallis adipiscing sem. Nam nonummy enim. Nullam bibendum lobortis neque. Vestibulum velit orci, tempus euismod, pretium quis, interdum vitae, nulla. Phasellus eget ante et tortor condimentum vestibulum.

+Suspendisse hendrerit quam nec felis. Sed varius turpis vitae pede. Lorem ipsum dolor sit amet, consectetuer adipiscing elit.

+</div>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/apply-style-text-decoration-crash.html b/tests/tests/webkitsecurity/assets/apply-style-text-decoration-crash.html
new file mode 100644
index 0000000..a3d00ea
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/apply-style-text-decoration-crash.html
@@ -0,0 +1,20 @@
+<html>

+    <script>

+        function runTest() 

+        {

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+

+            window.getSelection().setBaseAndExtent(start, 0, null, 0);

+            document.execCommand("Indent");

+            document.getElementById("result").innerHTML = "PASS";

+        }

+    </script>

+    <body onLoad="runTest();">

+        <p id="result"></p>

+        <div contenteditable="true" id="start" style="text-decoration: none;">

+            <hr style="text-align: right;"/>

+        </div>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/applyblockelement-visiblepositionforindex-crash.html b/tests/tests/webkitsecurity/assets/applyblockelement-visiblepositionforindex-crash.html
new file mode 100644
index 0000000..bbc0e77
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/applyblockelement-visiblepositionforindex-crash.html
@@ -0,0 +1,24 @@
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest() {
+    window.getSelection().setBaseAndExtent(start, 0, null, 0);
+    document.execCommand("Indent");
+    document.body.innerHTML = "PASS. WebKit didn't crash.";
+}
+</script>
+<body onload="runTest();">
+  <defs contenteditable="true" id="start">
+  <rt id="rt">A
+
+<script>
+document.write("text");
+try {
+    elem = document.getElementById("rt");
+    var new_elem = document.createElement("ruby");
+    new_elem.innerHTML = elem.innerHTML;
+    elem.parentNode.insertBefore(new_elem, elem);
+} catch (e) {}
+</script>
diff --git a/tests/tests/webkitsecurity/assets/arc-crash.html b/tests/tests/webkitsecurity/assets/arc-crash.html
new file mode 100644
index 0000000..f17a3e6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/arc-crash.html
@@ -0,0 +1,45 @@
+<html>
+<head>
+<script type="text/javascript">
+function debug(str) {
+    var c = document.getElementById('console')
+    c.appendChild(document.createTextNode(str + '\n'));
+}
+
+function runTests() {
+    debug("This tests that we don't crash when passing inf as a parameter to arc");
+    var canvas = document.getElementById("test");
+    var context = canvas.getContext("2d");
+    context.fillStyle = '#f00';
+    context.fillRect(0, 0, canvas.width, canvas.height);
+    try {
+        context.arc(10, 10, 20, 20, 1.0/0.0, true);
+        context.arc(10, 10, 20, 20, 1.0/0.0, true);
+        context.arc(10, 10, 1.0/0.0, 20, 20, true);
+        context.arc(10, 10, 20, 1.0/0.0, 20, true);
+        context.arc(10, 1.0/0.0, 10, 20, 20, true);
+        context.arc(1.0/0.0, 10, 10, 20, 20, true);
+        context.arc(10, 10, 20, 20, 1.0/0.0, false);
+        context.arc(10, 10, 1.0/0.0, 20, 20, false);
+        context.arc(10, 10, 20, 1.0/0.0, 20, false);
+        context.arc(10, 1.0/0.0, 10, 20, 20, false);
+        context.arc(1.0/0.0, 10, 10, 20, 20, false);
+    } catch (e) {
+    }
+    context.fillStyle = '#0f0';
+    context.fillRect(0, 0, canvas.width, canvas.height);
+    debug("Test passed.");
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+}
+</script>
+<title>borkedness</title>
+</head>
+<body>
+   <canvas id="test" width="100" height="100"></canvas><br />
+   <pre id="console"></pre>
+   <script>
+   runTests();
+   </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/area-islink-focus-null-ptr-crash.html b/tests/tests/webkitsecurity/assets/area-islink-focus-null-ptr-crash.html
new file mode 100644
index 0000000..c8555ea
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/area-islink-focus-null-ptr-crash.html
@@ -0,0 +1,14 @@
+<!--
+  http://code.google.com/p/chromium/issues/detail?id=73650
+  https://bugs.webkit.org/show_bug.cgi?id=54877
+-->
+<div id="log">FAIL</div>
+<script>
+  window.layoutTestController && layoutTestController.dumpAsText();
+
+  oArea = document.createElement('area');
+  oArea.href = 0;
+  oArea.focus();
+
+  log.innerHTML = "PASS";
+</script>
diff --git a/tests/tests/webkitsecurity/assets/aria-activedescendant-crash.html b/tests/tests/webkitsecurity/assets/aria-activedescendant-crash.html
new file mode 100644
index 0000000..47e28ad
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/aria-activedescendant-crash.html
@@ -0,0 +1,20 @@
+<html>
+    <head>
+        <script>
+            function test()
+            {
+                if (window.layoutTestController)
+                    layoutTestController.dumpAsText();
+                document.getElementById('bt').focus();
+                if (window.accessibilityController)
+                    var test = accessibilityController.focusedElement.stringAttributeValue("aria-activedescendant");
+                document.getElementById('bt').click();
+            }
+        </script>
+    </head>
+    <body onload="test()">
+        This tests that there is no crash if you set an aria-activedescendant attribute to an id of an element that has no renderer.<br>
+        <input type="button" id="bt" onclick="this.setAttribute('aria-activedescendant', 'hiddenElement')" value="Use VoiceOver to activate this button, and then navigate to the next element">
+        <div id="hiddenElement" style="display:none"></div>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/aria-options-and-menuitems-crash.html b/tests/tests/webkitsecurity/assets/aria-options-and-menuitems-crash.html
new file mode 100644
index 0000000..2a95ee2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/aria-options-and-menuitems-crash.html
@@ -0,0 +1,31 @@
+<html>
+<head>
+<script src="../../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+<div role="menuitem">An ARIA menu item</div>
+<div role="option">An ARIA option</div>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description("This tests that having elements with ARIA role 'option' or 'menuitem' as children of something of Group role does not crash.");
+
+if (window.layoutController) {
+    layoutTestController.dumpAsText();
+}
+
+if (window.accessibilityController) {
+    document.getElementById("body").focus();
+    webArea = accessibilityController.focusedElement;
+
+    // Just trying to get the accessible objects for the elements with
+    // role 'option' and 'menuitem' shouldn't make this crash.
+    element = webArea.childAtIndex(0);
+    element = webArea.childAtIndex(1);
+}
+
+</script>
+<script src="../../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/array-buffer-crash.html b/tests/tests/webkitsecurity/assets/array-buffer-crash.html
new file mode 100644
index 0000000..7bdfb85
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/array-buffer-crash.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+<script src="resources/webgl-test.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+
+description('Test ArrayBuffer.byteLength');
+
+<!-- The following used to cause a crash in Chrome -->
+new ArrayBuffer().byteLength;
+
+testPassed("new ArrayBuffer().byteLength did not crash");
+
+</script>
+<script src="../../js/resources/js-test-post.js"></script>
+
+<script>
+</script>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/array-buffer-view-crash-when-reassigned.html b/tests/tests/webkitsecurity/assets/array-buffer-view-crash-when-reassigned.html
new file mode 100644
index 0000000..84fb8c8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/array-buffer-view-crash-when-reassigned.html
@@ -0,0 +1,32 @@
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+<script src="resources/webgl-test.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+
+description('Verify that reassigning typed array constructor does not crash.');
+
+<!-- The following used to cause a crash in Chrome -->
+Uint8Array = 0;
+Uint16Array = "string";
+Uint32Array = function() {};
+Int16Array = function() {};
+Int16Array.prototype.set = 0;
+new Float64Array(function () {});
+new Float32Array([1, 2, 3], 1);
+new Int16Array(function() {});
+testPassed("reassigning typed array constructor did not crash");
+
+</script>
+<script src="../../js/resources/js-test-post.js"></script>
+
+<script>
+</script>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/array-buffer-view-crash.html b/tests/tests/webkitsecurity/assets/array-buffer-view-crash.html
new file mode 100644
index 0000000..c0690a2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/array-buffer-view-crash.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+<script src="resources/webgl-test.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+
+description('Verify that constructing a typed array view with no arguments and fetching its length does not crash');
+
+<!-- The following used to cause a crash in both Safari and Chrome -->
+new Uint32Array().length;
+
+testPassed("new Uint32Array().length did not crash");
+
+</script>
+<script src="../../js/resources/js-test-post.js"></script>
+
+<script>
+</script>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/asterisk-counter-update-after-layout-crash.html b/tests/tests/webkitsecurity/assets/asterisk-counter-update-after-layout-crash.html
new file mode 100644
index 0000000..6fdb445
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/asterisk-counter-update-after-layout-crash.html
@@ -0,0 +1,19 @@
+<style>
+.x:after { content:counter(c, asterisks) ""; counter-increment:c 1550; }
+</style>
+<script>
+function runTest() {
+    document.styleSheets[0].insertRule("div { counter-reset: c 141170 }");
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+}
+window.onload=runTest;
+</script>
+<div>
+    <span class="x">
+    <div></div>
+    <span class="x">
+    <p>
+    <p>
+    PASS if no assert or crash in debug
+</div>
diff --git a/tests/tests/webkitsecurity/assets/avl-crash.html b/tests/tests/webkitsecurity/assets/avl-crash.html
new file mode 100644
index 0000000..ecf61b9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/avl-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/avl-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/avl-crash.js b/tests/tests/webkitsecurity/assets/avl-crash.js
new file mode 100644
index 0000000..fc9dea5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/avl-crash.js
@@ -0,0 +1,98 @@
+description(
+"This test checks for a crash in sort() that was seen on a particular input data set."
+);
+
+function natcompare(a, b) {
+    if (a == b)
+        return 0;
+    return (a < b) ? -1 : 1;
+}
+
+SubwayData = [
+"23rd St-Broadway ", 
+"45 Road-Court Sq", 
+"LIC-Court Sq", 
+"LIC-Court Sq", 
+"23rd St-Park Ave S", 
+"241st St", 
+"242nd St", 
+"25th Ave", 
+"25th St", 
+"28th St-7th Ave", 
+"28th St-Broadway", 
+"28th St-Park Ave S", 
+"2nd Ave-Houston St", 
+"30th Ave", 
+"33rd St", 
+"33rd St-Park Ave", 
+"34th St-6th Ave", 
+"34th St-7th Ave", 
+"34th St-8th Ave", 
+"36th Ave", 
+"36th St", 
+"36th St", 
+"39th Ave", 
+"3rd Ave-138th St", 
+"3rd Ave-149th St", 
+"3rd Ave-14th St", 
+"40th St", 
+"42nd St-5th Ave-6th Ave", 
+"42nd St-5th Ave-6th Ave", 
+"45th St", 
+"46th St", 
+"46th St", 
+"47-50th Sts-Rockefeller Center", 
+"49th St-7th Ave", 
+"50th St-New Utrecht Ave", 
+"9th Ave", 
+"90th St-Elmhurst Ave", 
+"96th St", 
+"96th St", 
+"96th St", 
+"9th St-4th Ave", 
+"Alabama Ave", 
+"Allerton Ave", 
+"Aqueduct-North Conduit Ave", 
+"Astor Place", 
+"Astoria Blvd", 
+"Atlantic Ave", 
+"Atlantic Ave-Pacific St", 
+"Ave H", 
+"Ave N", 
+"Ave P", 
+"Ave U", 
+"Ave U", 
+"Ave U", 
+"Ave X", 
+"Bay Pkwy", 
+"Bay Pkwy", 
+"Bay Pkwy-22nd Ave", 
+"Bay Ridge Ave", 
+"Baychester Ave", 
+"Beach 105th St", 
+"Beach 25th St", 
+"Beach 36th St", 
+"Beach 44th St", 
+"Beach 60th St", 
+"Beach 67th St", 
+"Beach 90th St", 
+"Beach 98th St", 
+"Bedford Ave", 
+"Bedford Park Blvd", 
+"Broadway", 
+"Broadway", 
+"Bronx Park East", 
+"Brook Ave", 
+"Buhre Ave", 
+"Burke Ave", 
+"Burnside Ave", 
+"Bushwick Ave", 
+"Uptown Bleecker St-Lafayette St", 
+"Downtown Bleecker St-Lafayette St", 
+"Canal Street", 
+"Canal Street", 
+"Canal Street", 
+"Canal-Church Sts"
+];
+
+SubwayData.sort(natcompare)
diff --git a/tests/tests/webkitsecurity/assets/backcolor-crash.html b/tests/tests/webkitsecurity/assets/backcolor-crash.html
new file mode 100644
index 0000000..aa2f4d5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/backcolor-crash.html
@@ -0,0 +1,16 @@
+<html>
+<body>
+This is a crash test when executing backColor on a node where all of its ancestors have transparent background color.  You should see PASS at the end.
+<div id="test" contenteditable></div>
+<script>
+
+if (window.layoutTestController)
+    window.layoutTestController.dumpAsText();
+
+window.getSelection().setPosition(test, 0);
+var color = document.queryCommandValue('backColor', false, null);
+
+document.write('backColor: ' + color + '<br>');
+document.write('PASS');
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/background-fill-zero-area-crash.html b/tests/tests/webkitsecurity/assets/background-fill-zero-area-crash.html
new file mode 100644
index 0000000..bd7a580
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/background-fill-zero-area-crash.html
@@ -0,0 +1,50 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <script>
+            if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+        </script>
+        <style>
+            #a {
+                background-image: -webkit-gradient(linear, left top, left bottom, from(white), to(black));
+                -webkit-background-size: auto 50px;
+                -webkit-box-sizing: border-box;
+                border: 1px solid black;
+                width: 100px;
+                height: 2px;
+            }
+            #b {
+                background-image: -webkit-gradient(linear, left top, left bottom, from(white), to(black));
+                -webkit-background-size: 50px auto;
+                -webkit-box-sizing: border-box;
+                border: 1px solid black;
+                width: 2px;
+                height: 100px;
+            }
+            #c {
+                background-image: -webkit-gradient(linear, left top, left bottom, from(white), to(black));
+                -webkit-background-size: contain;
+                -webkit-box-sizing: border-box;
+                border: 1px solid black;
+                width: 2px;
+                height: 100px;
+            }
+            #d {
+                background-image: -webkit-gradient(linear, left top, left bottom, from(white), to(black));
+                -webkit-background-size: contain;
+                -webkit-box-sizing: border-box;
+                border: 1px solid black;
+                width: 100px;
+                height: 2px;
+            }
+        </style>
+    </head>
+    <body>
+        <p>Test of some edge cases for background fills with generated images. Test passed if it rendered and there was no division by zero.</p>
+        <div id="a"></div>
+        <div id="b"></div>
+        <div id="c"></div>
+        <div id="d"></div>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/background-norepeat-crash.html b/tests/tests/webkitsecurity/assets/background-norepeat-crash.html
new file mode 100644
index 0000000..1ba2c5a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/background-norepeat-crash.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+    <title></title>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<body style="background:url(),url(); background-repeat:no-repeat;">
+    <script>document.body.style.getPropertyValue("background")</script>
+    <p>
+        Test for crash when retrieving the implicit "background" property value with "background-repeat: no-repeat" (https://bugs.webkit.org/show_bug.cgi?id=49055). If this text appears, the test has passed.
+    </p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/backward-textiterator-first-letter-crash.html b/tests/tests/webkitsecurity/assets/backward-textiterator-first-letter-crash.html
new file mode 100644
index 0000000..eef2489
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/backward-textiterator-first-letter-crash.html
@@ -0,0 +1,15 @@
+<style>
+div:first-letter { margin-top: 0em; }
+</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+function done() {
+    document.body.innerHTML = 'PASS if WebKit did not hit assertions';
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+<body onload="setTimeout(done, 100);"><div>AB<select autofocus contenteditable>
diff --git a/tests/tests/webkitsecurity/assets/bad-handshake-crash.html b/tests/tests/webkitsecurity/assets/bad-handshake-crash.html
new file mode 100644
index 0000000..062a69c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/bad-handshake-crash.html
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../../../js-test-resources/js-test-pre.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+<script type="text/javascript">
+description("Make sure WebSocket doesn't crash with bad handshake message.");
+
+window.jsTestIsAsync = true;
+if (window.layoutTestController)
+    layoutTestController.overridePreference("WebKitHixie76WebSocketProtocolEnabled", 0);
+
+var ws = new WebSocket("ws://127.0.0.1:8880/websocket/tests/hybi/bad-handshake-crash");
+ws.onopen = function () {
+    debug("WebSocket is open");
+};
+ws.onclose = function () {
+    debug("WebSocket is closed");
+    finishJSTest();
+};
+
+</script>
+<script src="../../../../js-test-resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/bad-handshake-crash_wsh.py b/tests/tests/webkitsecurity/assets/bad-handshake-crash_wsh.py
new file mode 100644
index 0000000..f3a2feb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/bad-handshake-crash_wsh.py
@@ -0,0 +1,18 @@
+from mod_pywebsocket import handshake
+from mod_pywebsocket.handshake.hybi import compute_accept
+
+
+def web_socket_do_extra_handshake(request):
+    msg = "HTTP/1.1 101 Switching Protocols\r\n"
+    msg += "Upgrade: websocket\r\n"
+    msg += "Connection: Upgrade\r\n"
+    msg += "Sec-WebSocket-Accept: %s\r\n" % compute_accept(request.headers_in["Sec-WebSocket-Key"])[0]
+    msg += "\xa5:\r\n"
+    msg += "\r\n"
+    request.connection.write(msg)
+    print msg
+    raise handshake.AbortedByUserException("Abort the connection") # Prevents pywebsocket from sending its own handshake message.
+
+
+def web_socket_transfer_data(request):
+    pass
diff --git a/tests/tests/webkitsecurity/assets/bad-transition-shorthand-crash.html b/tests/tests/webkitsecurity/assets/bad-transition-shorthand-crash.html
new file mode 100644
index 0000000..3ac4a66
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/bad-transition-shorthand-crash.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+  <style>
+    #box {
+      position: relative;
+      height: 100px;
+      width: 100px;
+      background-color: blue;
+      -webkit-transform: rotate(0);
+      -webkit-transition: -webkit-transform, 2s;
+    }
+  </style>
+  <script>
+    if (window.layoutTestController) {
+      layoutTestController.dumpAsText();
+      layoutTestController.waitUntilDone();
+    }
+    
+    function finish()
+    {
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+    
+    function returnToStart()
+    {
+        var box = document.getElementById('box');
+        box.style.webkitTransform = 'rotate(0)';
+        setTimeout(finish, 20);
+    }
+    
+    function start()
+    {
+        var box = document.getElementById('box');
+        box.style.webkitTransform = 'rotate(180deg)';
+        setTimeout(returnToStart, 20);
+    }
+    
+    window.addEventListener('load', start, false);
+  </script>
+</head>
+<body>
+
+<p>
+This tests a crash that was occuring when you have both an explicit property and 'all' in the -webkit-transition-property
+    CSS property. The crash would occur when you retarget the transition. This test should not crash.
+</p>
+<div id="box">
+</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/baseVal-animVal-crash.html b/tests/tests/webkitsecurity/assets/baseVal-animVal-crash.html
new file mode 100644
index 0000000..1699996
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/baseVal-animVal-crash.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function go() {
+    var oSVGAltGlyphElement = document.createElementNS("http://www.w3.org/2000/svg", "altGlyph");
+    var oSvgMaskElement = document.createElementNS("http://www.w3.org/2000/svg", "mask");
+    var oSvgLengthList = oSVGAltGlyphElement.dy.baseVal;
+    oSvgLengthList.appendItem(oSvgMaskElement.width.animVal);
+    gc();
+    oSvgLengthList.appendItem(oSvgMaskElement.width.animVal);
+    gc();
+    oSvgLengthList.removeItem(0);
+    gc();
+    oSvgLengthList.appendItem(oSvgMaskElement.width.animVal);
+    gc(); 
+}
+</script>
+</head>
+<body onload="go()">
+This test passes if it doesn't crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/baseVal-animVal-list-crash.html b/tests/tests/webkitsecurity/assets/baseVal-animVal-list-crash.html
new file mode 100644
index 0000000..63519c4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/baseVal-animVal-list-crash.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function go() {
+    var oSvgTextElement = document.createElementNS("http://www.w3.org/2000/svg", "text");
+    var oSvgRectElement = document.createElementNS("http://www.w3.org/2000/svg", "rect");
+    oSvgTextElement.y.animVal;
+    oSvgTextElement.y.baseVal.initialize(oSvgRectElement.x.baseVal);
+    oSvgTextElement.y.animVal.getItem(0);
+}
+</script>
+</head>
+<body onload="go()">
+This test passes if it doesn't crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/before-block-doesnt-crash.html b/tests/tests/webkitsecurity/assets/before-block-doesnt-crash.html
new file mode 100644
index 0000000..db8ab52
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/before-block-doesnt-crash.html
@@ -0,0 +1,23 @@
+<meta http-equiv="refresh" content="1;url=" />
+<style>
+    ruby::before {
+        display: block;
+        content: url("http://xx");
+    }
+</style>
+<ruby>
+    <ruby>
+        <ruby>
+            <style>
+                ruby {
+                    float: right;	
+                }
+            </style>
+        </ruby>
+    </ruby>
+</ruby>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/before-child-non-table-section-add-table-crash.html b/tests/tests/webkitsecurity/assets/before-child-non-table-section-add-table-crash.html
new file mode 100644
index 0000000..a016655
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/before-child-non-table-section-add-table-crash.html
@@ -0,0 +1,25 @@
+<html>

+    <body onload="runTest();">

+        <div id="table" style="display: table;">

+            <em id="em"></em>

+            <audio controls="arbitrary" style="display: table-caption;" />

+            <img id="img" />

+        </div>

+        <div id="result"></div>

+        <script type="text/javascript">

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+

+            function runTest()

+            {

+                var img = document.getElementById('img');

+                var em = document.getElementById('em');

+                em.parentNode.replaceChild(img, em);

+                document.body.offsetTop;

+                document.body.removeChild(document.getElementById('table'));

+                

+                document.getElementById("result").innerHTML = "PASS";

+            }

+        </script>

+    </body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/before-content-with-list-marker-in-anon-block-crash.html b/tests/tests/webkitsecurity/assets/before-content-with-list-marker-in-anon-block-crash.html
new file mode 100644
index 0000000..09992a1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/before-content-with-list-marker-in-anon-block-crash.html
@@ -0,0 +1,41 @@
+<style>
+.c9::before { float: right; content: counter(section); }
+.c9 { display: list-item; }
+.c19 { display: table-row; }
+.c19:nth-child(even) { position: fixed; }
+</style>
+<script>
+var nodes = Array();
+function runTest() {
+    firstDiv = document.createElement('div');
+    document.documentElement.appendChild(firstDiv);
+
+    secondDiv = document.createElement('div');
+    document.documentElement.appendChild(secondDiv);
+
+    childDivListItem = document.createElement('div');
+    childDivListItem.setAttribute('class', 'c9');
+    document.documentElement.appendChild(childDivListItem);
+
+    citeNode = document.createElement('cite');
+    citeNode.setAttribute('class', 'c19');
+    document.documentElement.appendChild(citeNode);
+
+    parentDivListItem = document.createElement('div');
+    parentDivListItem.setAttribute('class', 'c9');
+    
+    citeNode.appendChild(parentDivListItem);
+
+    document.body.offsetTop;
+    parentDivListItem.appendChild(childDivListItem);
+    document.body.offsetTop;
+    secondDiv.setAttribute('class', 'c1');
+    document.body.offsetTop;
+    firstDiv.setAttribute('class', 'c1');
+
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+}
+window.onload = runTest;
+</script>
+PASS if no assert or crash on debug
diff --git a/tests/tests/webkitsecurity/assets/before-doesnt-crash.html b/tests/tests/webkitsecurity/assets/before-doesnt-crash.html
new file mode 100644
index 0000000..bdbeb2b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/before-doesnt-crash.html
@@ -0,0 +1,22 @@
+<html>
+  <head>
+    <style>
+      :before {
+        content: ""
+      }
+    </style>
+  </head>
+  <body onload="document.linkColor=0;">
+    <ruby>
+      <rt></rt>
+    </ruby>
+    <ruby style="float: left">
+      <rt></rt>
+    </ruby>
+    <script>
+      if (window.layoutTestController)
+          layoutTestController.dumpAsText();
+    </script>
+    This test passes if it doesn't crash.
+  </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/before-table-doesnt-crash.html b/tests/tests/webkitsecurity/assets/before-table-doesnt-crash.html
new file mode 100644
index 0000000..db8ab52
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/before-table-doesnt-crash.html
@@ -0,0 +1,23 @@
+<meta http-equiv="refresh" content="1;url=" />
+<style>
+    ruby::before {
+        display: block;
+        content: url("http://xx");
+    }
+</style>
+<ruby>
+    <ruby>
+        <ruby>
+            <style>
+                ruby {
+                    float: right;	
+                }
+            </style>
+        </ruby>
+    </ruby>
+</ruby>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/bidi-neutral-in-mixed-direction-run-crash.html b/tests/tests/webkitsecurity/assets/bidi-neutral-in-mixed-direction-run-crash.html
new file mode 100755
index 0000000..6130b30
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/bidi-neutral-in-mixed-direction-run-crash.html
@@ -0,0 +1,25 @@
+<html>

+<style>

+    body { direction: rtl; padding-left: 100%; }

+</style>

+<script>

+    if (window.layoutTestController) {

+        layoutTestController.dumpAsText();

+        layoutTestController.waitUntilDone();

+    }

+

+    function runTest() {

+        document.body.innerHTML = "PASS, if no crash or exceptions thrown";

+

+        if (window.layoutTestController)

+            layoutTestController.notifyDone();

+    }

+

+    setTimeout("runTest()", 0);

+</script>

+0<span>

+<image>

+A 0<div></div>

+</span>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/bindings-array-apply-crash.html b/tests/tests/webkitsecurity/assets/bindings-array-apply-crash.html
new file mode 100644
index 0000000..7ca2c3d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/bindings-array-apply-crash.html
@@ -0,0 +1,27 @@
+<html>
+<body>
+<p>This tests that runtime arrays are not treated as JSArrays when used in Function.apply.  The test passes if it does not crash.</p>
+<pre id="console"></pre>
+<script>
+function log(msg)
+{
+    document.getElementById('console').appendChild(document.createTextNode(msg + "\n"));
+}
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+if (!window.objCController)
+    alert("This needs to be run under DRT on the Mac.");
+
+function test()
+{
+    log("PASS: Function called.  No crash!");
+}
+
+var array = window.objCController.testArray();
+test.apply(null, array);
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/blob-builder-crash.html b/tests/tests/webkitsecurity/assets/blob-builder-crash.html
new file mode 100644
index 0000000..62664b1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/blob-builder-crash.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function log(message)
+{
+    document.getElementById('console').appendChild(document.createTextNode(message + "\n"));
+}
+
+function test()
+{
+    log("Test that calling WebKitBlobBuilder.append with null value should not cause crash.");
+    var builder = new WebKitBlobBuilder();
+    builder.append(null);
+
+    log("DONE");
+}
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</head>
+<body onload="test()">
+<pre id='console'></pre>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/block-not-removed-from-parent-lineboxes-crash.html b/tests/tests/webkitsecurity/assets/block-not-removed-from-parent-lineboxes-crash.html
new file mode 100644
index 0000000..03bc435
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/block-not-removed-from-parent-lineboxes-crash.html
@@ -0,0 +1,18 @@
+<html>
+<body>
+<div style="width: 25px">
+<img style="width: 20px"><img id="test1" style="width: 50px; display: none;"><span id="test2" style="float: left;">AB</span>CD</div>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+    
+document.body.offsetTop;
+test1.style.display = "";
+document.body.offsetTop;
+test2.parentNode.removeChild(test2);
+
+document.body.offsetTop;
+document.body.innerHTML = "PASS: does not crash";
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/block-remove-child-delete-line-box-crash.html b/tests/tests/webkitsecurity/assets/block-remove-child-delete-line-box-crash.html
new file mode 100644
index 0000000..0832ac4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/block-remove-child-delete-line-box-crash.html
@@ -0,0 +1,23 @@
+<html>

+<style>

+div { -webkit-column-count:2; }

+h1 { -webkit-column-span: all; }

+</style>

+<body>

+<summary>

+<div id="div1">

+BeforeText<span id="span1">SpanText</span>AfterText

+<p>ParaText</p>

+</div>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+document.body.offsetTop;

+var h1 = document.createElement('h1');

+h1.appendChild(document.createTextNode('heading'));

+div1.insertBefore(h1, span1);

+</script>

+</summary>

+</body>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/block-style-progress-crash.html b/tests/tests/webkitsecurity/assets/block-style-progress-crash.html
new file mode 100644
index 0000000..da0f66e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/block-style-progress-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>

+<html>

+<head>

+<script>

+

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+function runTest() {

+    var r = document.createRange();

+    getSelection().addRange(r);

+    document.execCommand('justifyRight', null, true);

+    document.body.innerHTML = 'PASS';

+}

+

+</script>

+</head>

+<body onload="runTest()" contentEditable>

+<progress >>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/blockquote-crash-expected.png b/tests/tests/webkitsecurity/assets/blockquote-crash-expected.png
new file mode 100644
index 0000000..75bb935
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/blockquote-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/blockquote-crash.html b/tests/tests/webkitsecurity/assets/blockquote-crash.html
new file mode 100644
index 0000000..72c7942
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/blockquote-crash.html
@@ -0,0 +1,33 @@
+<html>
+    <head>
+        <style>
+            blockquote {
+                color: blue;
+                border-left: 2px solid blue;
+                padding-left: 5px;
+                margin: 0px;
+            }
+        </style>
+        <script>
+            function test()
+            {
+                if (window.layoutTestController)
+                    layoutTestController.dumpAsText();
+
+                var qt = document.getElementById('qt');
+                var sel = window.getSelection();
+                sel.setPosition(qt, 0);
+                sel.modify("extend", "forward", "line");
+                document.execCommand("InsertNewlineInQuotedContent");
+                
+                document.write("<xmp>" + document.body.innerHTML + "</xmp>");
+            }
+        </script>
+    </head>
+    <body contenteditable onload="test()">
+        <div>This test should not crash</div>
+        <blockquote type="cite" id="qt">triple click me! then hit enter
+            <blockquote type="cite"><div style="min-height: 14px;"></div></blockquote>
+        </blockquote>
+    </body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/body-clone-link-decl-parent-crash.html b/tests/tests/webkitsecurity/assets/body-clone-link-decl-parent-crash.html
new file mode 100644
index 0000000..9f5fe3e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/body-clone-link-decl-parent-crash.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>

+<html>

+<head>

+<script src="../js/resources/js-test-pre.js"></script>

+</head>

+<body>

+Test passes if it does not crash.

+<div id="console"></div>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+iframe1 = document.createElement('iframe');

+document.body.appendChild(iframe1);

+document1 = iframe1.contentDocument.implementation.createHTMLDocument("document");

+var body1 = document1.body;

+document1.alinkColor = "blue";

+var body2 = body1.cloneNode(true);

+document1.body = document1.createElement('body');

+delete document1;

+gc();

+body2.vLink = 1;

+

+</script>

+<script src="../js/resources/js-test-post.js"></script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/body-removal-crash.html b/tests/tests/webkitsecurity/assets/body-removal-crash.html
new file mode 100644
index 0000000..0e104f6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/body-removal-crash.html
@@ -0,0 +1,52 @@
+<html>
+<head id="b">
+  <style id="a" type="text/css" media="screen">
+    #box {
+      -webkit-animation-duration: 2s;
+      -webkit-animation-timing-function: linear;
+      -webkit-animation-name: anim;
+      background-color: blue;
+      width: 100px;
+      height: 100px;
+    }
+    @-webkit-keyframes anim {
+        from { -webkit-transform: rotate(0) scale(1,1); }
+        to   { -webkit-transform: rotate(360deg) scale(2,4); }
+    }
+  </style>
+</head>
+<body>
+<div id="box">
+</div>
+<p>This should not crash</p>
+</body>
+</html>
+
+<script>
+
+var element;
+
+function crash() {
+    // trigger style processing
+    document.alinkColor = "aaa";
+    // now remove the body and insert it in a different location
+    element = document.body;
+    element.parentNode.removeChild(element);
+    document.getElementById("a").parentNode.insertBefore(element, document.getElementById("a").nextSibling);
+    setTimeout(cleanup, 0);
+}
+
+function cleanup() {
+  document.getElementById("b").parentNode.insertBefore(element, document.getElementById("b").nextSibling);
+  
+  if (window.layoutTestController)
+      layoutTestController.notifyDone();
+}
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+crash();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/border-image-crash.html b/tests/tests/webkitsecurity/assets/border-image-crash.html
new file mode 100644
index 0000000..0bbe36e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/border-image-crash.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+    <title></title>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<body>
+    <p>
+        Test for crash discovered with -webkit-border-image.  If this text appears, the test passed.
+    </p>
+    <p>
+        <div style="-webkit-border-image: url(resources/greenbox.png) 0 7 0 13 / 0 7 0 13 stretch stretch; width:100; height:100;"></div></p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/border-image-null-image-crash.html b/tests/tests/webkitsecurity/assets/border-image-null-image-crash.html
new file mode 100644
index 0000000..ce3ed58
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/border-image-null-image-crash.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<script>
+
+description("Tests that shorthand border-image with a null image doesn't crash.");
+
+var testContainer = document.createElement("div");
+document.body.appendChild(testContainer);
+
+testContainer.innerHTML = '<div id="test">hello</div>';
+
+e = document.getElementById('test');
+computedStyle = window.getComputedStyle(e, null);
+e.style.borderImage = "10% fill";
+
+shouldBe("computedStyle.getPropertyValue('border-image')", "'none'");
+
+document.body.removeChild(testContainer);
+</script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/call-apply-crash.html b/tests/tests/webkitsecurity/assets/call-apply-crash.html
new file mode 100644
index 0000000..4cf7eba
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/call-apply-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/call-apply-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/call-apply-crash.js b/tests/tests/webkitsecurity/assets/call-apply-crash.js
new file mode 100644
index 0000000..e0c8e63
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/call-apply-crash.js
@@ -0,0 +1,10 @@
+description("Test to ensure that the registerfile is grown correctly when calling apply");
+
+function testLog() { testPassed(this); }
+(function () {
+    Function.prototype.call.apply(testLog, arguments);
+})('Did not crash using apply', 0, 0); // needs 3+ arguments
+(function () {
+    arguments; // reify the arguments object.
+    Function.prototype.call.apply(testLog, arguments);
+})('Did not crash using apply', 0, 0); // needs 3+ arguments
diff --git a/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.html b/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.html
new file mode 100644
index 0000000..d39c7cc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/canvas-font-ex-units-crash.js"></script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.js b/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.js
new file mode 100644
index 0000000..1a3bf8b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/canvas-font-ex-units-crash.js
@@ -0,0 +1,6 @@
+description("Test that setting a font with size in 'ex' units doesn't crash.");
+
+ctx = document.createElement('canvas').getContext('2d');
+
+ctx.font = "5ex sans-serif";
+shouldBe("ctx.font = '5ex sans-serif'; ctx.font", "'5ex sans-serif'");
diff --git a/tests/tests/webkitsecurity/assets/canvas-getImageData-large-crash.html b/tests/tests/webkitsecurity/assets/canvas-getImageData-large-crash.html
new file mode 100644
index 0000000..6ac1da8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/canvas-getImageData-large-crash.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText(false);
+
+var canvas = document.createElement("canvas");
+canvas.getContext("2d").getImageData(10, 0xffffffff, 2147483647,10);
+</script>
+</head>
+<body>
+PASSED (If this page did not crash.)
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/canvas-toDataURL-crash.html b/tests/tests/webkitsecurity/assets/canvas-toDataURL-crash.html
new file mode 100644
index 0000000..f058dec
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/canvas-toDataURL-crash.html
@@ -0,0 +1,11 @@
+<p id="console"></p>
+<p>Calling toDataURL() on a huge canvas shouldn't crash.  If the text above is "PASS", the test passed.</p>
+<canvas id="foo" width="65536" height="65536"></canvas>
+<script>
+var canvas = document.getElementById('foo');
+var url = canvas.toDataURL();
+var p = document.getElementById('console');
+p.innerHTML = "PASS";
+if (window.layoutTestController)
+  layoutTestController.dumpAsText();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/canvas-toDataURL-jpeg-crash.html b/tests/tests/webkitsecurity/assets/canvas-toDataURL-jpeg-crash.html
new file mode 100644
index 0000000..b278d8c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/canvas-toDataURL-jpeg-crash.html
@@ -0,0 +1,11 @@
+Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=69681">bug 69681</a>,
+canvas.toDataURL("image/jpeg") should not crash.<br>
+<p id="log"></p>
+<canvas id="canvas" width="2000" height="2000"></canvas>
+<script>
+var test = document.getElementById('canvas').toDataURL('image/jpeg');
+// Test passes if we don't crash.
+document.getElementById('log').innerHTML = 'PASS';
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash-css.html b/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash-css.html
new file mode 100644
index 0000000..af06554
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash-css.html
@@ -0,0 +1,52 @@
+<html>
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.createElement("td"), xxx);
+}
+
+</script>
+<style>
+.table {
+    display: table;
+}
+
+.tbody {
+    display: table-row-group;
+}
+
+.tr {
+    display: table-row;
+}
+
+.td {
+    display: table-cell;
+}
+
+</style>
+
+</head>
+
+<body onload="boom()">
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<div class="table" border="1">
+ <div class="tr" id="tr1"> xxx
+  <div class="td">Whee</div>
+ </div>
+</div>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash.xhtml b/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash.xhtml
new file mode 100644
index 0000000..c722179
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/cell-in-row-before-misnested-text-crash.xhtml
@@ -0,0 +1,35 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.createElementNS("http://www.w3.org/1999/xhtml", "td"), xxx);
+}
+
+
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<table border="1">
+ <tr id="tr1"> xxx
+  <td>Whee</td>
+ </tr>
+</table>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/change-form-element-document-crash.html b/tests/tests/webkitsecurity/assets/change-form-element-document-crash.html
new file mode 100644
index 0000000..4925401
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/change-form-element-document-crash.html
@@ -0,0 +1,41 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function gc() {
+    if (window.GCController)
+        return GCController.collect();
+
+    for (var i = 0; i < 10000; i++)
+        var s = new String("abc");
+}
+
+function crash_test(element_name) {
+    var element = document.createElement(element_name);
+    element.setAttribute('form', '1');
+    var container = document.createElement('div');
+    container.appendChild(element);
+    document.implementation.createDocument().adoptNode(container);
+    container.removeChild(element);
+    delete element;
+    gc();
+    var form = document.createElement('form');
+    form.setAttribute('id', '2');
+    document.body.appendChild(form)
+}
+
+function test() {
+    crash_test('input');
+    crash_test('object');
+    document.body.innerHTML += "PASS";
+}
+</script>
+</head>
+<body onload="test()">
+<p>
+This page is a test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=51418">Bug 51418</a>. WebKit should not crash when this page is loaded.
+</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/change-version-no-crash-on-preflight-failure.html b/tests/tests/webkitsecurity/assets/change-version-no-crash-on-preflight-failure.html
new file mode 100644
index 0000000..2a512fb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/change-version-no-crash-on-preflight-failure.html
@@ -0,0 +1,36 @@
+<html>
+<head>
+<script>
+function finishTest()
+{
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function log(message)
+{
+    document.getElementById("console").innerText += message + "\n";
+}
+
+function runTest() {
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    var db = window.openDatabase("ChangeVersionFailureTest", "1", "Test the preflight step", 1024);
+    db.changeVersion("2", "3", null, function(error) {
+        log("PASS: db.changeVersion() failed as expected, and no assertions were triggered.");
+        finishTest();
+    }, function() {
+        log("FAIL: db.changeVersion() was expected to fail.");
+        finishTest();
+    });
+}
+</script>
+</head>
+<body onload="runTest();">
+This test verifies that no assertion is triggered when changeVersion()'s preflight step fails.
+<pre id="console"></pre>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/change-widget-and-click-crash.html b/tests/tests/webkitsecurity/assets/change-widget-and-click-crash.html
new file mode 100644
index 0000000..52ad4af
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/change-widget-and-click-crash.html
@@ -0,0 +1,35 @@
+<html>

+<script>

+function clickElement(element) {

+    if (window.eventSender) {

+        var centerX = element.offsetLeft + element.offsetWidth / 2;

+        var centerY = element.offsetTop + element.offsetHeight / 2;

+        eventSender.mouseMoveTo(centerX, centerY);

+        eventSender.mouseDown();

+    }

+}

+

+function crash() {

+    var x = document.getElementById('x');

+    x.setAttribute('data', x.data);

+    clickElement(x);

+    document.body.innerHTML = "PASS";

+

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+

+function load() {

+    if (window.layoutTestController) {

+        layoutTestController.dumpAsText();

+        layoutTestController.waitUntilDone();

+    }

+    setTimeout(crash, 0);

+}

+</script>

+<body onload="load()">

+    <object id="x" data="x" border="1" type="application/x-webkit-test-netscape">

+        <param name="wmode" value="transparent">

+    </object>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/changing-attrbutes-crash.html b/tests/tests/webkitsecurity/assets/changing-attrbutes-crash.html
new file mode 100644
index 0000000..cd4d578
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/changing-attrbutes-crash.html
@@ -0,0 +1,6 @@
+<svg><polygon class="bar" points="foo"></svg>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<p>This test passes if it doesn't crash.</p>
diff --git a/tests/tests/webkitsecurity/assets/character-data-mutation-crash-expected.png b/tests/tests/webkitsecurity/assets/character-data-mutation-crash-expected.png
new file mode 100644
index 0000000..06122f9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/character-data-mutation-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/character-data-mutation-crash.html b/tests/tests/webkitsecurity/assets/character-data-mutation-crash.html
new file mode 100644
index 0000000..07c4e47
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/character-data-mutation-crash.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>

+<html>

+<body>

+<p>This tests modifying the value of text node that's pointed by the selection and executing an editing command. WebKit should not crash and you should see PASS:</p>

+<div id="test" contenteditable>hello world</div>

+<script>

+

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+var test = document.getElementById('test');

+test.focus();

+window.getSelection().setBaseAndExtent(test.firstChild, 1, test.firstChild, 10);

+test.firstChild.data = 'hey';

+document.execCommand('insertLineBreak', false, null);

+

+test.innerHTML = 'PASS';

+

+</script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/checkbox-selection-crash.html b/tests/tests/webkitsecurity/assets/checkbox-selection-crash.html
new file mode 100644
index 0000000..1da71aa
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/checkbox-selection-crash.html
@@ -0,0 +1,28 @@
+<head>
+<style>
+.gone { display:none }
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<body>
+Loading this page should not crash.
+<table>
+<td id=td1>
+.<input id=cb type="checkbox">.
+</table>
+<script>
+    var sel = window.getSelection();
+    var td1 = document.getElementById('td1')
+    // having selection triggers Document::updateRendering() from paint()
+    sel.setBaseAndExtent(td1, 0, td1, 1000);
+    // this causes style recalc and rendering tree tear down (from updateRendering) in middle of painting, which crashes
+    document.body.setAttribute('class','gone');
+    var cb = document.getElementById('cb')
+    // this triggers synchronous paint() 
+    cb.click();  
+    document.body.setAttribute('class','');  
+</script>
+</body>
+
diff --git a/tests/tests/webkitsecurity/assets/child-not-removed-from-parent-lineboxes-crash.html b/tests/tests/webkitsecurity/assets/child-not-removed-from-parent-lineboxes-crash.html
new file mode 100644
index 0000000..ef81794
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/child-not-removed-from-parent-lineboxes-crash.html
@@ -0,0 +1,28 @@
+<html>
+<body>
+</body>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var tags = ['a', 'abbr', 'acronym', 'address', 'applet', 'area', 'article', 'aside', 'audio', 'b', 'base', 'basefont', 'bdo', 'bgsound', 'big', 'blockquote', 'body', 'br', 'button', 'canvas', 'caption', 'center', 'cite', 'code', 'col', 'colgroup', 'command', 'datagrid', 'datalist', 'dcell', 'dcol', 'drow', 'dd', 'del', 'details', 'dfn', 'dir', 'div', 'dl', 'dt', 'em', 'embed', 'fieldset', 'figcaption', 'figure', 'font', 'footer', 'form', 'frame', 'frameset', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'head', 'header', 'hgroup', 'hr', 'html', 'i', 'child', 'image', 'img', 'input', 'ins', 'isindex', 'kbd', 'keygen', 'label', 'layer', 'legend', 'li', 'link', 'listing', 'map', 'mark', 'marquee', 'menu', 'meta', 'meter', 'nav', 'nobr', 'noembed', 'noframes', 'nolayer', 'object', 'ol', 'optgroup', 'option', 'output', 'p', 'param', 'plaintext', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'script', 'section', 'select', 'small', 'source', 'span', 'strike', 'strong', 'style', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'textarea', 'tfoot', 'th', 'thead', 'title', 'tr', 'track', 'tt', 'u', 'ul', 'var', 'video', 'wbr', 'xmp', 'noscript', 'noscript', 'math', 'mfrac', 'mfenced', 'msubsup', 'mrow', 'mover', 'munder', 'munderover', 'msqrt', 'mroot', 'mi', 'mn', 'mo', 'mtext', 'msub', 'msup', 'ms', 'mglyph', 'malignmark', 'annotation-xml', 'a', 'access', 'anchor', 'br', 'card', 'do', 'fieldset', 'go', 'head', 'img', 'input', 'insertedLegend', 'meta', 'noop', 'onevent', 'optgroup', 'option', 'p', 'postfield', 'prev', 'refresh', 'select', 'setvar', 'table', 'td', 'template', 'timer', 'tr', 'a', 'altGlyph', 'altGlyphDef', 'altGlyphItem', 'animate', 'animateColor', 'animateMotion', 'animateTransform', 'set', 'circle', 'clipPath', 'color_profile', 'cursor', 'defs', 'desc', 'ellipse', 'feBlend', 'feColorMatrix', 'feComponentTransfer', 'feComposite', 'feConvolveMatrix', 'feDiffuseLighting', 'feDisplacementMap', 'feDistantLight', 'feFlood', 'feFuncA', 'feFuncB', 'feFuncG', 'feFuncR', 'feGaussianBlur', 'feImage', 'feMerge', 'feMergeNode', 'feMorphology', 'feOffset', 'fePointLight', 'feSpecularLighting', 'feSpotLight', 'feTile', 'feTurbulence', 'filter', 'font', 'font_face', 'font_face_format', 'font_face_name', 'font_face_src', 'font_face_uri', 'foreignObject', 'g', 'glyph', 'glyphRef', 'hkern', 'image', 'line', 'linearGradient', 'marker', 'mask', 'metadata', 'missing_glyph', 'mpath', 'path', 'pattern', 'polygon', 'polyline', 'radialGradient', 'rect', 'script', 'stop', 'style', 'svg', 'switch', 'symbol', 'text', 'textPath', 'title', 'tref', 'tspan', 'use', 'view', 'vkern']
+
+for (i = 0; i < tags.length; i++)
+{
+    child = document.createElement(tags[i]);
+    child.style.position = 'absolute';
+    document.body.appendChild(document.createTextNode('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaad'));
+    document.body.appendChild(child);
+    document.body.appendChild(document.createTextNode('aaaa'));
+    document.body.offsetTop;
+    child.setAttribute('style', '');
+    document.body.offsetTop;
+    document.body.removeChild(child);
+    document.body.offsetTop;
+    document.body.innerHTML = "";
+}
+
+document.body.innerHTML = "PASS: does not crash";
+</script>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/chromium-linux-fallback-crash.html b/tests/tests/webkitsecurity/assets/chromium-linux-fallback-crash.html
new file mode 100644
index 0000000..487bf0a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/chromium-linux-fallback-crash.html
@@ -0,0 +1,12 @@
+<html>
+  <script>
+    if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+  </script>
+
+  <body>
+    <p>Previously this would crash Chromium Linux by triggering a NULL pointer dereference in the font fallback code.</p>
+
+    <span style="font-family: -webkit-family-will-not-be-found;">Foo</span>
+  </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/clear-floats-crash.svg b/tests/tests/webkitsecurity/assets/clear-floats-crash.svg
new file mode 100644
index 0000000..eef7ac7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/clear-floats-crash.svg
@@ -0,0 +1,25 @@
+<html xmlns="http://www.w3.org/1999/xhtml">

+  <body>

+    This test is to ensure that we do not crash when clearing floats during SVG load.

+    <div id="log"><span style='color: red;'>FAIL:</span> Did not complete test</div>

+    <svg xmlns="http://www.w3.org/2000/svg">

+      <g>

+        <text style="float:right"></text>

+        <text></text>

+      </g>

+    </svg>

+    <script>

+        if (window.layoutTestController)

+            layoutTestController.dumpAsText();

+        var log = document.getElementById("log");

+        while (log.childNodes.length)

+            log.removeChild(log.firstChild);

+        var msg = document.createElementNS("http://www.w3.org/1999/xhtml", "span");

+        msg.style.color = "green";

+        msg.appendChild(document.createTextNode("PASS:"));

+        log.appendChild(msg);

+        log.appendChild(document.createTextNode(" Did not crash while rendering the SVG."));

+    </script>

+  </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.html b/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.html
new file mode 100644
index 0000000..f7f45cc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/clear-watch-invalid-id-crash.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.js b/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.js
new file mode 100644
index 0000000..040f003
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/clear-watch-invalid-id-crash.js
@@ -0,0 +1,15 @@
+description("Tests for a crash when clearWatch() is called with a zero ID.<br><br>We call clearWatch() with a request in progress then navigate the page. This accesses the watchers map during cleanup and triggers the crash. This page should not be visible when the test completes.");
+
+if (window.layoutTestController) {
+    layoutTestController.setGeolocationPermission(true);
+    layoutTestController.setMockGeolocationPosition(51.478, -0.166, 100);
+} else
+    debug('This test can not be run without the LayoutTestController');
+
+document.body.onload = function() {
+    navigator.geolocation.watchPosition(function() {});
+    navigator.geolocation.clearWatch(0);
+    location = "data:text/html,TEST COMPLETE<script>if(window.layoutTestController) layoutTestController.notifyDone();</script>";
+}
+
+window.jsTestIsAsync = true;
diff --git a/tests/tests/webkitsecurity/assets/click-internal-anchor-with-use-crash.xhtml b/tests/tests/webkitsecurity/assets/click-internal-anchor-with-use-crash.xhtml
new file mode 100644
index 0000000..8c5b4dc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/click-internal-anchor-with-use-crash.xhtml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<html>
+    <svg xmlns="http://www.w3.org/2000/svg" onload="onLoad()" xmlns:xlink="http://www.w3.org/1999/xlink">
+        <script type="text/javascript">
+        function onLoad()
+        {
+            clickLink(document.getElementById("link"));
+            
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+        }
+
+        function clickLink(link)
+        {
+            var event = document.createEvent("MouseEvents");
+            event.initMouseEvent("click", true, true, window,
+                0, 0, 0, 0, 0,
+                false, false, false, false,
+                0, null);
+            link.dispatchEvent(event);
+        }
+        </script>
+        <a id="link" xlink:href="#">
+            <text x="50" y="50">PASS if no crash</text>
+        </a>
+    </svg>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/click-size-zero-no-crash.html b/tests/tests/webkitsecurity/assets/click-size-zero-no-crash.html
new file mode 100644
index 0000000..df44e72
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/click-size-zero-no-crash.html
@@ -0,0 +1,33 @@
+<html>
+<script src="../js/resources/js-test-pre.js"></script>
+<script>
+function getCenterFor(element)
+{
+  var rect = element.getBoundingClientRect();
+  return { x : parseInt((rect.left + rect.right) / 2) , y : parseInt((rect.top + rect.bottom) / 2)};
+}
+
+function runTest()
+{
+  if (!window.layoutTestController)
+    return;
+  if (!window.eventSender)
+    return;
+
+  layoutTestController.dumpAsText();
+  center = getCenterFor(document.getElementById("emptyselect"));
+  eventSender.mouseMoveTo(center.x, center.y);
+  eventSender.mouseDown();
+  eventSender.mouseUp();
+  eventSender.keyDown("downArrow");
+}
+
+</script>
+<style>
+</style>
+<body onload="runTest();">
+<select multiple id="emptyselect"></select>
+This should not crash
+</body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash-expected.png b/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash-expected.png
new file mode 100644
index 0000000..9f813ab
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash.html b/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash.html
new file mode 100644
index 0000000..3ef1ef4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/clone-anonymous-block-non-inline-child-crash.html
@@ -0,0 +1,21 @@
+<html>

+<style>

+div { 

+    border: 5px solid maroon; 

+    -webkit-column-count: 2;

+    margin: 1em 0;

+}

+h2 { 

+    -webkit-column-span: all;

+    background-color: #eeeeee;

+    color: black;

+}

+</style>

+<div>

+<label>Some inline text

+<summary>Some block text

+<h2>PASS</h2>

+Lorem ipsum dolor sit amet, consectetuer adipiscing elit. Nulla varius enim ac mi. Curabitur sollicitudin felis quis lectus. Quisque adipiscing rhoncus sem. Proin nulla purus, vulputate vel, varius ut, euismod et, nisi. Sed vitae felis vel orci sagittis aliquam. Cras convallis adipiscing sem. Nam nonummy enim. Nullam bibendum lobortis neque. Vestibulum velit orci, tempus euismod, pretium quis, interdum vitae, nulla. Phasellus eget ante et tortor condimentum vestibulum.

+Suspendisse hendrerit quam nec felis. Sed varius turpis vitae pede. Lorem ipsum dolor sit amet, consectetuer adipiscing elit.

+</div>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/clone-before-after-content-crash.html b/tests/tests/webkitsecurity/assets/clone-before-after-content-crash.html
new file mode 100755
index 0000000..c0116d4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/clone-before-after-content-crash.html
@@ -0,0 +1,34 @@
+<html>
+  <head>
+    <style>
+      #test1 { -webkit-column-count: 1; }
+      #test2 { display: block; }
+      #test3::after { display: block; content: "A"; }
+      #test4 { -webkit-column-span: all; }
+    </style>
+    <script>
+	  if (window.layoutTestController)
+	      layoutTestController.dumpAsText();
+      function runTest(){
+        test1 = document.createElement('div');
+        test1.setAttribute('id', 'test1');
+        document.body.appendChild(test1);
+        test2 = document.createElement('div');
+        test2.setAttribute('id', 'test2');
+        test1.appendChild(test2);
+        test3 = document.createElement('div');
+        test3.setAttribute('id', 'test3');
+        test2.appendChild(test3);
+        test4 = document.createElement('span');
+        test4.setAttribute('id', 'test4');
+        test3.appendChild(test4);
+        document.body.offsetTop;
+        test4.style.display='block';
+      }
+      window.onload = runTest
+    </script>
+  </head>
+  <body>
+  Test passes if it does not crash.
+  </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/clone-block-children-inline-mismatch-crash.html b/tests/tests/webkitsecurity/assets/clone-block-children-inline-mismatch-crash.html
new file mode 100644
index 0000000..534b7ae
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/clone-block-children-inline-mismatch-crash.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<style>
+#div1 { -webkit-column-count: 2; }
+#q1 { display: block; }
+#q1::before { display: table-row; }
+#div2 { -webkit-column-span: all; }
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest() 
+{
+    div1 = document.createElement('div');
+    div1.setAttribute('id', 'div1'); 
+    document.body.appendChild(div1); 
+    q1 = document.createElement('q'); 
+    q1.setAttribute('id', 'q1');
+    div1.appendChild(q1);
+    div2 = document.createElement('div');
+    div2.setAttribute('id', 'div2'); 
+    q1.appendChild(div2); 
+}
+
+window.onload = runTest;
+</script>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/cloneNode-after-deleteRule-crash.html b/tests/tests/webkitsecurity/assets/cloneNode-after-deleteRule-crash.html
new file mode 100644
index 0000000..689310e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/cloneNode-after-deleteRule-crash.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<script>
+
+function runtest() {
+    q = document.getElementsByTagName('object')[0].contentDocument;
+    q.styleSheets[0].deleteRule(1);
+    q.getElementsByTagName('head')[0].cloneNode(true);
+}
+
+description("This test checks that mutating a stylesheet and then using cloneNode() in a subdocument doesn't cause a crash.");
+
+</script>
+<object data="resources/cloneNode-after-deleteRule-subdocument.html" onload="runtest()"/>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.html b/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.html
new file mode 100644
index 0000000..2805949
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.html
@@ -0,0 +1,36 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head></head>
+<body>
+<p>Nested creation of two WebSockets should not cause a crash.</p>
+<p></p>
+<p>On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".</p>
+<pre id=log>
+</pre>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+    layoutTestController.overridePreference("WebKitHixie76WebSocketProtocolEnabled", 0);
+}
+
+function log(message)
+{
+    document.getElementById("log").innerHTML += message + "\n";
+}
+
+function endTest()
+{
+    log("TEST COMPLETE");
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+var worker = new Worker('resources/close-in-onmessage-crash.js');
+worker.onmessage = function (evt) {
+    log(evt.data);
+    if (evt.data == "DONE")
+        endTest();
+};
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.js b/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.js
new file mode 100644
index 0000000..9abcc9e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/close-in-onmessage-crash.js
@@ -0,0 +1,30 @@
+function runTests()
+{
+    try {
+        var url = 'ws://localhost:8880/websocket/tests/hybi/workers/resources/simple';
+        var ws = new WebSocket(url);
+
+        ws.onopen = function()
+        {
+            postMessage('PASS: worker: Connected.');
+        };
+
+        ws.onmessage = function(messageEvent)
+        {
+            postMessage('PASS: worker: Received message: "' + messageEvent.data + '"');
+            ws.close();
+        };
+
+        ws.onclose = function()
+        {
+            postMessage('PASS: worker: Closed.');
+            postMessage('DONE');
+        };
+    } catch (e) {
+        postMessage('FAIL: worker: Unexpected exception: ' + e);
+    } finally {
+        postMessage('PASS: worker: Parsed successfully.');
+    }
+}
+
+runTests();
diff --git a/tests/tests/webkitsecurity/assets/column-span-parent-continuation-crash.html b/tests/tests/webkitsecurity/assets/column-span-parent-continuation-crash.html
new file mode 100644
index 0000000..2a110f3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/column-span-parent-continuation-crash.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>

+<html>

+<body>

+<div id="console"></div>

+<style>

+div { -webkit-column-count: 1; }

+h2 { -webkit-column-span: all; }

+</style>

+<script src="../js/resources/js-test-pre.js"></script>

+<script>

+if (window.layoutTestController) {

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+function runTest()

+{

+    document.body.offsetTop;

+    child = document.getElementById('test');

+    child.parentNode.removeChild(child);

+    child = document.getElementById('anything');

+    gc();

+    document.body.innerHTML = "PASS";

+

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+

+setTimeout("runTest()", 0);

+</script>

+<script src="../js/resources/js-test-post.js"></script>

+<div>

+<span id="test"><h2></span>

+</div>

+</body>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/combining-character-sequence-fallback-crash.html b/tests/tests/webkitsecurity/assets/combining-character-sequence-fallback-crash.html
new file mode 100644
index 0000000..1b4145b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/combining-character-sequence-fallback-crash.html
@@ -0,0 +1,14 @@
+<p>
+    Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=68737">https://bugs.webkit.org/show_bug.cgi?id=68737</a>
+    REGRESSION (r95391): Crash in -[WebCascadeList objectAtIndex:] when a font-family list contains missing fonts</i>.
+</p>
+<p>
+    The test passes if it does not cause a crash.
+</p>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<div style="font-family: verdana, a-font-you-do-not-have;">
+    i&#x0302; and i&#x033f;
+</div>
diff --git a/tests/tests/webkitsecurity/assets/console-long-eval-crash.html b/tests/tests/webkitsecurity/assets/console-long-eval-crash.html
new file mode 100644
index 0000000..75444bb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/console-long-eval-crash.html
@@ -0,0 +1,31 @@
+<html>
+<head>
+<script src="../../http/tests/inspector/inspector-test.js"></script>
+<script src="../../http/tests/inspector/console-test.js"></script>
+<script>
+
+layoutTestController.setCanOpenWindows();
+
+function doDialog()
+{
+    layoutTestController.closeWebInspector();
+    showModalDialog('data:text/html,<script>setTimeout(close, 0);%3c/script>');
+    setTimeout(function(){layoutTestController.notifyDone();}, 0);
+}
+
+function test()
+{
+    RuntimeAgent.evaluate("doDialog()");
+}
+
+</script>
+</head>
+
+<body onload="runTest()">
+<p>
+Test that any long api call from the frontend will not crash the inspected page's renderer if the page is reloaded or frontend is closed in the middle.
+</p>
+<a href="https://bugs.webkit.org/show_bug.cgi?id=60616">https://bugs.webkit.org/show_bug.cgi?id=60616</a>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/constructor-as-function-crash.html b/tests/tests/webkitsecurity/assets/constructor-as-function-crash.html
new file mode 100644
index 0000000..29e20d3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/constructor-as-function-crash.html
@@ -0,0 +1,32 @@
+<html>
+<head>
+    <title>Calling bindings constructors as function should not cause a crash</title>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        function runTest()
+        {
+            // List of constructors to test.
+            var constructors = ["EventSource", "MessageChannel", "SharedWorker", "WebGLArrayBuffer", "WebKitCSSMatrix", "WebKitPoint", "WebSocket", "Worker", "XMLHttpRequest", "XSLTProcessor"];
+            var result = document.getElementById("result");
+            for (var i in constructors) {
+                try {
+                    var func = constructors[i] + "()";
+                    eval(func);
+                    result.innerHTML += "FAIL";
+                }
+                catch (e) {
+                    result.innerHTML += "PASS";
+                }
+                result.innerHTML += ": " + constructors[i] + "<br/>";
+            }
+        }
+
+    </script>
+</head>
+<body onload="runTest()">
+    <p>Calling <code>bindings</code> constructors as function should throw an exception and not cause a crash.</p>
+    <div id="result"></div>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/container-transform-crash.html b/tests/tests/webkitsecurity/assets/container-transform-crash.html
new file mode 100644
index 0000000..e6b1ff3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/container-transform-crash.html
@@ -0,0 +1,29 @@
+<html>
+  <head>
+    <script>
+      if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    </script>
+    <style>
+      .container {
+        position: relative;
+        height: 350px;
+        width: 400px;
+        border: 1px solid black;
+        margin: 10px;
+      }
+      
+      .container > a {
+        -webkit-transform: rotate(20deg);
+      }
+    </style>
+  </head>
+<body>
+    Inline with -webkit-transform that contains positioned element. This should not crash.
+    <div class="container">
+        <a href="#">
+            <div style="height: 150px; top: 100px; width: 160px; background-color: grey; position: absolute; left: 134px;"><p>some text here</p></div>
+        </a>
+    </div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/content-height-zero-crash.html b/tests/tests/webkitsecurity/assets/content-height-zero-crash.html
new file mode 100644
index 0000000..071e003
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/content-height-zero-crash.html
@@ -0,0 +1,10 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<p>
+    This tests for a crash when specifying multiple columns for a block with 0 content height.
+</p>
+<div style="height: 0; -webkit-column-count: 2;">
+    <div style="height: 50px; width: 100px;"></div>
+</div>
diff --git a/tests/tests/webkitsecurity/assets/context-destroyed-crash.html b/tests/tests/webkitsecurity/assets/context-destroyed-crash.html
new file mode 100644
index 0000000..7a616e7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/context-destroyed-crash.html
@@ -0,0 +1,44 @@
+<html>
+<head>
+<script src="resources/webgl-test.js"></script>
+</head>
+<body>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function gc()
+{
+    if (window.GCController)
+        return GCController.collect();
+
+    for (var i = 0; i < 10000; ++i)
+        var s = new String("AAAA");
+}
+
+window.onload = function()
+{
+    canvas = document.createElement("canvas");
+    context = create3DContext(canvas);
+    extension = context.getExtension("WEBKIT_WEBGL_lose_context");
+    
+    canvas = null;
+    context = null;
+    gc();
+    
+    setTimeout(finishTest, 1);
+}
+
+function finishTest()
+{
+    extension.loseContext();
+    
+    document.body.innerHTML = "PASS";
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/continuationCrash-expected.png b/tests/tests/webkitsecurity/assets/continuationCrash-expected.png
new file mode 100644
index 0000000..6c37873
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/continuationCrash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/continuationCrash.html b/tests/tests/webkitsecurity/assets/continuationCrash.html
new file mode 100644
index 0000000..3c2cd12
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/continuationCrash.html
@@ -0,0 +1,57 @@
+<html>
+<head>
+
+<script language="JavaScript">
+function setBlock() {
+	var el = document.getElementById("block");
+	el.style.display="block";
+}
+function setOutline() {
+	var el = document.getElementById("outline");
+	el.style.outline="2px solid red";
+}
+function setSpan() {
+	var newChild = document.createElement("span");
+	newChild.setAttribute("id", "outline");
+	var aSpan = document.createElement("span");
+	aSpan.setAttribute("id", "block");
+	newChild.appendChild(aSpan);
+	var oldChild = document.body.firstChild;
+	document.body.replaceChild(newChild, oldChild);
+}
+</script>
+
+</head>
+
+<body><span id="outline">
+	<span id="block">A span-element</span>
+</span>
+
+<h4>Instructions</h4>
+<p>Click the following buttons.</p>
+<ol>
+<li>Start with the outmost left one.</id>
+<li>Click the middle one.</li>
+<li>(The ouline will not be updated correctly.)
+<li>Click the right button.</li>
+<li>This will crash Safari 1.3 (v176 and v170, no other configurations tested).</li>
+<li>The combination 2. 1. 3. will also crash Safari.</li>
+<li>1. 3. will not crash Safari. (But the outline should vanish. Shouldn't it?)</li>
+<li>2. 3. will not crash Safari either.</li>
+
+<script>
+    setOutline();
+</script>
+<script>
+    setBlock();
+</script>
+<script>
+    setSpan();
+</script>
+
+<input type="button" value="1. Set outline property" onclick="setOutline()" />
+<input type="button" value="2. Set display property" onclick="setBlock()" />
+<input type="button" value="3. Replace span-element" onclick="setSpan()" />
+</body>
+
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/convolution-crash-expected.png b/tests/tests/webkitsecurity/assets/convolution-crash-expected.png
new file mode 100644
index 0000000..05dc2eb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/convolution-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/convolution-crash.svg b/tests/tests/webkitsecurity/assets/convolution-crash.svg
new file mode 100644
index 0000000..c11ca6e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/convolution-crash.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<defs> <filter id="foo"> <feConvolveMatrix kernelMatrix="0 0 0 0 1 0 0 0 -1"/> </filter> </defs>
+<image width="2" height="3" xlink:href="bar" filter="url(#foo)" />
+<rect x="10" y="10" width="100" height="100" fill="green"/>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/copy-crash-with-extraneous-attribute.html b/tests/tests/webkitsecurity/assets/copy-crash-with-extraneous-attribute.html
new file mode 100644
index 0000000..99777bd
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/copy-crash-with-extraneous-attribute.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+    <script src=../editing.js language="JavaScript" type="text/JavaScript" ></script>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+
+<body background>
+This test passes if it does not crash.
+
+<script>
+    selectAllCommand();
+    copyCommand();
+</script>
+
+</html>
diff --git a/tests/tests/webkitsecurity/assets/copy-crash.html b/tests/tests/webkitsecurity/assets/copy-crash.html
new file mode 100644
index 0000000..4dce284
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/copy-crash.html
@@ -0,0 +1,358 @@
+<html>
+  <head>
+    <script src="../editing.js" language="JavaScript" type="text/JavaScript" ></script>
+    <style type="text/css">
+      div.popup {
+        color: black !important;
+        background: yellow !important;
+        padding: 0.5em !important;
+        position: absolute !important;
+        z-index: 20000 !important;
+        display: none;
+      }
+    </style>
+    <script type="text/javascript">
+      function getAbsolutePosition(element) {
+        var r = { x: element.offsetLeft, y: element.offsetTop };
+        if (element.offsetParent) {
+          var tmp = getAbsolutePosition(element.offsetParent);
+          r.x += tmp.x;
+          r.y += tmp.y;
+        }
+        return r;
+      }
+
+      function runTest1() {
+        if (!window.layoutTestController)
+          return;
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+
+        e = document.getElementById("mouse_target");
+        r = getAbsolutePosition(e);
+        x = r.x + e.offsetLeft + e.offsetWidth / 2;
+        y = r.y + e.offsetTop + e.offsetHeight / 2;
+        eventSender.mouseMoveTo(x, y);
+        window.setTimeout("runTest2()", 400);
+      }
+
+      function runTest2() {
+        e = document.getElementById("select_target");
+        r = getAbsolutePosition(e);
+
+        setSelectionCommand(e, 0, e, 1);
+        eventSender.mouseMoveTo(0, 0);
+        window.setTimeout("runTest3()", 200);
+      }
+
+      function runTest3() {
+        copyCommand();
+        layoutTestController.notifyDone();
+      }
+
+      function MPP_bind(fn, self, var_args) {
+        var boundargs = fn.boundArgs_ || [];
+        boundargs = boundargs.concat(Array.prototype.slice.call(arguments, 2));
+
+        if (typeof fn.boundSelf_ != 'undefined') {
+          self = fn.boundSelf_;
+        }
+
+        if (typeof fn.foundFn_ != 'undefined') {
+          fn = fn.boundFn_;
+        }
+
+        var newfn = function() {
+          var args = boundargs.concat(Array.prototype.slice.call(arguments));
+          return fn.apply(self, args);
+        }
+
+        newfn.boundArgs_ = boundargs;
+        newfn.boundSelf_ = self;
+        newfn.boundFn_ = fn;
+
+        return newfn;
+      };
+
+      function PersonPopup() {
+        this.pointerPosX = 0;
+        this.pointerPosY = 0;
+
+        this.pointerOnTargetElement = false;
+
+        this.targetPosX = 0;
+        this.targetPosY = 0;
+        this.targetWidth = 0;
+        this.targetHeight = 0;
+        this.targetElement = 0;
+
+        this.delayed = false;
+        this.visible = false;
+        this.pointerOutsidePopup = false;
+
+        this.showTimerID = -1;
+        this.hideTimerID = -1;
+
+        window.addEventListener('load',
+                                MPP_bind(this.handleOnLoad_, this), null);
+
+      };
+
+      PersonPopup.prototype.getPointerX_ = function(e) {
+        var x, scrollLeft;
+
+        if (e.pageX) {
+          x = e.pageX;
+        } else if (e.clientX) {
+          x = e.clientX + document.body.scrollLeft;
+        } else {
+          x = 0;
+        }
+        return x;
+      };
+
+      PersonPopup.prototype.getPointerY_ = function(e) {
+        var y, scrollTop;
+
+        if (e.pageY) {
+          y = e.pageY;
+        } else if (e.clientY) {
+          y = e.clientY + document.body.scrollTop;
+        } else {
+          y = 0;
+        }
+        return y;
+      };
+
+      PersonPopup.prototype.pointerCloseEnough_ = function(x, y) {
+        var POINTER_TOLERANCE = 5;
+        if (this.pointerOutsidePopup) {
+          if ((x >= this.targetPosX) &&
+              (x <= this.targetPosX + this.targetWidth) &&
+              (y >= this.targetPosY) &&
+              (y <= this.targetPosY + this.targetHeight)) {
+            this.pointerOutsidePopup = false;
+            return true;
+          }
+        } else {
+          if ((x >= this.targetPosX - POINTER_TOLERANCE) &&
+              (x <= this.targetPosX + this.targetWidth +
+                    POINTER_TOLERANCE) &&
+              (y >= this.targetPosY - POINTER_TOLERANCE) &&
+              (y <= this.targetPosY + this.targetHeight +
+                    POINTER_TOLERANCE)) {
+            this.pointerOutsidePopup = false;
+            return true;
+          }
+        }
+
+        return false;
+      };
+
+      PersonPopup.prototype.handleMouseMove_ = function(e) {
+        if ((this.delayed) || (this.visible)) {
+          e = e || window.event;
+
+          var x = this.getPointerX_(e);
+          var y = this.getPointerY_(e);
+
+          if (this.pointerCloseEnough_(x, y)) {
+            if (this.hideTimerID) {
+              window.clearTimeout(this.hideTimerID);
+              this.hideTimerID = -1;
+            }
+          } else {
+            if (this.hideTimerID == -1) {
+              this.hideTimerID = window.setTimeout(MPP_bind(this.hide_, this),
+                                                   200);
+            }
+          }
+        }
+      };
+
+      PersonPopup.prototype.resizeElement_ = function(el, x, y, w, h) {
+        if (x != false) {
+          el.style.left = x + 'px';
+        }
+        if (y != false) {
+          el.style.top = y + 'px';
+        }
+        if (w != false) {
+          el.style.width = w + 'px';
+        }
+        if (h != false) {
+          el.style.height = h + 'px';
+        }
+      };
+
+      PersonPopup.prototype.show_ = function() {
+        this.showTimerID = -1;
+
+        if (this.hideTimerID != -1) {
+          this.delayed = false;
+          return;
+        }
+        if (!this.pointerOnTargetElement) {
+          this.delayed = false;
+          return;
+        }
+        this.resizeElement_(this.popupDetailedElement,
+                            this.targetPosX, this.targetPosY,
+                            this.targetWidth, false);
+        this.popupDetailedElement.style.display = 'block';
+        this.popupDetailedElement.innerHTML = "<a href='http://dnede.com' id='select_target'>Select</a>";
+        this.popupDetailedElement.style.visibility = 'visible';
+        this.visible = true;
+        this.delayed = false;
+      };
+
+      PersonPopup.prototype.hide_ = function() {
+        this.hideTimerID = -1;
+        this.popupDetailedElement.style.display = 'none';
+        this.visible = false;
+        this.delayed = false;
+      };
+
+      PersonPopup.prototype.handleAnchorMouseMove_ = function(e) {
+        e = e || window.event;
+
+        var targetElement = (e.target) ? e.target : e.srcElement;
+
+        this.pointerOnTargetElement = true;
+
+        if (targetElement == this.targetElement) {
+          this.x = this.getPointerX_(e);
+          this.y = this.getPointerY_(e);
+
+        } else {
+          this.handleAnchorMouseOver_(e);
+        }
+      };
+
+      PersonPopup.prototype.handleAnchorMouseOver_ = function(e) {
+        e = e || window.event;
+        var targetElement = (e.target) ? e.target : e.srcElement;
+
+        if (this.visible &&
+            (targetElement == this.targetElement) &&
+            (this.hideTimerID == -1)) {
+          return;
+        }
+
+        this.x = this.getPointerX_(e);
+        this.y = this.getPointerY_(e);
+
+        if (this.visible &&
+            (targetElement != this.targetElement) &&
+            (this.pointerCloseEnough_(this.x, this.y))) {
+          return;
+        }
+
+        if (this.delayed && (this.targetElement == targetElement)) {
+          return;
+        }
+
+        this.targetElement = targetElement;
+        var screenWidth = self.innerWidth;
+        var screenHeight = self.innerHeight;
+        var scrollTop = document.documentElement.scrollTop;
+        var scrollLeft = document.documentElement.scrollLeft;
+        this.targetWidth = 12.7 * 26;
+        this.targetHeight = 12.7 * 13;
+        this.targetPosX = Math.floor(this.x + 15);
+        this.targetPosY = Math.floor(this.y + 20);
+
+        if (this.showTimerID != -1) {
+          window.clearTimeout(this.showTimerID);
+        }
+
+        if (this.visible) {
+          this.popupDetailedElement.style.display = 'none';
+          this.showTimerID =
+            window.setTimeout(MPP_bind(this.show_, this), 200);
+        } else {
+          this.showTimerID =
+            window.setTimeout(MPP_bind(this.show_, this), 350);
+        }
+
+        this.delayed = true;
+        this.pointerOutsidePopup = true;
+      };
+
+      PersonPopup.prototype.handleMouseOut_ = function(e) {
+        if ((this.delayed) || (this.visible)) {
+
+          this.pointerOnTargetElement = false;
+
+          e = e || window.event;
+
+          if (e) {
+            var from = null;
+
+            if (e.relatedTarget) {
+              from = e.relatedTarget;
+            } else if (e.toElement) {
+              from = e.toElement;
+            }
+
+            var targetElement = (e.target) ? e.target : e.srcElement;
+
+            try {
+              if ((from == null) || (from.tagName == 'HTML') ||
+                  (from.tagName.substring(0, 3) == 'xul')) {
+                this.hideTimerID =
+                  window.setTimeout(MPP_bind(this.hide_, this),
+                                    200);
+              }
+            } catch(e) {
+
+            }
+          }
+        }
+      };
+
+      PersonPopup.prototype.handleOnLoad_ = function(e) {
+        e = e || window.event;
+        this.popupDetailedElement = document.createElement('div');
+        this.popupDetailedElement.
+            setAttribute('id','popup_detailed');
+        this.popupDetailedElement.className = 'popup';
+        this.popupDetailedElement.style.display = 'none';
+        this.popupDetailedElement.style.position = 'absolute';
+        this.popupDetailedElement.innerHTML = '&nbsp;';
+        document.body.appendChild(this.popupDetailedElement);
+
+        document.body.onmousemove = MPP_bind(this.handleMouseMove_, this);
+        document.body.onmouseout = MPP_bind(this.handleMouseOut_, this);
+        this.enablePopupsForChildElements(document);
+        
+        runTest1();
+      };
+
+      PersonPopup.prototype.enablePopupsForChildElements = function(el) {
+        var els = el.getElementsByTagName('*');
+
+        for (var i = 0, item; item = els[i]; i++) {
+          if (item.className.indexOf('showPersonPopup') != -1) {
+            item.onmouseover = MPP_bind(this.handleAnchorMouseOver_, this);
+            item.onmousemove = MPP_bind(this.handleAnchorMouseMove_, this);
+          }
+        }
+      };
+      
+      var personPopup = new PersonPopup();
+    </script>
+  </head>
+  <body>
+    <p class="byline">
+        <a class="showPersonPopup" id="mouse_target" href="dummy">Mouse Over</a>
+    </p>
+    <div id="log_div">
+      This test checks the fix for https://bugs.webkit.org/show_bug.cgi?id=18506. To test it manually:
+      <li/> Hover mouse over "Mouse Over" link
+      <li/> Quickly jump to the yellow box that pops up and select "Select" link
+      <li/> Move mouse away so that pop up disappears
+      <li/> Press the "Copy" keyboard accelerator - this should not cause any crash
+    </div>
+  </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/copy-standalone-image-crash.html b/tests/tests/webkitsecurity/assets/copy-standalone-image-crash.html
new file mode 100644
index 0000000..18522b5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/copy-standalone-image-crash.html
@@ -0,0 +1,68 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+
+var actionitems;
+
+if (window.layoutTestController) {
+     window.layoutTestController.dumpAsText();
+     window.layoutTestController.waitUntilDone();
+}
+
+function doClick() {
+    for (var i = 0; i < actionitems.length; i++)
+    {
+        var title = actionitems[i].title;
+
+        if (!title)
+           break;
+
+        title = title.replace(/_/g,'');
+
+        if (title.match("Copy Image")) {
+           actionitems[i].click();
+           break;
+        }
+    }
+
+    document.body.innerHTML = "PASS";
+
+    window.layoutTestController.notifyDone();
+}
+
+function hideDiv() {
+    document.getElementById("DIV").style.display="none";
+}
+
+function doTest() {
+    if (!window.layoutTestController) {
+        document.body.addEventListener('mousedown', function () {setTimeout(hideDiv, 100)}, false);
+        return;
+    }
+
+    var image = document.getElementById("IMG");
+
+    x = image.offsetLeft + 10;
+    y = image.offsetTop + 10;
+
+    eventSender.mouseMoveTo(x, y);
+    actionitems = eventSender.contextClick();
+
+    hideDiv();
+
+    setTimeout(doClick, 10);
+}
+
+</script>
+</head>
+<body onload="doTest()">
+This is an automated test case for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=31721">31721</a><br>
+If you wish to test manually, mouseover to image, activate context menu, wait for the image to disappear and then click copy image.<br>
+There should be no crash.
+<div ID="DIV">
+    <img id="IMG" src="resources/apple.gif"/>
+    </div>
+</body>
+
+</html>
diff --git a/tests/tests/webkitsecurity/assets/copy-without-common-block-crash.html b/tests/tests/webkitsecurity/assets/copy-without-common-block-crash.html
new file mode 100644
index 0000000..21c078f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/copy-without-common-block-crash.html
@@ -0,0 +1,18 @@
+<html>
+<body>
+<p>This tests crash when copying a text without a common ancestor block. To manually test, copy "hello" below and WebKit should not crash. On DRT, you should see PASS below.</p>
+<span id="test" contenteditable>hello</span>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    window.layoutTestController.dumpAsText();
+
+var test = document.getElementById('test');
+document.getSelection().selectAllChildren(test);
+document.execCommand('copy');
+
+test.innerHTML = 'PASS';
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/counter-after-style-crash.html b/tests/tests/webkitsecurity/assets/counter-after-style-crash.html
new file mode 100644
index 0000000..8a0af67
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/counter-after-style-crash.html
@@ -0,0 +1,32 @@
+<html>
+  <script>
+  if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+  }
+  </script>
+  <style>
+    div {
+      counter-reset:ctr
+    }
+
+    :after {
+      content:counter(x);
+      counter-increment:ctr;
+    }
+  </style>                          
+  <junk>TESTING..</div><div><div></div>
+  <span></span>
+  <table>
+    </script>
+    <script>
+      document.designMode='on';
+      document.execCommand('selectall');
+      document.execCommand('italic');
+      document.execCommand('removeformat');
+
+      document.body.innerHTML = "PASS: Counters updated successfully without crashing";
+      layoutTestController.notifyDone();
+    </script>
+  </table>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/counter-before-selector-crash.html b/tests/tests/webkitsecurity/assets/counter-before-selector-crash.html
new file mode 100644
index 0000000..cbc8bc5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/counter-before-selector-crash.html
@@ -0,0 +1,26 @@
+<html>
+    <head>
+        <style>
+            div.example:before {
+                content: counter(exampleno, upper-roman);
+                counter-increment: exampleno;
+            }
+            pre.example:before {
+                content: counter(exampleno, upper-roman);
+                counter-increment: exampleno;
+            }
+        </style>
+        <script>
+            function test()
+            {
+                if (window.layoutTestController)
+                    layoutTestController.dumpAsText();
+            }
+        </script>
+    </head>
+    <body onload="test()">
+        This tests that we don't crash when using the CSS counters feature.
+        <div class="example"></div>
+        <pre class="example"></pre>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/counter-crash-frame-src.html b/tests/tests/webkitsecurity/assets/counter-crash-frame-src.html
new file mode 100644
index 0000000..a2ba184
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/counter-crash-frame-src.html
@@ -0,0 +1,22 @@
+

+<script>

+function boom() {

+    var p = document.getElementById('p').cloneNode(false);

+    document.getElementById('fig').appendChild(p);

+

+    var count = document.getElementById('count').cloneNode(false);

+    document.getElementById('multi').appendChild(count);

+

+    document.location.reload();

+}

+</script>

+<body onload="boom();">

+    <spacer id='count' style='counter-increment: aaa 1;'>

+        <fig id='fig'>

+    </spacer>

+    <acronym>

+        <spacer style='counter-increment: aaa 1;'></spacer>

+    </acronym>

+    <multicol id='multi'></multicol>

+    <p id='p'></p>

+</body>

diff --git a/tests/tests/webkitsecurity/assets/counter-crash.html b/tests/tests/webkitsecurity/assets/counter-crash.html
new file mode 100644
index 0000000..374806b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/counter-crash.html
@@ -0,0 +1,16 @@
+<html>

+    <script>

+        window.onload = function()

+        {

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+

+            document.getElementById('content').innerHTML = "PASS: rendered counter nodes without crashing.";

+        }

+    </script>

+    <iframe src='resources/counter-crash-frame-src.html'>

+    </iframe>

+    <div id='content'>

+    FAIL

+    </div>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/counter-reparent-table-children-crash.html b/tests/tests/webkitsecurity/assets/counter-reparent-table-children-crash.html
new file mode 100644
index 0000000..87d6aef
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/counter-reparent-table-children-crash.html
@@ -0,0 +1,31 @@
+<html>

+<style>

+td {

+    counter-increment: list-item;

+}

+</style>

+<script>

+if (window.layoutTestController) {

+    layoutTestController.waitUntilDone();

+}

+

+function crash() {

+    document.body.innerHTML = "PASS: Malformed table counters do not cause crash";

+    if (window.layoutTestController) {

+        layoutTestController.notifyDone();

+        layoutTestController.dumpAsText();

+    }

+}

+</script>

+<body onload="crash()">

+    <table>

+        <tbody>

+            <td>

+        </tbody>

+        <ol>re-parent me</ol>

+        <ol>re-parent me</ol>

+            </td>

+        <td></td>

+    </table>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/counter-traverse-object-crash.html b/tests/tests/webkitsecurity/assets/counter-traverse-object-crash.html
new file mode 100644
index 0000000..5ad3656
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/counter-traverse-object-crash.html
@@ -0,0 +1,17 @@
+<html>
+    <script>
+        function test()
+        {
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+            document.getElementsByTagName("div")[0].outerHTML = "PASS";
+        }
+    </script>
+    This tests that we do not crash when RenderCounter traverses detached render trees.
+    <body onload="test()" style="counter-increment: ctr">
+        <object>
+            <b style="counter-increment: ctr"><div></div></b>
+            <menu style="counter-increment: ctr"></menu>
+        </object>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-1.html b/tests/tests/webkitsecurity/assets/crash-1.html
new file mode 100644
index 0000000..5722427
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script>
+description("KDE JS Test");
+</script>
+<script src="script-tests/crash-1.js"></script>
+<script src="../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-1.js b/tests/tests/webkitsecurity/assets/crash-1.js
new file mode 100644
index 0000000..acd5584
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-1.js
@@ -0,0 +1,8 @@
+// infinite recursion
+try {
+  var v = [];
+  v[0] = v;
+  v.toString();
+} catch (e) {
+  debug("OK. Caught an exception.");
+}
diff --git a/tests/tests/webkitsecurity/assets/crash-2.html b/tests/tests/webkitsecurity/assets/crash-2.html
new file mode 100644
index 0000000..3bf39e5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-2.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../resources/js-test-pre.js"></script>
+</head>
+<body>
+<script>
+description("KDE JS Test");
+</script>
+<script src="script-tests/crash-2.js"></script>
+<script src="../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-2.js b/tests/tests/webkitsecurity/assets/crash-2.js
new file mode 100644
index 0000000..5ae3188
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-2.js
@@ -0,0 +1,10 @@
+// infinite recursion 2
+function foo() {
+   foo();
+}
+
+try {
+  foo();
+} catch (e) {
+  debug("OK. Caught an exception");
+}
diff --git a/tests/tests/webkitsecurity/assets/crash-HTMLParser-createHead.html b/tests/tests/webkitsecurity/assets/crash-HTMLParser-createHead.html
new file mode 100644
index 0000000..d6f7407
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-HTMLParser-createHead.html
@@ -0,0 +1,15 @@
+<body onload=go();></body>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function go() {
+        document.open();
+        try {
+            new Image().insertAdjacentHTML(0,"<x<meta>");
+        } catch (e) {
+        }
+        document.write('<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=32426">32426</a>: Crash in WebCore::HTMLParser::createHead</p>');
+        document.write('<p>This test PASSED as it did not CRASH nor ASSERTED.</p>');
+    }
+</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-accessing-clipboardData-types.html b/tests/tests/webkitsecurity/assets/crash-accessing-clipboardData-types.html
new file mode 100644
index 0000000..60d0358
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-accessing-clipboardData-types.html
@@ -0,0 +1,20 @@
+<body>
+
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=30150">bug 30150</a> Crash when accessing clipboardData.types</p>
+<p>PASS if didn't crash.</p>
+
+<div contenteditable id=d>Test</div>
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+document.body.addEventListener("paste", function(e){ e.clipboardData.types }, true);
+
+document.getElementById("d").focus();
+document.execCommand("SelectAll");
+document.execCommand("Cut");
+document.execCommand("Paste");
+
+</script>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/crash-anonymous-table-computeLogicalWidth.html b/tests/tests/webkitsecurity/assets/crash-anonymous-table-computeLogicalWidth.html
new file mode 100755
index 0000000..f1a9ec8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-anonymous-table-computeLogicalWidth.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.tableBefore:before { display: inline-table; content: url(data:text/plain,foo); width: 10px; }
+</style>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<div class="tableBefore"></div>
+<div>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70392">70392</a>: Multiple crashes in RenderTable during layout</div>
+<div>This test passes if it does not CRASH.</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-anonymous-table-layout.html b/tests/tests/webkitsecurity/assets/crash-anonymous-table-layout.html
new file mode 100755
index 0000000..4451384
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-anonymous-table-layout.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.tableAfter::after { display: table; content: attr(class); height: 1px; }
+</style>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<div class="tableAfter"></div>
+<div>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70392">70392</a>: Multiple crashes in RenderTable during layout</div>
+<div>This test passes if it does not CRASH.</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-beforeBorder-dirty-section.html b/tests/tests/webkitsecurity/assets/crash-beforeBorder-dirty-section.html
new file mode 100644
index 0000000..7ca2358
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-beforeBorder-dirty-section.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+    #el1 {
+        border-collapse: collapse;
+        -webkit-writing-mode: vertical-rl;
+    }
+</style>
+</head>
+<body>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var wrapper = document.createElement('div');
+    wrapper.style.display = 'inline-block';
+    document.body.appendChild(wrapper);
+    var table = document.createElement('table');
+    table.setAttribute('id', 'el1');
+    wrapper.appendChild(table);
+    tbody = document.createElement('tbody');
+    tbody.setAttribute('id', 'el2');
+    table.appendChild(tbody);
+
+    function crash() {
+        tbody.style.display = 'table';
+        document.body.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=75215'>Bug 75215: Crash in RenderTable::borderBefore<a><br>This test has passed!";
+    }
+
+    window.addEventListener('load', crash, false);
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-breaking-blockquote-with-list.html b/tests/tests/webkitsecurity/assets/crash-breaking-blockquote-with-list.html
new file mode 100644
index 0000000..3f22ead
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-breaking-blockquote-with-list.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<body>
+<div id="description">This test assures that inserting a newline in a list nested in a blockquote doesn't crash.</div>
+<div contenteditable="true" id="container">
+<blockquote type="cite">
+    <ol><li style=" -webkit-appearance: relevancy-level-indicator" id="two">TwoTwo</li></ol>
+</blockquote>
+</div>
+<script>
+    li = document.getElementById("two");
+    text = li.firstChild;
+    selection = window.getSelection();
+    selection.setPosition(text, 3);
+    document.execCommand("InsertNewlineInQuotedContent");
+    var div = document.getElementById("container");
+    div.parentNode.removeChild(div);
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</body>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-button-input-autofocus.html b/tests/tests/webkitsecurity/assets/crash-button-input-autofocus.html
new file mode 100755
index 0000000..4763ff3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-button-input-autofocus.html
@@ -0,0 +1,14 @@
+<html>
+<body>
+<p style="visibility: collapse;"><button><input autofocus><input id="test"></input></button></p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+document.body.offsetTop;
+document.getElementById('test').parentNode.removeChild(document.getElementById('test'));
+document.body.offsetTop;
+</script>
+<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=63776">63776</a>: Partial layout when a flex-box has visibility: collapse</p>
+<p>This test PASSES if it does not CRASH.</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-button-keygen.html b/tests/tests/webkitsecurity/assets/crash-button-keygen.html
new file mode 100755
index 0000000..7cf441e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-button-keygen.html
@@ -0,0 +1,14 @@
+<html>
+<body>
+<p style="visibility: collapse;"><button><keygen autofocus><input id="test"></keygen></button></p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+document.body.offsetTop;
+document.getElementById('test').parentNode.removeChild(document.getElementById('test'));
+document.body.offsetTop;
+</script>
+<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=63776">63776</a>: Partial layout when a flex-box has visibility: collapse</p>
+<p>This test PASSES if it does not CRASH.</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-button-relayout.html b/tests/tests/webkitsecurity/assets/crash-button-relayout.html
new file mode 100755
index 0000000..49a6d2a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-button-relayout.html
@@ -0,0 +1,14 @@
+<html>
+<body>
+<p style="visibility: collapse;"><button><input><script>document.getElementsByTagName('input')[0].offsetTop;</script><input id="test"></input></button></p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+document.body.offsetTop;
+document.getElementById('test').parentNode.removeChild(document.getElementById('test'));
+document.body.offsetTop;
+</script>
+<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=63776">63776</a>: Partial layout when a flex-box has visibility: collapse</p>
+<p>This test PASSES if it does not CRASH.</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-closing-page-with-media-as-plugin-fallback.html b/tests/tests/webkitsecurity/assets/crash-closing-page-with-media-as-plugin-fallback.html
new file mode 100644
index 0000000..b567536
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-closing-page-with-media-as-plugin-fallback.html
@@ -0,0 +1,41 @@
+<script>
+var childWindow;
+</script>
+This test makes sure that closing a window with a video element that has a poster image doesn't crash (radar 10576732 and https://bugs.webkit.org/show_bug.cgi?id=74533)<br>
+If it doesn't crash, it passes.<br>
+<button id="button" onclick="childWindow = window.open('resources/video-with-poster-as-object-fallback.html')">
+    Click here to open test window
+</button><br>
+<div id="result"></div><br>
+
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+    layoutTestController.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
+    layoutTestController.overridePreference("WebKitPageCacheSupportsPluginsPreferenceKey", 1);
+    layoutTestController.setCanOpenWindows(true);
+    layoutTestController.setCloseRemainingWindowsWhenComplete(true);
+    var button = document.getElementById("button");
+    eventSender.mouseMoveTo(button.offsetParent.offsetLeft + button.offsetLeft + button.offsetWidth / 2, button.offsetParent.offsetTop +  button.offsetTop + button.offsetHeight / 2);
+    eventSender.mouseDown();
+    eventSender.mouseUp();
+}
+
+function childLoaded()
+{
+    childWindow.close();
+    setTimeout("checkClosed()", 0);
+}
+
+function checkClosed()
+{
+    if (childWindow.closed) {
+        document.getElementById("result").innerText = "Closed the window without crashing!";
+        if (window.layoutTestController)
+            setTimeout("layoutTestController.notifyDone();", 0);
+    }
+    setTimeout("checkClosed()", 0);
+}
+
+</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-copying-backforwardlist.html b/tests/tests/webkitsecurity/assets/crash-copying-backforwardlist.html
new file mode 100644
index 0000000..511c139
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-copying-backforwardlist.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+    layoutTestController.setCanOpenWindows(true);
+    layoutTestController.setNewWindowsCopyBackForwardList(true);
+}
+
+</script>
+</head>
+<body onload="window.open('data:text/html,<script>if (window.layoutTestController) layoutTestController.notifyDone();</script>');">
+<pre>
+This test only works in DRT by tickling the [WebView _loadBackForwardListFromOtherView:] method.
+If it doesn't crash, then the test passes.
+</pre>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-css-generated-content.xhtml b/tests/tests/webkitsecurity/assets/crash-css-generated-content.xhtml
new file mode 100644
index 0000000..b905b3a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-css-generated-content.xhtml
@@ -0,0 +1,27 @@
+<!DOCTYPE html
+  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html lang="en-US" xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml">
+    <style>
+        svg text:before {
+            content: 'FAIL';
+        }
+        svg text:after {
+            content: 'FAIL';
+        }
+    </style>
+    <head>
+        <title>Test case for rdar://6302405</title>
+    </head>
+    <body>
+        <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+            <text x="50" y="50">This test ensures that we do not crash when css generated content attempts to attach to svg text</text>
+        </svg>
+        <script>
+        <![CDATA[
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+        ]]>
+        </script>
+    </body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-determining-aria-role-when-label-present.html b/tests/tests/webkitsecurity/assets/crash-determining-aria-role-when-label-present.html
new file mode 100644
index 0000000..9521b58
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-determining-aria-role-when-label-present.html
@@ -0,0 +1,30 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<label><q role=x><input id="test">
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This tests a crashing scenario where an element with a role attribute is a child of a label that also has a corresponding control.");
+
+    if (window.accessibilityController) {
+          document.getElementById("test").focus();
+         
+          // This line should not crash.
+          var input = accessibilityController.focusedElement;
+
+          shouldBe("input.childrenCount", "0");
+    }
+
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-display-local-directory.html b/tests/tests/webkitsecurity/assets/crash-display-local-directory.html
new file mode 100644
index 0000000..7fa0cb9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-display-local-directory.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+    <title>Test crash on directory display</title>
+    <script>
+        function directoryTest() {
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            var result = document.getElementById("result");
+
+            var directoryDocument = document.getElementById("myDirectory").contentDocument;
+            if (directoryDocument)
+              result.innerHTML = "PASS: Local directory loaded.";
+            else
+              result.innerHTML = "FAIL: Local directory cannot be listed.";
+        }
+    </script>
+</head>
+<body>
+    <p>This test is to see if a local directory index can be diplayed.</p>
+    <p id="result">
+        Test has not run.
+    </p>
+    <iframe id="myDirectory" src="resources/directory" width="600px" height="400px" onload="directoryTest()"/>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-empty-section-calcBorder.html b/tests/tests/webkitsecurity/assets/crash-empty-section-calcBorder.html
new file mode 100644
index 0000000..8bb0c6c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-empty-section-calcBorder.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function crash() {
+        var firstBody = document.getElementById("firstBody");
+        firstBody.removeChild(firstBody.firstChild);
+        firstBody.offsetTop;
+    }
+
+    window.addEventListener("load", crash, false);
+</script>
+</head>
+<body>
+<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=71246">71246</a>: REGRESSION(98738): Multiple crashes in the table rendering code</p>
+<p>This test PASSES if it does not CRASH.</p>
+<table style="border-collapse: collapse">
+    <tbody id="firstBody" style="border: 2px solid green"><tr style="border: 4px solid red"></tr></tbody>
+</table>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-empty-section-fixed-layout-calcArray.html b/tests/tests/webkitsecurity/assets/crash-empty-section-fixed-layout-calcArray.html
new file mode 100644
index 0000000..e58ac95
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-empty-section-fixed-layout-calcArray.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function crash() {
+        var firstBody = document.getElementById("firstBody");
+        firstBody.removeChild(firstBody.firstChild);
+        firstBody.offsetTop;
+    }
+
+    window.addEventListener("load", crash, false);
+</script>
+</head>
+<body>
+<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=71246">71246</a>: REGRESSION(98738): Multiple crashes in the table rendering code</p>
+<p>This test PASSES if it does not CRASH.</p>
+<table style="table-layout:fixed; width:0;">
+    <tbody id="firstBody"><tr></tr></tbody>
+</table>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-filter-change-expected.png b/tests/tests/webkitsecurity/assets/crash-filter-change-expected.png
new file mode 100644
index 0000000..b3003d0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-filter-change-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/crash-filter-change.html b/tests/tests/webkitsecurity/assets/crash-filter-change.html
new file mode 100644
index 0000000..cf77b18
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-filter-change.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<!-- Test passes if doesn't crash. -->
+<style>
+.first {
+    -webkit-filter: hue-rotate(90deg);
+}
+.second {
+    -webkit-filter: blur(3px);
+}
+</style>
+<img class='first' src="resources/reference.png">
+<script>
+    if (window.layoutTestController)
+        window.layoutTestController.dumpAsText(true);
+    // force a layout
+    document.body.offsetTop;
+    var img = document.getElementsByTagName('img')[0];
+    img.className = 'second';
+</script>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-flexbox-no-layout-child.html b/tests/tests/webkitsecurity/assets/crash-flexbox-no-layout-child.html
new file mode 100644
index 0000000..636505e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-flexbox-no-layout-child.html
@@ -0,0 +1,20 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom() {
+  setTimeout('document.querySelector("progress").setAttribute("style", "overflow: scroll; border-style: dotted;");', 10);
+}
+window.onload = boom;
+</script>
+<body>
+  <span style="display: -webkit-inline-box;">
+    <span style="position: fixed; visibility: collapse;">
+      <span style="visibility: visible;">
+        <progress></progress>
+      </span>
+    </span>
+  </span>
+  <div>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=64842">64842</a>: RenderDeprecatedFlexibleBox does not call its children's layout method</div>
+  <div>This test passes if it does not CRASH.</div>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/crash-frameset-CSS-content-property.html b/tests/tests/webkitsecurity/assets/crash-frameset-CSS-content-property.html
new file mode 100644
index 0000000..b497b64
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-frameset-CSS-content-property.html
@@ -0,0 +1,38 @@
+<html>
+<head>
+<title>WebKit Bug 47314</title>
+<script>
+function runTest()
+{
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var frameset = document.getElementById("frameset");
+    var mouseClick = document.createEvent("MouseEvent");
+    mouseClick.initEvent("click", true, true);
+    frameset.dispatchEvent(mouseClick);
+
+    if (!window.layoutTestController) {
+        // For some reason, when running this test by hand in release builds you must manually
+        // click on the not-found image placeholder to cause a crash. Hence, we don't replace
+        // the <frameset> and print a PASS message.
+        return;
+    }
+
+    // As per the definition of the body element in section 3.1.4 the HTML 5 spec.
+    // <http://www.w3.org/TR/html5/dom.html#the-body-element>, a document can either
+    // have a <frameset> or a <body>, but not both, and a frameset does not provide
+    // a means to print a PASS message. Therefore, we replace <frameset> with <body>.
+    var htmlElement = document.getElementsByTagName("html")[0];
+    htmlElement.replaceChild(document.createElement("body"), frameset);
+    document.body.appendChild(document.createTextNode("PASS, mouse event to <frameset> did not cause crash."));
+}
+
+window.onload = runTest;
+</script>
+</head>
+<!-- This tests that we don't crash when clicking on a <frameset> that specifies the CSS content property. -->
+<!-- This test PASSED if you see the word "PASS" on the page. Otherwise, it FAILED. -->
+<!-- Note: If you are running this test by hand in a release build then try clicking on the not-found image placeholder to cause a crash. -->
+<frameset id="frameset" style="content:url(click-to-crash.jpg)"></frameset>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-generated-counter.html b/tests/tests/webkitsecurity/assets/crash-generated-counter.html
new file mode 100755
index 0000000..7d7deaa
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-generated-counter.html
@@ -0,0 +1,23 @@
+<html>
+    <body>
+        <style>
+            div:before
+            {
+                counter-reset: foobar;
+                content: counter(foobar, upper-roman);
+                display: block;
+                overflow: hidden;
+                width: 100;
+                height: 100;
+            }
+        </style>
+        Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=61411">61411</a>: ASSERTION FAILED: !m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout() with generated content<br>
+        Test passes if it does not crash.
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            document.body.offsetTop;
+        </script><div></div>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-generated-image.html b/tests/tests/webkitsecurity/assets/crash-generated-image.html
new file mode 100755
index 0000000..63aec66
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-generated-image.html
@@ -0,0 +1,22 @@
+<html>
+    <body>
+        <style>
+            div:before
+            {
+                content: url(resources/greenbox.png);
+                display: block;
+                overflow: hidden;
+                width: 100;
+                height: 100;
+            }
+        </style>
+        Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=61411">61411</a>: ASSERTION FAILED: !m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout() with generated content<br>
+        Test passes if it does not crash.
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            document.body.offsetTop;
+        </script><div></div>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-generated-quote.html b/tests/tests/webkitsecurity/assets/crash-generated-quote.html
new file mode 100755
index 0000000..9691582
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-generated-quote.html
@@ -0,0 +1,22 @@
+<html>
+    <body>
+        <style>
+            div:before
+            {
+                content: open-quote;
+                display: block;
+                overflow: hidden;
+                width: 100;
+                height: 100;
+            }
+        </style>
+        Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=61411">61411</a>: ASSERTION FAILED: !m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout() with generated content<br>
+        Test passes if it does not crash.
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            document.body.offsetTop;
+        </script><div></div>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-generated-text.html b/tests/tests/webkitsecurity/assets/crash-generated-text.html
new file mode 100755
index 0000000..4b38e7c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-generated-text.html
@@ -0,0 +1,22 @@
+<html>
+    <body>
+        <style>
+            div:before
+            {
+                content: 'PASS';
+                display: block;
+                overflow: hidden;
+                width: 100;
+                height: 100;
+            }
+        </style>
+        Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=61411">61411</a>: ASSERTION FAILED: !m_layoutRoot->container() || !m_layoutRoot->container()->needsLayout() with generated content<br>
+        Test passes if it does not crash.
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            document.body.offsetTop;
+        </script><div></div>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-huge-layer.html b/tests/tests/webkitsecurity/assets/crash-huge-layer.html
new file mode 100644
index 0000000..15c5474
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-huge-layer.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<p>This is a test for <a href="https://bugs.webkit.org/show_bug.cgi?id=65637">Bug 65637: Crash beneath PlatformCALayerWinInternal::updateTiles when zooming on Google Maps</a>. The test passes if the browser does not crash.</p>
+<div style="width: 33554432px; height: 33554432px; -webkit-transform: translateZ(0);">Did you crash?</div>
diff --git a/tests/tests/webkitsecurity/assets/crash-hw-sw-switch-expected.png b/tests/tests/webkitsecurity/assets/crash-hw-sw-switch-expected.png
new file mode 100644
index 0000000..89ffdbe
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-hw-sw-switch-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/crash-hw-sw-switch.html b/tests/tests/webkitsecurity/assets/crash-hw-sw-switch.html
new file mode 100644
index 0000000..8731c7f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-hw-sw-switch.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<!-- Test passes if doesn't crash. -->
+<style>
+.sw {
+    -webkit-filter: blur(4px);
+}
+.hw {
+    -webkit-filter: blur(3px);
+    -webkit-transform:translateZ(0);
+}
+</style>
+<img class='sw' src="resources/reference.png">
+PASS if test does not crash or cause an ASSERT failure.
+<script>
+    if (window.layoutTestController)
+        window.layoutTestController.dumpAsText(true);
+    // force a layout
+    document.body.offsetTop;
+    var img = document.getElementsByTagName('img')[0];
+    img.className = 'hw';
+    // force a layout
+    document.body.offsetTop;
+    img.className = 'sw';
+</script>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-in-element-for-text-marker.html b/tests/tests/webkitsecurity/assets/crash-in-element-for-text-marker.html
new file mode 100644
index 0000000..488c72f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-in-element-for-text-marker.html
@@ -0,0 +1,44 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+asdf
+
+<div id="content" tabindex="0">test</div>
+
+asdf
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This protects against a crash when AXUIElementForTextMarker is queried with an empty text marker.");
+
+    if (window.accessibilityController) {
+
+          document.getElementById("content").focus();
+          var content = accessibilityController.focusedElement;
+
+          // get a marker that is invalid (the next one after the end of the body).
+          var textMarkerRange = content.textMarkerRangeForElement(content);
+          var endMarker = content.endTextMarkerForTextMarkerRange(textMarkerRange);
+
+          // Remove "content" so that the text marker becomes invalid.
+          document.getElementById("body").removeChild(document.getElementById("content"));
+
+          document.getElementById("body").focus();
+          var body = accessibilityController.focusedElement;
+
+          // Ask for the ui element for that marker (should not crash).
+          body.accessibilityElementForTextMarker(endMarker);
+    }
+
+</script>
+
+<script src="../../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-indenting-list-item.html b/tests/tests/webkitsecurity/assets/crash-indenting-list-item.html
new file mode 100644
index 0000000..11ccad4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-indenting-list-item.html
@@ -0,0 +1,8 @@
+<div contentEditable><ul><li id='foo'></li></ul></div>
+<script src="../../resources/dump-as-markup.js"></script>
+<script>
+window.getSelection().setBaseAndExtent(foo, 0, foo, 0);
+// This test passes if it does not crash.
+document.execCommand('indent', false, null);
+document.getElementById("foo").innerText = "PASSED";
+</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-inline-container-client.html b/tests/tests/webkitsecurity/assets/crash-inline-container-client.html
new file mode 100644
index 0000000..ec9b9a0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-inline-container-client.html
@@ -0,0 +1,24 @@
+<svg>
+<g>
+<defs><linearGradient id="linearGradient"></linearGradient></defs>
+<text style="fill:url(#linearGradient);">
+  B<tspan>A</tspan>
+</text>
+<text style="filter:url(#dropShadow);">
+  <tspan id="tspan">K</tspan>
+</text>
+</g>
+
+<text x="10" y="30">This test passes if it does not crash.</text>
+
+<script>
+var canvas = document.createElement("canvas");
+document.getElementById("linearGradient").appendChild(canvas);
+range = document.createRange();
+range.setEndAfter(document.getElementById("tspan"));
+range.extractContents();
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/crash-invalid-text-marker-node.html b/tests/tests/webkitsecurity/assets/crash-invalid-text-marker-node.html
new file mode 100644
index 0000000..d6e2ca3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-invalid-text-marker-node.html
@@ -0,0 +1,48 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<iframe id="iframe" width=100 height=100></iframe>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This protects against a crash when a text marker still holds a reference to a node that's been deallocated.");
+
+    // Add an element that a text marker can be retrieved from.
+    var contentDoc = document.getElementById("iframe").contentDocument; 
+    contentDoc.body.innerHTML = "<h1 tabindex='0'>content</h1>";
+
+    // Tab to the element. 
+    // Note: If the element has an "id" it won't get de-allocated in time, so .focus() can't be used.
+    eventSender.keyDown("\t");
+
+    // get a marker that will become invalid when the node disappears.
+    var axDiv = accessibilityController.focusedElement;
+    var textMarkerRange = axDiv.textMarkerRangeForElement(axDiv);
+    var invalidMarker = axDiv.startTextMarkerForTextMarkerRange(textMarkerRange);
+
+</script>
+
+<script>
+     // Write new content to cause all content to disappear.
+     contentDoc.body.innerHTML = "<h2>new content</h2>";
+</script>
+
+<script>
+    // Access the invalid marker (it should not crash).
+    document.getElementById("body").focus();
+    var body = accessibilityController.focusedElement;
+
+    body.accessibilityElementForTextMarker(invalidMarker);
+
+</script>
+
+<script src="../../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-line-break-after-outdent.html b/tests/tests/webkitsecurity/assets/crash-line-break-after-outdent.html
new file mode 100644
index 0000000..22c4133
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-line-break-after-outdent.html
@@ -0,0 +1,29 @@
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function f() {
+    document.designMode="on";
+    document.execCommand("SelectAll");
+    document.execCommand("InsertImage",false);
+    document.execCommand("InsertImage",false);
+    document.execCommand("Indent");
+    document.execCommand("insertunorderedlist",false);
+    document.execCommand("InsertUnorderedList",false);
+    document.execCommand("Bold");
+    document.execCommand("InsertLineBreak");
+    document.execCommand("insertunorderedlist");
+    document.execCommand("insertimage",false);
+    document.execCommand("insertparagraph",false);
+    document.execCommand("insertunorderedlist");
+    document.execCommand("InsertUnorderedList");
+    document.execCommand("Outdent");
+    document.write("<p>Test for bug <a href=\"https://bugs.webkit.org/show_bug.cgi?id=60778\">REGRESSION (83075): Crash in line break after outdent</p>");
+    document.write("<p>This test PASSED!</p>");
+}
+ </script>
+</head>
+<body onload='f();'>
+    <pre id="x">x</pre>
+</body>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-multiple-family-fontface.html b/tests/tests/webkitsecurity/assets/crash-multiple-family-fontface.html
new file mode 100644
index 0000000..7e53cd5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-multiple-family-fontface.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<style>
+    @font-face {
+        font-family:morris,xx;
+        /* Important: src cannot be local to trigger the crash */
+        src:url(doesNotExist.ttf);
+    }
+    body {
+        font:12px morris;
+    }
+
+</style>
+<script>
+    if (window.layoutTestController)
+        window.layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+    <p>Try to reference a custom font (@font-face) which was defined with more than 1 font-family.</p>
+    <p>PASS if does not crash</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-1px-border.html b/tests/tests/webkitsecurity/assets/crash-on-1px-border.html
new file mode 100644
index 0000000..a63c049
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-1px-border.html
@@ -0,0 +1,15 @@
+<head>
+<style>
+.thin {
+  border-bottom: 1px solid;
+  background: -webkit-gradient(linear, 0% 100%, 0% 100%, from(red), to(blue))
+}
+</style>
+<script>
+if (window.layoutTestController)
+  window.layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<h1>Linear gradient with 1px border-bottom. Should not crash</h1>
+<div class="thin"></div>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-absolute-positioning.html b/tests/tests/webkitsecurity/assets/crash-on-absolute-positioning.html
new file mode 100644
index 0000000..ddde86a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-absolute-positioning.html
@@ -0,0 +1,45 @@
+<html>
+<script>
+if (window.layoutTestController)
+{
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function removeFloat()
+{
+    var float2 = document.getElementById('float2');
+    float2.style.display = 'none';
+    window.setTimeout('crash();', 0);
+}
+
+function crash()
+{
+    var block1 = document.getElementById('block1');
+    var float1 = document.getElementById('float1');
+    block1.style.position = 'absolute';
+    float1.style.display = 'none';
+    if (window.layoutTestController)
+    {
+        layoutTestController.notifyDone();
+    }
+}
+</script>
+<body onload="removeFloat()">
+<p>This test passes if it doesn't crash.</p>
+<div style="position:absolute; left:0; top:40">
+<div id="block1" style="border:solid">
+<div id="float1" style="float:left; width:50px; height:600px; background-color:purple; margin-left:5px"></div>
+<div id="float2" style="float:left; width:50px; height:150px; background-color:purple; margin-left:5px"></div>
+<div id="block2">A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
+<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
+<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
+<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
+<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
+</div>
+<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
+<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
+<div>A float is a renderer that is designed to shift all the way to the left side or all the way to the right side of a paragraph. The lines of the paragraph then flow around the floating object avoiding it. You can see an example of a float in this very paragraph. There is a purple box in the upper right hand corner. Note how all of the text in this paragraph is avoiding the float.</div>
+</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-clear-selection-expected.png b/tests/tests/webkitsecurity/assets/crash-on-clear-selection-expected.png
new file mode 100644
index 0000000..59c5386
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-clear-selection-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/crash-on-clear-selection.html b/tests/tests/webkitsecurity/assets/crash-on-clear-selection.html
new file mode 100644
index 0000000..19fedae
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-clear-selection.html
@@ -0,0 +1,12 @@
+If this doesn't crash, then the test passes.
+<div id=foo>foo</div>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var foo = document.getElementById('foo');
+    window.getSelection().selectAllChildren(foo);
+
+    foo.style.display = 'none';
+    window.getSelection().removeAllRanges();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-custom-cursor-when-loading.html b/tests/tests/webkitsecurity/assets/crash-on-custom-cursor-when-loading.html
new file mode 100644
index 0000000..bb16e58
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-custom-cursor-when-loading.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<style>
+    div {
+        cursor: url(resources/purple-srgb.png);
+        width: 200;
+        height: 200;
+        background: green;
+    }
+</style>
+</head>
+<body>
+    <div></div>
+    <script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    if (window.eventSender) {
+        eventSender.dragMode = false;
+        eventSender.mouseMoveTo(50, 50)
+    }
+    </script>
+    <p>PASS without crash.</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-degenerate-gradient.html b/tests/tests/webkitsecurity/assets/crash-on-degenerate-gradient.html
new file mode 100644
index 0000000..82b2194
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-degenerate-gradient.html
@@ -0,0 +1,11 @@
+<head>
+<script>
+if (window.layoutTestController)
+  window.layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<h1>Degenerate Linear gradient. Should not crash</h1>
+<button style="background-image: -webkit-radial-gradient(1 1, Scrollbar -1, red -1)">
+</body>
+
diff --git a/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events-expected.png b/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events-expected.png
new file mode 100644
index 0000000..7de8711
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events.html b/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events.html
new file mode 100644
index 0000000..e3c6277
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-drag-with-mutation-events.html
@@ -0,0 +1,47 @@
+<body style="margin: 0px">
+<div>Make sure WebKit doesn't crash when web authors blast away everything in DOMNodeInserted handler! https://bugs.webkit.org/show_bug.cgi?id=22634</div>
+<div id="dragstart" contentEditable>Drag something from here to the document below</div>
+<iframe src="about:blank" id="iframe"></iframe>
+<script>
+var iframe = document.getElementById("iframe");
+iframe.style.height = "20px";
+var doc = iframe.contentDocument;
+doc.body.style.margin = "0px";
+var divForDrop = document.createElement("div");
+divForDrop.contentEditable = true;
+doc.body.appendChild(divForDrop);
+divForDrop.appendChild(document.createTextNode("Drop on this line!"));
+
+function clearDivDuringInsertion()
+{
+    doc.execCommand("selectall");
+    doc.execCommand("delete");
+    doc.execCommand("selectall");
+}
+
+divForDrop.addEventListener("DOMNodeInserted", clearDivDuringInsertion, true);
+
+if (window.eventSender) {
+    layoutTestController.dumpAsText();
+
+    var startDiv = document.getElementById("dragstart");
+    startDiv.focus();
+    document.execCommand("selectall");
+
+    var startX = startDiv.offsetLeft + 10;
+    var startY = startDiv.offsetTop + 10;
+
+    var endX = iframe.offsetLeft + divForDrop.offsetLeft + 10;
+    var endY = iframe.offsetTop + divForDrop.offsetTop + 10;
+
+    eventSender.mouseMoveTo(startX, startY);
+    eventSender.mouseDown();
+    eventSender.leapForward(1000);
+
+    eventSender.mouseMoveTo(endX, endY);
+    eventSender.mouseUp();
+    
+    document.body.innerHTML = "PASSED, no crash";
+}
+
+</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-enter-in-contentEditable-list.html b/tests/tests/webkitsecurity/assets/crash-on-enter-in-contentEditable-list.html
new file mode 100644
index 0000000..5e21e70
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-enter-in-contentEditable-list.html
@@ -0,0 +1,9 @@
+<script src="../../resources/dump-as-markup.js"></script>
+<div>This test passes if it doesn't crash.</div>
+<ul contentEditable>
+    <li id=foo></li>
+</ul>
+<script>
+window.getSelection().selectAllChildren(foo);
+document.execCommand('insertParagraph');
+</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-mutate-during-drop.html b/tests/tests/webkitsecurity/assets/crash-on-mutate-during-drop.html
new file mode 100644
index 0000000..1b85004
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-mutate-during-drop.html
@@ -0,0 +1,41 @@
+<html>
+<head>
+<script>
+function foo() {
+    if (event.type == "DOMNodeInserted" && event.target.nodeType == 3)
+        document.body.innerHTML = "PASSED";
+}
+
+function runTest() {
+    if (!window.layoutTestController)
+      return;
+
+    window.layoutTestController.dumpAsText();
+
+    document.addEventListener("DOMNodeInserted", function() { foo() }, true);
+
+    // Select the element 'dragSource'.
+    var selection = window.getSelection();
+    var range =  document.createRange();
+    range.selectNode(document.getElementById("dragSource"));
+    selection.addRange(range);
+
+    // Drag the source text to the target text.
+    var source = document.getElementById('dragSource');
+    var target = document.getElementById('dragTarget');
+    eventSender.mouseMoveTo(source.offsetLeft + 2, source.offsetTop + 2);
+    eventSender.mouseDown();
+    eventSender.leapForward(500);
+    eventSender.mouseMoveTo(target.offsetLeft + target.offsetWidth / 2,
+                            target.offsetTop + target.offsetHeight / 2);
+    eventSender.mouseUp();
+}
+</script>
+</head>
+<body contenteditable="true" onload="runTest()">
+<p>This test tests for a crash when a DOM mutation event listener
+   modifies the text during a drop. If the test doesn't crash, all is good.
+<p id="dragSource">drag source text
+<p id="dragTarget">drag dest text
+</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-on-remove.html b/tests/tests/webkitsecurity/assets/crash-on-remove.html
new file mode 100644
index 0000000..839c24c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-remove.html
@@ -0,0 +1,16 @@
+<p>
+    Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=18879">https://bugs.webkit.org/show_bug.cgi?id=18879</a>
+    Reproducible crash when removing a gradient</i>.
+</p>
+<p>
+    The test should not crash and there should be a green square below.
+</p>
+<div id="target" style="width: 100px; height: 100px; background-color: green; background-image: -webkit-gradient(linear, left top, left bottom, from(red), to(transparent))">
+</div>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    document.body.offsetTop;
+    document.getElementById("target").style.removeProperty("background-image");
+</script>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-tr.html b/tests/tests/webkitsecurity/assets/crash-on-tr.html
new file mode 100644
index 0000000..24b8cb0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-tr.html
@@ -0,0 +1,21 @@
+<head>
+<style type="text/css">
+.f {
+    background:-webkit-gradient(linear, left top, left bottom, from(#E7E7E7), to(#CFCFCF));
+}
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</head>
+
+This test should not crash (or ASSERT).<p>
+
+There should also be a table cell with a gradient below.<p>
+
+<table
+<tr class="f">
+<td>Gradient</td>
+</tr>
+</table>
diff --git a/tests/tests/webkitsecurity/assets/crash-on-zero-radius-expected.png b/tests/tests/webkitsecurity/assets/crash-on-zero-radius-expected.png
new file mode 100644
index 0000000..fda6832
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-zero-radius-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/crash-on-zero-radius.html b/tests/tests/webkitsecurity/assets/crash-on-zero-radius.html
new file mode 100644
index 0000000..2b21eae
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-on-zero-radius.html
@@ -0,0 +1,10 @@
+<head>
+<style>
+.radial { width:150px; height:150px; border:2px solid black;
+           background: -webkit-gradient(radial, 45 45, 0, 52 50, 0, from(#A7D30C), to(rgba(1,159,98,0)), color-stop(90%, #019F62)),
+                       -webkit-gradient(radial, 45 45, 10, 52 50, 30, from(#A7D30C), to(rgba(1,159,98,0)), color-stop(90%, #019F62)) }
+</style>
+</head>
+<body>
+<h1>Two gradients, one with zero radius that should not crash.</h1>
+<div class="radial"></div>
diff --git a/tests/tests/webkitsecurity/assets/crash-paint-no-documentElement-renderer.html-disabled b/tests/tests/webkitsecurity/assets/crash-paint-no-documentElement-renderer.html-disabled
new file mode 100755
index 0000000..a4ea9e6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-paint-no-documentElement-renderer.html-disabled
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body onload="go()">
+<p>Bug 64284: Crash in RenderBox::paintBoxDecorations when documentElement has no renderer</p>
+<p>For this test to PASS, it should not ASSERT or CRASH.</p>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function go() {
+        document.open();
+        var oUElement = document.createElement("U");
+        oUElement.hidden=true;
+        oUElement.innerHTML="<style>*{-webkit-border-before-style:groove}";
+        document.appendChild(oUElement);
+        document.close();
+    }
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-removed-iframe.html b/tests/tests/webkitsecurity/assets/crash-removed-iframe.html
new file mode 100644
index 0000000..49fdb44
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-removed-iframe.html
@@ -0,0 +1,52 @@
+<html>
+<head>
+    <title>Crash doing open on destroyed window</title> 
+    <script> 
+    function testCrash1() {
+        var ifr = document.createElement('iframe');
+        ifr.onload = function() {
+            var win = ifr.contentWindow;
+            ifr.parentNode.removeChild(ifr);
+            win.open('pantz', '_top');
+        };
+        document.body.appendChild(ifr);
+    }
+
+    // Test with a deconnected iframe.
+    function testCrash2() {
+        var ifr = document.createElement('iframe');
+        ifr.onload = function() {
+            var win = ifr.contentWindow;
+            ifr.parentNode.removeChild(ifr);
+            win.open('pantz', ifr);
+        };
+        document.body.appendChild(ifr);
+    }
+
+    // Test with a new iframe.
+    function testCrash3() {
+        var ifr = document.createElement('iframe');
+        var ifr2 = document.createElement('iframe');
+        ifr.onload = function() {
+            var win = ifr.contentWindow;
+            ifr.parentNode.removeChild(ifr);
+            win.open('pantz', ifr2);
+        };
+        document.body.appendChild(ifr);
+    }
+
+    function testCrash() {
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        testCrash1();
+        testCrash2();
+        testCrash3();
+    }
+    </script> 
+</head>
+<body onload="testCrash()">
+    <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=19588">19588</a>: CRASH doing open() on destroyed window</p>
+    <p> If this page does not crash the test has passed. </p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-reparent-tiled-layer.html b/tests/tests/webkitsecurity/assets/crash-reparent-tiled-layer.html
new file mode 100644
index 0000000..d3d793e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-reparent-tiled-layer.html
@@ -0,0 +1,63 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>Test that switching to tiled layers when the parent is a tiled layer does not crash</title>
+
+    <style type="text/css" media="screen">
+
+    #container {
+      width: 500px;
+      height: 5000px;
+      border: 1px solid black;
+      background-color: yellow;
+      -webkit-transform:translateZ(0);
+    }
+    
+    #box {
+        position: absolute;
+        left:50px;
+        width: 200px;
+        height: 200px;
+        -webkit-transform:translateZ(0);
+        top: 100px;
+        background-color: red;
+    }
+    </style>
+    <script type="text/javascript" charset="utf-8">
+        if (window.layoutTestController) {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+        }
+        
+        result = "";
+
+        function testOnLoad()
+        {
+            window.setTimeout(function() {
+                document.getElementById('box').style.height = "4800px";
+                
+                // Let it render
+                window.setTimeout(function() {
+                    if (window.layoutTestController) {
+                        document.getElementById('layers').innerHTML = layoutTestController.layerTreeAsText();
+                        layoutTestController.notifyDone();
+                    }
+                }, 0);
+            }, 0);
+        }
+      
+        window.addEventListener('load', testOnLoad, false);
+    </script>
+  </head>
+  <body>
+      <p>
+        From https://bugs.webkit.org/show_bug.cgi?id=44629. The parent is a tiled layer.
+        When the child is a non-tiled layer and it is switched to a tiled layer, a crash
+        occurs. This test should not crash.
+      </p>
+        <div id="container">
+          <div id="box"></div>
+        </div>
+        <pre id="layers">Layer tree appears here in DRT.</pre>
+  </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-replaced-display-block.html b/tests/tests/webkitsecurity/assets/crash-replaced-display-block.html
new file mode 100644
index 0000000..56645f0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-replaced-display-block.html
@@ -0,0 +1,11 @@
+<p>This tests rdar://problem/6545095 ASSERTION FAILED: RenderBlock.h:519: !o || o->isRenderBlock()</p>
+
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+
+<div style="float: left; height: 1000px; width: 20px;"></div>
+<span>
+    <img style="display: block; width: auto;" />
+</span>
diff --git a/tests/tests/webkitsecurity/assets/crash-replacing-location-before-load.html b/tests/tests/webkitsecurity/assets/crash-replacing-location-before-load.html
new file mode 100644
index 0000000..d37baea
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-replacing-location-before-load.html
@@ -0,0 +1,25 @@
+<script>
+if (parent == window) {
+  if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+  }
+  function replaceHash(frag) {
+    frames[0].location.replace('#' + frag);
+  }
+  onload = function() {
+    var f = document.createElement("iframe");
+    f.src = location;
+    f.onload = function() {
+      delete f.onload;
+      replaceHash('bar');
+      if (window.layoutTestController)
+        layoutTestController.notifyDone();
+    }
+    document.body.appendChild(f);
+    replaceHash('foo');
+  }
+}
+</script>
+<!-- If we do not crash, then this test was successful. -->
+<body>PASS</body>
diff --git a/tests/tests/webkitsecurity/assets/crash-restoring-plugin-page-from-page-cache.html b/tests/tests/webkitsecurity/assets/crash-restoring-plugin-page-from-page-cache.html
new file mode 100644
index 0000000..4bc4b15
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-restoring-plugin-page-from-page-cache.html
@@ -0,0 +1,94 @@
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+    layoutTestController.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
+    layoutTestController.overridePreference("WebKitPageCacheSupportsPluginsPreferenceKey", 1);
+}
+
+function pageShown() {
+    if (event.persisted)
+        setTimeout("testComplete()", 0);   
+    else
+        setTimeout("startTest()", 0);
+}
+
+function testComplete() {
+    alert("Made it back!");
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function startTest() {
+    document.getElementById("ExamplePlugin").setAttribute("style", "display:none");
+    window.location.href = 'resources/go-back.html';
+}
+
+</script>
+
+<style>
+    object { border-color: red; border-width: 2px; border-style:solid; }
+</style>
+</head>
+
+<body onpageshow="pageShown();">
+    
+This test - assuming it will pass - does the following:<br>
+1 - Has nested plugin elements<br>
+2 - Leaves the page, and the page enters the page cache<br>
+3 - Returns, pulling the page from the page cache<br>
+4 - Doesn't crash<br>
+<br>
+If you're not running under DRT, you'll need to leave the page then return to it yourself.
+<br>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+<object>
+
+<object type="application/x-shockwave-flash" width="500" height="375" id="ExamplePlugin">
+    <img src="resources/apple.gif">
+</object>
+
+Some fallback text to force a renderer.
+
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object>
+</object><br><br>
+
+(Yes, the extreme number of object elements are necessary to more reliably reproduce the crash.  Leave them.)
+</body>
diff --git a/tests/tests/webkitsecurity/assets/crash-section-logical-height-changed-needsCellRecalc.html b/tests/tests/webkitsecurity/assets/crash-section-logical-height-changed-needsCellRecalc.html
new file mode 100644
index 0000000..facd6d5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-section-logical-height-changed-needsCellRecalc.html
@@ -0,0 +1,53 @@
+<style>
+.c3 { position: fixed; }
+.c12:first-letter { visibility: inherit; }
+.c12 { -webkit-appearance: button; }
+.c13 { display: table-row; }
+.c13:nth-last-child(odd) { height: 80%; }
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom() {
+    var quote = document.createElement('q');
+    document.documentElement.appendChild(quote);
+
+    base = document.createElement('base');
+    base2 = document.createElement('base');
+    base2.setAttribute('class', 'c3');
+    quote.appendChild(base2);
+
+    var ins = document.createElement('ins');
+    base2.appendChild(ins);
+
+    var sub = document.createElement('sub');
+    var quote3 = document.createElement('q');
+    quote3.setAttribute('class', 'c12');
+    sub.appendChild(quote3);
+
+    figureRow = document.createElement('figure');
+    figureRow.setAttribute('class', 'c13');
+    document.documentElement.appendChild(figureRow);
+
+    var col = document.createElement('col');
+    col.setAttribute('class', 'c13');
+    document.documentElement.appendChild(col);
+
+    var select = document.createElement('select');
+    document.documentElement.appendChild(select);
+
+    code = document.createElement('code');
+    document.documentElement.appendChild(code);
+
+    quote2 = document.createElement('q');
+    setTimeout('quote2.appendChild(code);', 321);
+    ins.appendChild(sub);
+    setTimeout('base.appendChild(figureRow);', 251);
+    text = document.createTextNode('-1435037881');
+    setTimeout('figureRow.appendChild(text);', 206);
+}
+window.onload = boom;
+</script>
+<p>Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=76842">76842</a>: Crash in WebCore::RenderTableSection::rowLogicalHeightChanged</p>
+<p>This test passes if it does not crash nor ASSERT.</p>
diff --git a/tests/tests/webkitsecurity/assets/crash-set-font.html b/tests/tests/webkitsecurity/assets/crash-set-font.html
new file mode 100644
index 0000000..108e281
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-set-font.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        oContext2d = document.getCSSCanvasContext("2d","",0,0);
+        oContext2d.font = "small-caps .0ex G";
+        oContext2d.font = "italic .0ex G";
+        oContext2d.font = "italic 400 .0ex G";
+    </script>
+</head>
+<body>
+<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=66291">66291</a>: Crash because CSSPrimitiveValue::computeLengthDouble assumes fontMetrics are available</p>
+<p>This test passed as it did not crash.</p>
diff --git a/tests/tests/webkitsecurity/assets/crash-splitColumn-2.html b/tests/tests/webkitsecurity/assets/crash-splitColumn-2.html
new file mode 100755
index 0000000..81f4573
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-splitColumn-2.html
@@ -0,0 +1,64 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.c7 { display: table-row-group; }
+.c7:nth-last-of-type(-n+6) { float: none; }
+.c21:nth-child(2n) { position: static; float: left; }
+.c26 { border-style: ridge; content: counter(section);</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function crash()
+{
+    var img = document.createElement('img');
+    img.appendChild(select);
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function insertNodes() {
+    document.documentElement.appendChild(document.createElement('a'));
+    document.documentElement.appendChild(document.createElement('dfn'));
+    document.documentElement.appendChild(document.createElement('keygen'));
+    var iframe = document.createElement('iframe');
+    iframe.setAttribute('src', 'dne.html');
+    document.documentElement.appendChild(iframe);
+    document.documentElement.appendChild(document.createElement('rp'));
+    document.documentElement.appendChild(document.createElement('ul'));
+    document.documentElement.appendChild(document.createElement('option'));
+    document.documentElement.appendChild(document.createElement('label'));
+    document.documentElement.appendChild(document.createElement('table'));
+    document.documentElement.appendChild(document.createElement('mark'));
+    document.documentElement.appendChild(document.createElement('bdo'));
+    document.documentElement.appendChild(document.createElement('colgroup'));
+    document.documentElement.appendChild(document.createElement('strong'));
+
+    select = document.createElement('select');
+    document.documentElement.appendChild(select);
+
+    var sup = document.createElement('sup');
+    sup.setAttribute('class', 'c7');
+    document.documentElement.appendChild(sup);
+    var td = document.createElement('td');
+    td.setAttribute('class', 'c21');
+    document.documentElement.appendChild(td);
+
+    var th = document.createElement('th');
+    th.setAttribute('colspan', '2');
+    th.setAttribute('class', 'c26');
+    sup.appendChild(th);
+
+    setTimeout(crash, 0);
+}
+window.addEventListener("load", insertNodes, false);
+</script>
+</head>
+<body>
+<p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p>
+<p> This test PASSES if it does not CRASH or ASSERT.</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-splitColumn-3.html b/tests/tests/webkitsecurity/assets/crash-splitColumn-3.html
new file mode 100644
index 0000000..f431b12
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-splitColumn-3.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function crash()
+{
+    var firstCell = document.getElementById("firstCell");
+    firstCell.parentNode.removeChild(firstCell);
+}
+
+window.addEventListener("load", crash, false);
+</script>
+</head>
+<body>
+<p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p>
+<p> This test PASSES if it does not CRASH or ASSERT.</p>
+<table><tr><td id="firstCell">foobar</td><td colspan="2"></td><td></td></tr></table>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-splitColumn.html b/tests/tests/webkitsecurity/assets/crash-splitColumn.html
new file mode 100755
index 0000000..43898b5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-splitColumn.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.lastTableHeaderGroup:last-of-type { display: table-header-group; }</style>
+</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function crash()
+{
+    rubyTag.appendChild(lastTableHead);
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function insertNodes() {
+    var tableHead = document.createElement('th');
+    tableHead.setAttribute('colspan', '5');
+    tableHead.setAttribute('class', 'lastTableHeaderGroup');
+    document.documentElement.appendChild(tableHead);
+    tableHead.appendChild(document.createElement('p'));
+    lastTableHead = document.createElement('th');
+    document.documentElement.appendChild(lastTableHead);
+    rubyTag = document.createElement('rt');
+    setTimeout(crash, 0);
+}
+window.addEventListener("load", insertNodes, false);
+</script>
+</head>
+<body>
+<p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=70171">70171</a>: Crash in RenderTableSection::splitColumn</p>
+<p> This test PASSES if it does not CRASH or ASSERT.</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-style-first-letter.html b/tests/tests/webkitsecurity/assets/crash-style-first-letter.html
new file mode 100644
index 0000000..fde9860
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-style-first-letter.html
@@ -0,0 +1 @@
+<svg><p>Test for https://bugs.webkit.org/show_bug.cgi?id=49316: The test PASSED if it did not crash.</p><script>if (window.layoutTestController) layoutTestController.dumpAsText();</script><use><style>:first-letter{margin-right:auto}<i><style>
diff --git a/tests/tests/webkitsecurity/assets/crash-svg-document.html b/tests/tests/webkitsecurity/assets/crash-svg-document.html
new file mode 100644
index 0000000..fe7ac42
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-svg-document.html
@@ -0,0 +1,12 @@
+<body>
+<script>
+
+if (window.layoutTestController) {
+    layoutTestController.setFrameFlatteningEnabled(true);
+    layoutTestController.dumpAsText();
+}
+
+</script>
+<iframe src="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg'></svg>"></iframe>
+Should not crash.
+</body>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/crash-table-cell-change-height.html b/tests/tests/webkitsecurity/assets/crash-table-cell-change-height.html
new file mode 100755
index 0000000..ba308d0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-table-cell-change-height.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<body>
+<table>
+<tr id="row">
+<th id="header" height="50">If this test does not crash, it has PASSED.</th>
+<th>Bug 72004: Crash in styleDidChange when changing a table cell's height.<br></th>
+</tr>
+</table>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var row = document.getElementById("row");
+var header = document.getElementById("header");
+row.parentNode.appendChild(header);
+</script>
+<script>
+header.setAttribute("height", 1);
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-text-in-textpath.svg b/tests/tests/webkitsecurity/assets/crash-text-in-textpath.svg
new file mode 100755
index 0000000..4fc2841
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-text-in-textpath.svg
@@ -0,0 +1,20 @@
+<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<text>
+    <textPath id="textPath">
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            // This triggers a layout before adding the #text node.
+            document.getElementById('textPath').scrollIntoView('foo');
+        </script>
+        foo    
+        <script>
+            // This triggers a layout after adding the #text node to fire the ASSERT.
+            document.getElementById('textPath').scrollIntoView('foo');
+        </script>
+    </textPath>
+</text>
+<text x="10" y="50">Test for bug <a xlink:href="https://bugs.webkit.org/show_bug.cgi?id=63076">63076</a>: Assertion failure in RenderSVGInlineText::characterStartsNewTextChunk</text>
+<text x="10" y="100">This test passes if it does not crash</text>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/crash-textPath-attributes-iframe.svg b/tests/tests/webkitsecurity/assets/crash-textPath-attributes-iframe.svg
new file mode 100755
index 0000000..bdad494
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-textPath-attributes-iframe.svg
@@ -0,0 +1,3 @@
+<!DOCTYPE svg>
+<?xml-stylesheet href="data:text/css,:before{content:counter(x)}"?>
+<svg xmlns="http://www.w3.org/2000/svg"><text>x<tspan>  <tspan
diff --git a/tests/tests/webkitsecurity/assets/crash-textPath-attributes.html b/tests/tests/webkitsecurity/assets/crash-textPath-attributes.html
new file mode 100755
index 0000000..0ba1be5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-textPath-attributes.html
@@ -0,0 +1,13 @@
+<iframe src="resources/crash-textPath-attributes-iframe.svg" onload="go(this)"></iframe>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function go(oIframe) {
+      var oSelection = oIframe.contentWindow.getSelection();
+      oSelection.selectAllChildren(oIframe.contentDocument);
+      oSelection.deleteFromDocument();
+    }
+</script>
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=62439">Update SVG position values on SVG DOM updates</a></p>
+<p>This test PASSES if he does not crash</p>
diff --git a/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.html b/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.html
new file mode 100644
index 0000000..28bbeb3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.html
@@ -0,0 +1,22 @@
+<html manifest="crash-when-navigating-away-then-back.manifest">
+<script>
+
+function cached()
+{
+    window.close();
+    window.opener.closedWindow();
+}
+
+function noupdate()
+{
+    window.opener.document.getElementById('result').innerHTML = 'SUCCESS';
+    window.close();
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+applicationCache.addEventListener('cached', cached, false);
+applicationCache.addEventListener('noupdate', noupdate, false);
+
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.manifest b/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.manifest
new file mode 100644
index 0000000..a9fb276
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-when-navigating-away-then-back.manifest
@@ -0,0 +1,2 @@
+CACHE MANIFEST
+crash-when-navigating-away-then-back.html
diff --git a/tests/tests/webkitsecurity/assets/crash-when-reparent-sibling.html b/tests/tests/webkitsecurity/assets/crash-when-reparent-sibling.html
new file mode 100644
index 0000000..973b12e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-when-reparent-sibling.html
@@ -0,0 +1,45 @@
+<html>
+    <head>
+        <script>
+        function runTest()
+        {
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            // Create a run-in.
+            var elem = document.createElement("div");
+            elem.id = "run-in";
+            elem.innerHTML = "run-in";
+            elem.setAttribute("style", "display: run-in");
+            document.body.appendChild(elem);
+
+            // Create a sibling block to the run-in.
+            elem = document.createElement("div");
+            elem.id = "block-sibling";
+            elem.innerHTML = "block sibling";
+            document.body.appendChild(elem);
+
+            // Trigger a re-paint.
+            document.body.offsetTop;
+
+            // Add a block child to the run-in.
+            elem = document.createElement("div");
+            elem.innerHTML = "block child";
+            elem.setAttribute("style", "display: table");
+            document.getElementById("run-in").appendChild(elem);
+            
+            // Trigger a re-paint.
+            document.body.offsetTop;
+
+            // Reparent the run-in's sibling block.
+            document.getElementById("output").appendChild(document.getElementById("block-sibling"));
+            document.getElementById("result").innerHTML = "PASS";
+        }    
+        </script>
+    </head>
+    <body onload="runTest()">
+        <div id="result"></div>
+        Output: <br/>
+        <div id="output"></div>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crash-while-loading-tag-with-pause.html b/tests/tests/webkitsecurity/assets/crash-while-loading-tag-with-pause.html
new file mode 100644
index 0000000..88db4ab
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-while-loading-tag-with-pause.html
@@ -0,0 +1,8 @@
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.setXSSAuditorEnabled(true);
+}
+</script>
+This test passes if it doesn't crash.<br>
+<iframe src="resources/tag-with-pause.php?onclick=alert(1)"></iframe>
diff --git a/tests/tests/webkitsecurity/assets/crash-with-noelement-selectbox.html b/tests/tests/webkitsecurity/assets/crash-with-noelement-selectbox.html
new file mode 100644
index 0000000..a880531
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crash-with-noelement-selectbox.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<select id="selectBox">
+</select>
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This tests that there's no crash when accessising the stringValue of a menu list that has no elements.");
+
+    if (window.accessibilityController) {
+       document.getElementById("selectBox").focus();
+       var selectBox = accessibilityController.focusedElement;
+
+       // this call should not crash. 
+       var stringValue = selectBox.stringValue;
+    }
+
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/crashing-a-tag-in-map.html b/tests/tests/webkitsecurity/assets/crashing-a-tag-in-map.html
new file mode 100644
index 0000000..74460e1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/crashing-a-tag-in-map.html
@@ -0,0 +1,38 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<div class="body">
+
+<img src="resources/cake.png" height="500" width="613" border="0" usemap="#img">
+<map id="img" name="img">
+<area shape="rect" coords="97,45,5,5" href="test.html" alt="">
+<area shape="rect" coords="447,45,5,5" href="test.html">
+<a href="test.html"></a>
+<area shape="default" nohref="nohref" alt="">
+</map></div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This tests that a hit test on a image map that has areas and anchors does not crash");
+
+    if (window.accessibilityController) {
+
+          var body = document.getElementById("body");
+          body.focus();
+
+          // test fails if it crashes here
+          var control = accessibilityController.focusedElement.elementAtPoint(100, 100);
+    }
+
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/create-blob-url-crash.html b/tests/tests/webkitsecurity/assets/create-blob-url-crash.html
new file mode 100644
index 0000000..8001244
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/create-blob-url-crash.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+function log(message)
+{
+    document.getElementById('console').appendChild(document.createTextNode(message + "\n"));
+}
+
+function test()
+{
+    log("Test that createObjectURL with no argument should throw an exception.");
+    try {
+        var url = webkitURL.createObjectURL();
+        log("FAIL");
+    } catch(err) {
+        log("PASS: " + err.message);
+    }
+
+    log("DONE");
+}
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</head>
+<body onload="test()">
+<pre id='console'></pre>
+</body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.html b/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.html
new file mode 100644
index 0000000..72250c9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/create-document-crash-on-attach-event.js"></script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.js b/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.js
new file mode 100644
index 0000000..aa5f6a1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/create-document-crash-on-attach-event.js
@@ -0,0 +1,6 @@
+description('This test checks for crashes in setting an event handler on a document element created by '
+            + 'document.implementation.createDocument.');
+
+var doc = document.implementation.createDocument('', '', null);
+doc.onload = function() { };
+testPassed('Attached onload event handler to created document.');
diff --git a/tests/tests/webkitsecurity/assets/create-pattern-does-not-crash.html b/tests/tests/webkitsecurity/assets/create-pattern-does-not-crash.html
new file mode 100644
index 0000000..e2db81d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/create-pattern-does-not-crash.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML>
+<canvas id="c"></canvas><br/>
+This test case ensures we don't crash when using canvas.createPattern
+<script>
+window.onload = function ()
+{
+    if (window.layoutTestController)
+        window.layoutTestController.dumpAsText();
+    var canvas = document.getElementById('c');
+    var ctx = canvas.getContext('2d');
+    var p = ctx.createPattern(canvas, 'no-repeat');
+}
+</script>
diff --git a/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.png b/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.png
new file mode 100644
index 0000000..3b9792c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.webarchive b/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.webarchive
new file mode 100644
index 0000000..8828aa8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash-expected.webarchive
@@ -0,0 +1,71 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>WebMainResource</key>
+	<dict>
+		<key>WebResourceData</key>
+		<string>&lt;html&gt;&lt;head&gt;
+&lt;script&gt;
+if (window.layoutTestController)
+    layoutTestController.dumpDOMAsWebArchive();
+&lt;/script&gt;
+&lt;link rel="stylesheet" href="http://localhost:8000/webarchive/resources/localhost-stylesheet.css" type="text/css"&gt;
+&lt;/head&gt;
+&lt;body&gt;
+This HTML links to an external stylesheet from a different security origin.&lt;br&gt;
+Making a webarchive of this page should not crash.
+
+
+&lt;/body&gt;&lt;/html&gt;</string>
+		<key>WebResourceFrameName</key>
+		<string></string>
+		<key>WebResourceMIMEType</key>
+		<string>text/html</string>
+		<key>WebResourceTextEncodingName</key>
+		<string>UTF-8</string>
+		<key>WebResourceURL</key>
+		<string>http://127.0.0.1:8000/webarchive/cross-origin-stylesheet-crash.html</string>
+	</dict>
+	<key>WebSubresources</key>
+	<array>
+		<dict>
+			<key>WebResourceData</key>
+			<string>
+</string>
+			<key>WebResourceMIMEType</key>
+			<string>text/css</string>
+			<key>WebResourceResponse</key>
+			<dict>
+				<key>MIMEType</key>
+				<string>text/css</string>
+				<key>URL</key>
+				<string>http://localhost:8000/webarchive/resources/localhost-stylesheet.css</string>
+				<key>allHeaderFields</key>
+				<dict>
+					<key>Accept-Ranges</key>
+					<string>bytes</string>
+					<key>Content-Length</key>
+					<string>1</string>
+					<key>Content-Type</key>
+					<string>text/css</string>
+					<key>Date</key>
+					<string>Sun, 16 Nov 2008 17:00:00 GMT</string>
+					<key>Etag</key>
+					<string>"301925-21-45c7d72d3e780"</string>
+					<key>Last-Modified</key>
+					<string>Sun, 16 Nov 2008 16:55:00 GMT</string>
+					<key>Server</key>
+					<string>Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7l PHP/5.2.6</string>
+				</dict>
+				<key>expectedContentLength</key>
+				<integer>1</integer>
+				<key>statusCode</key>
+				<integer>200</integer>
+			</dict>
+			<key>WebResourceURL</key>
+			<string>http://localhost:8000/webarchive/resources/localhost-stylesheet.css</string>
+		</dict>
+	</array>
+</dict>
+</plist>
diff --git a/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash.html b/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash.html
new file mode 100644
index 0000000..82a18e3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/cross-origin-stylesheet-crash.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpDOMAsWebArchive();
+</script>
+<link rel="stylesheet" href="http://localhost:8000/webarchive/resources/localhost-stylesheet.css" type="text/css">
+</head>
+<body>
+This HTML links to an external stylesheet from a different security origin.<br>
+Making a webarchive of this page should not crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/css-content-and-webkit-mask-box-image-crash.html b/tests/tests/webkitsecurity/assets/css-content-and-webkit-mask-box-image-crash.html
new file mode 100644
index 0000000..4f12718
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/css-content-and-webkit-mask-box-image-crash.html
@@ -0,0 +1,15 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function insertSpan() {
+        document.getElementById("container").innerHTML = "<span style=\"content:url('resources/compass.jpg'); -webkit-mask-box-image:url('resources/compass.jpg');\">FAIL</span>";
+    }
+</script>
+<body onload="insertSpan()">
+    The test passes if you see the Safari icon below.
+    <div id="container"></div>
+    <script>
+        insertSpan();
+    </script>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/css-fontface-rule-crash.html b/tests/tests/webkitsecurity/assets/css-fontface-rule-crash.html
new file mode 100644
index 0000000..0e7fb84
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/css-fontface-rule-crash.html
@@ -0,0 +1,37 @@
+<html>
+<head>
+<script src="../../resources/gc.js"></script>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function load()
+{
+    style = document.createElement('style');
+    style.textContent = '@font-face { font-family: "A"; }';
+    document.head.appendChild(style);
+    rulestyle = document.styleSheets[0].cssRules[0].style;
+    document.head.removeChild(style);
+    style = null;
+    setTimeout(crash, 0);
+}
+
+function crash()
+{
+    gc();
+    obj = rulestyle.parentRule;
+    // If the gc() actually successfully reaps everything it can, then obj
+    // will end up null (post-fix). gc() is not guaranteed to reap the font-face
+    // rule, however, particularly in the browser context.
+    if (obj)
+        obj = obj.foo;
+    document.body.innerText = 'PASS';
+    if (window.layoutTestController)
+        layoutTestController.notifyDone()
+}
+</script>
+</head>
+<body onload="load()"></body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/css-inline-style-declaration-crash.html b/tests/tests/webkitsecurity/assets/css-inline-style-declaration-crash.html
new file mode 100644
index 0000000..0bf6c0c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/css-inline-style-declaration-crash.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<script src="../js/resources/js-test-pre.js"></script>
+<script>
+description('Setting a CSSStyleDeclaration after its element has been GCed should not crash.');
+
+var span = document.createElement('span');
+var style = span.style;
+span = null;
+gc();
+style.cssText = 'color:red';
+
+testPassed('Did not crash');
+</script>
+<script src="../js/resources/js-test-post.js"></script>
diff --git a/tests/tests/webkitsecurity/assets/css-keyframe-style-crash.html b/tests/tests/webkitsecurity/assets/css-keyframe-style-crash.html
new file mode 100644
index 0000000..713043f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/css-keyframe-style-crash.html
@@ -0,0 +1,40 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+if (!window.gc)
+{
+    window.gc = function()
+    {
+        if (window.GCController)
+            return GCController.collect();
+        for (var i = 0; i < 10000; i++)
+            var s = new String("abc");
+    }
+}
+
+function load()
+{
+    style = document.createElement('style');
+    style.textContent = '@-webkit-keyframes anim { from { color: green } }';
+    document.head.appendChild(style);
+    rule = document.styleSheets[0].cssRules[0].findRule('from');
+    document.head.removeChild(style);
+    setTimeout(crash, 0);
+}
+
+function crash()
+{
+    gc();
+    obj = rule.style.parentRule;
+    if (window.layoutTestController)
+        layoutTestController.notifyDone()
+}
+</script>
+</head>
+<body onload="load()">PASS</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/css3-radial-gradient-crash.html b/tests/tests/webkitsecurity/assets/css3-radial-gradient-crash.html
new file mode 100644
index 0000000..be9ad58
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/css3-radial-gradient-crash.html
@@ -0,0 +1,11 @@
+<head>
+<script>
+if (window.layoutTestController)
+  window.layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<p>This test should not crash.</p>
+<div style="height: 10px; width: 10px; background-image: -webkit-radial-gradient(top)"></div>
+</body>
+
diff --git a/tests/tests/webkitsecurity/assets/cssTarget-crash.html b/tests/tests/webkitsecurity/assets/cssTarget-crash.html
new file mode 100644
index 0000000..db5669c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/cssTarget-crash.html
@@ -0,0 +1,30 @@
+<html>
+<body>
+<div><a href="rdar://4504805&4577323&4643028&5659812">Should not crash.</a></div>
+<form name="f" method="GET" action="#a"></form>
+<div id="anchors"><a name="a"></a></div>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+var stopped = false;
+setTimeout("doIt()", 0);
+setTimeout("stopped = true;", 100);
+function doIt() {
+    if (stopped) {
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+        return;
+    }
+    document.forms.f.submit();
+    var x=Math.random();
+    setTimeout("doIt("+x+")",10);
+    document.forms.f.action="#"+x;
+    document.getElementById("anchors").innerHTML+=
+        "<img width=100 height=100><a name=\""+x+"\"></a>";
+}
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/custom-font-data-crash.html b/tests/tests/webkitsecurity/assets/custom-font-data-crash.html
new file mode 100644
index 0000000..1ea1eeb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/custom-font-data-crash.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<body style="font: 1px ahem;">
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+setTimeout("if (window.layoutTestController) { layoutTestController.notifyDone(); }", 50);
+</script>
+<style>
+@font-face { font-family: "A"; src: url(); }
+* { font-family: A; }
+</style>
+<nobr><table><hr>PASS
+</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/custom-font-data-crash2.html b/tests/tests/webkitsecurity/assets/custom-font-data-crash2.html
new file mode 100644
index 0000000..bf1eb51
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/custom-font-data-crash2.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<style>
+@font-face { font-family: A; src: url(); }
+#y { font-family: A; }
+#y:first-letter { content: "A"; }
+</style>
+<body>
+<div id="y">EFGH</div>
+</body>
+<script>
+function finish() {
+    document.body.innerHTML = "PASS";
+	if (window.layoutTestController)
+	    layoutTestController.notifyDone();
+}
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+document.designMode = 'on';
+document.execCommand('selectall');
+
+// Let the font load to finish.
+setTimeout("finish()", 50);
+</script>
+<style>
+#y:before { content: "ABCD"; }
+</style>
+</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/dangling-form-element-crash.html b/tests/tests/webkitsecurity/assets/dangling-form-element-crash.html
new file mode 100644
index 0000000..f5d097e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/dangling-form-element-crash.html
@@ -0,0 +1,36 @@
+<html>
+  <script>
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    function gc() {
+        if (window.GCController)
+            return GCController.collect();
+        for (var i = 0; i < 10000; ++i)
+            var s = new String("foo");
+    }
+
+    function resetFormOwner() {
+        gc();
+        var form = document.createElement('form');
+        form.id = 'foo';
+        document.body.appendChild(form);
+        document.body.innerHTML += 'PASS';
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+
+    function test() {
+        var div = document.createElement('div');
+        var input = document.createElement('input');
+        input.setAttribute('form', 'foo');
+        div.appendChild(input);
+        setTimeout(resetFormOwner, 0);
+    }
+  </script>
+<body onload="test()">
+<p>Checks dangling form associated elements doesn't cause crash. WebKit should not crash when this page is loaded.</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash-expected.png b/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash-expected.png
new file mode 100644
index 0000000..b91766d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash.html b/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash.html
new file mode 100644
index 0000000..5553ed3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/dashboard-regions-attr-crash.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<p>Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=8469">http://bugs.webkit.org/show_bug.cgi?id=8469</a> CRASH: WebCore::CSSParser::parseDashboardRegions when attr() is passed</i>.</p>
+<p>If the test passes it won't crash</p> 
+<br style="-webkit-dashboard-region: dashboard-region("a");">
+<table style="-webkit-dashboard-region: attr("a");">
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/data-view-crash.html b/tests/tests/webkitsecurity/assets/data-view-crash.html
new file mode 100644
index 0000000..6fce7bc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/data-view-crash.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+description("Test that DataView does not crash with bad offset or length.");
+
+var array = new Uint8Array([164, 112, 157, 63]);
+var view;
+shouldThrow("view = new DataView(array.buffer, -4500000000)");
+shouldThrow("view = new DataView(array.buffer, -4500000000, 4500000000)");
+var value = view ? view.getFloat32(0, true) : 0;
+</script>
+
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/debugger-activation-crash.html b/tests/tests/webkitsecurity/assets/debugger-activation-crash.html
new file mode 100644
index 0000000..b405770
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/debugger-activation-crash.html
@@ -0,0 +1,42 @@
+<script src="../../http/tests/inspector/inspector-test.js"></script>
+<script src="../../http/tests/inspector/debugger-test.js"></script>
+
+<script>
+var closures = [];
+function makeClosure() {
+    var v1, v2, v3, v4, v5, v6, v7, v8, v9, v10; // Make a lot of potentially captured variables.
+    return function (){ return v1; }; // But only capture one in optimizing compiles.
+}
+
+for (var i = 0; i < 100; ++i) {
+    closures.push(makeClosure());
+}
+
+function tryCrash() {
+    makeClosure(); // Force recompilation.
+    
+    // At this point, we should have 100 activations that captured 1 variable
+    // but think they captured 10. If so, GC should make them crash.
+    if (window.GCController)
+        GCController.collect();
+    else {
+        for (var i = 0; i < 10000; ++i)
+            new Object;
+    }
+}
+
+function test() {
+    InspectorTest.startDebuggerTest(function () {
+        InspectorTest.evaluateInPage("tryCrash()");
+        InspectorTest.completeDebuggerTest();
+    });
+}
+
+window.onload = runTest;
+</script>
+
+<p>
+Tests for a crash caused by inaccurate Activation records.
+&lt;rdar://problem/8525907&gt; Crash in debugger beneath MarkStack::drain @ me.com, ibm.com
+</p>
+
diff --git a/tests/tests/webkitsecurity/assets/debugger-activation-crash2.html b/tests/tests/webkitsecurity/assets/debugger-activation-crash2.html
new file mode 100644
index 0000000..b1a718a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/debugger-activation-crash2.html
@@ -0,0 +1,54 @@
+<script src="../../http/tests/inspector/inspector-test.js"></script>
+<script src="../../http/tests/inspector/debugger-test.js"></script>
+
+<script>
+var closures = [];
+function makeClosure() {
+    var v1, v2, v3, v4, v5, v6, v7, v8, v9, v10; // Make a lot of potentially captured variables.
+    return function () { 
+        var x = v1; // But only capture one in optimizing compiles.
+        return x;
+    };
+}
+
+for (var i = 0; i < 100; ++i) {
+    closures.push(makeClosure());
+}
+
+closures[0](); // Force compilation.
+function testFunction() {
+    closures[0](); // Force recompilation.
+    
+    // At this point, closures[0] captured 1 variable but thinks it captured 10.
+    // If so, stopping at a breakpoint should make it crash.
+}
+
+function test() {
+    InspectorTest.startDebuggerTest(step1);
+
+    function step1()
+    {
+        InspectorTest.showScriptSource("debugger-activation-crash2.html", step2);
+    }
+
+    function step2(sourceFrame)
+    {
+        InspectorTest.addResult("Script source was shown.");
+        InspectorTest.setBreakpoint(sourceFrame, 8, "", true);
+        InspectorTest.runTestFunctionAndWaitUntilPaused(step3);
+    }
+
+    function step3(callFrames)
+    {
+        InspectorTest.captureStackTrace(callFrames, true);
+        InspectorTest.completeDebuggerTest();
+    }
+}
+
+window.onload = runTest;
+</script>
+
+<p>
+Tests for a crash when paused at a breakpoint caused by inaccurate Activation records.
+<a href="https://bugs.webkit.org/show_bug.cgi?id=57120">Bug 57120</a>
+</p>
diff --git a/tests/tests/webkitsecurity/assets/delayed-style-mutation-event-crash.html b/tests/tests/webkitsecurity/assets/delayed-style-mutation-event-crash.html
new file mode 100644
index 0000000..fabb7a0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/delayed-style-mutation-event-crash.html
@@ -0,0 +1,11 @@
+<html>
+<div id="foo"><p id="bar">FAILURE</p></div>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+var bar = document.getElementById("bar");
+var foo = document.getElementById("foo");
+bar.style.color = "green";
+foo.innerHTML = "SUCCESS (You didn't crash)";
+</script>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/delete-insignificant-text-crash.html b/tests/tests/webkitsecurity/assets/delete-insignificant-text-crash.html
new file mode 100644
index 0000000..cc93630
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/delete-insignificant-text-crash.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This tests deleting a node in DOMCharacterDataModified doesn't result in a crash.</p>
+<div id="test" contenteditable></div>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var test = document.getElementById('test');
+test.appendChild(document.createTextNode('a  '));
+test.appendChild(document.createTextNode('  '));
+test.appendChild(document.createTextNode('b'));
+test.appendChild(document.createTextNode('  '));
+getSelection().setPosition(test.firstChild.nextSibling, 0);
+document.body.addEventListener('DOMCharacterDataModified', function () {
+    test.removeChild(test.firstChild.nextSibling);
+    if (window.GCController)
+        GCController.collect();
+}, false);
+document.execCommand("InsertText", false, "c");
+
+test.textContent = '';
+document.writeln('PASS');
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/destroy-cell-with-selection-crash.html b/tests/tests/webkitsecurity/assets/destroy-cell-with-selection-crash.html
new file mode 100644
index 0000000..8010ef7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/destroy-cell-with-selection-crash.html
@@ -0,0 +1,17 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+Test doing display:none for a cell in table with selection. This passes if it does not crash.
+<table style="border-collapse: collapse">
+    <td id=c0></td>
+    <td id=c1></td>
+</table>
+<script>
+var c0 = document.getElementById('c0');
+var c1 = document.getElementById('c1');
+var selection = window.getSelection();
+selection.setBaseAndExtent(c0, 0, c1, 0);
+c1.style.display = 'none';
+</script>
+
diff --git a/tests/tests/webkitsecurity/assets/destroy-counter-crash.html b/tests/tests/webkitsecurity/assets/destroy-counter-crash.html
new file mode 100644
index 0000000..9601c96
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/destroy-counter-crash.html
@@ -0,0 +1,29 @@
+<html>

+  <head>

+    <style type="text/css">

+    div { counter-reset: c }

+    iframe { counter-reset: c }

+    h1:after { content: counter(c) }

+    </style>

+    <script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+

+    window.onload = function () {

+        var testElement = document.getElementById("test");

+        document.body.removeChild(testElement);

+        var p = document.createElement("p");

+        p.appendChild(document.createTextNode("TEST PASSED"));

+        document.body.appendChild(p);

+    }

+    </script>

+  </head>

+  <body>

+  This test is to ensure that we do not crash when destroying counter nodes.

+    <div id="test">

+      <iframe/>

+      <h1/>

+    </div>

+  </body>

+</html>

+ 

diff --git a/tests/tests/webkitsecurity/assets/destroy-selected-radio-button-crash.html b/tests/tests/webkitsecurity/assets/destroy-selected-radio-button-crash.html
new file mode 100644
index 0000000..04b65a6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/destroy-selected-radio-button-crash.html
@@ -0,0 +1,17 @@
+<html>
+<script>
+function runTest() {
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    document.getElementById('container').innerHTML = '';
+    document.getElementById('radio').checked = true;
+}
+</script>
+<body onload="runTest()">
+    <div>This tests that destroying a checked radio button that does not have a form correctly removes the radio button element from the checked radio buttons map. This test should ideally be run with GuardMalloc or a similar memory checker.</div>
+    <div>SUCCESS - Didn't crash!</div>
+    <div id="container"><input name="a" type="radio" checked></div>
+    <input name="a" id="radio" type="radio">
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/detached-object-notification-crash.html b/tests/tests/webkitsecurity/assets/detached-object-notification-crash.html
new file mode 100644
index 0000000..da90024
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/detached-object-notification-crash.html
@@ -0,0 +1,48 @@
+<html>
+<head>
+    <script src="../../../fast/js/resources/js-test-pre.js"></script>
+</head>
+
+<body id="body">
+
+<input id="avnElement">
+<input id="avnElement2">
+
+<p>This tests that posting a notification for a deleted element does
+not cause a crash.</p>
+
+<p id="notDRT">This test should only be run inside of DumpRenderTree.</p>
+
+<p id="console"></p>
+
+<script>
+    function notificationReceived(event)
+    {
+        if (event != "value change event")
+            return;
+
+        debug("PASS: Didn't crash.");
+        layoutTestController.notifyDone();
+    }
+    if (window.layoutTestController && window.accessibilityController) {
+        document.getElementById("notDRT").style.visibility = "hidden";
+
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+
+        var element = document.getElementById("avnElement");
+        element.focus();
+
+        element.setAttribute("aria-valuenow", 2);
+        document.getElementById("body").removeChild(element);
+
+        var element2 = document.getElementById("avnElement2");
+        element2.focus();
+
+        accessibilityController.focusedElement.addNotificationListener(notificationReceived);
+
+        element2.setAttribute("aria-valuenow", 2);
+    }
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/detached-outermost-svg-crash.html b/tests/tests/webkitsecurity/assets/detached-outermost-svg-crash.html
new file mode 100644
index 0000000..08be168
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/detached-outermost-svg-crash.html
@@ -0,0 +1,13 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+for (prop in svg) {
+    // Access all the properties on the <svg> element
+    // at least one of them (like viewport) will call SVGSVGElement::isOutermostSVG()
+    // and will trigger the crash seen in https://bugs.webkit.org/show_bug.cgi?id=25105
+    svg[prop];
+}
+</script>
+<div>PASSED -- webkit did not crash in SVGSVGElement::isOutermostSVG().  See https://bugs.webkit.org/show_bug.cgi?id=25105</div>
diff --git a/tests/tests/webkitsecurity/assets/details-children-merge-crash.html b/tests/tests/webkitsecurity/assets/details-children-merge-crash.html
new file mode 100644
index 0000000..6e82056
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/details-children-merge-crash.html
@@ -0,0 +1,31 @@
+
+<script>
+
+var runTests = function () {
+
+    if (!window.layoutTestController)
+        return;
+
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+
+    var d = document.getElementById("d1");
+
+    setTimeout(function () {
+        d.open = false;
+        setTimeout(function () {
+            d.open = true;
+            setTimeout(function () {
+                d.open = false;
+                layoutTestController.notifyDone();
+            }, 1);
+        }, 1);
+    }, 1);
+};
+
+</script>
+
+<body onload="runTests()">
+    Test passes if it does not crash.
+    <li><details open id="d1">some text</details></li>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/details-element-render-inline-crash.html b/tests/tests/webkitsecurity/assets/details-element-render-inline-crash.html
new file mode 100644
index 0000000..159cf0d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/details-element-render-inline-crash.html
@@ -0,0 +1,14 @@
+<html>

+<head>

+<script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+</script>

+</head>

+<body>

+<style>

+   .control { display: inline; }

+</style>

+PASS<details class="control"><p><a></p></details>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/device-orientation-crash.html b/tests/tests/webkitsecurity/assets/device-orientation-crash.html
new file mode 100644
index 0000000..3127634
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/device-orientation-crash.html
@@ -0,0 +1,45 @@
+<html>

+<script>

+var frame;

+

+if (!window.gc) {

+    window.gc = function() {

+        if (window.GCController)

+            return GCController.collect();

+        for (var i = 0; i < 10000; i++) {

+            var s = new String("abc");

+        }

+    }

+}

+

+function done() {

+    document.body.innerHTML = 'PASS: handler not supported or did not crash when removing Windows during ondeviceorientation event';

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+

+function remove() {

+    frame = null;

+    document.body.innerHTML = '';

+    gc();

+    setTimeout(done, 0);

+}

+

+function crash() {

+    if (window.layoutTestController) {

+        layoutTestController.dumpAsText();

+        layoutTestController.waitUntilDone();

+    }

+

+    frame = document.createElement('iframe');

+    document.body.appendChild(frame);

+

+    if (!frame.contentWindow.ondeviceorientation)

+        done();

+    else

+        frame.contentWindow.ondeviceorientation = remove;

+}

+</script>

+<body onload="crash()">

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/dirty-inline-textbox-crash.html b/tests/tests/webkitsecurity/assets/dirty-inline-textbox-crash.html
new file mode 100644
index 0000000..d0cc04b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/dirty-inline-textbox-crash.html
@@ -0,0 +1,21 @@
+<html>

+    <head>

+        <style>

+            .box

+            {

+                display: run-in; 

+                -webkit-padding-start: 10000;

+            }

+        </style>

+    </head>

+    <body>

+        <div class="box">PASS</div>

+        <div class="box"></div>

+        <div class="box"></div>

+        <div></div>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+        </script>

+    </body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/dispatchEvent-crash.html b/tests/tests/webkitsecurity/assets/dispatchEvent-crash.html
new file mode 100644
index 0000000..b55e248
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/dispatchEvent-crash.html
@@ -0,0 +1,36 @@
+<p>This is a test for https://bugs.webkit.org/show_bug.cgi?id=21063 (NULL pointer crash in dispatchEvent(null)).  It passes if it does not crash.</p>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    // FIXME: this should also test WorkerContext and MessagePort.
+    var eventTargets = [new XMLHttpRequest, (new XMLHttpRequest).upload, window.applicationCache, new Worker("about:blank"), document.body];
+
+    for (var i = 0; i < eventTargets.length; ++i) {
+        eventTarget = eventTargets[i];
+        try {
+            eventTarget.dispatchEvent(null);
+        } catch(e) {
+        }
+    
+        try {
+            eventTarget.dispatchEvent(undefined);
+        } catch(e) {
+        }
+    
+        try {
+            eventTarget.dispatchEvent("string");
+        } catch(e) {
+        }
+    
+        try {
+            eventTarget.dispatchEvent(0);
+        } catch(e) {
+        }
+    
+        try {
+            eventTarget.dispatchEvent({});
+        } catch(e) {
+        }
+    }
+</script>
diff --git a/tests/tests/webkitsecurity/assets/display-none-inline-style-change-crash.html b/tests/tests/webkitsecurity/assets/display-none-inline-style-change-crash.html
new file mode 100644
index 0000000..0e44873
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/display-none-inline-style-change-crash.html
@@ -0,0 +1,16 @@
+<style>
+    /* dummy descendant rule */
+    span li { color: red; }
+</style>
+<p>
+    Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=15887">http://bugs.webkit.org/show_bug.cgi?id=15887</a> REGRESSION (r27576): Crash in RenderStyle::affectedByHoverRules clicking link on Digg</i>.
+</p>
+<p>
+    This test should not crash.
+</p>
+<div id="target" style="display: none;"></div>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    document.getElementById("target").style.color = "blue";
+</script>
diff --git a/tests/tests/webkitsecurity/assets/div-within-anchors-causes-crash.html b/tests/tests/webkitsecurity/assets/div-within-anchors-causes-crash.html
new file mode 100644
index 0000000..7d4c266
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/div-within-anchors-causes-crash.html
@@ -0,0 +1,66 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> 
+<html> 
+<head>
+<script> 
+
+    function buildAccessibilityTree(accessibilityObject, indent) {
+        var str = "";
+        for (var i = 0; i < indent; i++)
+            str += "    ";
+        str += accessibilityObject.role;
+        str += " " + accessibilityObject.stringValue;
+        str += "\n";
+        document.getElementById("tree").innerText += str;
+
+        if (accessibilityObject.stringValue.indexOf('End of test') >= 0)
+            return false;
+
+        var count = accessibilityObject.childrenCount;
+        for (var i = 0; i < count; ++i) {
+            if (!buildAccessibilityTree(accessibilityObject.childAtIndex(i), indent + 1))
+                return false;
+        }
+
+        return true;
+    }
+</script> 
+<script src="../fast/js/resources/js-test-pre.js"></script> 
+</head> 
+<body> 
+ 
+<a><div></div></a>
+
+<a><div></div></a>
+
+<a href="about:blank"><div></div></a> 
+
+<div>End of test</div>
+
+<pre id="tree"></pre>
+ 
+<p id="description"></p> 
+<div id="console"></div> 
+ 
+<script> 
+    description("This can cause a crash.");
+ 
+    if (window.accessibilityController) {
+        // First build up full accessibility tree.
+        document.getElementById("tree").innerText += "Before:\n";
+        document.body.focus();
+        buildAccessibilityTree(accessibilityController.focusedElement, 0);
+        
+        // Remove anchor that causes debug assert in AccessibilityRenderObject::addChildren
+        document.body.removeChild(document.body.children[2])
+        
+        // Build up full accessibility tree again.
+        document.getElementById("tree").innerText += "After:\n";
+        document.body.focus();
+        buildAccessibilityTree(accessibilityController.focusedElement, 0);
+    }
+ 
+</script> 
+ 
+<script src="../fast/js/resources/js-test-post.js"></script> 
+</body> 
+</html> 
diff --git a/tests/tests/webkitsecurity/assets/doctype-event-listener-crash.html b/tests/tests/webkitsecurity/assets/doctype-event-listener-crash.html
new file mode 100644
index 0000000..8e849d4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/doctype-event-listener-crash.html
@@ -0,0 +1,11 @@
+<p>This page tests for a crash when adding an event listener to a doctype node.</p>
+<p>If the test passes, you'll see a PASS message below.</p>
+
+<pre>PASS: You didn't crash.</pre>
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+var doctype = document.implementation.createDocumentType("html", 0, 0);
+doctype.addEventListener("click", function () { }, false);
+</script>
diff --git a/tests/tests/webkitsecurity/assets/document-deactivation-callback-crash.html b/tests/tests/webkitsecurity/assets/document-deactivation-callback-crash.html
new file mode 100644
index 0000000..d8b535e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/document-deactivation-callback-crash.html
@@ -0,0 +1,41 @@
+<p>
+    Test for a crash when deactivating a document that had adopted a &lt;form>
+    element.
+</p>
+<p>
+    The test passed if it did not crash.
+</p>
+<iframe id="iframe"></iframe>
+<script>
+    var iframe = document.getElementById("iframe");
+
+    onload = function()
+    {
+        if (window.layoutTestController) {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+        }
+
+        document.body.offsetTop;
+        var otherDocument = iframe.contentDocument;
+        var form = document.createElement("form");
+        otherDocument.adoptNode(form);
+        form = null;
+        setTimeout(finish, 0);
+    }
+
+    function finish()
+    {
+        if (window.GCController)
+            GCController.collect()
+        else {
+            for (var i = 0; i < 10000; i++)
+                var foo = { };
+        }
+
+        iframe.parentNode.removeChild(iframe);
+
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+</script>
diff --git a/tests/tests/webkitsecurity/assets/domstring-replace-crash.html b/tests/tests/webkitsecurity/assets/domstring-replace-crash.html
new file mode 100644
index 0000000..3862982
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/domstring-replace-crash.html
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="EUC-JP"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" lang="en">
+<head>
+<script type="text/javascript">
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<title>
+</title>
+</head>
+<body>
+<p>
+This test checks for a regression against
+<i><a href="https://bugs.webkit.org/show_bug.cgi?id=6236">https://bugs.webkit.org/show_bug.cgi?id=6236</a> REGRESSION: Crash in DOMString::replace() in ToT (12/25/05)</i>.
+</p>
+No crash = test PASS.
+</p>
+<form>
+<input type="text"/>
+</form>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/domurl-script-execution-context-crash.html b/tests/tests/webkitsecurity/assets/domurl-script-execution-context-crash.html
new file mode 100644
index 0000000..36f2d19
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/domurl-script-execution-context-crash.html
@@ -0,0 +1,30 @@
+<html>
+<script>
+function crash()
+{
+    try {
+        e.apply(w, ['webkitURL']);
+    } catch (ex) { }
+    document.body.innerHTML = "PASS: null security context for DOMURL did not crash";
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function load()
+{
+    w.close();
+    setTimeout(crash, 30);
+}
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.setCanOpenWindows();
+    layoutTestController.setCloseRemainingWindowsWhenComplete(true);
+    layoutTestController.waitUntilDone();
+}
+
+e = (w = open()).eval;
+</script>
+<body onload="load()">
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/dont-crash-with-null-gif-frames.html b/tests/tests/webkitsecurity/assets/dont-crash-with-null-gif-frames.html
new file mode 100644
index 0000000..a630c3c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/dont-crash-with-null-gif-frames.html
@@ -0,0 +1,6 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+This tests passes if it doesn't crash.<br>
+<img src=resources/quicksort.gif>
diff --git a/tests/tests/webkitsecurity/assets/double-merge-anonymous-block-crash.html b/tests/tests/webkitsecurity/assets/double-merge-anonymous-block-crash.html
new file mode 100644
index 0000000..949ddc9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/double-merge-anonymous-block-crash.html
@@ -0,0 +1,27 @@
+<html>

+    <head>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+        </script>

+    </head>

+    <style>

+    div { 

+        border: 5px solid maroon; 

+        -webkit-column-count: 2;

+        margin: 1em 0;

+    }

+    summary { 

+        -webkit-column-span: all;

+        background-color: #eeeeee;

+        color: black;

+    }

+    </style>

+    <body onload="document.open(); document.write('PASS, does not crash'); document.close();">

+        <div>

+            <label>AAA

+            <summary>BBB

+        </div>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/doubleclick-crash-expected.png b/tests/tests/webkitsecurity/assets/doubleclick-crash-expected.png
new file mode 100644
index 0000000..ee6421a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/doubleclick-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/doubleclick-crash.html b/tests/tests/webkitsecurity/assets/doubleclick-crash.html
new file mode 100644
index 0000000..2acac37
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/doubleclick-crash.html
@@ -0,0 +1,52 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+     layoutTestController.dumpEditingCallbacks();
+</script>
+
+<style>
+body { margin: 0; padding: 0 }
+</style>
+<script type="text/javascript">
+function step4()
+{
+    eventSender.mouseUp();
+    layoutTestController.notifyDone();
+}
+
+function step3()
+{
+    eventSender.mouseDown();
+    window.setTimeout(step4, 1);
+}
+
+function step2()
+{
+    eventSender.mouseUp();
+    window.setTimeout(step3, 100);
+}
+
+function step1()
+{
+    eventSender.mouseDown();
+    window.setTimeout(step2, 1);
+}
+
+function step0()
+{
+    eventSender.mouseMoveTo(50, 10);
+    window.setTimeout(step1, 1);
+}
+
+step0();
+layoutTestController.waitUntilDone();
+</script>
+</head>
+<body>
+<pre>
+Test.
+Test.
+</body>
+</html>
+<!-- http://bugzilla.opendarwin.org/show_bug.cgi?id=3739 - only testing for crashing, not the actual results. -->
diff --git a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash-expected.png b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash-expected.png
new file mode 100644
index 0000000..6f484eb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash.html b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash.html
new file mode 100644
index 0000000..31a60fb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-crash.html
@@ -0,0 +1,30 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+     layoutTestController.dumpAsText();
+     layoutTestController.setSmartInsertDeleteEnabled(false);
+     layoutTestController.setSelectTrailingWhitespaceEnabled(true);
+}
+</script>
+</head>
+<body>
+<pre>
+Double-click in the white space below this text block -- should not crash.
+<a href="https://bugs.webkit.org/show_bug.cgi?id=23232">BUG 23232</a>.
+</pre> 
+<script type="text/javascript">
+    if (window.layoutTestController) {
+        // Double click at the end of the body.
+        eventSender.mouseMoveTo(10, 100);
+        eventSender.mouseDown();
+        eventSender.mouseUp();
+        eventSender.mouseDown();
+        eventSender.mouseUp();
+
+        // As long as didn't crash, we passed.
+        document.write("PASS");
+    }
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash-expected.png b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash-expected.png
new file mode 100644
index 0000000..5cbdfe9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash.html b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash.html
new file mode 100644
index 0000000..a63f89e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/doubleclick-whitespace-img-crash.html
@@ -0,0 +1,39 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+     layoutTestController.dumpAsText();
+     layoutTestController.setSmartInsertDeleteEnabled(false);
+     layoutTestController.setSelectTrailingWhitespaceEnabled(true);
+     layoutTestController.waitUntilDone();
+}
+
+function startTest() {
+     if (window.layoutTestController) {
+          // The IFRAME has loaded with an image in it. Double click
+          // in any of the space around the image in the IFRAME.
+          // (The image is 76 x 103 pixels big).
+          eventSender.mouseMoveTo(150, 150);
+          eventSender.mouseDown();
+          eventSender.mouseUp();
+          eventSender.mouseDown();
+          eventSender.mouseUp();
+
+          // As long as didn't crash, we passed.
+          document.body.innerHTML = "PASS";
+          layoutTestController.notifyDone();
+     }
+}
+</script>
+</head>
+<body onload="startTest()">
+
+<iframe src="../resources/abe.png" style="width: 300px; height: 300px"></iframe>
+
+<p>
+Double-click in the white space around the image -- should not crash or access invalid memory.
+<a href="https://bugs.webkit.org/show_bug.cgi?id=25335">BUG 25335</a>.
+</p> 
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/drag-and-drop-dataTransfer-types-nocrash.html b/tests/tests/webkitsecurity/assets/drag-and-drop-dataTransfer-types-nocrash.html
new file mode 100644
index 0000000..2128e40
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/drag-and-drop-dataTransfer-types-nocrash.html
@@ -0,0 +1,138 @@
+<html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+<style>
+#dropTarget, #dragMe { text-align: center; display: table-cell; vertical-align: middle }
+#dropTarget {width: 256px; height: 256px; border: 1px dashed}
+#dragMe {-webkit-user-drag: element; -webkit-user-select: none; background: #ff0000; width: 64px; height: 64px; color: white}
+</style>
+<script>
+    var dragMe;
+    var dropTarget;
+    var consoleElm;
+    var event;
+    
+    var FORMAT_TYPE = 'text/plain';
+    var ALLOWED_EFFECT = 'copy';
+    var DROP_EFFECT = 'copy';
+    
+    window.onload = function()
+    {
+        dragMe = document.getElementById("dragMe");
+        dropTarget = document.getElementById("dropTarget");
+        consoleElm = document.getElementById("console");
+        
+        if (!dragMe || !dropTarget || !consoleElm)
+            return;
+        
+        dragMe.ondragstart = dragStart;
+        dragMe.ondragend = dragEnd;
+        
+        dropTarget.ondragenter = dragEntered;
+        dropTarget.ondragover = dragOver;
+        dropTarget.ondrop = drop;
+        
+        runTest();
+    }
+    
+    function dragStart(e)
+    {
+        event = e;
+        e.dataTransfer.effectAllowed = ALLOWED_EFFECT;
+        e.dataTransfer.setData(FORMAT_TYPE, e.target.textContent);
+    }
+    
+    function dragEnd(e)
+    {
+        return;
+    }
+    
+    function dragEntered(e)
+    {
+        dragEnteredAndUpdated(e);
+    }
+    
+    function dragOver(e)
+    {
+        dragEnteredAndUpdated(e);
+    }
+    
+    function dragEnteredAndUpdated(e)
+    {
+        event = e;
+        e.dataTransfer.dropEffect = DROP_EFFECT;
+        cancelDrag(e);
+    }
+    
+    function drop(e)
+    {
+        checkFormatType(e);
+        cancelDrag(e);
+    }
+    
+    function cancelDrag(e)
+    {
+        if (e.preventDefault)
+            e.preventDefault();
+        else {
+            // Assume this script is executing within Internet Explorer
+            e.returnValue = false;
+        }
+    }
+    
+    function checkFormatType(e)
+    {
+        event = e;
+        var formatTypes = e.dataTransfer.types; // This line causes the crash.
+        if (event.dataTransfer.types.indexOf(FORMAT_TYPE) == -1)
+            testFailed('event.dataTransfer.types should contain format "' + FORMAT_TYPE + '", but it does not.');
+        else
+            testPassed('event.dataTransfer.types contains format "' + FORMAT_TYPE + '"');
+
+        if (event.dataTransfer.getData(FORMAT_TYPE) != 'Square')
+            testFailed('event.dataTransfer.getData("' + FORMAT_TYPE + '") should contain "Square", but it does not.');
+        else
+            testPassed('event.dataTransfer.getData("' + FORMAT_TYPE + '") contains "Square"');
+    }
+
+    function runTest()
+    {
+        if (!window.eventSender)
+            return;
+            
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+            
+        var startX = dragMe.offsetLeft + 10;
+        var startY = dragMe.offsetTop + dragMe.offsetHeight / 2;
+        var endX = dropTarget.offsetLeft + 10;
+        var endY = dropTarget.offsetTop + dropTarget.offsetHeight / 2;
+        
+        eventSender.mouseMoveTo(startX, startY);
+        eventSender.mouseDown();
+        eventSender.leapForward(100);
+        eventSender.mouseMoveTo(endX, endY);
+        eventSender.mouseUp();
+        
+        var testContainer = document.getElementById("test-container");
+        if (testContainer)
+            document.body.removeChild(testContainer);
+        debug('<br /><span class="pass">TEST COMPLETE</span>');
+    }
+</script>
+</head>
+<body>
+    <p id="description"></p>
+    <div id="test-container">
+        <div id="dropTarget">Drop the red square onto me.</div>
+        <hr/>
+        <p>Items that can be dragged to the drop target:</p>
+        <div id="dragMe" draggable="true">Square</div>
+        <hr/>
+    </div>
+    <div id="console"></div>
+    <script>
+        description("This test checks that on a successful drop we can access <code>event.dataTransfer.types</code> without crashing.");
+    </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/drag-drop-iframe-refresh-crash.html b/tests/tests/webkitsecurity/assets/drag-drop-iframe-refresh-crash.html
new file mode 100644
index 0000000..d7311d7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/drag-drop-iframe-refresh-crash.html
@@ -0,0 +1,58 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+}
+
+function log(message) {
+    var console = document.getElementById("console");
+    var li = document.createElement("li");
+    var text = document.createTextNode(message);
+    
+    console.appendChild(li);
+    li.appendChild(text);
+}
+
+function runTest() {
+
+    var doc = window.frames[0].document;
+    e = doc.getElementById("dragme");
+    xdrag = e.offsetLeft + e.offsetWidth / 2;
+    ydrag = e.offsetTop + e.offsetHeight / 2;
+    e = doc.getElementById("target");
+    xdrop = e.offsetLeft + e.offsetWidth / 2;
+    ydrop = e.offsetTop + e.offsetHeight / 2;
+
+    var timer = setInterval(function() {
+                                window.frames[0].location = "../resources/drag-drop.html";
+                            }, 100);
+
+    if (!window.layoutTestController) {
+        log("This test uses eventSender. To run it manually, drag the selected image to another position in the editable div and drop it. Renderer should not crash.");
+        return;
+    }
+    
+    var max_tries = 50; 
+    for (i = 0; i < max_tries; i++) {
+         eventSender.mouseMoveTo(xdrag, ydrag);
+         eventSender.mouseDown();    
+         eventSender.mouseMoveTo(xdrop, ydrop);
+         eventSender.mouseUp();
+    }
+
+    clearInterval(timer);
+
+    document.write("<p>Bug 37618: Crash when an image drag-drop operation happens inside a continuously refreshing iframe.</p>");
+    document.write("<p>SUCCESS</p>");
+
+    layoutTestController.notifyDone();
+}
+</script>
+</head>
+<body onload="runTest()">
+<iframe src="../resources/drag-drop.html"></iframe>
+<ul id="console"></ul>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/drag-file-crash.html b/tests/tests/webkitsecurity/assets/drag-file-crash.html
new file mode 100644
index 0000000..4250be2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/drag-file-crash.html
@@ -0,0 +1,32 @@
+<style>
+    #scroller {
+        height: 1000px;
+    }
+</style>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function moveMouseToCenterOfElement(element)
+    {
+        var centerX = element.offsetLeft + element.offsetWidth / 2;
+        var centerY = element.offsetTop + element.offsetHeight / 2;
+        eventSender.mouseMoveTo(centerX, centerY);
+    }
+
+    function run()
+    {
+        window.scrollBy(0, 1000);
+        if (window.eventSender) {
+            eventSender.beginDragWithFiles(["resources/abe.png"]);
+            var fileInput = document.getElementById('file');
+            moveMouseToCenterOfElement(fileInput);
+            eventSender.mouseUp();
+        }
+    }
+</script>
+<body onload="run()">
+<div id="scroller"></div>
+<input type="file" id="file">
+This is a test for https://bugs.webkit.org/show_bug.cgi?id=29276. It passes if it does not crash. If not run from DRT, drag a file onto the file input.
+</body>
diff --git a/tests/tests/webkitsecurity/assets/drag-over-iframe-invalid-source-crash.html b/tests/tests/webkitsecurity/assets/drag-over-iframe-invalid-source-crash.html
new file mode 100644
index 0000000..3d37326
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/drag-over-iframe-invalid-source-crash.html
@@ -0,0 +1,22 @@
+<head>
+<script>
+window.onload = function () {
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText(); 
+
+    var abe = document.getElementById("abe");
+    var dragTarget = document.getElementById("dragTarget");
+
+    eventSender.mouseMoveTo(abe.offsetLeft + 50, abe.offsetTop + 50);
+    eventSender.mouseDown();
+    eventSender.leapForward(500);
+    eventSender.mouseMoveTo(dragTarget.offsetLeft + 10, dragTarget.offsetTop + 10);
+    eventSender.mouseUp();
+}
+</script>
+</head>
+
+<p>This page tests that we don't crash if we drag something to an iframe that has an invalid source.</p>
+<img id="abe" src="http://127.0.0.1:8000/security/resources/abe.png">
+<div>SUCCESS - didn't crash</div>
+<iframe id="dragTarget" src="file:"></iframe> 
diff --git a/tests/tests/webkitsecurity/assets/duplicate-html-element-crash.html b/tests/tests/webkitsecurity/assets/duplicate-html-element-crash.html
new file mode 100644
index 0000000..216f1a9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/duplicate-html-element-crash.html
@@ -0,0 +1,17 @@
+<body onload="runTest()">
+<script>
+function runTest() {
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+        
+    var div = document.createElement('div');
+    div.appendChild(document.body.parentElement);
+    var a = document.createElement('a');
+    a.innerHTML = '<x><html></html>'; 
+    
+    document.appendChild(document.createElement('html'))
+    document.documentElement.innerHTML='<div>This tests that we won\'t crash when creating a new html element when the document does not ' +
+        'have a document element.</div><div>SUCCESS - Did not crash!</div>'
+}
+</script>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/duplicate-param-crash.html b/tests/tests/webkitsecurity/assets/duplicate-param-crash.html
new file mode 100644
index 0000000..859a901
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/duplicate-param-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/duplicate-param-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/duplicate-param-crash.js b/tests/tests/webkitsecurity/assets/duplicate-param-crash.js
new file mode 100644
index 0000000..6b9a1df
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/duplicate-param-crash.js
@@ -0,0 +1,19 @@
+description(
+'Tests to ensure that activations are built correctly in the face of duplicate parameter names and do not cause crashes.'
+);
+
+function test1(a, b, b, b, b, b, b) {
+    return function() {
+        return a;
+    }
+}
+
+shouldBe('test1("success")()', '"success"');
+
+function test2(a, a, a, a, a, a, b) {
+    return function() {
+        return b;
+    }
+}
+
+shouldBe('test2("success", "success", "success", "success", "success", "success", "success")()', '"success"');
diff --git a/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.html b/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.html
new file mode 100644
index 0000000..40cedfc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/duplicate-param-gc-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.js b/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.js
new file mode 100644
index 0000000..c11806a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/duplicate-param-gc-crash.js
@@ -0,0 +1,47 @@
+description(
+'Tests to ensure that activations are built correctly in the face of duplicate parameter names and do not cause crashes.'
+);
+
+function gc()
+{
+    if (this.GCController)
+        GCController.collect();
+    else
+        for (var i = 0; i < 10000; ++i) // Allocate a sufficient number of objects to force a GC.
+            ({});
+}
+
+function eatRegisters(param)
+{
+    if (param > 10)
+        return;
+    eatRegisters(param + 1);
+}
+
+function test1(a, b, b, b, b, b, b) {
+    return function() {
+        return a[0];
+    }
+}
+
+var test1Closure = test1(["success"]);
+
+var extra = test1("success");
+eatRegisters(0);
+gc();
+
+shouldBe('test1Closure()', '"success"');
+
+function test2(a, a, a, a, a, a, b) {
+    return function() {
+        return b[0];
+    }
+}
+
+var test2Closure = test2("success", "success", "success", "success", "success", "success", ["success"]);
+extra =  test2("success", "success", "success", "success", "success", "success", ["success"]);
+
+eatRegisters(0);
+gc();
+
+shouldBe('test2Closure()', '"success"');
diff --git a/tests/tests/webkitsecurity/assets/dynamic-marker-crash-expected.png b/tests/tests/webkitsecurity/assets/dynamic-marker-crash-expected.png
new file mode 100644
index 0000000..2dfcdd8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/dynamic-marker-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/dynamic-marker-crash.html b/tests/tests/webkitsecurity/assets/dynamic-marker-crash.html
new file mode 100644
index 0000000..94dc792
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/dynamic-marker-crash.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
+     "http://www.w3.org/TR/html4/strict.dtd">
+<html>
+	<head>
+		<title>Test</title>
+		<script type="text/javascript">
+			function displayOnOff(el)
+			{
+		  		el.style.display = (el.style.display == 'block') ? 'none' : 'block';
+			}
+		</script>
+	</head>
+	<body>
+		
+	<!-- Removing the <ul> and <li> elements will make this work in Safari! -->
+	<ul>
+	  <li> 
+		<form action="./" id="myform" method="get" style="display:none">
+			<p><input id="tag_list" name="tag_list"	size="40" type="text" value="blah blubb" >
+			</p>
+		</form>
+		<p>There should be an input field above this line of text.</a></p>
+	  </li>
+	</ul>
+<script>
+document.body.offsetLeft
+displayOnOff(document.getElementById('myform'))
+document.body.offsetLeft
+</script>
+	</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/editable-non-editable-crash-expected.png b/tests/tests/webkitsecurity/assets/editable-non-editable-crash-expected.png
new file mode 100644
index 0000000..b59174d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/editable-non-editable-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/editable-non-editable-crash.html b/tests/tests/webkitsecurity/assets/editable-non-editable-crash.html
new file mode 100644
index 0000000..88d8328
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/editable-non-editable-crash.html
@@ -0,0 +1,20 @@
+<head>
+<script>
+if (window.layoutTestController)
+     layoutTestController.dumpEditingCallbacks();
+</script>
+<style>
+table, td {
+    border: 1px solid #aaa;
+}
+</style></head>
+<body>
+<div contenteditable="true"><table style="border: 1px solid #aaa" id="base"><tr><td id="extent" contenteditable="false">This tests for a Mail crasher that happened when a selection was created with one endpoint in non-editable content and the other in editable content.</td></tr></table></div>
+
+<script>
+var s = window.getSelection();
+var b = document.getElementById("base");
+var e = document.getElementById("extent");
+s.setBaseAndExtent(b, 0, e, 0);
+</script>
+</body>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/editing-command-while-executing-typing-command-crash.html b/tests/tests/webkitsecurity/assets/editing-command-while-executing-typing-command-crash.html
new file mode 100644
index 0000000..ada1db0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/editing-command-while-executing-typing-command-crash.html
@@ -0,0 +1,18 @@
+<script>
+window.onload = function() {
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    document.execCommand("selectall", false);
+    document.designMode="on";
+    document.execCommand("insertparagraph", false);
+    document.execCommand("InsertText", false);
+
+    document.firstChild.appendChild(document.createElement('body'));
+    document.body.innerText = "This tests executing an editing command while executing a typing command.\nPASS";
+};
+
+document.addEventListener("DOMNodeRemovedFromDocument",
+    function() { document.execCommand("JustifyNone", false); },true);
+
+</script>
diff --git a/tests/tests/webkitsecurity/assets/editing-nontext-node-crash.xhtml b/tests/tests/webkitsecurity/assets/editing-nontext-node-crash.xhtml
new file mode 100644
index 0000000..964b5f1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/editing-nontext-node-crash.xhtml
@@ -0,0 +1,36 @@
+<html xmlns="http://www.w3.org/1999/xhtml">

+    <head> 

+        <script>//<![CDATA[

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+

+            var selection = window.getSelection();

+            function runEditingTest() {

+                var elem = document.getElementById("test2");

+                selection.setPosition(elem, 0);

+                for (i = 0; i < 21; i++)

+                    selection.modify("move", "forward", "character");

+                document.execCommand("Delete");

+                

+                // Test completed without crash.

+                document.getElementById("test1").removeChild(elem);

+                document.getElementById("result").innerHTML = "PASS";

+            }

+        //]]></script>                   

+    </head>  

+    <body onload="runEditingTest()">

+        <p>This tests passes if it does not crash.</p>

+        <div id="result"></div>

+        <div id="test1" contenteditable="">

+            <span id="test2">Something Something <br/>

+                <svg xmlns="http://www.w3.org/2000/svg">

+                    <html xmlns="http://www.w3.org/1999/xhtml">

+                        <body>

+                        </body>

+                    </html>

+                </svg>

+            </span>

+        </div>

+    </body>  

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/element-instance-held-by-js-crash.svg b/tests/tests/webkitsecurity/assets/element-instance-held-by-js-crash.svg
new file mode 100644
index 0000000..ddf4690
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/element-instance-held-by-js-crash.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <script>
+    <![CDATA[
+    window.onload = function() {
+        // Grab a reference to an SVGElementInstance native object. This reference will prevent the
+        // object from deletion when the shadow DOM is removed due to a style change.
+        instance = document.getElementById("use_elem").instanceRoot;
+
+        // Setting an attribute forces re-creation of the shadow DOM
+        document.getElementById("circleID").setAttribute("cx", 30);
+
+        // The animate element tries to modify the element, which tries to update the
+        // instances in the circle, which crashes if it holds a pointer to a non-existent element.
+
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    }
+    //]]>
+    </script>
+    <circle transform="translate(1)" id="circleID" fill="green" cy="15" cx="15" r="10" >
+        <animate attributeName="cy" />
+    </circle>
+    <text id="resultText" y="20" x="50" >
+      PASS - Null corresponding element dereference does not crash.
+    </text>
+    <use id="use_elem" xlink:href="#circleID" />
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/element-removal-crash.xhtml b/tests/tests/webkitsecurity/assets/element-removal-crash.xhtml
new file mode 100644
index 0000000..2ac0e12
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/element-removal-crash.xhtml
@@ -0,0 +1,31 @@
+<span xmlns="http://www.w3.org/1999/xhtml">
+<span/>
+<style>
+    span 
+    {
+        counter-increment: counter;
+    }
+    span:before
+    {
+        content: counter(counter);
+    }
+</style>
+<script>
+    if (window.layoutTestController) 
+    {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    function runTest()
+    {
+        document.documentElement.textContent = "PASS";
+
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+
+    setTimeout('runTest()', 0);
+</script>
+<span/>
+
diff --git a/tests/tests/webkitsecurity/assets/embed-bidi-style-in-isolate-crash.html b/tests/tests/webkitsecurity/assets/embed-bidi-style-in-isolate-crash.html
new file mode 100755
index 0000000..54c74c3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/embed-bidi-style-in-isolate-crash.html
@@ -0,0 +1,11 @@
+<bdi>
+    <ruby>PASS, if no exception or crash in debug</ruby>
+    <em  dir="ltr">
+        <embed></embed>
+        <audio onerror="open()" src="foo"></audio>
+    </em>
+</bdi>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/embedCrasher.html b/tests/tests/webkitsecurity/assets/embedCrasher.html
new file mode 100644
index 0000000..49b9f43
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/embedCrasher.html
@@ -0,0 +1,8 @@
+<embed src='doesnotexist'>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    alert("PASS: If you see this and the test did not crash the test has passed. (rdar://problem/5267870)");
+</script>
+<frameset>
+<frame>
diff --git a/tests/tests/webkitsecurity/assets/empty-anonymous-block-remove-crash.html b/tests/tests/webkitsecurity/assets/empty-anonymous-block-remove-crash.html
new file mode 100644
index 0000000..23328fa
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-anonymous-block-remove-crash.html
@@ -0,0 +1,29 @@
+<html>

+    <head>

+        <script>

+            if (window.layoutTestController)

+            {

+                layoutTestController.dumpAsText();

+                layoutTestController.waitUntilDone();

+            }

+        

+            function runTest()

+            {

+                var button = document.getElementById("test");

+                button.insertBefore(document.createElement("tbody"));

+                document.body.offsetTop;

+                document.body.removeChild(button);

+                

+                var result = document.createElement("div");

+                result.innerHTML = "PASS";

+                document.body.appendChild(result);

+                if (window.layoutTestController)

+                    layoutTestController.notifyDone();

+            }

+        </script>

+    </head>

+    <body onload="runTest()">

+        <button id="test"/>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/empty-bdi-crash.html b/tests/tests/webkitsecurity/assets/empty-bdi-crash.html
new file mode 100644
index 0000000..5adf37b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-bdi-crash.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+This test ensures WebKit does not crash when encountering an empty bdi element.
+<bdi></bdi>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/empty-content-with-float-crash.html b/tests/tests/webkitsecurity/assets/empty-content-with-float-crash.html
new file mode 100644
index 0000000..8909041
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-content-with-float-crash.html
@@ -0,0 +1,17 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<style>
+    span::after {content: ''; }
+</style>
+<p>
+    Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=17988">http://bugs.webkit.org/show_bug.cgi?id=17988</a>
+    REGRESSION (r31114-31132): Crash in InlineBox::isDirty() opening chowhound.com</i>.
+</p>
+<p>
+    No crash means PASS.
+</p>
+<span>
+    <div style="float: left;"></div>
+</span>
diff --git a/tests/tests/webkitsecurity/assets/empty-first-line-crash.html b/tests/tests/webkitsecurity/assets/empty-first-line-crash.html
new file mode 100644
index 0000000..e4b7a04
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-first-line-crash.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<style>
+*:empty:first-line { background: red; }
+</style>
+<div>
+Tests that the :empty pseudo-class doesn't cause a crash when the empty status changes during parsing.
+<button autofocus></button>
+</div>
diff --git a/tests/tests/webkitsecurity/assets/empty-mroot-crash.xhtml b/tests/tests/webkitsecurity/assets/empty-mroot-crash.xhtml
new file mode 100644
index 0000000..f4f2bbb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-mroot-crash.xhtml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:m="http://www.w3.org/1998/Math/MathML" xml:lang="en">
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+    <mtext>This test passes if it does not crash.</mtext> 
+    <mroot></mroot>
+</math>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/empty-msubsup-crash.html b/tests/tests/webkitsecurity/assets/empty-msubsup-crash.html
new file mode 100644
index 0000000..61d4904
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-msubsup-crash.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+
+<p>This test passes if it does not crash.</p>
+
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+    <msubsup></msubsup>
+</math>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/empty-render-surface-crasher.html b/tests/tests/webkitsecurity/assets/empty-render-surface-crasher.html
new file mode 100644
index 0000000..d83a75f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-render-surface-crasher.html
@@ -0,0 +1,34 @@
+<!DOCTYPE>
+<html>
+<head>
+<title>Empty Render Surface</title>
+  <style type="text/css" media="screen">
+    .container {
+      position: relative;
+      height: 0x;
+      width: 0px;
+      opacity:0.5;
+    }
+    
+    .child {
+      -webkit-transform: translateZ(0);
+      height: 0px;
+      width: 0px;
+      background-color: red;
+    }    
+  </style>
+  <script type="text/javascript" charset="utf-8">
+    if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+  </script>
+
+</head>
+<body>
+<p>This page tests that an empty render surface does not crash as reported in <a href='https://bugs.webkit.org/show_bug.cgi?id=51432'>this bug</a>. Pass if this does not crash.</p>
+
+<div class="container">
+  <div class="child"> </div>
+</div>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/empty-row-crash-expected.png b/tests/tests/webkitsecurity/assets/empty-row-crash-expected.png
new file mode 100644
index 0000000..8763576
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-row-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/empty-row-crash.html b/tests/tests/webkitsecurity/assets/empty-row-crash.html
new file mode 100644
index 0000000..c60ed6a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-row-crash.html
@@ -0,0 +1,13 @@
+<html>
+<body>
+<table id="obj">
+<script>
+obj.createTFoot();
+obj.deleteTFoot();
+obj.focus();
+obj.insertRow();
+obj.insertRow();
+</script>
+This test passes if it does not crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/empty-section-crash-expected.png b/tests/tests/webkitsecurity/assets/empty-section-crash-expected.png
new file mode 100644
index 0000000..567a8a3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-section-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/empty-section-crash.html b/tests/tests/webkitsecurity/assets/empty-section-crash.html
new file mode 100644
index 0000000..7438134
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-section-crash.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+    <title></title>
+    <script type="text/javascript">
+        function finish()
+        {
+            /* Since the crash happens in painting code, force painting. This
+               makes the test work even when run without the --pixel option. */
+            layoutTestController.display();
+            layoutTestController.notifyDone();
+        }
+
+        function test()
+        {
+            if (window.layoutTestController) {
+                layoutTestController.waitUntilDone();
+                setTimeout(finish, 0);
+            }
+        }
+    </script>
+</head>
+<body onload="test();">
+    <p>
+        Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=9009">http://bugzilla.opendarwin.org/show_bug.cgi?id=9009</a>
+        REGRESSION: ToT crash in WebCore at Zap2it</i>.
+    </p>
+    <p>
+        No crash means PASS.
+    </p>
+    <table style="position: absolute; top: -6px; border-collapse: collapse; border-top: 10px solid; width: 100px; height: 100px;">
+    <tbody></tbody>
+    <tbody><tr><td></td></tr></tbody>
+    </table>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash-expected.png b/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash-expected.png
new file mode 100644
index 0000000..b5daa85
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash.html b/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash.html
new file mode 100644
index 0000000..3d8062a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-webkit-mask-crash.html
@@ -0,0 +1,12 @@
+<script>
+    // We need to dump the image to get the crash but we don't care about the layout information.
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText(true);
+</script>
+<style>
+*{
+    -webkit-mask-image:none,none,url(x);
+}
+</style>
+<p style="position:absolute; top: -1000px">https://bugs.webkit.org/show_bug.cgi?id=50151 : Crash in RenderBox::paintMaskImages due to a mask without an associated image<br>
+The test passes if it does not CRASH (normally the output is a white page)</p>
diff --git a/tests/tests/webkitsecurity/assets/empty-worker-nocrash.html b/tests/tests/webkitsecurity/assets/empty-worker-nocrash.html
new file mode 100644
index 0000000..29cd0e1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/empty-worker-nocrash.html
@@ -0,0 +1,11 @@
+<html>
+<script>
+var worker = new Worker('about:blank');
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+setTimeout('window.layoutTestController.notifyDone()', 20);
+</script>
+<p>PASS</p>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/end-of-buffer-crash.html b/tests/tests/webkitsecurity/assets/end-of-buffer-crash.html
new file mode 100644
index 0000000..6f69e83
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/end-of-buffer-crash.html
@@ -0,0 +1,12 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+
+<style>tenbytes {</style>
+
+<p>This test tickles a subtle off-by-one bug in how the CSS lexer handles end
+of buffer conditions.  The contents of the style tag satisfy (length mod 8 = 2)
+and contain an unclosed curly brace.  We pass if we don't crash.</p>
+
+<p>PASS</p>
diff --git a/tests/tests/webkitsecurity/assets/eval-cache-crash.html b/tests/tests/webkitsecurity/assets/eval-cache-crash.html
new file mode 100644
index 0000000..983f971
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/eval-cache-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/eval-cache-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/eval-cache-crash.js b/tests/tests/webkitsecurity/assets/eval-cache-crash.js
new file mode 100644
index 0000000..bc8eb7e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/eval-cache-crash.js
@@ -0,0 +1,15 @@
+description(
+"Test to make sure the eval code cache doesn't crash or give wrong results in odd situations."
+);
+
+
+var str = "(function () { return a; })";
+var a = "first";
+var first = eval(str)();
+shouldBe("first", "'first'");
+
+with ({a : "second"}) {
+    var second = eval(str)();
+}
+
+shouldBe("second", "'second'");
diff --git a/tests/tests/webkitsecurity/assets/event-listener-map-rehash-crash.html b/tests/tests/webkitsecurity/assets/event-listener-map-rehash-crash.html
new file mode 100644
index 0000000..c9018d7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/event-listener-map-rehash-crash.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+<script>
+    function stub() {}
+
+    document.addEventListener("DOMContentLoaded", function()
+    {
+        for (var i = 0; i < 50; ++i)
+            document.addEventListener("boom" + i, stub, false);
+    }, false);
+
+    document.addEventListener("DOMContentLoaded", stub);
+</script>
+</head>
+<body>
+<script>
+    description("Ensures that rehashing of events map doesn't leave us with a dangling event list reference.");
+    testPassed("Did not crash.");
+</script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/eventsource-reconnect-during-navigate-crash.html b/tests/tests/webkitsecurity/assets/eventsource-reconnect-during-navigate-crash.html
new file mode 100644
index 0000000..68aef92
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/eventsource-reconnect-during-navigate-crash.html
@@ -0,0 +1,20 @@
+<html>
+<body>
+<p>Navigate while an EventSource reconnect timer is waiting, then have the reconnect timer trigger before the page unloads. We pass if we don't crash.
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+}
+
+function navigate() {
+    window.location = "resources/wait-then-notify-done.php";
+}
+
+var es = new EventSource("resources/reconnect.php");
+es.onerror = function() {
+    setTimeout(navigate, 0);
+};
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/exception-codegen-crash.html b/tests/tests/webkitsecurity/assets/exception-codegen-crash.html
new file mode 100644
index 0000000..71f03e1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/exception-codegen-crash.html
@@ -0,0 +1,21 @@
+<p>This page tests some conditions that used to cause crashes during codegen.
+</p>
+<p>If you don't crash, you pass.
+</p>
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var scripts = [
+    "(1++).x;",
+    "/^[s{-.[]()]$/.x;",
+    "(++1).x;",
+    "(1 = 1).x;"
+];
+
+try {
+    eval(scripts.join("\n"));
+} catch (e) {
+}
+</script>
diff --git a/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash-iframe.html b/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash-iframe.html
new file mode 100644
index 0000000..3df8f4e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash-iframe.html
@@ -0,0 +1,16 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function crash()
+{
+    /* Ensure we have no frame when the exception is thrown. */
+    var iframe = parent.document.getElementById("iframe");
+    iframe.parentNode.removeChild(iframe);
+    
+    /* Throw an exception. */
+    throw "crash";
+}
+
+crash();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash.html b/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash.html
new file mode 100644
index 0000000..3fd8b28
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/exception-no-frame-inline-script-crash.html
@@ -0,0 +1,11 @@
+<p>This test checks for a crash when throwing an exception under the following
+conditions: (1) The throwing script's document has no frame; (2) The script is
+inline in the document.
+</p>
+
+<hr>
+
+<p>PASS: You didn't crash.
+</p>
+
+<iframe id="iframe" src='resources/exception-no-frame-inline-script-crash-iframe.html'></iframe>
diff --git a/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash-iframe.html b/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash-iframe.html
new file mode 100644
index 0000000..c1386fc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash-iframe.html
@@ -0,0 +1,13 @@
+<script>
+function crash()
+{
+    /* Ensure we have no frame when the exception is thrown. */
+    var iframe = parent.document.getElementById("iframe");
+    iframe.parentNode.removeChild(iframe);
+    
+    /* Throw an exception. */
+    throw "crash";
+}
+
+setTimeout(crash, 0);
+</script>
diff --git a/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash.html b/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash.html
new file mode 100644
index 0000000..97ca6b5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/exception-no-frame-timeout-crash.html
@@ -0,0 +1,16 @@
+<p>This test checks for a crash when throwing an exception under the following
+conditions: (1) The throwing script's document has no frame; (2) The script is run 
+from a timeout.
+</p>
+
+<hr>
+
+<p>PASS: You didn't crash.
+</p>
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+
+<iframe id="iframe" src='exception-no-frame-timeout-crash-iframe.html'></iframe>
diff --git a/tests/tests/webkitsecurity/assets/existent-eventsource-status-error-iframe-crash.html b/tests/tests/webkitsecurity/assets/existent-eventsource-status-error-iframe-crash.html
new file mode 100644
index 0000000..08cc5ab
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/existent-eventsource-status-error-iframe-crash.html
@@ -0,0 +1,27 @@
+<html>
+  <iframe id="test"></iframe>
+  <div id="result"></div>
+  <script>
+    if (window.layoutTestController)
+    {
+      layoutTestController.dumpAsText();
+      layoutTestController.waitUntilDone();
+    }
+
+    function runTest()
+    {
+      document.getElementById("test").src = "resources/request-existent-eventsource-error.html";
+    }
+
+    function finish()
+    {
+      document.body.removeChild(document.getElementById("test"));
+  
+      document.getElementById("result").innerHTML = "PASS";
+      if (window.layoutTestController)
+        layoutTestController.notifyDone();
+    }
+
+    runTest();
+  </script>
+<html>
diff --git a/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash-expected.png b/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash-expected.png
new file mode 100644
index 0000000..f105d92
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash.html b/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash.html
new file mode 100644
index 0000000..7a8f12d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/extend-by-line-anonymous-content-crash.html
@@ -0,0 +1,17 @@
+<style>
+    #b:before { content: "bar"; }
+</style>
+<p>
+    Test for <a href="rdar://problem/6081309">rdar://problem/6081309</a>, a crash when moving or extending the selection with line granularity.
+</p>
+<div id="target">foo</div>
+<div id="b">baz</div>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var sel = getSelection();
+    var start = document.getElementById("target").firstChild;
+    sel.setBaseAndExtent(start, 0, start, 1);
+    sel.modify("extend", "forward", "line");
+</script>
diff --git a/tests/tests/webkitsecurity/assets/extend-over-file-input-by-drag-crash.html b/tests/tests/webkitsecurity/assets/extend-over-file-input-by-drag-crash.html
new file mode 100644
index 0000000..6e8fd7a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/extend-over-file-input-by-drag-crash.html
@@ -0,0 +1,34 @@
+<!DOCTYPE>

+<html>

+<body>

+<p>This test ensures WebKit does not crash when selecting text across an element with type=file.

+To manually test, start selection in "start" and extend the selection by dragging to "end" moving across the input element.

+WebKit should not crash.</p>

+<span id="test">start<input type=file>end</span>

+<script>

+

+if (window.layoutTestController && window.eventSender) {

+    layoutTestController.dumpAsText();

+

+    var test = document.getElementById('test');

+    var input = test.getElementsByTagName('input')[0];

+

+    var y = test.offsetTop + test.offsetHeight / 2;

+    eventSender.mouseMoveTo(test.offsetLeft + 5, y);

+    eventSender.mouseDown();

+

+    eventSender.leapForward(200);

+    eventSender.mouseMoveTo(input.offsetLeft + input.offsetWidth / 2, y);

+    eventSender.leapForward(200);

+

+    eventSender.mouseMoveTo(test.offsetLeft + test.offsetWidth - 5, y);

+    eventSender.mouseDown();

+

+    test.parentNode.removeChild(test);

+

+    document.write('PASS');

+}

+

+</script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/feComponentTransfer-style-crash.xhtml b/tests/tests/webkitsecurity/assets/feComponentTransfer-style-crash.xhtml
new file mode 100644
index 0000000..d9d78a1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/feComponentTransfer-style-crash.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+window.onload = function()
+{
+    try {
+        document.getElementById('tgt').type.baseVal=99999;
+    } catch (e) {
+        alert (e);
+    }
+
+    setTimeout(function () {
+            document.body.innerHTML = "PASS";
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }, 0);
+}
+</script>
+<defs><filter id="f"><feComponentTransfer><feFuncR type="identity" id="tgt"/></feComponentTransfer></filter></defs>
+<text x="20" y="20" filter="url(#f)" style="fill:green" id="out">TESTING</text>
+<rect width="128" height="128" style="fill:green" filter="url(#f)"/>
+</svg>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/feDisplacementMap-crash-test.xhtml b/tests/tests/webkitsecurity/assets/feDisplacementMap-crash-test.xhtml
new file mode 100644
index 0000000..8fa2ca8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/feDisplacementMap-crash-test.xhtml
@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<body>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+window.onload = function()
+{
+    try {
+        document.getElementById('d').xChannelSelector.baseVal=0x80000000;
+        document.getElementById('d').yChannelSelector.baseVal=0x40000000;
+    } catch(e) {
+        alert (e);
+    }
+
+    setTimeout(function () {
+            document.body.innerHTML = "PASS";
+            layoutTestController.notifyDone();
+        }, 0);
+}
+</script>
+<defs><filter id="f"><feDisplacementMap id="d"/></filter></defs>
+<rect width="128" height="128" style="fill:rgb(0,255,0)" filter="url(#f)"/> 
+</svg>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/feImage-zero-size-crash.svg b/tests/tests/webkitsecurity/assets/feImage-zero-size-crash.svg
new file mode 100644
index 0000000..e124a0d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/feImage-zero-size-crash.svg
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" viewBox="0 0 400 400">
+    <title>This test passes if it doesn't crash.</title>
+    <text id="log" />
+    <defs>
+        <circle id="circle" r="0" fill="red" />
+        <filter id="image">
+            <feImage xlink:href="#circle" />
+        </filter>
+    </defs>
+    <rect x="0" y="0" width="100" height="100" filter="url(#image)" />
+    <rect x="100" y="100" width="100" height="100" fill="green" />
+    <script>
+      <![CDATA[
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        var log = document.getElementById("log");
+        log.appendChild(document.createTextNode("PASS"));
+    ]]>
+    </script>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/feLighting-crash-expected.png b/tests/tests/webkitsecurity/assets/feLighting-crash-expected.png
new file mode 100644
index 0000000..62b197f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/feLighting-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/feLighting-crash.svg b/tests/tests/webkitsecurity/assets/feLighting-crash.svg
new file mode 100644
index 0000000..cbe2e1d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/feLighting-crash.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+
+<defs>
+<filter id="light" primitiveUnits="userSpaceOnUse">
+<feSpecularLighting lighting-color="blue" surfaceScale="5" specularConstant="10" specularExponent="6">
+    <feDistantLight azimuth="0" elevation="30"/>
+</feSpecularLighting>
+</filter>
+</defs>
+
+<rect width="40" height="20" filter="url(#light)" fill="black"/>
+
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/fenced-whitespace-separators-crash.html b/tests/tests/webkitsecurity/assets/fenced-whitespace-separators-crash.html
new file mode 100644
index 0000000..ce87b7e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/fenced-whitespace-separators-crash.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+
+<body>
+<math>
+    <mfenced separators=" ">
+        <mrow>
+            <mrow>
+                <mi>v</mi>
+            </mrow>
+            <mi>i</mi>
+        </mrow>
+    </mfenced>
+</math>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/file-reader-directory-crash.html b/tests/tests/webkitsecurity/assets/file-reader-directory-crash.html
new file mode 100644
index 0000000..9550cb4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/file-reader-directory-crash.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html>
+<body>
+<input type=file id=file onchange='onInputFileChange()'>
+<p id=status>To test manually, drag a directory to the file input above.</p>
+<script>
+var input = document.getElementsByTagName("input")[0];
+var statusElement = document.getElementById("status");
+
+function onInputFileChange()
+{
+    var file = document.getElementById('file').files[0];
+    var reader = new FileReader();
+    statusElement.textContent = "Starting test...";
+    reader.readAsText(file);
+    reader.onloadend = function() {
+        statusElement.textContent = "PASS, no crash";
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+}
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+eventSender.beginDragWithFiles(['resources']);
+eventSender.mouseMoveTo(input.offsetLeft + 1, input.offsetTop + 1);
+eventSender.mouseUp();
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/filesystem-no-callback-null-ptr-crash.html b/tests/tests/webkitsecurity/assets/filesystem-no-callback-null-ptr-crash.html
new file mode 100644
index 0000000..ff4b9b1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/filesystem-no-callback-null-ptr-crash.html
@@ -0,0 +1,19 @@
+<!--
+  http://code.google.com/p/chromium/issues/detail?id=63204
+  https://bugs.webkit.org/show_bug.cgi?id=49539
+-->
+<div id="log">FAIL</div>
+<script>
+  if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+  if (window.webkitRequestFileSystem) {
+      // These two calls should throw an exception but should NOT cause a NULL pointer crash:
+      webkitResolveLocalFileSystemURL('');
+      try {
+          webkitRequestFileSystem(TEMPORARY, 100);
+      }
+      catch(e) {
+          document.getElementById('log').innerHTML = "PASS";
+      }
+  }
+</script>
diff --git a/tests/tests/webkitsecurity/assets/fill-layer-crash.html b/tests/tests/webkitsecurity/assets/fill-layer-crash.html
new file mode 100644
index 0000000..5867b62b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/fill-layer-crash.html
@@ -0,0 +1,25 @@
+<html>
+<head id="head">
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<style>
+* {background-image:inherit;}
+</style>
+</head>
+<body>
+ <span></span>
+</body>
+<script>
+document.body.style.background="-webkit-canvas(foo)";
+var head = document.getElementById("head");
+style = document.createElement("style");
+style.type = "text/css";
+var rule = document.createTextNode("* {content:counter(mycount_id)}");
+style.appendChild(rule);
+head.appendChild(style);
+document.body.setAttribute("style","line-height:128mm;");
+</script>
+This test works if it doesn't crash.
+</html>
diff --git a/tests/tests/webkitsecurity/assets/filter-after-transform-crash.svg b/tests/tests/webkitsecurity/assets/filter-after-transform-crash.svg
new file mode 100644
index 0000000..654c8b7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/filter-after-transform-crash.svg
@@ -0,0 +1,22 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="80" y="80" width="300" height="180" viewBox="0 0 200 120">
+    <script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    </script>
+    <defs>
+        <filter id="MyFilter" filterUnits="userSpaceOnUse" >
+            <feGaussianBlur />
+            <feOffset />
+            <feSpecularLighting >
+                <fePointLight />
+            </feSpecularLighting>
+            <feComposite />
+            <feMerge>
+                <feMergeNode />
+                <feMergeNode />
+            </feMerge>
+        </filter>
+    </defs>
+    <g transform="matrix(0,-256152301,1000,0,1,1) " filter="url(#MyFilter)" />
+    <text>PASS - Applying filter does not crash.</text>
+</svg>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/filter-empty-element-crash-expected.png b/tests/tests/webkitsecurity/assets/filter-empty-element-crash-expected.png
new file mode 100644
index 0000000..b649c59
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/filter-empty-element-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/filter-empty-element-crash.html b/tests/tests/webkitsecurity/assets/filter-empty-element-crash.html
new file mode 100644
index 0000000..1bb3161
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/filter-empty-element-crash.html
@@ -0,0 +1,6 @@
+<script>
+if (window.layoutTestController)
+    window.layoutTestController.dumpAsText(true);
+</script>
+<div style="-webkit-filter: blur(1px);" width="0px" height="0px"></div>
+<p>If you can read this, the test passed.</p>
diff --git a/tests/tests/webkitsecurity/assets/find-layout-crash.html b/tests/tests/webkitsecurity/assets/find-layout-crash.html
new file mode 100644
index 0000000..6af5cf2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/find-layout-crash.html
@@ -0,0 +1,26 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<p>Test case for
+<a href="https://bugs.webkit.org/show_bug.cgi?id=32842"
+   >https://bugs.webkit.org/show_bug.cgi?id=26088</a>.
+The test passes if there is no crash.
+<TEXTAREA id="container">
+
+
+sit
+</TEXTAREA>down
+
+<SCRIPT>
+    document.execCommand("FindString", true, "s");
+    document.execCommand("FindString", true, "n");
+</SCRIPT>
+
+<STYLE></STYLE>
+
+<script type="text/javascript">
+    e=document.getElementById('container');
+    e.innerHTML="";
+</script>
+
diff --git a/tests/tests/webkitsecurity/assets/first-letter-anonymous-block-crash.html b/tests/tests/webkitsecurity/assets/first-letter-anonymous-block-crash.html
new file mode 100644
index 0000000..3c21504
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/first-letter-anonymous-block-crash.html
@@ -0,0 +1,15 @@
+<html>
+<style type=text/css>
+dd:first-letter { content:""; }
+dir:first-letter { text-align:""; }
+</style>
+<dd>
+<dir>
+<font>
+<form>
+No crash means PASS
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/first-letter-block-form-controls-crash.html b/tests/tests/webkitsecurity/assets/first-letter-block-form-controls-crash.html
new file mode 100644
index 0000000..a032da7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/first-letter-block-form-controls-crash.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+    .capitalize:first-letter {
+        text-transform: uppercase;
+    }
+    .block {
+        display: block;
+    }
+</style>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+    <p>
+        Test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=34641">Bug 34641</a>.
+    </p>
+
+    <div class="capitalize"><input class="block" type="submit"></div>
+    <div class="capitalize"><select class="block"><option>foo</select></div>
+    <div class="capitalize"><input class="block" type="text" value="foo"></div>
+    <div class="capitalize"><input class="block" type="checkbox"></div>
+    <div class="capitalize"><input class="block" type="radio"></div>
+    <div class="capitalize"><input class="block" type="file"></div>
+    <div class="capitalize"><textarea class="block"></textarea></div>
+    <div class="capitalize"><video class="block" controls></video></div>
+    <div class="capitalize"><audio class="block" controls></audio></div>
+    <!-- this makes WebKit recalc style -->
+    <style></style>
+    <p>No crash means PASS</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-crash.html b/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-crash.html
new file mode 100755
index 0000000..ec2b887
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-crash.html
@@ -0,0 +1,41 @@
+<style>
+.spanStyle { float: inherit; }
+.inlineFL::first-letter { visibility: visible; }
+.floatFL { float: right; }
+.floatFL::first-letter { position: absolute; content: 'A'; }
+</style>
+PASS, if no exception or crash observed
+<script>
+parentDiv = document.createElement('div');
+childSpan = document.createElement('span');
+childDiv = document.createElement('div');
+textNode =  document.createTextNode('bcd');
+
+function removeTextNode() {
+    parentDiv.removeChild(textNode);
+    delete textNode;
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function changeClass() {
+    parentDiv.setAttribute('class', 'inlineFL');
+    setTimeout("removeTextNode()", 10);
+}
+
+function runTest() {
+    parentDiv.setAttribute('class', 'floatFL');
+    document.documentElement.appendChild(parentDiv);
+    childSpan = document.createElement('span');
+    childSpan.setAttribute('class', 'spanStyle');
+    parentDiv.appendChild(childSpan);
+    parentDiv.appendChild(textNode);
+    childSpan.appendChild(childDiv);
+    setTimeout("changeClass()", 10);
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+    }
+}
+window.onload = runTest;
+</script>
diff --git a/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-table-crash.html b/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-table-crash.html
new file mode 100755
index 0000000..fa07640
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/first-letter-inline-flow-split-table-crash.html
@@ -0,0 +1,47 @@
+<style>
+.noFloat:empty { float: none; }
+.theadStyle:nth-last-child(odd) { display: table-header-group; float: right; }
+.pSpanStyle { overflow: hidden; -webkit-appearance: button; }
+.pSpanStyle:first-letter { text-align: -webkit-left; content: counter(section); }
+</style>
+<script>
+var parentSpan =  document.createElement('span');
+var childSpan =  document.createElement('span');
+var thead = document.createElement('thead');
+var textNode = document.createTextNode('abc');
+
+function removeTextNode() {
+    childSpan.removeChild(textNode);
+    delete textNode;
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function changeClass() {
+    thead.setAttribute('class', 'noFloat');
+    setTimeout("removeTable()", 10);
+}
+
+function removeTable() {
+    childSpan.removeChild(thead);
+    setTimeout('removeTextNode();', 10);
+}
+
+function runTest() {
+    parentSpan.setAttribute('class', 'pSpanStyle');
+    document.documentElement.appendChild(parentSpan);
+    childSpan.setAttribute('class', 'noFloat');
+    parentSpan.appendChild(childSpan);
+    thead.setAttribute('class', 'theadStyle');
+    childSpan.appendChild(thead);
+    childSpan.appendChild(textNode);
+    setTimeout('changeClass();', 10);
+
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+    }
+}
+window.onload = runTest;
+</script>
+PASS, if no exception or crash in debug
diff --git a/tests/tests/webkitsecurity/assets/first-letter-rtl-crash.html b/tests/tests/webkitsecurity/assets/first-letter-rtl-crash.html
new file mode 100644
index 0000000..8abb966
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/first-letter-rtl-crash.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<style>
+body:first-letter { color: black; }
+</style>
+<script>
+
+function run() {
+    document.execCommand('findString', false, '!ABC');
+    document.body.innerHTML = '<br>This test ensures WebKit does not crash when first-letter rule is applied to LTR letters that ' +
+    ' are not visually contiguous to each other.<br>PASS';
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+}
+
+</script>
+<body style="direction: rtl;" onload="run()">!ABC&#x202E;</body>
diff --git a/tests/tests/webkitsecurity/assets/first-letter-text-fragment-crash.html b/tests/tests/webkitsecurity/assets/first-letter-text-fragment-crash.html
new file mode 100644
index 0000000..d9c1e75
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/first-letter-text-fragment-crash.html
@@ -0,0 +1,19 @@
+<html>
+    <style>
+        .test1:first-letter { content : ""; }
+        .test2:first-letter { text-align : center; }
+    </style>
+    <div class="test1">
+    <div class="test2">
+    PASS 
+    </div>
+    </div>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        document.execCommand("selectall");
+        document.designMode = "on";
+        document.execCommand("ForeColor", false, "red");
+    </script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/first-letter-text-transform-causes-crash.html b/tests/tests/webkitsecurity/assets/first-letter-text-transform-causes-crash.html
new file mode 100644
index 0000000..6cd5640
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/first-letter-text-transform-causes-crash.html
@@ -0,0 +1,40 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<style>
+       dt:first-letter{text-transform:uppercase;}
+</style>
+<script>
+
+    function buildAccessibilityTree(accessibilityObject) {
+        var count = accessibilityObject.childrenCount;
+        for (var i = 0; i < count; ++i)
+            buildAccessibilityTree(accessibilityObject.childAtIndex(i));
+    }
+</script>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+
+<dt>dt</dt>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+    description("First letter text transform causes assert and bad type cast. This can cause a crash.");
+
+    // Trigger a layout operation to create the two RenderTextFragment instances.
+    document.body.children[0].offsetWidth;
+
+    if (window.accessibilityController) {
+        // Build up full accessibility tree.
+        document.body.focus();
+        buildAccessibilityTree(accessibilityController.focusedElement);
+    }
+
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/firstRect-crash-expected.png b/tests/tests/webkitsecurity/assets/firstRect-crash-expected.png
new file mode 100644
index 0000000..b9d0d26
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/firstRect-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/firstRect-crash.html b/tests/tests/webkitsecurity/assets/firstRect-crash.html
new file mode 100644
index 0000000..32763cb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/firstRect-crash.html
@@ -0,0 +1,20 @@
+<body>
+<p>This test passes if we don't crash.</p>
+<h2 id='h2' class="sidebar-title">Trending:</h2>
+<p id='p'>test</p>
+<script>
+function runTest()
+{
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    window.getSelection().setBaseAndExtent(
+        document.getElementById("h2").firstChild, 9,
+        document.getElementById("p"), 0);
+    document.getElementById("p").style.display = "none";
+
+    document.getElementById("h2").innerText = "PASSED";
+}
+runTest();
+</script>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/firstletter-tablecell-crash.html b/tests/tests/webkitsecurity/assets/firstletter-tablecell-crash.html
new file mode 100644
index 0000000..bacd464
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/firstletter-tablecell-crash.html
@@ -0,0 +1,7 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<style>*:nth-child(2):first-letter { vertical-align: super; }</style>
+<a>...</a><del style="display:table-cell;">This text should be displayed without crashing
+
diff --git a/tests/tests/webkitsecurity/assets/firstline-fixed-crash.html b/tests/tests/webkitsecurity/assets/firstline-fixed-crash.html
new file mode 100644
index 0000000..6f95149
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/firstline-fixed-crash.html
@@ -0,0 +1,11 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<style>
+*:nth-child(2):first-line { margin-bottom: 1px; }</style>
+<div contentEditable>
+<a style="position: fixed;">
+This text should render without crashing
+</div>...
+
diff --git a/tests/tests/webkitsecurity/assets/fix-range-from-root-editable-crash.html b/tests/tests/webkitsecurity/assets/fix-range-from-root-editable-crash.html
new file mode 100644
index 0000000..635f6fd
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/fix-range-from-root-editable-crash.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function go() {
+    document.designMode = "on";
+    document.execCommand("SelectAll",         false, null);
+    document.execCommand("strikethrough",     false, null);
+    document.body.innerHTML = 'This tests ApplyStyleCommand::fixRangeAndApplyInlineStyle does not crash when startNode is body.<br>PASS';
+    layoutTestController.notifyDone();
+}
+</script>
+</head>
+<body onload="go()"><div><img></div></body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/fixed-table-layout-large-colspan-crash.html b/tests/tests/webkitsecurity/assets/fixed-table-layout-large-colspan-crash.html
new file mode 100644
index 0000000..855dd85
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/fixed-table-layout-large-colspan-crash.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<style type="text/css">
+table {
+    table-layout: fixed;
+    width: 15px;
+}
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function finish() {
+    document.getElementById("result").innerHTML = "PASS";
+}
+</script>
+</head>
+<body onload="finish()">
+<p>Tests that large colspan in a fixed table layout does not result in crash.</p>
+<div id=result></div>
+<table>
+<td colspan="1923138113">
+</td>
+</table>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/flexbox-in-region-crash.html b/tests/tests/webkitsecurity/assets/flexbox-in-region-crash.html
new file mode 100644
index 0000000..8a79a90
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/flexbox-in-region-crash.html
@@ -0,0 +1,51 @@
+<!doctype html>
+<html>
+    <head>
+        <style>
+            #el1 {
+                -webkit-flow-into: A;
+                display: -webkit-flexbox;
+            }
+            #el3 {
+                -webkit-flow-from: A;
+            }
+        </style>
+        <script>
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+            }
+
+            onload = function() {
+                el1 = document.createElement('div')
+                el1.setAttribute('id','el1')
+                document.body.appendChild(el1)
+
+                el2 = document.createElement('div')
+                document.body.appendChild(el2)
+
+                el3 = document.createElement('hr')
+                el3.setAttribute('id','el3')
+                el2.appendChild(el3)
+
+                el4 = document.createElement('p')
+                el4.setAttribute('id', 'el4')
+                el5 = document.createTextNode("P1")
+                el4.appendChild(el5)
+                el1.appendChild(el4)
+
+                setTimeout(function() {
+                    el1.style.display='inline'
+                    el4.style.visibility = 'hidden'
+
+                    if (window.layoutTestController)
+                        layoutTestController.notifyDone();
+	            },0)
+            }
+        </script>
+    </head>
+    <body>
+        <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=77474">77474</a>: Crash in RenderFlowThread::setRegionBoxesRegionStyle</p>
+        <p> This test PASSES if it does not CRASH or ASSERT.</p>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/float-not-removed-crash.html b/tests/tests/webkitsecurity/assets/float-not-removed-crash.html
new file mode 100644
index 0000000..82e76ba
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/float-not-removed-crash.html
@@ -0,0 +1,26 @@
+<html>

+    Test passes if it does not crash.

+    <body onload="runTest()">

+        <div style="display: -webkit-inline-box">

+            <span id="span1">

+                <span><blockquote></blockquote></span>

+                <span><p style="float: left;"></p></span>

+            </span>

+            <span id="span2" style="display: list-item"></span>

+        </div>

+        <script type="text/javascript">

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+

+            function runTest() {

+                document.body.offsetTop;

+                span1 = document.getElementById('span1');

+                span2 = document.getElementById('span2');

+                tfoot = document.createElement('tfoot');

+                span2.appendChild(tfoot);

+                document.body.offsetTop;

+                span1.parentNode.removeChild(span1);

+            }

+        </script>

+    </body>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/float-not-removed-from-next-sibling-crash.html b/tests/tests/webkitsecurity/assets/float-not-removed-from-next-sibling-crash.html
new file mode 100644
index 0000000..e7aa0b8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/float-not-removed-from-next-sibling-crash.html
@@ -0,0 +1,32 @@
+<html>

+    <body onload="runTest()">

+        Test passes if it does not crash.

+        <div style="width: 15px;">

+            <script>

+                if (window.layoutTestController)

+                    layoutTestController.dumpAsText();

+

+                function runTest()

+                {

+                    document.body.offsetTop;

+                    var container = document.getElementById('panel');

+                    container.style.position = 'relative';

+                    document.getElementById('test1').style.position = 'absolute';

+                    document.getElementById('test2').style.position = 'absolute';

+                    document.body.offsetTop;

+                    

+                    container.style.height = '1px';

+                    document.getElementById('test1').style.display = 'none';

+                }

+            </script>

+            <div id="panel">

+                <div id="test1">

+                    <img style="float: left" height="1px">

+                </div>

+                <div id="test2">

+                    <a><p>P A S S</p>

+                </div>

+            </div>

+        </div>

+    </body>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/float-originating-line-deleted-crash.html b/tests/tests/webkitsecurity/assets/float-originating-line-deleted-crash.html
new file mode 100644
index 0000000..cce2564
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/float-originating-line-deleted-crash.html
@@ -0,0 +1,26 @@
+<html>

+Test passes if it does not crash.

+<script>

+if (window.layoutTestController) {

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+function runTest()

+{

+    child = document.getElementById('test');

+    child.parentNode.removeChild(child);

+

+	document.body.offsetTop;

+    

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+

+setTimeout("runTest();", 0);

+</script>

+<style id='test'>

+    p { float: left; }

+</style>

+<table><span><p></p><p></p></span></table>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/floating-before-content-with-list-marker-crash.html b/tests/tests/webkitsecurity/assets/floating-before-content-with-list-marker-crash.html
new file mode 100644
index 0000000..2c665d7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/floating-before-content-with-list-marker-crash.html
@@ -0,0 +1,19 @@
+<style>
+.floatingBefore::before { overflow: visible; float: left; content: open-quote; }
+</style>
+<script>
+tbodyElement = document.createElement('tbody');
+listItemElement = document.createElement('li');
+listItemElement.setAttribute('class', 'floatingBefore');
+document.documentElement.appendChild(listItemElement);
+headerElement = document.createElement('header');
+listItemElement.appendChild(headerElement);
+listItemElement.appendChild(document.createElement('sub'));
+document.documentElement.offsetHeight;
+tbodyElement.appendChild(headerElement);
+
+document.documentElement.appendChild(document.createTextNode('PASS if no crash or assert in debug'));
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/floats-not-cleared-crash.html b/tests/tests/webkitsecurity/assets/floats-not-cleared-crash.html
new file mode 100644
index 0000000..f72159d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/floats-not-cleared-crash.html
@@ -0,0 +1,26 @@
+<html>

+<script>

+if (window.layoutTestController)

+{

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}   

+window.setTimeout('crash();', 0);

+function crash()

+{

+    document.body.offsetTop;

+

+    block1.style.position = 'absolute';

+    float1.style.display = 'none';

+

+    document.body.offsetTop;

+    block1.innerHTML = "PASS";

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+</script>

+<div id="block1">

+<span id="float1" style="float: left; margin-bottom: 10000px;">

+</div>

+<junk>

+<html>

diff --git a/tests/tests/webkitsecurity/assets/focus-change-crash.html b/tests/tests/webkitsecurity/assets/focus-change-crash.html
new file mode 100644
index 0000000..9b28155
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/focus-change-crash.html
@@ -0,0 +1,27 @@
+<div>Type something into the first input and press tab.  The browser should not crash.</div>
+<div id="parent">
+<input id="a" />
+<input id="b" />
+</div>
+<div id="results"></div>
+<script>
+document.getElementById("a").addEventListener("change", function(e) {
+    var parent = document.getElementById("parent");
+    parent.innerHTML = "<input id='c' />";
+    document.getElementById("c").select();
+}, false);
+
+function runTest()
+{
+    document.getElementById("a").focus();
+    if (!window.layoutTestController)
+        return;
+    layoutTestController.dumpAsText();
+    eventSender.keyDown("x")
+    eventSender.keyDown("\t");
+    document.getElementById("results").innerText = "PASSED";
+}
+
+runTest();
+
+</script>
diff --git a/tests/tests/webkitsecurity/assets/focus-change-crash2.html b/tests/tests/webkitsecurity/assets/focus-change-crash2.html
new file mode 100644
index 0000000..7800465
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/focus-change-crash2.html
@@ -0,0 +1,31 @@
+<p>This tests a crash when changing focus deletes the node being focused. This test requires DRT.</p>
+<div id='test'><input id='1' /><input id='2' /></div>
+<script>
+function runTest()
+{
+    document.getElementById("1").addEventListener("keypress", function(e) {
+        document.getElementById("2").focus();
+
+        setTimeout(function() {
+            document.getElementById("test").innerHTML = "PASSED";
+            layoutTestController.notifyDone();
+        }, 0);
+    }, false);
+
+    document.getElementById("1").addEventListener("change", function(e) {
+        document.getElementById("test").innerHTML = "<input id='3' />";
+        window.GCController.collect();
+        document.getElementById("3").focus();
+    }, false);
+
+    document.getElementById("1").focus();
+
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+        eventSender.keyDown("a")
+    }
+}
+
+runTest();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/focus-controller-crash-change-event.html b/tests/tests/webkitsecurity/assets/focus-controller-crash-change-event.html
new file mode 100644
index 0000000..126f0e6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/focus-controller-crash-change-event.html
@@ -0,0 +1,32 @@
+<html>

+<div id="b">

+    Press a key!

+    <input id="a">

+    <iframe></iframe>

+</div>

+<script>

+if (window.layoutTestController) {

+    layoutTestController.dumpAsText();

+	layoutTestController.waitUntilDone();

+}

+

+a.addEventListener("change", function() { 

+    b.innerHTML = "PASS";

+

+	if (window.layoutTestController)

+	    layoutTestController.notifyDone();

+});

+

+a.addEventListener("keyup", function() {

+    var e = document.createEvent("KeyboardEvent");

+    e.initKeyboardEvent('keydown', true, true, document.defaultView, 'U+0009', 0, false, false, false, false, false);

+    a.dispatchEvent(e);

+})

+

+document.body.offsetTop;

+a.focus();

+

+if (window.layoutTestController)

+    eventSender.keyDown('a');

+</script>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/focus-crash-expected.png b/tests/tests/webkitsecurity/assets/focus-crash-expected.png
new file mode 100644
index 0000000..c666229
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/focus-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/focus-crash.html b/tests/tests/webkitsecurity/assets/focus-crash.html
new file mode 100644
index 0000000..b0cb936
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/focus-crash.html
@@ -0,0 +1,44 @@
+<html><head>
+<title>Focus crash</title>
+</head>
+<body onload="load()">
+To run this test manually, click the "Crash me" button.
+<div id='container'>
+    <iframe id='testframe' style="width: 100%; height:200px;" src="../resources/iframebody.html"></iframe>
+</div>
+<input id='testbutton' type="button" value="Crash me" onclick="crash()">
+<ul id="console"></ul>
+<script>
+
+function load()
+{
+    document.getElementById('testframe').contentWindow.document.body.focus();
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    if (eventSender) {
+        var button = document.getElementById('testbutton');
+        eventSender.mouseMoveTo(button.offsetLeft + 10, button.offsetTop + 5)
+        eventSender.mouseDown();
+        eventSender.mouseUp();
+    }
+}
+
+function crash()
+{
+    var focuselem = document.getElementById('testframe').contentWindow;
+    var elem = document.getElementById('container');
+    elem.style.display = 'none';
+    focuselem.focus();
+    log("SUCCEEDED");
+}
+
+function log(str) {
+    var li = document.createElement("li");
+    li.appendChild(document.createTextNode(str));
+    var console = document.getElementById("console");
+    console.appendChild(li);
+}
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/font-platformDestroy-crash-expected.png b/tests/tests/webkitsecurity/assets/font-platformDestroy-crash-expected.png
new file mode 100644
index 0000000..832067e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/font-platformDestroy-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/font-platformDestroy-crash.svg b/tests/tests/webkitsecurity/assets/font-platformDestroy-crash.svg
new file mode 100644
index 0000000..42538d2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/font-platformDestroy-crash.svg
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Tiny//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd">
+
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" id="svg-root" width="100%" height="100%" viewBox="0 0 480 360">
+    <style id="style">
+        text { }
+    </style>
+    <g id="test-body-content" font-size="10">
+        <defs>
+        <font id="embeded" horiz-adv-x="224">
+<font-face font-family="embeded" units-per-em="1000" panose-1="0 0 0 0 0 0 0 0 0 0" ascent="917" descent="-250" alphabetic="0"/>
+            <glyph unicode="1" glyph-name="gl_1" horiz-adv-x="1500" d="M 0 0 L 250 0 L 250 250 L 0 250 Z"/>
+        </font>
+        </defs>
+
+        <g transform="translate(100, 40)">
+            <text font-family="embeded">1</text>
+        </g>
+        <g transform="translate(100, 60)">
+            <text>Test for http://bugs.webkit.org/show_bug.cgi?id=16967</text>
+        </g>
+    </g>
+
+    <script><![CDATA[
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        var style = document.getElementById("style");
+        var parent = style.parentNode;
+
+        for (var t = 0; t < 50; t++) {
+            parent.offsetTop;
+            parent.removeChild(style);
+            parent.appendChild(style);
+        }
+    ]]></script>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/fontMetric-border-radius-null-crash.html b/tests/tests/webkitsecurity/assets/fontMetric-border-radius-null-crash.html
new file mode 100644
index 0000000..4065439
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/fontMetric-border-radius-null-crash.html
@@ -0,0 +1,8 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    document.writeln("<v>");
+    document.body.innerHTML="<style>*{border-radius:5ex;}</style>";
+    document.write("<title>x");
+    document.body.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=57756'>chrome.dll!WebCore::RenderStyle::fontMetrics ReadAV@NULL (two crashes)<br>PASSED: This test did not crash!";
+</script>
diff --git a/tests/tests/webkitsecurity/assets/fontMetric-webkit-border-end-width-null-crash.html b/tests/tests/webkitsecurity/assets/fontMetric-webkit-border-end-width-null-crash.html
new file mode 100644
index 0000000..d127f02
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/fontMetric-webkit-border-end-width-null-crash.html
@@ -0,0 +1,8 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    document.writeln("<v>");
+    document.body.innerHTML="<style>*{-webkit-border-end-width:0ex;}</style>";
+    document.write("<title>x");
+    document.body.innerHTML = "<a href='https://bugs.webkit.org/show_bug.cgi?id=57756'>chrome.dll!WebCore::RenderStyle::fontMetrics ReadAV@NULL (two crashes)<br>PASSED: This test did not crash!";
+</script>
diff --git a/tests/tests/webkitsecurity/assets/fontsize-unit-rems-crash.html b/tests/tests/webkitsecurity/assets/fontsize-unit-rems-crash.html
new file mode 100644
index 0000000..4d3d16f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/fontsize-unit-rems-crash.html
@@ -0,0 +1,7 @@
+<html style="display:none;">
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<title style="line-height: 1rem;">Test case for 61989</title>
+<p>This is test for Bug 61989 No crash means test PASS.</p></html>
diff --git a/tests/tests/webkitsecurity/assets/foreign-content-crash.html b/tests/tests/webkitsecurity/assets/foreign-content-crash.html
new file mode 100644
index 0000000..718981a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/foreign-content-crash.html
@@ -0,0 +1,8 @@
+<script>
+    var svgElement = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    svgElement.appendChild(document.createElement("div")).insertAdjacentHTML("beforeBegin", "</p>");
+
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<p>This test passes if it doesn't crash.</p>
diff --git a/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover-expected.png b/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover-expected.png
new file mode 100644
index 0000000..5f7999f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover.xml b/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover.xml
new file mode 100644
index 0000000..e4479df
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/foreignObject-crash-on-hover.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
+         "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg"
+     xmlns:xlink="http://www.w3.org/1999/xlink"
+     xmlns:html="http://www.w3.org/1999/xhtml"
+     height="600" width="800" onload="runRepaintTest()">
+  <script xlink:href="../../fast/repaint/resources/repaint.js"/>
+  <g transform="translate(50,50)">
+    <polygon points="0,0 300,0 300,300 0,300" style="fill:lightblue; stroke:red;"/>
+    <!-- switch -->
+    <foreignObject x="10" y="10" width="280" height="280">
+      <html:b>Absolute Lineto</html:b><html:br/>
+       &lt;path d="M50,80 L250,80 150,280 z" 
+                style="fill:red; stroke:blue;"/&gt;
+    </foreignObject>
+    <!-- /switch -->
+    <path d="M50,80 L250,80 150,280 z" 
+          style="fill:red; stroke:blue;"/>
+  </g>
+  <script>
+  function repaintTest() {
+    if (window.eventSender) {
+        layoutTestController.waitUntilDone();
+        eventSender.mouseMoveTo(100, 100);
+        eventSender.mouseUp();
+        eventSender.mouseDown();
+        setTimeout("layoutTestController.notifyDone()", 0);
+    }
+  }
+  </script>
+</svg> 
diff --git a/tests/tests/webkitsecurity/assets/foreignobject-crash-with-absolute-positioned-children.svg b/tests/tests/webkitsecurity/assets/foreignobject-crash-with-absolute-positioned-children.svg
new file mode 100644
index 0000000..68d1e47
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/foreignobject-crash-with-absolute-positioned-children.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<script>
+  if (window.layoutTestController)
+     layoutTestController.dumpAsText();
+</script>
+
+    <foreignObject  width="100%" height="100%" >
+        <body xmlns="http://www.w3.org/1999/xhtml" >
+            <div style="position:absolute">PASS -- This did not crash. https://bugs.webkit.org/show_bug.cgi?id=26342</div>
+        </body>
+    </foreignObject>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/form-associated-element-crash.html b/tests/tests/webkitsecurity/assets/form-associated-element-crash.html
new file mode 100644
index 0000000..80aae53
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-associated-element-crash.html
@@ -0,0 +1,45 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+if (!window.gc) {
+    gc = function () {
+        if (window.GCController)
+            return GCController.collect();
+        for (var i = 0; i < 10000; i++)
+            var s = new String("abc");
+    }
+}
+
+var element = document.createElement('input');
+
+function test() {
+    element.setAttribute('form', 'form1');
+    document.body.appendChild(element);
+    element.attributes.removeNamedItem('form');
+    setTimeout(delay, 0);
+}
+
+function delay() {
+    document.body.removeChild(element);
+    element = 0;
+    gc();
+    var form = document.createElement('form');
+    form.setAttribute('id', 'form2');
+    document.body.appendChild(form);
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+</head>
+<body onload="test()">
+<p>
+This page is a test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=51905">Bug 51905</a>. WebKit should not crash when this page is loaded.
+</p>
+PASS
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/form-associated-element-crash2.html b/tests/tests/webkitsecurity/assets/form-associated-element-crash2.html
new file mode 100644
index 0000000..2030306
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-associated-element-crash2.html
@@ -0,0 +1,48 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function gc() {
+    var array = [];
+    for (var i = 0x30000; i--; )
+        if (!(Math.round(Math.random() * 20)))
+            array = [];
+        else
+            array.push(new String(Math.random()))
+}
+
+function test()
+{
+    var element = document.createElement('input');
+    element.setAttribute('form', 'form1');
+    var div = document.createElement('div');
+    div.appendChild(element);
+    element.removeAttribute('form');
+    div.innerHTML = '';
+    element = 0;
+    gc();
+    setTimeout(delay, 0);
+}
+
+function delay()
+{
+    var form = document.createElement('form');
+    form.setAttribute('id', 'form2');
+    document.body.appendChild(form);
+    location.reload();
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+</head>
+<body onload="test()">
+<p>
+This page is a test case for <a href="https://bugs.webkit.org/show_bug.cgi?id=51905">Bug 51905</a>. WebKit should not crash when this page is loaded.
+</p>
+PASS
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/form-associated-element-crash3.html b/tests/tests/webkitsecurity/assets/form-associated-element-crash3.html
new file mode 100644
index 0000000..033ffff
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-associated-element-crash3.html
@@ -0,0 +1,16 @@
+<body>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+This test passes if it doesn't crash.  Note: You might need to reload this test
+many times (or run the test under valgrind / ASAN) to see a crash.
+<span>
+<span>
+<video src="javascript:" onloadstart>
+<form  id="tjbvp"></form>
+</video>
+</span>
+</span>
+<keygen form="woujt">
+</body>
diff --git a/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash.html b/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash.html
new file mode 100644
index 0000000..87ff1f6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash.html
@@ -0,0 +1,37 @@
+<html>

+    <script src="../js/resources/js-test-pre.js"></script>

+    <body onload="runTest()">

+        <div id="console"></div>

+        <form id="form1" style="display:none" method="post" target="test" action="http://anything.com"></form>

+        <script>

+            if (window.layoutTestController)

+            {

+                layoutTestController.dumpAsText();

+                layoutTestController.waitUntilDone();

+            }

+        

+            function runTest()

+            {

+                document.getElementById('form1').submit();

+                

+                if (window.layoutTestController)

+                    layoutTestController.notifyDone();

+                document.getElementById('console').innerHTML = 'PASS';

+            }

+

+            count = 0;

+            document.addEventListener("beforeload", function(event) {

+                event.preventDefault();

+                count = count + 1;

+                if (count == 2)

+                {

+                    document.body.removeChild(document.getElementById('test'));

+                    gc();

+                    document.body.offsetTop;

+                }

+            }, true);

+       </script>

+       <iframe id="test" src="about:blank"></iframe>

+   </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash2.html b/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash2.html
new file mode 100644
index 0000000..e5fa9da
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-iframe-target-before-load-crash2.html
@@ -0,0 +1,37 @@
+<html>

+    <script src="../js/resources/js-test-pre.js"></script>

+    <body onload="runTest()">

+        <div id="console"></div>

+        <form id="form1" style="display:none" target="test" action="about:blank"></form>

+        <script>

+            if (window.layoutTestController)

+            {

+                layoutTestController.dumpAsText();

+                layoutTestController.waitUntilDone();

+            }

+        

+            function runTest()

+            {

+                document.getElementById('form1').submit();

+                

+                if (window.layoutTestController)

+                    layoutTestController.notifyDone();

+                document.getElementById('console').innerHTML = 'PASS';

+            }

+

+            count = 0;

+            document.addEventListener("beforeload", function(event) {

+                event.preventDefault();

+                count = count + 1;

+                if (count == 2)

+                {

+                    document.body.removeChild(document.getElementById('test'));

+                    gc();

+                    document.body.offsetTop;

+                }

+            }, true);

+       </script>

+       <iframe id="test" src="about:blank"></iframe>

+   </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash-css.html b/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash-css.html
new file mode 100644
index 0000000..9a8e524
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash-css.html
@@ -0,0 +1,55 @@
+<html>
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
+}
+
+
+
+</script>
+<style>
+.table {
+    display: table;
+}
+
+.tbody {
+    display: table-row-group;
+}
+
+.tr {
+    display: table-row;
+}
+
+.td {
+    display: table-cell;
+}
+
+</style>
+</head>
+
+<body onload="boom()">
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<div class="table" border="1">
+ <div class="tr" id="tr1"> xxx
+  <div class="td">Whee</div>
+ </div>
+</div>
+
+<form id="f1">QQQ</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash.xhtml b/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash.xhtml
new file mode 100644
index 0000000..8a16723
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-in-row-before-misnested-text-crash.xhtml
@@ -0,0 +1,37 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
+}
+
+
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<table border="1">
+ <tr id="tr1"> xxx
+  <td>Whee</td>
+ </tr>
+</table>
+
+<form id="f1">QQQ</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash-css.html b/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash-css.html
new file mode 100644
index 0000000..f9699ef
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash-css.html
@@ -0,0 +1,55 @@
+<html>
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
+}
+</script>
+<style>
+.table {
+    display: table;
+}
+
+.tbody {
+    display: table-row-group;
+}
+
+.tr {
+    display: table-row;
+}
+
+.td {
+    display: table-cell;
+}
+
+</style>
+</head>
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<body onload="boom()">
+
+<div class="table" border="1" id="tr1">
+ xxx
+<div class="tbody">
+ <div class="tr">
+  <div class="td">Whee</div>
+ </div>
+</div>
+</div>
+
+<form id="f1">QQQ</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash.xhtml b/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash.xhtml
new file mode 100644
index 0000000..1ff6b81
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-in-table-before-misnested-text-crash.xhtml
@@ -0,0 +1,40 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
+}
+
+
+
+</script>
+</head>
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<body onload="boom()">
+
+<table border="1" id="tr1">
+ xxx
+<tbody>
+ <tr>
+  <td>Whee</td>
+ </tr>
+</tbody>
+</table>
+
+<form id="f1">QQQ</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash-css.html b/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash-css.html
new file mode 100644
index 0000000..b1ec421
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash-css.html
@@ -0,0 +1,54 @@
+<html>
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
+}
+</script>
+<style>
+.table {
+    display: table;
+}
+
+.tbody {
+    display: table-row-group;
+}
+
+.tr {
+    display: table-row;
+}
+
+.td {
+    display: table-cell;
+}
+
+</style>
+</head>
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<body onload="boom()">
+
+<div class="table" border="1">
+<div class="tbody" id="tr1"> xxx
+ <div class="tr">
+  <div class="td">Whee</div>
+ </div>
+</div>
+</div>
+
+<form id="f1">QQQ</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash.xhtml b/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash.xhtml
new file mode 100644
index 0000000..436eb79
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-in-tbody-before-misnested-text-crash.xhtml
@@ -0,0 +1,39 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.getElementById("f1").cloneNode(true), xxx);
+}
+
+
+
+</script>
+</head>
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<body onload="boom()">
+
+<table border="1">
+<tbody id="tr1"> xxx
+ <tr>
+  <td>Whee</td>
+ </tr>
+</tbody>
+</table>
+
+<form id="f1">QQQ</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/form-submission-create-crash.xhtml b/tests/tests/webkitsecurity/assets/form-submission-create-crash.xhtml
new file mode 100644
index 0000000..5947a2f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/form-submission-create-crash.xhtml
@@ -0,0 +1,25 @@
+<html xmlns='http://www.w3.org/1999/xhtml'>
+Test passes if it does not crash.
+<form>
+<input id="submit" type="submit" />
+</form>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+textNode = document.createTextNode("x");
+document.getElementById("submit").appendChild(textNode);
+
+runTest = function() {
+    event = document.createEvent("MouseEvent");
+    event.initEvent("click");
+    textNode.dispatchEvent(event);
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+setTimeout(runTest, 0);
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-contentWindow-crash.html b/tests/tests/webkitsecurity/assets/frame-contentWindow-crash.html
new file mode 100644
index 0000000..18b031b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/frame-contentWindow-crash.html
@@ -0,0 +1,12 @@
+This is a test for <a href="http://bugs.webkit.org/show_bug.cgi?id=13868">http://bugs.webkit.org/show_bug.cgi?id=13868</a> 
+REGRESSION: crash on accessing a new iframe's contentWindow property.
+
+This tests HTMLFrameElement.contentWindow.
+
+If there is no crash this test passes.
+<script type="text/javascript">
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    document.createElement('frame').contentWindow;
+</script>
diff --git a/tests/tests/webkitsecurity/assets/frame-crash-with-page-cache.html b/tests/tests/webkitsecurity/assets/frame-crash-with-page-cache.html
new file mode 100644
index 0000000..3621f24
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/frame-crash-with-page-cache.html
@@ -0,0 +1,34 @@
+<html>
+<script>
+window.finish = function()
+{
+    if (layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+window.log = function(message) {
+     document.getElementById("result").innerHTML += message + "<br>";
+}
+
+window.failure = function(message) {
+    log("FAIL: " + message);
+    finish();
+}
+
+function test() {
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+        layoutTestController.setCanOpenWindows();
+        layoutTestController.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
+    }
+    log("open page-1");
+    window.open("resources/cached-page-1.html");
+}
+</script>
+
+<body onload="test()">
+If WebKit does not assert or crash, you passed.
+<div id="result"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-unload-abort-crash.html b/tests/tests/webkitsecurity/assets/frame-unload-abort-crash.html
new file mode 100644
index 0000000..ca2407c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/frame-unload-abort-crash.html
@@ -0,0 +1,42 @@
+<html>
+<body>
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=25394">bug 25394</a>: crash in DocumentLoader::addResponse due to bad |this| pointer</p>
+<p>You should see a few messages followed by PASSED once. </p>
+<script>
+    var consoleMessages = document.createElement("ul");
+    document.body.appendChild(consoleMessages);
+
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+    }
+
+    function subframeLoaded()
+    {
+        var frameDiv = document.getElementById('framediv');
+        frameDiv.innerHTML = 'PASSED';
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+
+    function dumpRequestStatus(request)
+    {
+        try {
+            log("Ready State: " + request.readyState);
+        } catch (ex) {
+            log("Exception getting status: " + ex.message);
+        }
+    }
+
+    function log(message)
+    {
+        var item = document.createElement("li");
+        item.appendChild(document.createTextNode(message));
+        consoleMessages.appendChild(item);
+    }
+</script>
+<div id="framediv">
+<iframe src="resources/xmlhttprequest-in-unload.html" width=50 height=10 border=0></iframe>
+</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-unload-crash-1.html b/tests/tests/webkitsecurity/assets/frame-unload-crash-1.html
new file mode 100644
index 0000000..f83f8ae
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/frame-unload-crash-1.html
@@ -0,0 +1,5 @@
+<html>
+<body onload="location='frame-unload-crash-3.html'">
+  <iframe src="frame-unload-crash-2.html">
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-unload-crash-2.html b/tests/tests/webkitsecurity/assets/frame-unload-crash-2.html
new file mode 100644
index 0000000..75e54a1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/frame-unload-crash-2.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+// When we create an XHR from onunload, we expect it to be cancelled almost
+// immediately afterwards.  When that happens the XHR's onabort handler is
+// called.  The XHR created from there is cancelled again, but at a later point
+// after this FRAME has already been detached from its parent.
+var requests = [];
+function startRequest() {
+  var x = new XMLHttpRequest();
+  x.open("GET", location, true);
+  x.onabort = startRequest;
+  x.send(null);
+  requests.push(x);
+}
+</script>
+</head>
+<body onunload="startRequest()"></body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-unload-crash-3.html b/tests/tests/webkitsecurity/assets/frame-unload-crash-3.html
new file mode 100644
index 0000000..cfa1890
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/frame-unload-crash-3.html
@@ -0,0 +1,3 @@
+<html>
+<body onload="parent.done()"></body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/frame-unload-crash.html b/tests/tests/webkitsecurity/assets/frame-unload-crash.html
new file mode 100644
index 0000000..32fa8c0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/frame-unload-crash.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+<script>
+
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+}
+
+function done()
+{
+    document.getElementById("results").appendChild(document.createTextNode("PASS"));
+    layoutTestController.notifyDone();
+}
+
+</script>
+</head>
+<body>
+<p>
+  This is a test for <a href="https://bugs.webkit.org/show_bug.cgi?id=25136">bug 25136</a>: <i>CRASH in DocumentLoader::removeSubresourceLoader
+  due to null m_frame.</i> If successful, PASS should be printed below.
+</p>
+<p id="results" class="pass"></p>
+<iframe style="border: 0" src="resources/frame-unload-crash-1.html">
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/frameless-media-element-crash.html b/tests/tests/webkitsecurity/assets/frameless-media-element-crash.html
new file mode 100644
index 0000000..44b4279
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/frameless-media-element-crash.html
@@ -0,0 +1,12 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var doc = document.implementation.createHTMLDocument();
+doc.open();
+doc.write('<video controls></video>');
+doc.close();
+
+</script>
+<p>Creating a video element in a frameless document should not crash WebKit.
+<p>This test passes if it does not crash.
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/generated-after-counter-doesnt-crash.html-disabled b/tests/tests/webkitsecurity/assets/generated-after-counter-doesnt-crash.html-disabled
new file mode 100644
index 0000000..271c310
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/generated-after-counter-doesnt-crash.html-disabled
@@ -0,0 +1,26 @@
+<html>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<style type="text/css">
+
+ruby:after{
+	counter-reset: g -2532653 K -48696899414062 ll -48202514648437 rr -1821899414062;
+}
+ruby::after{
+	display: table;
+	content: url("http://xx");
+}
+
+</style>
+	<ruby>
+		<ruby>
+			<ruby>
+<style type="text/css">
+ruby{
+	float: left;
+}
+</style>
+	<ruby>
+This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/generated-before-and-after-counter-doesnt-crash.html-disabled b/tests/tests/webkitsecurity/assets/generated-before-and-after-counter-doesnt-crash.html-disabled
new file mode 100644
index 0000000..9ec77f7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/generated-before-and-after-counter-doesnt-crash.html-disabled
@@ -0,0 +1,33 @@
+<html>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<style type="text/css">
+
+ruby:before{
+	counter-reset: g -2532653 K -48696899414062 ll -48202514648437 rr -1821899414062;
+}
+ruby::before{
+	display: table;
+	content: url("http://xx");
+}
+ruby:after{
+	counter-reset: g -2532653 K -48696899414062 ll -48202514648437 rr -1821899414062;
+}
+ruby::after{
+	display: table;
+	content: url("http://yy");
+}
+
+</style>
+	<ruby>
+		<ruby>
+			<ruby>
+<style type="text/css">
+ruby{
+	float: left;
+}
+</style>
+	<ruby>
+This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/generated-before-counter-doesnt-crash.html b/tests/tests/webkitsecurity/assets/generated-before-counter-doesnt-crash.html
new file mode 100644
index 0000000..d4f161e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/generated-before-counter-doesnt-crash.html
@@ -0,0 +1,26 @@
+<html>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<style type="text/css">
+
+ruby:before{
+	counter-reset: g -2532653 K -48696899414062 ll -48202514648437 rr -1821899414062;
+}
+ruby::before{
+	display: table;
+	content: url("http://xx");
+}
+
+</style>
+	<ruby>
+		<ruby>
+			<ruby>
+<style type="text/css">
+ruby{
+	float: right;
+}
+</style>
+	<ruby>
+This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash-expected.png b/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash-expected.png
new file mode 100644
index 0000000..ca9f6a4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash.html b/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash.html
new file mode 100644
index 0000000..d06c4f4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/generated-child-split-flow-crash.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>

+<html style="font-family: ahem; -webkit-font-smoothing: none;">

+<style>

+    #div1 { 

+        -webkit-column-count: 2;

+    }

+    #span1:after 

+    {

+        display: block;

+        content: counter(c);

+        color: green;

+        -webkit-column-span: all;

+    }

+</style>

+<div id="div1">

+A<span id="span1" style="color: blue">B</span>C

+</div>

+<script>

+function runTest()

+{

+    span1 = document.getElementById('span1');

+    span1.style.display = 'block';

+    document.body.offsetTop;

+    document.body.style.zoom = 2;

+}

+

+window.onload = runTest;

+</script>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/generated-content-crash.html b/tests/tests/webkitsecurity/assets/generated-content-crash.html
new file mode 100644
index 0000000..ad9e954
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/generated-content-crash.html
@@ -0,0 +1,29 @@
+<html>
+        <head>
+    <title>Reduction of bug 10198
+        </title>
+        <style type="text/css">
+
+.clearFix:after {
+    content: "."; 
+    display: block; 
+    overflow: hidden;
+}
+
+        </style>
+        <script type="text/javascript">
+           if (window.layoutTestController)
+               layoutTestController.dumpAsText();
+        </script>
+        </head>
+        <body>
+           <p>
+               Test case for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=10198">https://bugs.webkit.org/show_bug.cgi?id=10198</a>
+               REGRESSION: WebKit r15750 crashes while loading anthem.com</i>.
+           </p>
+           <p>
+               No crash means test PASS.
+           </p>
+                <div class="clearFix">
+        </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/generated-layer-scrollbar-crash.html b/tests/tests/webkitsecurity/assets/generated-layer-scrollbar-crash.html
new file mode 100644
index 0000000..c2b6693
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/generated-layer-scrollbar-crash.html
@@ -0,0 +1,26 @@
+<html>
+<head>
+    <title></title>
+    <style type="text/css">
+        div:after {
+            content: ".";
+            display: block; 
+            overflow: scroll;
+        }
+    </style>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<body>
+    <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=12518">http://bugs.webkit.org/show_bug.cgi?id=12518</a>
+        Betsson.com crashes browser</i>.
+    </p>
+    <p>
+        No crash means PASS.
+    </p>
+    <div></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/get-url-with-iframe-target-no-crash.html b/tests/tests/webkitsecurity/assets/get-url-with-iframe-target-no-crash.html
new file mode 100644
index 0000000..35d1a09
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/get-url-with-iframe-target-no-crash.html
@@ -0,0 +1,21 @@
+<html>
+<script>
+function runtest() {
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+        plg.getURLNotify("data:text/html,<body onload='layoutTestController.notifyDone()'></body>", "frame", "callback");
+        plg.parentNode.removeChild(plg)
+    } else {
+        document.write("Cannot run interactively");
+    }
+}
+</script>
+<body onload="runtest()">
+<embed id="plg" type="application/x-webkit-test-netscape"></embed>
+This tests that we do not crash upon trying to deliver NPP_URLNotify to
+a plugin that has been deleted.
+<div id="result">SUCCESS</div>
+<iframe id="frame"></iframe>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/getMatchedCSSRules-null-crash.html b/tests/tests/webkitsecurity/assets/getMatchedCSSRules-null-crash.html
new file mode 100644
index 0000000..8fb3ecd
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/getMatchedCSSRules-null-crash.html
@@ -0,0 +1,6 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    var rules = getMatchedCSSRules(null, "", false);
+</script>
+SUCCESS (<code>getMatchedCSSRule(null, ...)</code> did not crash).
diff --git a/tests/tests/webkitsecurity/assets/giant-stylesheet-crash.html b/tests/tests/webkitsecurity/assets/giant-stylesheet-crash.html
new file mode 100644
index 0000000..6fbe8cc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/giant-stylesheet-crash.html
@@ -0,0 +1,25 @@
+<head>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+</script>

+

+<script>

+var styleElement = document.createElement('style');

+styleElement.setAttribute('type', 'text/css');

+

+var str="z";

+for (var i = 0; i < 16; i++) {

+    str += str;

+}

+for (var i = 0; i < 1+(1<<16); i++){

+    var txt = document.createTextNode(str);

+    styleElement.appendChild(txt);

+}

+

+document.getElementsByTagName('head')[0].appendChild(styleElement); 

+</script>

+</head>

+<body>

+This test verifies that creating a huge inline stylesheet doesn't crash.

+</body>

diff --git a/tests/tests/webkitsecurity/assets/glyphref-renderer-create-crash.html b/tests/tests/webkitsecurity/assets/glyphref-renderer-create-crash.html
new file mode 100644
index 0000000..7c0ae8a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/glyphref-renderer-create-crash.html
@@ -0,0 +1,14 @@
+<html>
+Test passes if it does not crash.
+<svg>
+<glyphref>
+<foreignObject>
+</foreignObject>
+</glyphref>
+</svg>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/gradient-on-pseudoelement-crash.html b/tests/tests/webkitsecurity/assets/gradient-on-pseudoelement-crash.html
new file mode 100644
index 0000000..fabf1fa
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/gradient-on-pseudoelement-crash.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+body:first-line {
+    background-image: -webkit-gradient(linear, 0% 0%, 0% 100%, from(blue), to(green));
+}
+</style>
+<script type="text/javascript" charset="utf-8">
+  if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+This test should not crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/hasFocus-frameless-crash.html b/tests/tests/webkitsecurity/assets/hasFocus-frameless-crash.html
new file mode 100644
index 0000000..ab82ea9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/hasFocus-frameless-crash.html
@@ -0,0 +1,8 @@
+<p>This tests that calling HTMLDocument.hasFocus() on a frameless HTMLDocument does not crash.</p>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var newDoc = document.implementation.createHTMLDocument("");
+    newDoc.hasFocus();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash.html b/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash.html
new file mode 100644
index 0000000..d2872e3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash.html
@@ -0,0 +1,38 @@
+<style>
+::-webkit-scrollbar {
+  width: 16px;
+}
+</style>
+
+<body>
+<iframe id="iframe" width="1"></iframe>
+<p>This tests to make sure that an iframe with custom scrollbars that is
+hidden does not crash the browser when unloaded.  The test passes if it does
+not crash.</p>
+</body>
+
+<script>
+function runTest()
+{
+    if (document.location.search == "?done") {
+        document.body.appendChild(document.createTextNode("PASSED"));
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+        return;
+    }
+
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+    }
+
+    setTimeout(function() {
+      document.getElementById("iframe").style.display = "none";
+
+      // Unload the page to see if the crash is triggered.
+      document.location.href = "?done";
+    }, 0);
+}
+
+runTest();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash2.html b/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash2.html
new file mode 100644
index 0000000..5a26c94
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/hidden-iframe-scrollbar-crash2.html
@@ -0,0 +1,28 @@
+<html>
+<body><p>
+This is some text to force a scrollbar to appear.
+This is some text to force a scrollbar to appear.
+This is some text to force a scrollbar to appear.
+</p>
+<img id="i" onbeforeload="beforeload()" onload="pass()">
+</body>
+<script>
+function beforeload()
+{
+    setTimeout(function() {
+        var win = window.parent;
+        win.document.getElementById("iframe").style.display = "none";
+    });
+    return true;
+}
+
+function pass()
+{
+    var win = window.parent;
+    win.document.getElementById("iframe").style.display = "";
+    win.document.body.appendChild(document.createTextNode("PASSED"));
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/horizontal-box-float-crash.html b/tests/tests/webkitsecurity/assets/horizontal-box-float-crash.html
new file mode 100644
index 0000000..3850e6c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/horizontal-box-float-crash.html
@@ -0,0 +1,38 @@
+<html>
+<body onload="runTest()">
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function runTest()
+    {
+        document.body.offsetTop;
+        var container = document.getElementById('container');
+        var test = document.getElementById('test');
+        var blockquote = document.getElementById('blockquote');
+        blockquote.parentNode.removeChild(blockquote);
+        test.appendChild(blockquote);
+        document.body.offsetTop;
+        test.parentNode.removeChild(test);
+        if (window.layoutTestController) {
+            // Force a focus in which forces a paint that can trigger the crash.
+            layoutTestController.setWindowIsKey(false);
+            layoutTestController.setWindowIsKey(true);
+            document.getElementById("results").innerHTML = "PASS";
+        }
+    }
+</script>
+<div>This test passes if it does not crash.</div>
+<div id="container" style="display: -webkit-box;">
+    <div id="test">
+        <span style="float: right;">This is a floating span.</span>
+        <span>.</span>
+    </div>
+    <span>
+        <ol id="results">
+            <blockquote id="blockquote">blockquote</blockquote>
+        </ol>
+    </span>
+</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/hover-style-recalc-crash.html b/tests/tests/webkitsecurity/assets/hover-style-recalc-crash.html
new file mode 100644
index 0000000..e86c13d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/hover-style-recalc-crash.html
@@ -0,0 +1,26 @@
+<style>
+    div#a { width: 100px; height: 100px; background-color: lightblue; }
+    div#b { display: none; }
+    div#b a { display: block; width: 100px; height: 100px; background-color: blue; }
+    div#a:hover + div { display:block; }
+</style>
+<p>
+    Test for <i><a href="rdar://problem/7873647">rdar://problem/7873647</a>
+    Crash when updating hover state</i>.
+</p>
+<p>
+    Hover over the light blue square, then move down into the blue square. The browser should not crash.
+</p>
+<div id="a"></div>
+<div id="b">
+    <a></a>
+</div>
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        document.body.offsetTop;
+        var y = document.getElementById("a").getBoundingClientRect().top;
+        eventSender.mouseMoveTo(50, y + 50);
+        eventSender.mouseMoveTo(50, y + 150);
+    }
+</script>
diff --git a/tests/tests/webkitsecurity/assets/hover-timer-crash.html b/tests/tests/webkitsecurity/assets/hover-timer-crash.html
new file mode 100644
index 0000000..c4494ab
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/hover-timer-crash.html
@@ -0,0 +1,43 @@
+<html>
+<head>
+    <script type="text/javascript">
+        function finish()
+        {
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
+
+        function crash_step2()
+        {
+          var target = document.getElementById("target");
+          target.contentDocument.body.parentNode.removeChild(target.contentDocument.body);
+          target.parentNode.removeChild(target);
+          setTimeout(finish, 10);
+        }
+
+        function test()
+        {
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+                var target = document.getElementById("target");
+                eventSender.mouseMoveTo(target.offsetLeft + target.offsetWidth / 2, target.offsetTop + target.offsetHeight / 2);
+                setTimeout(crash_step2, 100);
+            }
+        }
+    </script>
+</head>
+<body onload="test()">
+    <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=13124">http://bugs.webkit.org/show_bug.cgi?id=13124</a>
+        REGRESSION: Reproducible crash in Widget::getView</i>.
+    </p>
+    <p>
+        To test interactively, move the mouse into the yellow rect and wait a second.
+    </p>
+    <p>
+        No crash means SUCCESS.
+    </p>
+    <iframe onmouseover="if (!window.layoutTestController) setTimeout(crash_step2, 1000)" id="target" src="data:text/html,<body bgcolor='yellow'></body>" style="border: solid black"></iframe>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/huge-column-gap-crash.html b/tests/tests/webkitsecurity/assets/huge-column-gap-crash.html
new file mode 100644
index 0000000..1580182
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/huge-column-gap-crash.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<style>
+body {
+    -webkit-column-width: .600pt;
+    -webkit-column-gap: 2261953074155095154;
+}
+</style>
+
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+
+<body class="test">
+This test passes if it does not crash.
+</body>
+
+</html>
diff --git a/tests/tests/webkitsecurity/assets/id-attribute-with-namespace-crash.html b/tests/tests/webkitsecurity/assets/id-attribute-with-namespace-crash.html
new file mode 100644
index 0000000..df238a5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/id-attribute-with-namespace-crash.html
@@ -0,0 +1,42 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+gc = window.gc || function()
+{
+    if (window.GCController)
+        return GCController.collect();
+
+    for (var i = 0; i < 10000; ++i)
+        var s = new String("AAAA");
+}
+
+window.onload = function()
+{
+    element = document.body.appendChild(document.createElement("a"));
+
+    element.setAttributeNS("namespace", "id", "foo");
+    element.setAttribute("id", "bar");
+    
+    document.body.removeChild(element);
+    element = null;
+    gc();
+    
+    setTimeout(finishTest, 0);
+}
+
+finishTest = function()
+{
+    document.getElementById("bar");
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+</head>
+<body>PASS</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/ident-crashes-topnode-is-text.html b/tests/tests/webkitsecurity/assets/ident-crashes-topnode-is-text.html
new file mode 100644
index 0000000..1529cd0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/ident-crashes-topnode-is-text.html
@@ -0,0 +1,16 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest() {
+    window.getSelection().setBaseAndExtent(start, 0, null, 0);
+    document.execCommand("Indent");
+
+    document.writeln('execCommand("Indent") was crashing if the top element to be formatted is actually not an element.<br>');
+    document.writeln('The test has passed if it does not crash.<br><br>')
+    document.writeln('PASS');
+}
+</script>
+<body onLoad="runTest();">
+    ><defs contenteditable="true" id="start">
+        <rt>AAAAAAA0A0AAAA00
diff --git a/tests/tests/webkitsecurity/assets/iframe-contentWindow-crash.html b/tests/tests/webkitsecurity/assets/iframe-contentWindow-crash.html
new file mode 100644
index 0000000..d4bd0eb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-contentWindow-crash.html
@@ -0,0 +1,11 @@
+This is a test for <a href="http://bugs.webkit.org/show_bug.cgi?id=13868">http://bugs.webkit.org/show_bug.cgi?id=13868</a> 
+REGRESSION: crash on accessing a new iframe's contentWindow property.
+
+This tests HTMLIFrameElement.contentWindow.
+
+If there is no crash this test passes.
+<script type="text/javascript">
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    document.createElement('iframe').contentWindow;
+</script>
diff --git a/tests/tests/webkitsecurity/assets/iframe-crash-on-missing-image.xhtml b/tests/tests/webkitsecurity/assets/iframe-crash-on-missing-image.xhtml
new file mode 100644
index 0000000..5acbe1d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-crash-on-missing-image.xhtml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html
+   PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+   "xhtml1-transitional.dtd">
+<html xmlns='http://www.w3.org/1999/xhtml'>
+<head>
+<title>NIST DOM HTML Test - IFRAME</title>
+
+<script type='text/javascript' src='../../dom/xhtml/level2/html/selfxhtml.js'></script><script charset='UTF-8' type='text/javascript' src='../../dom/xhtml/level2/html/HTMLIFrameElement01.js'></script><script type='text/javascript'>function loadComplete() { startTest(); }</script></head>
+<body onload="loadComplete()">
+<iframe longdesc="about:blank" marginheight="10" marginwidth="5" width="60" height="50" name="Iframe1" frameborder="1" scrolling="yes" src="right.png" align="top">IFRAME1</iframe>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/iframe-flattening-crash.html b/tests/tests/webkitsecurity/assets/iframe-flattening-crash.html
new file mode 100644
index 0000000..02c0bbf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-flattening-crash.html
@@ -0,0 +1,32 @@
+<html>
+<head>
+    <script type="text/javascript">
+        if (window.layoutTestController) {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+            layoutTestController.setFrameFlatteningEnabled(true);
+        }
+    </script>
+</head>
+<body>
+    <style>body { background-color: green; }</style>
+    <p>This test passes if it does not crash <a href="https://bugs.webkit.org/show_bug.cgi?id=52449">https://bugs.webkit.org/show_bug.cgi?id=52449</a></p>
+
+    <p><iframe id="if"  width="20%" height="20%" scrolling=auto src="data:text/html,
+    <html>
+    <script>
+        function test2(){
+            var i = document.getElementsByTagName('html')[0].clientWidth; 
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+            if (window.layoutTestController)
+                layoutTestController.setFrameFlatteningEnabled(true);
+        }
+    </script>
+    <body onresize='test2();'>
+    <div style='position: absolute; width: 400px; height: 400px; left: 0; top: 0px;' id='p'><input id='in' value='abcd'></div>
+    </body></html>
+    ">
+</body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/iframe-flattening-selection-crash.html b/tests/tests/webkitsecurity/assets/iframe-flattening-selection-crash.html
new file mode 100644
index 0000000..7f35bd3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-flattening-selection-crash.html
@@ -0,0 +1,36 @@
+<html>
+<head>
+    <script type="text/javascript">
+        if (window.layoutTestController) {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+            layoutTestController.setFrameFlatteningEnabled(true);
+        }
+
+        setTimeout(function() {
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }, 500);
+
+        function test() {
+            if (window.layoutTestController)
+                layoutTestController.setFrameFlatteningEnabled(true);
+            document.getElementById("if").contentWindow.document.getElementById('in').focus();
+            document.getElementById("if").contentWindow.document.getElementById('p').style.top = "20px";
+        }
+    </script>
+</head>
+<body>
+    <style>body { background-color: green; }</style>
+    <p>This test passes if it does not crash <a href="https://bugs.webkit.org/show_bug.cgi?id=52449">https://bugs.webkit.org/show_bug.cgi?id=52449</a></p>
+
+    <p><iframe id="if" onload="test();" width="20%" height="20%" scrolling=auto src="data:text/html,
+    <html>
+    <body'>
+    <div style='position: absolute; width: 400px; height: 400px; left: 0; top: 0px;' id='p'><input id='in' value='abcd'></div>
+    </body></html>
+    ">
+</body>
+</html>
+
+
diff --git a/tests/tests/webkitsecurity/assets/iframe-invalid-source-crash.html b/tests/tests/webkitsecurity/assets/iframe-invalid-source-crash.html
new file mode 100644
index 0000000..c81bddf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-invalid-source-crash.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+    <body>
+        <iframe src="file:"></iframe>
+        This tests that we don't crash if an iframe has an invalid source. 
+        <div>SUCCESS - didn't crash</div>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-crash-mac.html b/tests/tests/webkitsecurity/assets/iframe-onload-crash-mac.html
new file mode 100644
index 0000000..79dafef
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-onload-crash-mac.html
@@ -0,0 +1,19 @@
+<meta><input><h6><nobr></nobr><datagrid><ins><button><em><iframe onload="
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.setEditingBehavior('mac');
+}
+
+if (document.counter)
+    document.counter++;
+else
+    document.counter = 1;
+
+if (document.counter <= 16) {
+    document.designMode='on';
+    document.execCommand('selectall');
+    document.execCommand('italic');
+    document.execCommand('RemoveFormat');
+    document.execCommand('inserthtml', false);
+    document.body.innerHTML='PASS';
+} ">x
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-crash-unix.html b/tests/tests/webkitsecurity/assets/iframe-onload-crash-unix.html
new file mode 100644
index 0000000..a3f8ba2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-onload-crash-unix.html
@@ -0,0 +1,19 @@
+<meta><input><h6><nobr></nobr><datagrid><ins><button><em><iframe onload="
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.setEditingBehavior('unix');
+}
+
+if (document.counter)
+    document.counter++;
+else
+    document.counter = 1;
+
+if (document.counter <= 16) {
+    document.designMode='on';
+    document.execCommand('selectall');
+    document.execCommand('italic');
+    document.execCommand('RemoveFormat');
+    document.execCommand('inserthtml', false);
+    document.body.innerHTML='PASS';
+} ">x
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-crash-win.html b/tests/tests/webkitsecurity/assets/iframe-onload-crash-win.html
new file mode 100644
index 0000000..567366b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-onload-crash-win.html
@@ -0,0 +1,19 @@
+<meta><input><h6><nobr></nobr><datagrid><ins><button><em><iframe onload="
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.setEditingBehavior('win');
+}
+
+if (document.counter)
+    document.counter++;
+else
+    document.counter = 1;
+
+if (document.counter <= 16) {
+    document.designMode='on';
+    document.execCommand('selectall');
+    document.execCommand('italic');
+    document.execCommand('RemoveFormat');
+    document.execCommand('inserthtml', false);
+    document.body.innerHTML='PASS';
+} ">x
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash-child.html b/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash-child.html
new file mode 100644
index 0000000..c7daf2d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash-child.html
@@ -0,0 +1,3 @@
+<html>
+<script src="iframe-onload-remove-self-no-crash.js"></script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.html b/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.html
new file mode 100644
index 0000000..fca7d11
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.html
@@ -0,0 +1,13 @@
+<html>
+<script>
+if (window.layoutTestController)
+  layoutTestController.dumpAsText();
+</script>
+<script src="resources/iframe-onload-remove-self-no-crash.js"></script>
+<body>
+This tests that setting remove a child frame in onload event handler
+does not crash the renderer.
+<br>
+<iframe src="resources/iframe-onload-remove-self-no-crash-child.html"></iframe>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.js b/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.js
new file mode 100644
index 0000000..2d3771e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-onload-remove-self-no-crash.js
@@ -0,0 +1,16 @@
+function onWindowLoad() {
+  var doc = top.document;
+  var b = doc.body;
+
+  var x = doc.getElementById('x');
+  if (x) {
+    b.removeChild(x);
+  }
+
+  x = doc.createElement("iframe");
+  x.setAttribute('id','x');
+  // appendChild triggers load
+  b.appendChild(x);
+}
+
+window.addEventListener("load", onWindowLoad, false);
diff --git a/tests/tests/webkitsecurity/assets/iframe-option-crash-expected.png b/tests/tests/webkitsecurity/assets/iframe-option-crash-expected.png
new file mode 100644
index 0000000..58edac4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-option-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/iframe-option-crash.xhtml b/tests/tests/webkitsecurity/assets/iframe-option-crash.xhtml
new file mode 100644
index 0000000..5b43769
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-option-crash.xhtml
@@ -0,0 +1,30 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+
+<script>
+function test()
+{
+    if (window.layoutTestController)
+        layoutTestController.waitUntilDone();
+
+    var frame = document.getElementsByTagName("iframe")[0];
+    var body = document.getElementById("body");
+    body.appendChild(document.getElementById("option"));
+    body.appendChild(frame);
+
+    document.getElementById("result").appendChild(document.createTextNode("If no crash while painting, the test passed (requires pixel test mode)."));
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+
+</head>
+
+<body id="body" onload="test()">
+      <div id="result"></div>
+      <iframe src="javascript:55"/>
+      <option id="option"><iframe src="data:text/html,11"/></option>
+</body>
+
+</html>
diff --git a/tests/tests/webkitsecurity/assets/iframe-plugin-load-remove-document-crash.html b/tests/tests/webkitsecurity/assets/iframe-plugin-load-remove-document-crash.html
new file mode 100644
index 0000000..0765e9b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/iframe-plugin-load-remove-document-crash.html
@@ -0,0 +1,21 @@
+<html>

+<body onload="runTest()">

+<script>

+    if (window.layoutTestController)

+    {

+        layoutTestController.dumpAsText();

+        layoutTestController.waitUntilDone();

+    }

+    

+    function runTest()

+    {

+        document.body.innerHTML = 'PASS';

+        

+        if (layoutTestController)

+            layoutTestController.notifyDone();

+    }

+</script>

+<iframe src="data:application/x-webkit-test-netscape,foo"></iframe>

+</body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.html b/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.html
new file mode 100644
index 0000000..84b1f6d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/ignored-result-null-comparison-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.js b/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.js
new file mode 100644
index 0000000..19e91ac
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/ignored-result-null-comparison-crash.js
@@ -0,0 +1,19 @@
+description(
+"This tests that bytecode generation doesn't crash on a comparison to null with an ignored result."
+);
+
+function equalToNullTest(a)
+{
+    a == null;
+    return true;
+}
+
+shouldBeTrue("equalToNullTest()");
+
+function notEqualToNullTest(a)
+{
+    a != null;
+    return true;
+}
+
+shouldBeTrue("notEqualToNullTest()");
diff --git a/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.html b/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.html
new file mode 100644
index 0000000..d93d0b9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/ignored-result-ref-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.js b/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.js
new file mode 100644
index 0000000..c3ccd23
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/ignored-result-ref-crash.js
@@ -0,0 +1,63 @@
+description(
+"This tests that bytecode code generation doesn't crash when it encounters odd cases of an ignored result."
+);
+
+function emptyStatementDoWhileTest()
+{
+    do
+        ;
+    while (false) { }
+    return true;
+}
+
+shouldBeTrue("emptyStatementDoWhileTest()");
+
+function debuggerDoWhileTest()
+{
+    do
+        debugger;
+    while (false) { }
+    return true;
+}
+
+shouldBeTrue("debuggerDoWhileTest()");
+
+function continueDoWhileTest()
+{
+    var i = 0;
+    do
+        i++;
+    while (i < 10) {
+        do
+            continue;
+        while (false) { }
+    }
+    return true;
+}
+
+shouldBeTrue("continueDoWhileTest()");
+
+function breakDoWhileTest()
+{
+    var i = 0;
+    do
+        i++;
+    while (i < 10) {
+        do
+            continue;
+        while (false) { }
+    }
+    return true;
+}
+
+shouldBeTrue("breakDoWhileTest()");
+
+function tryDoWhileTest()
+{
+    do
+        try { } catch (o) { }
+    while (false) { }
+    return true;
+}
+
+shouldBeTrue("tryDoWhileTest()");
diff --git a/tests/tests/webkitsecurity/assets/image-empty-crash.html b/tests/tests/webkitsecurity/assets/image-empty-crash.html
new file mode 100644
index 0000000..265c405
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/image-empty-crash.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+    <title></title>
+    <script type="text/javascript">
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<body>
+    <p>
+        This is a test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=10202">https://bugs.webkit.org/show_bug.cgi?id=10202</a>
+        REGRESSION: Repro crash when loading an empty image document</i>.
+    </p>
+    <p>
+        No crash means test PASS.
+    </p>
+    <hr>
+    <iframe src="data:image/png,"></iframe>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/image-map-title-causes-crash.html b/tests/tests/webkitsecurity/assets/image-map-title-causes-crash.html
new file mode 100644
index 0000000..cdf22c9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/image-map-title-causes-crash.html
@@ -0,0 +1,47 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">

+<html>

+<head>

+<script>

+

+    function removeAreaElement() {

+        document.getElementById("test").innerHTML=1

+    }

+

+    function queryTitleOnDecendants(accessibilityObject) {

+        accessibilityObject.title

+

+        var count = accessibilityObject.childrenCount;

+        for (var i = 0; i < count; ++i)

+            queryTitleOnDecendants(accessibilityObject.childAtIndex(i));

+    }

+</script>

+<script src="../fast/js/resources/js-test-pre.js"></script>

+</head>

+<body>

+

+<img usemap="#map">

+<map name="map" id="test"><area href="javascript:document.getElementById('result').innerHTML='area clicked'" /></map>

+

+<p id="description"></p>

+<div id="console"></div>

+

+<script>

+    description("Requesting the title of an AccessibilityImageMapLink can cause a crash when the map's area element has been removed.");

+

+    if (window.accessibilityController) {

+        // First build up full accessibility tree.

+        document.body.focus();

+        queryTitleOnDecendants(accessibilityController.focusedElement);

+        

+        removeAreaElement()

+        

+        // Now call request the title for each accessibility object.

+        document.body.focus();

+        queryTitleOnDecendants(accessibilityController.focusedElement);

+    }

+

+</script>

+

+<script src="../fast/js/resources/js-test-post.js"></script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/image-map-update-parent-crash.html b/tests/tests/webkitsecurity/assets/image-map-update-parent-crash.html
new file mode 100644
index 0000000..dfe4697
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/image-map-update-parent-crash.html
@@ -0,0 +1,53 @@
+<html>
+<head>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+
+<script>
+
+if (window.layoutTestController)
+  layoutTestController.waitUntilDone();
+
+function buildAccessibilityTree(accessibilityObject, indent) {
+    var count = accessibilityObject.childrenCount;
+    for (var i = 0; i < count; ++i) {
+         if (!buildAccessibilityTree(accessibilityObject.childAtIndex(i), indent + 1))
+            return false;
+    }
+
+    return true;
+}
+
+function runAXTest() {
+
+
+   description("This tests that an image map's hold on it's parent will be cleared if the parent goes away.");
+
+   // First access all children using AX
+   buildAccessibilityTree(accessibilityController.rootElement, 0);
+
+   var child = document.getElementById('img'); child.parentNode.removeChild(child);
+ 
+   // Now verify we haven't crashed.
+   buildAccessibilityTree(accessibilityController.rootElement, 0);
+
+   if (window.layoutTestController)
+       layoutTestController.notifyDone();
+}
+</script>
+
+</head>
+<body>
+
+<map name="map">
+<div id="o7"></div>
+<area id="o20" href="#"></area></map>
+
+<img id="img" usemap="#map"><span></span> 
+
+<script>setTimeout("runAXTest();", 1);</script> 
+
+<p id="description"></p>
+<div id="console"></div>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/imagemap-norender-crash.html b/tests/tests/webkitsecurity/assets/imagemap-norender-crash.html
new file mode 100644
index 0000000..d319723
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/imagemap-norender-crash.html
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+<body id="body">
+
+<h1 id="header" tabindex=0>start element</h1>
+<div><img src="resources/abe.png" alt="test" style="width:679px; height:112px" usemap="#Map"></div>
+<div style="display:none"><map name="Map" id="Map"><area shape="rect" coords=coords="5,48,247,97" href="http://www.webkit.org/" target="_blank" id="area1"/></map></div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This tests tabbing to an image map link where the map might not have a renderer won't crash.");
+
+    // start at the right place
+    document.getElementById("header").focus();
+
+    // tab forward
+    eventSender.keyDown('\t');
+    shouldBe("document.activeElement.id", "'area1'");
+</script>
+
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/imbricated-flow-threads-crash.html b/tests/tests/webkitsecurity/assets/imbricated-flow-threads-crash.html
new file mode 100644
index 0000000..5b27d51
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/imbricated-flow-threads-crash.html
@@ -0,0 +1,69 @@
+<html>
+<head>
+    <style type="text/css">
+    article{
+        -webkit-flow-into: article;
+    }
+    .region{
+        -webkit-flow-from: article;
+    }
+    #layout{
+        -webkit-flow-into: pages;
+    }
+    .page{
+        -webkit-flow-from: pages;
+    } 
+    #layout .region{
+        width: 50%;
+        background-color: lightgreen;
+        height: 100%;
+    }
+    #layout,
+    #paginator{
+        width: 200px;
+        height: 500px;
+    }
+    #paginator .page{
+        width: 100%;
+        height: 100%;
+        background: #ddd;
+    }
+    .description{
+        color: blue;
+    }
+    </style>
+</head>
+<body>
+    <div><p class="description">Text should be rendered in the green region. The test passes if there is no crash</p></div>
+
+    <div id="layout">
+        <div id="r1" class="region"></div>
+    </div> 
+    <div id="paginator">
+        <div class="page"></div>
+    </div>
+    <article>
+        <p>
+            Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
+        </p>
+    </article>
+    <script>
+        if (window.layoutTestController) {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+        }
+        function addNewRegion() {
+            var oldRegion = document.getElementById("r1");
+            var newRegion = oldRegion.cloneNode(true);
+            oldRegion.parentNode.appendChild(newRegion);
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
+        function test() {
+            setTimeout(addNewRegion, 0);
+        }
+
+        window.addEventListener("load", test, false);
+    </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/implicit-head-in-fragment-crash.html b/tests/tests/webkitsecurity/assets/implicit-head-in-fragment-crash.html
new file mode 100644
index 0000000..1de9dc9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/implicit-head-in-fragment-crash.html
@@ -0,0 +1,24 @@
+<SCRIPT>
+  if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+  }
+  setTimeout(function () {
+    node = document.createElement("M");
+    document.open();
+    node.innerHTML = "<body>";
+    node.innerHTML = "<p>";
+
+    node = document.createDocumentFragment();
+    document.open();
+    node.innerHTML = "<body>";
+    node.innerHTML = "<p>";
+
+    var b = document.body;
+    document.write("<a href='https://bugs.webkit.org/show_bug.cgi?id=25694'>bug 25694</a><br>");
+    document.write(b ? "FAIL: document.body is not null (but at least we didn't crash)" : "PASS");
+    document.close();
+    if (window.layoutTestController)
+      layoutTestController.notifyDone();
+  }, 0);
+</SCRIPT>
diff --git a/tests/tests/webkitsecurity/assets/import-crash.html b/tests/tests/webkitsecurity/assets/import-crash.html
new file mode 100644
index 0000000..b4d1f8f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/import-crash.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+   "http://www.w3.org/TR/html4/loose.dtd">
+
+<html lang="en">
+<head>
+  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+  <title>Test that @import rule importing keyframes does not crash</title>
+  <style type="text/css"> @import "resources/keyframes.css"; </style>
+  <style type="text/css" media="screen">
+    #box {
+        position: absolute;
+        left: 0;
+        top: 100px;
+        height: 100px;
+        width: 100px;
+        background-color: blue;
+        -webkit-animation-duration: 1s;
+        -webkit-animation-timing-function: linear;
+        -webkit-animation-name: "anim";
+    }
+    </style>
+    <script type="text/javascript" charset="utf-8">
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+  </script>
+</head>
+<body>
+This test simply loads a sheet using @import that contains keyframes, to see if https://bugs.webkit.org/show_bug.cgi?id=20855
+is fixed.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/indent-node-to-split-to-crash.html b/tests/tests/webkitsecurity/assets/indent-node-to-split-to-crash.html
new file mode 100644
index 0000000..407dcb0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/indent-node-to-split-to-crash.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>

+<html>

+<head>

+<script type="text/JavaScript">

+

+function runTest() {

+    document.execCommand('usecss', null, 'false');

+

+    var div = document.getElementById('a');

+    var range = document.createRange();

+    var sNode = div.childNodes[0];

+    var eNode = div.childNodes[3];

+    range.setStart(sNode, NaN);

+    range.setEnd(eNode, NaN);

+    getSelection().removeAllRanges();

+    getSelection().addRange(range);

+

+    document.execCommand('indent', null, true);

+

+    document.body.innerHTML = 'This test ensures WebKit does not crash when intending.<br>PASS';

+

+    layoutTestController.notifyDone();

+}

+

+if (window.layoutTestController) {

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+</script>

+</head>

+<body onload="runTest()"><div contenteditable="" id="a"><div><br><div contenteditable="false"><table></table></div></div><blockquote><input></blockquote><br></br></div></body></html>

diff --git a/tests/tests/webkitsecurity/assets/index-validation-crash-with-buffer-sub-data.html b/tests/tests/webkitsecurity/assets/index-validation-crash-with-buffer-sub-data.html
new file mode 100644
index 0000000..11405a5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/index-validation-crash-with-buffer-sub-data.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+<script src="resources/webgl-test.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+
+<script>
+description('Verifies that the index validation code which is within bufferSubData does not crash.')
+
+var gl = create3DContext();
+
+var elementBuffer = gl.createBuffer();
+gl.bindBuffer(gl.ELEMENT_ARRAY_BUFFER, elementBuffer);
+gl.bufferData(gl.ELEMENT_ARRAY_BUFFER, 256, gl.STATIC_DRAW);
+var data = new Uint8Array(127);
+gl.bufferSubData(gl.ELEMENT_ARRAY_BUFFER, 63, data);
+testPassed("bufferSubData, when buffer object was initialized with null, did not crash");
+</script>
+
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/initkeyboardevent-crash.html b/tests/tests/webkitsecurity/assets/initkeyboardevent-crash.html
new file mode 100644
index 0000000..87c7aac
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/initkeyboardevent-crash.html
@@ -0,0 +1,17 @@
+<p>This tests that dispatching a keyboard event created via javascript does
+not crash.</p>
+<p id="results"></p>
+
+<input id="1"> 
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var evt = document.createEvent("KeyboardEvent");
+evt.initKeyboardEvent("keydown", true, true, window, 0, 0, 0, 0, 0, 0, "a");
+var elt = document.getElementById("1");
+elt.focus();
+elt.dispatchEvent(evt);
+
+document.getElementById("results").innerText = "PASSED";
+</script>
diff --git a/tests/tests/webkitsecurity/assets/inline-body-crash.html b/tests/tests/webkitsecurity/assets/inline-body-crash.html
new file mode 100644
index 0000000..a66959d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-body-crash.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<title>inline body causes crash</title>
+<script>
+  if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+</script>
+</head>
+
+<body style="display: inline;">
+  <marquee>No crash means PASS</marquee>
+</body>
+
+</html>
diff --git a/tests/tests/webkitsecurity/assets/inline-body-with-scrollbar-crash.html b/tests/tests/webkitsecurity/assets/inline-body-with-scrollbar-crash.html
new file mode 100644
index 0000000..1eeb0fd
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-body-with-scrollbar-crash.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<title>inline body causes crash with custom scrollbar</title>
+<style>
+  ::-webkit-scrollbar { width: 5px; height: 5px; }
+</style>
+<script>
+  if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+</script>
+</head>
+
+<body style="overflow: scroll; display: inline;">
+  <div style="width: 5000px; height: 5000px;">No crash means PASS</div>
+</body>
+
+</html>
diff --git a/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash.html b/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash.html
new file mode 100644
index 0000000..6bafbb9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash.html
@@ -0,0 +1,24 @@
+<html>

+<style>

+div {

+   display: inline-block;

+   width: 1px;

+   height: 1px;

+}

+</style>

+<div>

+<br><br>

+</div>

+<div style="overflow: auto">

+<br><br>

+PASS

+</div>

+<script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+

+    document.designMode = "on";

+    document.execCommand("SelectAll");

+    document.execCommand("InsertUnorderedList", true, null);

+</script>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash2.html b/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash2.html
new file mode 100644
index 0000000..ddc9ca1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-box-adjust-position-crash2.html
@@ -0,0 +1,14 @@
+<html>

+Test passes it if does not crash.

+&nbsp;<img>

+<style>

+* { 

+   position: fixed; 

+   -webkit-text-emphasis-style: sesame;

+}

+</style>

+<script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+</script>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/inline-box-wrapper-crash.html b/tests/tests/webkitsecurity/assets/inline-box-wrapper-crash.html
new file mode 100644
index 0000000..dfd2d9d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-box-wrapper-crash.html
@@ -0,0 +1,24 @@
+<html>

+<style>

+    body { direction: rtl; padding-left: 100%; }

+</style>

+<script>

+    if (window.layoutTestController) {

+        layoutTestController.dumpAsText();

+        layoutTestController.waitUntilDone();

+    }

+

+    function runTest() {

+        document.body.innerHTML = "PASS";

+

+        if (window.layoutTestController)

+            layoutTestController.notifyDone();

+    }

+

+    setTimeout("runTest()", 0);

+</script>

+0<image>

+<span>

+A<div></div>

+</span>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/inline-child-height-width-calc-crash.html b/tests/tests/webkitsecurity/assets/inline-child-height-width-calc-crash.html
new file mode 100644
index 0000000..ac03b71
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-child-height-width-calc-crash.html
@@ -0,0 +1,27 @@
+<html>

+    <head>

+        <script>

+            if (window.layoutTestController)

+            {

+                layoutTestController.dumpAsText();

+                layoutTestController.waitUntilDone();

+            }

+

+            function runTest() {

+                brElement = document.getElementById('test');

+                document.open();

+                setTimeout(function () {

+                    document.appendChild(brElement);

+                    

+                    alert('PASS');

+                    if (window.layoutTestController)

+                        layoutTestController.notifyDone();

+                }, 0);

+            }

+        </script>

+    </head>

+    <body onload="runTest()">

+        <br id='test'>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/inline-children-crash.html b/tests/tests/webkitsecurity/assets/inline-children-crash.html
new file mode 100644
index 0000000..57a919b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-children-crash.html
@@ -0,0 +1,31 @@
+<html>
+<head>
+<style>
+#flexbox {
+  display: -moz-box;
+  display: -khtml-box;
+  display: box;
+  width: 100px;
+  height: 100px;
+  -moz-box-orient: vertical;
+  -webkit-box-orient: vertical;
+  box-orient: vertical;
+  -webkit-line-clamp: 50%;
+}
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<p>Remove last block content from a flexbox, leaving only inline content. This should not crash</p>
+
+<div id="flexbox"><div id=remove></div>text</div>
+<script>
+var flexbox = document.getElementById('flexbox');
+flexbox.removeChild(flexbox.firstChild);
+</script>
+</body>
+
+  
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/inline-crash-expected.png b/tests/tests/webkitsecurity/assets/inline-crash-expected.png
new file mode 100644
index 0000000..e610da2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/inline-crash.html b/tests/tests/webkitsecurity/assets/inline-crash.html
new file mode 100644
index 0000000..b012e9e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-crash.html
@@ -0,0 +1,25 @@
+<script>
+    onload = function()
+    {
+        if (window.layoutTestController) {
+            layoutTestController.waitUntilDone();
+            layoutTestController.display();
+        }
+        setTimeout(changeColor, 0);
+    }
+
+    changeColor = function()
+    {
+        var span = document.getElementById("span");
+        getSelection().setBaseAndExtent(span, 0, span, 1);
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+</script>
+<p>
+    Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=19525">https://bugs.webkit.org/show_bug.cgi?id=19525</a>
+    -webkit-box-reflect in hyperlink causes webkit to crash</i>.
+</p>
+<p>
+    Because it is an inline flow, <span id="span" style="-webkit-box-reflect: below;">this span</span> should not have a reflection, and selecting it should not cause a crash.
+</p>
diff --git a/tests/tests/webkitsecurity/assets/inline-destroy-dirty-lines-crash.html b/tests/tests/webkitsecurity/assets/inline-destroy-dirty-lines-crash.html
new file mode 100644
index 0000000..b8add8f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-destroy-dirty-lines-crash.html
@@ -0,0 +1,19 @@
+<html>
+<body onload="runTest()">
+Test passes it it does not crash.
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function runTest()
+    {
+        document.body.offsetTop;
+        child = document.getElementById('test');
+        child.parentNode.removeChild(child);
+    }
+</script>
+<br>
+<span id="test"></span>
+</body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/inline-marquee-crash.html b/tests/tests/webkitsecurity/assets/inline-marquee-crash.html
new file mode 100644
index 0000000..1435e4b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-marquee-crash.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+<title>inline marquee causes crashes</title>
+<script>
+  if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+</script>
+</head>
+
+<body>
+  <div style="opacity: 0.9;">
+    <marquee style="opacity: 0.9; display: inline;">No crash means PASS</marquee>
+  </div>
+</body>
+
+</html>
diff --git a/tests/tests/webkitsecurity/assets/inline-splitting-with-after-float-crash.html b/tests/tests/webkitsecurity/assets/inline-splitting-with-after-float-crash.html
new file mode 100755
index 0000000..cb0c877
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-splitting-with-after-float-crash.html
@@ -0,0 +1,27 @@
+<style>

+    .c2:after { float: left; content: "A"; }

+</style>

+PASS, if the script does not cause a crash or ASSERT failure

+<script>

+    function endTest(childSpan) {

+        childSpan.appendChild(divToInsert);

+        if (window.layoutTestController)

+            layoutTestController.notifyDone();

+    }

+    function startTest() {

+        quoteNode = document.createElement('q');

+        document.documentElement.appendChild(quoteNode);

+        divToInsert = document.createElement('div');

+        parentSpan = document.createElement('span');

+        parentSpan.setAttribute('class', 'c2');

+        childSpan = document.createElement('span');

+        parentSpan.appendChild(childSpan);

+        document.documentElement.appendChild(parentSpan);

+        setTimeout('endTest(childSpan);', 50);

+        if (window.layoutTestController) {

+            layoutTestController.waitUntilDone();

+            layoutTestController.dumpAsText();

+        }

+    }

+    window.onload = startTest;

+</script>

diff --git a/tests/tests/webkitsecurity/assets/inline-text-destroy-attributes-crash.xhtml b/tests/tests/webkitsecurity/assets/inline-text-destroy-attributes-crash.xhtml
new file mode 100644
index 0000000..e00e61c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-text-destroy-attributes-crash.xhtml
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>

+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">

+<defs>

+    <text id="text1">

+        <tspan id="tspan1" x="906" y="250">Test passes it if does not crash</tspan>

+        <tspan id="tspan2" x="447" y="108">PASS</tspan>

+    </text>

+</defs>

+<use id="use1" xlink:href="#text1"/>

+<text id="text2"></text>

+<script>

+    if (window.layoutTestController)

+	    layoutTestController.dumpAsText();

+

+    var range = document.createRange();

+    range.setStart(document.getElementById("use1"), 0);

+    range.setEnd(document.getElementById("text2"), 0);

+    (new XMLSerializer()).serializeToString(range.extractContents());

+	document.getElementById('text1').offsetTop;

+    range.surroundContents(document.getElementById("tspan1"));

+</script>

+</svg>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/inline-to-block-crash.html b/tests/tests/webkitsecurity/assets/inline-to-block-crash.html
new file mode 100644
index 0000000..d4c8081
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/inline-to-block-crash.html
@@ -0,0 +1,43 @@
+<script>
+
+// This tests a particular sequence of render tree changes, which
+// caused a crash in the code that maintains the line box tree.
+// Even small changes to the test make it no longer crash, so it
+// should be left as-is. That's why the test results don't say
+// anything about what this tests -- adding that caused the crash
+// to go away!
+
+function turnAnchorIntoBlock()
+{
+    document.getElementById("a").style.display = "block";
+    document.getElementById("span").firstChild.data = "PASSED";
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function turnSpanIntoBlock()
+{
+    document.body.offsetHeight; // trigger layout
+    document.getElementById("span").style.display = "block";
+    
+    setTimeout(turnAnchorIntoBlock, 0);
+}
+
+function runTest()
+{
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+    setTimeout(turnSpanIntoBlock, 0);
+}
+
+</script>
+
+<body onload="runTest()">
+
+<a id="a">
+    <span id="span">TEST HAS NOT RUN YET</span>
+</a>
+
+</body>
diff --git a/tests/tests/webkitsecurity/assets/innerHTML-script-tag-crash.xhtml b/tests/tests/webkitsecurity/assets/innerHTML-script-tag-crash.xhtml
new file mode 100644
index 0000000..3cfaf05
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/innerHTML-script-tag-crash.xhtml
@@ -0,0 +1,19 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <script>
+        <![CDATA[
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            var span = document.createElement("span");
+            document.documentElement.appendChild(span);
+            span.outerHTML = "<sc"+"ript></scr"+"ipt>";
+        ]]>
+    </script>
+</head>
+<body>
+    <p>This tests a crash in the xml parser when using innerHTML or outerHTML to insert a script tag into a xhtml 
+       document. (rdar://problem/5519698).  The test has passed if it does not crash.</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/innerHTML-selection-crash.html b/tests/tests/webkitsecurity/assets/innerHTML-selection-crash.html
new file mode 100644
index 0000000..9ff249b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/innerHTML-selection-crash.html
@@ -0,0 +1,20 @@
+<p>This tests that calling innerHTML doesn't crash when the selection endpoint is inside a text field's shadow DOM tree.</p>
+
+<p>If the test doesn't crash, then it passes.</p>
+
+<input id="field" type="text" value="some text">
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+document.getElementById('field').setAttribute('style', 'display: inline');
+document.getElementById('field').focus();
+document.body.offsetLeft;
+document.getElementById('field').setAttribute('style', 'display: block');
+document.body.innerHTML;
+document.getElementById('field').setAttribute('style', 'display: none');
+
+document.write("<p>PASS: There was no crash.</p>");
+
+</script>
diff --git a/tests/tests/webkitsecurity/assets/input-box-text-fragment-combine-text-crash.html b/tests/tests/webkitsecurity/assets/input-box-text-fragment-combine-text-crash.html
new file mode 100644
index 0000000..3a4e689
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/input-box-text-fragment-combine-text-crash.html
@@ -0,0 +1,11 @@
+<html>

+Test passes if it does not crash.

+<input type="submit" value="Search"></input>

+<style>

+    input { -webkit-text-combine:horizontal; }

+</style>

+<script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+</script>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/input-element-attach-crash.html b/tests/tests/webkitsecurity/assets/input-element-attach-crash.html
new file mode 100644
index 0000000..318731b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/input-element-attach-crash.html
@@ -0,0 +1,20 @@
+<html>
+    <head>
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+        </script>
+    </head>
+    <body>
+        <button autofocus>
+            <object>
+                <select autofocus>
+                <input>
+                <span>
+                <div></div>
+                PASS
+            </object>
+            <object></object>
+        </button>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/input-element-page-cache-crash.html b/tests/tests/webkitsecurity/assets/input-element-page-cache-crash.html
new file mode 100644
index 0000000..891d941
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/input-element-page-cache-crash.html
@@ -0,0 +1,55 @@
+<html>
+<head>
+<script>
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+    layoutTestController.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
+}
+
+function runTest()
+{
+    var input = document.getElementById("testinput");
+    input.setAttribute("autocomplete", "on");
+    input.parentNode.removeChild(input);
+
+    // Location changes need to happen outside the onload handler to generate history entries.
+    setTimeout(function() {window.location = "data:text/html,<script>history.back();</scrip" + "t>";}, 0);
+}
+
+function pageHidden()
+{
+    if (!sessionStorage.finishTest) {
+        console.log('navigating away');
+        sessionStorage.finishTest = true;
+    } else {
+        // Clean up after ourselves
+        delete sessionStorage.finishTest;
+    }
+}
+
+function pageShown()
+{
+    if (sessionStorage.finishTest) {
+        console.log('navigated back');
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    } else {
+        runTest();
+    }
+}
+
+</script>    
+</head>
+
+<body onpagehide="pageHidden();" onpageshow="pageShown();">
+<pre>This test has an input element that starts out with autocomplete=off.
+It then changes autocomplete to on.
+It then removes the element so it is destroyed.
+It then navigates to a new page, placing the current page in the page cache.
+Finally it returns to the original page.</pre>
+<form>
+<input id="testinput" autocomplete="off">
+</form>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/input-number-crash.html b/tests/tests/webkitsecurity/assets/input-number-crash.html
new file mode 100644
index 0000000..3086af8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/input-number-crash.html
@@ -0,0 +1,26 @@
+<html>
+    <head>
+        <script>
+            function test()
+            {
+                if (window.layoutTestController)
+                    layoutTestController.dumpAsText();
+                var input = document.getElementById("test");
+                var x = input.offsetLeft + input.offsetWidth - 8;
+                var y = input.offsetTop + input.offsetHeight - 7;
+                if (window.eventSender) {
+                    eventSender.mouseMoveTo(x, y);
+                    eventSender.mouseDown();
+                    eventSender.mouseUp();
+                }
+            }
+        </script>
+        <style>
+            #test { width: 100px; }
+        </style>
+    </head>
+    <body onload="test()">
+        This tests that we don't crash when the renderer goes away during event handling.<br>
+        <input type="number" id="test" onclick="event.target.style.display='none'">
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/input-number-spinbutton-crash.html b/tests/tests/webkitsecurity/assets/input-number-spinbutton-crash.html
new file mode 100644
index 0000000..fbda964
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/input-number-spinbutton-crash.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+input::-webkit-inner-spin-button { display: none; }
+</style>
+</head>
+<body>
+<input type="number" id="in">
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+var input = document.getElementById('in');
+var evt = document.createEvent("MouseEvent");
+evt.initMouseEvent("click", true, true, window, 10, 10, 10, 10);
+input.dispatchEvent(evt);
+input.style.display='none';
+</script>
+PASS
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/input-search-table-column-crash.html b/tests/tests/webkitsecurity/assets/input-search-table-column-crash.html
new file mode 100644
index 0000000..dc29ccf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/input-search-table-column-crash.html
@@ -0,0 +1,14 @@
+<html>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+    <style>
+        input[type="search"]::-webkit-search-cancel-button {
+            -webkit-appearance: none; 
+            display: table-column;
+        }
+    </style>
+    <input type="search">
+    PASS
+</html>
diff --git a/tests/tests/webkitsecurity/assets/insert-images-in-pre-x-crash.html b/tests/tests/webkitsecurity/assets/insert-images-in-pre-x-crash.html
new file mode 100644
index 0000000..a1c6fdb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/insert-images-in-pre-x-crash.html
@@ -0,0 +1,21 @@
+<pre id="x"><x style="white-space: pre-wrap;"><br></x></pre>
+<script>
+
+// Adding DOCTYPE, html, or body prevents the crash to reproduce.
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var x = document.getElementById("x");
+document.execCommand("selectall",false);
+document.designMode="on";
+document.execCommand("InsertImage");
+document.execCommand("InsertImage");
+document.execCommand("InsertImage");
+
+document.open();
+document.writeln('This test ensures WebKit does not crash.<br><br>PASS');
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/insert-text-crash.html b/tests/tests/webkitsecurity/assets/insert-text-crash.html
new file mode 100644
index 0000000..7810e8e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/insert-text-crash.html
@@ -0,0 +1,20 @@
+<style>
+#el2 {
+    display: -webkit-flexbox;
+    border: 1px solid red;
+}
+#el3 {
+    position: absolute;
+    border: 1px solid green;
+}
+</style>
+<body contenteditable=true>
+<div id="el2"><div id="el3">AA </div></div>
+</body>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+document.execCommand('selectall')
+document.execCommand('inserttext', '')
+document.body.innerText = "This test passes if it does not crash.";
+</script>
diff --git a/tests/tests/webkitsecurity/assets/insert-text-into-empty-frameset-crash.html b/tests/tests/webkitsecurity/assets/insert-text-into-empty-frameset-crash.html
new file mode 100644
index 0000000..f539969
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/insert-text-into-empty-frameset-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+setTimeout(function() {
+    document.designMode="on";
+    document.execCommand("selectall");
+    document.execCommand("InsertText", false);
+    document.open();
+    document.write("This test ensures that selecting all and inserting text into a page with a frameset does not crash<br><br>PASS");
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}, 0);
+</script>
+<frameset><frame></frame></frameset>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/insertAdjacentHTML-DocumentFragment-crash.html b/tests/tests/webkitsecurity/assets/insertAdjacentHTML-DocumentFragment-crash.html
new file mode 100644
index 0000000..3efa325
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/insertAdjacentHTML-DocumentFragment-crash.html
@@ -0,0 +1,10 @@
+This test passes if it doesn't crash (or ASSERT).
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var f = document.createDocumentFragment();
+var s = document.createElement('div');
+f.appendChild(s);
+s.insertAdjacentHTML('afterend', "aaa");
+</script>
diff --git a/tests/tests/webkitsecurity/assets/insertHTML-mutation-crash.html b/tests/tests/webkitsecurity/assets/insertHTML-mutation-crash.html
new file mode 100644
index 0000000..d46e6b3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/insertHTML-mutation-crash.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script type="text/javascript">
+        function log(msg)
+        {
+            document.body.appendChild(document.createTextNode(msg + '\n'));
+        }
+
+        function runTests()
+        {
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            var listener = function(e) {
+                var el = document.getElementById('cont');
+                if (el.firstElementChild && el.lastElementChild != el.firstElementChild) {
+                    el.lastElementChild.appendChild(el.firstElementChild);
+                    el.lastElementChild && el.removeChild(el.lastElementChild);
+                }
+                if (e.target.firstChild && e.target.firstChild.className == 'Apple-style-span')
+                    e.target.firstChild.innerHTML = e.target.firstChild.innerHTML.split(' ')[0];
+            };
+            document.addEventListener("DOMSubtreeModified", listener);
+
+            var el = document.getElementById('cont');
+            window.getSelection().setBaseAndExtent(document.getElementById('start'), 0, document.getElementById('end'), 0);
+            var str = '<span class="Apple-style-span" style="color: red;"><span>styled</span> <span>content</span></span>';
+            document.execCommand("InsertHTML", false, str);
+
+            document.removeEventListener("DOMSubtreeModified", listener);
+
+            log('PASS: No crash.');
+        }
+
+    </script>
+</head>
+<body onload="runTests();">
+    <div id="cont" contenteditable="true">
+        <span>This <span id="start">tests</span></span>
+        <span>that we don't crash when <code id="end">mutating</code> the dom</span>
+        <span>during execution of an InsertHTML command.</span>
+    </div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/insertNode-empty-fragment-crash.html b/tests/tests/webkitsecurity/assets/insertNode-empty-fragment-crash.html
new file mode 100644
index 0000000..7ec617c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/insertNode-empty-fragment-crash.html
@@ -0,0 +1,38 @@
+<html>
+    <head>
+        <script src="../../js/resources/js-test-pre.js"></script>
+    </head>
+    <body>
+        <script>
+            description('Test Range.insertNode(fragment) when the fragment is empty and the range is collapsed');
+
+            var p = document.createElement('p');
+            var t1 = document.createTextNode('12345');
+            p.appendChild(t1);
+            var t2 = document.createTextNode('ABCDE');
+            p.appendChild(t2);
+            document.body.appendChild(p);
+            var r = document.createRange();
+            r.setStart(p, 1);
+            r.setEnd(p, 1);
+            shouldBeEqualToString("r.toString()", "");
+
+            var df = document.createDocumentFragment();
+            r.insertNode(df);
+
+            shouldBe("p.childNodes.length", "2");
+            shouldBe("p.childNodes[0]", "t1");
+            shouldBe("p.childNodes[1]", "t2");
+
+            shouldBeTrue("r.collapsed");
+            shouldBe("r.startContainer", "p");
+            shouldBe("r.startOffset", "1");
+            shouldBe("r.endContainer", "p");
+            shouldBe("r.endOffset", "1");
+            shouldBeEqualToString("r.toString()", "")
+
+            document.body.removeChild(p);
+        </script>
+        <script src="../../js/resources/js-test-post.js"></script>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/insertion-point-line-number-on-password-crashes.html b/tests/tests/webkitsecurity/assets/insertion-point-line-number-on-password-crashes.html
new file mode 100644
index 0000000..6b7581c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/insertion-point-line-number-on-password-crashes.html
@@ -0,0 +1,25 @@
+<html>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<body>
+
+    <div id="result"></div>
+
+    <input type="password" id="password">
+
+    <script>
+        if (window.accessibilityController) {
+            var result = document.getElementById("result");
+
+            var password = document.getElementById("password");
+            password.focus();
+
+            // Make sure this doesn't crash.
+            lineNumber = accessibilityController.focusedElement.insertionPointLineNumber;
+            result.innerText += "Line number for password element: " + lineNumber + "\n";
+        }
+    </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/interactive-validation-crash-by-style-override.html b/tests/tests/webkitsecurity/assets/interactive-validation-crash-by-style-override.html
new file mode 100644
index 0000000..c6019ec
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/interactive-validation-crash-by-style-override.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+<style type="text/css">
+div {
+    position: relative;
+}
+</style>
+</head>
+<body>
+<form>
+  <select required>
+    <option value="">X</option>
+    <option>Y</option>
+  </select>
+  <input type=submit id="submit">
+</form>
+
+<div id=console></div>
+
+<script>
+document.getElementById('submit').click();
+setTimeout(function () {
+    document.getElementsByTagName('select')[0].selectedIndex = 1;
+    testPassed('Not crashed');
+    finishJSTest();
+}, 0);
+window.jsTestIsAsync = true;
+</script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/interactive-validation-select-crash.html b/tests/tests/webkitsecurity/assets/interactive-validation-select-crash.html
new file mode 100644
index 0000000..a82b052
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/interactive-validation-select-crash.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p>Test for a bug that RenderBlock crashed when a validation message bubble for a select element with float:left was closing.</p>
+<div id=console></div>
+<form>
+<select style="float:left" required>
+<option value="">Plese select</option>
+<option>Foo</option>
+</select>
+<input type=submit id=submit>
+</form>
+
+<script>
+window.jsTestIsAsync = true;
+
+function closeBubble() {
+    // Make the <select> valid to close the validation message bubble.
+    document.getElementsByTagName('select')[0].selectedIndex = 1;
+    setTimeout(finish, 0);
+}
+function finish() {
+    testPassed('Not crashed.');
+    finishJSTest();
+}
+
+document.getElementById('submit').click();
+setTimeout(closeBubble, 0);
+</script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.html b/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.html
new file mode 100644
index 0000000..32e32f9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.html
@@ -0,0 +1,2 @@
+<title>Testcase for 6345</title>
+<script type="text/javascript" src="resources/invalid-charset-on-script-crashes-loader.js" charset="invalid-encoding-name"></script>
diff --git a/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.js b/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.js
new file mode 100644
index 0000000..044c0c5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/invalid-charset-on-script-crashes-loader.js
@@ -0,0 +1,3 @@
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+document.writeln("Success!");
diff --git a/tests/tests/webkitsecurity/assets/invalid-color-crash.svg b/tests/tests/webkitsecurity/assets/invalid-color-crash.svg
new file mode 100644
index 0000000..bdb85ed
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/invalid-color-crash.svg
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http:/xlink">

+    <script>

+        <![CDATA[

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+        ]]>

+    </script>

+    <style type="text/css">

+        svg 

+        {

+            stop-color: initial;

+        }

+    </style>

+    <text id="myText1" fill="green" x="0" y="0">PASS</text>

+</svg>

+

diff --git a/tests/tests/webkitsecurity/assets/invalid-cursor-property-crash.html b/tests/tests/webkitsecurity/assets/invalid-cursor-property-crash.html
new file mode 100644
index 0000000..c768564
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/invalid-cursor-property-crash.html
@@ -0,0 +1,21 @@
+<html>
+<head>
+    <script>
+    function runTest() {
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+            
+        var d = document.getElementById('theDiv');
+        var style = document.defaultView.getComputedStyle(d, '');
+        
+        if (style && style.cursor == 'url(' + document.location + '), auto')
+            document.getElementById('result').innerHTML = 'SUCCESS';            
+    }
+    </script>
+</head>
+<body onload="runTest()">
+<div id="theDiv" style="cursor: url()">
+<div>This tests that the invalid cursor property value does not get applied. See Bug 11221.</div>
+<div id="result">FAILURE</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/invalid-font-family-in-font-face-crash.html b/tests/tests/webkitsecurity/assets/invalid-font-family-in-font-face-crash.html
new file mode 100644
index 0000000..6003f48
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/invalid-font-family-in-font-face-crash.html
@@ -0,0 +1,14 @@
+<html>

+Test passes if it does not crash.

+<style>

+    @font-face { font-family: inherit; }

+	

+	@font-face { font-family: initial; }

+</style>

+<script>

+    if (window.layoutTestController)

+	    layoutTestController.dumpAsText();

+		

+	document.body.offsetTop;

+</script>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/invalid-media-url-crash.html b/tests/tests/webkitsecurity/assets/invalid-media-url-crash.html
new file mode 100644
index 0000000..42540b7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/invalid-media-url-crash.html
@@ -0,0 +1,32 @@
+<html>
+    <body>
+        <p>Tests that invalid media src url does not result in crash.</p>
+        <script src=video-test.js></script>
+        <script>
+            var invalid_url = "!:/" + String.fromCharCode(0) + "%aa#aa";
+            var error_count = 0;
+
+            function errorEvent()
+            {
+                error_count++;
+                if (error_count == 2)
+                {
+                    testExpected("audio.error.code", MediaError.MEDIA_ERR_SRC_NOT_SUPPORTED);
+                    testExpected("video.error.code", MediaError.MEDIA_ERR_SRC_NOT_SUPPORTED);
+                    testExpected("audio.networkState", HTMLMediaElement.NETWORK_NO_SOURCE);
+                    testExpected("video.networkState", HTMLMediaElement.NETWORK_NO_SOURCE);
+                    endTest();
+                }
+            }
+
+            var audio = document.createElement('audio');
+            var video = document.createElement('video');
+            audio.src = invalid_url;
+            video.src = invalid_url;
+            audio.onerror = errorEvent;
+            video.onerror = errorEvent;
+            document.body.appendChild(audio);
+            document.body.appendChild(video);
+        </script>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/invalid-set-font-crash.html b/tests/tests/webkitsecurity/assets/invalid-set-font-crash.html
new file mode 100644
index 0000000..1e04bf7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/invalid-set-font-crash.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+    <script type="text/javascript">
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function init()
+    {
+        var ctx = document.getElementById("canvas").getContext("2d");
+        ctx.font = "font-family: Helvetica; font-size: 48pt; font-color: #000000";
+        ctx.fillText("Hello world", 10, 200);
+    }
+    </script>
+</head>
+<body onload="init()">
+    <p>This test should not crash.</p>
+    <canvas id="canvas" height="300" width="300"></canvas>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/jQuery-animation-crash.html b/tests/tests/webkitsecurity/assets/jQuery-animation-crash.html
new file mode 100644
index 0000000..2699c0b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/jQuery-animation-crash.html
@@ -0,0 +1,58 @@
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=25381">bug 25381</a>:
+jQuery animation crashing Safari.</p>
+<p>PASS if didn't crash.</p>
+<div style="position:fixed; top:0px; width:100px; background:red;">
+    <div id="i" style="position:fixed; display:none; top:0px; width:100px; height:100px; overflow:hidden; background:green;"><div>ABC</div></div>
+</div>
+
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function swap( elem, options, callback ) {
+    var old = {};
+    // Remember the old values, and insert the new ones
+    for ( var name in options ) {
+        old[ name ] = elem.style[ name ];
+        elem.style[ name ] = options[ name ];
+    }
+
+    callback.call( elem );
+
+    // Revert the old values
+    for ( var name in options ) {
+        elem.style[ name ] = old[ name ];
+    }
+}
+
+function forceLayout()
+{
+    document.body.offsetTop;
+}
+
+setTimeout(function() {
+    var elem = document.getElementById('i');
+    elem.style['display']='block';
+
+    var val, props = { position: "absolute", visibility: "hidden", display:"block" }; 
+    function getWH() {
+        val = elem.offsetHeight;
+    }
+    swap( elem, props, getWH );
+
+    forceLayout();
+    elem.style['height']=2;
+    forceLayout();
+    elem.style['height']=3;
+    forceLayout();
+    elem.style['display']='none';
+    forceLayout();
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+    return;
+}, 0); 
+
+</script>
+
diff --git a/tests/tests/webkitsecurity/assets/javascript-url-as-framesrc-crash.html b/tests/tests/webkitsecurity/assets/javascript-url-as-framesrc-crash.html
new file mode 100644
index 0000000..a0da5be
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/javascript-url-as-framesrc-crash.html
@@ -0,0 +1,21 @@
+<head>

+<script language="JavaScript">

+// See https://bugs.webkit.org/show_bug.cgi?id=26230

+

+if (window.layoutTestController) {

+    layoutTestController.dumpAsText();

+}

+

+function makeFrameContents() {

+    var doc = theFrame.document;

+    doc.open();

+    doc.write('<img src=no-image-resource-required.png>');

+    doc.close();

+    return "SUCCESS (as long as we didn't crash, claim victory)";

+}

+</script>

+</head>

+

+<frameset>

+    <frame name="theFrame" src="javascript:parent.makeFrameContents()">

+</frameset>

diff --git a/tests/tests/webkitsecurity/assets/javascript-url-crash-function-iframe.html b/tests/tests/webkitsecurity/assets/javascript-url-crash-function-iframe.html
new file mode 100644
index 0000000..2fca7f8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/javascript-url-crash-function-iframe.html
@@ -0,0 +1,22 @@
+<script>
+function test()
+{
+    (function ()
+    {
+        (function ()
+        {
+            (function ()
+            {
+                frameElement.src = "javascript:'<pre>PASS: You didn\\'t crash.</pre>'";
+            })()
+        })()
+    })()
+}
+
+setTimeout(function ()
+{
+    test();
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}, 0);
+</script>
diff --git a/tests/tests/webkitsecurity/assets/javascript-url-crash-function.html b/tests/tests/webkitsecurity/assets/javascript-url-crash-function.html
new file mode 100644
index 0000000..2dcc16a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/javascript-url-crash-function.html
@@ -0,0 +1,14 @@
+<p>
+This page tests whether loading a javascript: URL into an iframe while the
+iframe is calling a JavaScript function causes a crash.
+</p>
+
+<iframe src="resources/javascript-url-crash-function-iframe.html"></iframe>
+
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.dumpChildFramesAsText();
+    layoutTestController.waitUntilDone();
+}
+</script>
diff --git a/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.html b/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.html
new file mode 100644
index 0000000..47fd0ca
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.html
@@ -0,0 +1,10 @@
+<html>
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+    
+    window.location="resources/javascript-url-iframe-crash.webarchive";
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.webarchive b/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.webarchive
new file mode 100644
index 0000000..07c478d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/javascript-url-iframe-crash.webarchive
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/keyboardevent-mousedown-crash.html b/tests/tests/webkitsecurity/assets/keyboardevent-mousedown-crash.html
new file mode 100644
index 0000000..38b1788
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/keyboardevent-mousedown-crash.html
@@ -0,0 +1,21 @@
+<html>
+    <body>
+        <div id="test"></div>
+        <div id="result"></div> 
+        <script>
+            if (window.layoutTestController)
+            {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+            }
+
+            var event = document.createEvent('KeyboardEvent');
+            event.initEvent('mousedown', true, true);
+            document.getElementById('test').dispatchEvent(event);
+
+            document.getElementById('result').innerHTML = "PASS";
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        </script> 
+    </body> 
+</html>
diff --git a/tests/tests/webkitsecurity/assets/keyevent-iframe-removed-crash.html b/tests/tests/webkitsecurity/assets/keyevent-iframe-removed-crash.html
new file mode 100644
index 0000000..01f81f3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/keyevent-iframe-removed-crash.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script>
+    function go() {
+        var fr = document.createElement('iframe');
+        fr.id = "blorp";
+        document.body.appendChild(fr);
+        fr.contentDocument.body.innerHTML = '<p id="a">move mouse out of the window, and press a key</p>';
+        fr.contentDocument.body.onkeydown = function(e) {
+            e.preventDefault();
+            document.body.removeChild(fr);
+        };
+
+        fr.focus();
+
+        if (window.layoutTestController)
+        {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+            setTimeout(nuke, 0);
+        }
+    }
+
+    function nuke() {
+        eventSender.keyDown("x")
+        layoutTestController.notifyDone();
+    }
+</script>
+</head>
+
+<body onload="go()">
+    <p>
+        This test passes if it does not crash. Move the mouse out
+        of the window, and then press any key.
+    </p>
+
+    <p>
+        PASS
+    </p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/khmer-crash.html b/tests/tests/webkitsecurity/assets/khmer-crash.html
new file mode 100644
index 0000000..df4badd
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/khmer-crash.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html dir="ltr" lang="km">
+<head>
+<meta charset="UTF-8" />
+<title>តូបសៀវភៅ | ប្រឆាំង​នឹង​ភាព​ល្ងង់​ខ្លៅ​</title>
+</head>
+  <div>This test checks that rendering of Khmer text does not crash.  The test
+  passes if it does not crash.</div>
+  <div id="site-description">ប្រឆាំង​នឹង​ភាព​ល្ងង់​ខ្លៅ​</div>
+</body>
+
+<script>
+function runTest() {
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    var div = document.getElementById("site-description");
+    window.getSelection().setBaseAndExtent(div, 0, div, 1);
+}
+runTest();
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.css b/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.css
new file mode 100644
index 0000000..077f6dd
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.css
@@ -0,0 +1 @@
+a {}
diff --git a/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.html b/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.html
new file mode 100644
index 0000000..d48dff4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/large-list-of-rules-crash.html
@@ -0,0 +1,27 @@
+<!DOCTYPE HTML PUBLIC
+  "-//W3C//DTD HTML 4.01//EN"
+  "http://www.w3.org/TR/html4/strict.dtd">
+
+<script type="text/javascript">
+var array = Array(200000);
+for (var i = 0; i < 200000; ++i)
+    array[i] = "a {}\n";
+var s = array.join("");
+
+var style = document.createElement("style");
+style.appendChild(document.createTextNode(s));
+document.getElementsByTagName("head")[0].appendChild(style);
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+
+<!-- loading a linked style sheet causes the list of CSS Rules to be rebuilt,
+     which caused a crash (stack overflow) -->
+<link rel="stylesheet" href="resources/large-list-of-rules-crash.css">
+<link rel="stylesheet" href="resources/large-list-of-rules-crash.css">
+
+<p>Test case for
+<a href="https://bugs.webkit.org/show_bug.cgi?id=27748"
+   >https://bugs.webkit.org/show_bug.cgi?id=27748</a>. If the browser did
+   not crash, the test passed.</p>
diff --git a/tests/tests/webkitsecurity/assets/large-rowspan-crash.html b/tests/tests/webkitsecurity/assets/large-rowspan-crash.html
new file mode 100644
index 0000000..26fc5ba
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/large-rowspan-crash.html
@@ -0,0 +1,6 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<table><td rowspan=674227123></td></table>
+<p>If the browser didn't crash, the test passed.</p>
diff --git a/tests/tests/webkitsecurity/assets/large-size-image-crash.html b/tests/tests/webkitsecurity/assets/large-size-image-crash.html
new file mode 100644
index 0000000..fa32d5f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/large-size-image-crash.html
@@ -0,0 +1,13 @@
+<html>

+    <head>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+        </script>

+    </head>

+    <body>

+        <img src="resources/large-size-image-crash.jpeg">

+        <p>PASS</p>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/large-size-image-crash.jpeg b/tests/tests/webkitsecurity/assets/large-size-image-crash.jpeg
new file mode 100644
index 0000000..9e97147
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/large-size-image-crash.jpeg
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/layer-hit-test-crash-expected.png b/tests/tests/webkitsecurity/assets/layer-hit-test-crash-expected.png
new file mode 100644
index 0000000..66cd3a8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/layer-hit-test-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/layer-hit-test-crash.html b/tests/tests/webkitsecurity/assets/layer-hit-test-crash.html
new file mode 100644
index 0000000..81a0a02
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/layer-hit-test-crash.html
@@ -0,0 +1,56 @@
+<html>
+<head>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.waitUntilDone();
+
+function test()
+{
+    window.setTimeout('removeChildLayer()', 0);
+}
+
+function removeChildLayer()
+{
+    // force a layout
+    x = document.getElementById('remove').clientX;
+
+    if (window.eventSender) {
+        eventSender.mouseMoveTo(100, 100);
+        eventSender.mouseDown();
+    }
+
+    document.getElementById('remove').style.visibility = "hidden";
+    window.setTimeout('moveMouse()', 0);
+}
+
+function moveMouse()
+{
+    if (window.eventSender)
+        eventSender.mouseMoveTo(100, 100);
+    window.setTimeout('finish()', 0);
+}
+
+function finish()
+{
+    if (window.eventSender)
+        eventSender.mouseUp();
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+</script>
+</head>
+
+<body onload="test();">
+<div>Mousing over the yellow square below should not cause an
+assertion failure or crash. This tests for regressions against
+<a href="https://bugs.webkit.org/show_bug.cgi?id=6931">6931</a>.
+
+</div>
+<div style="background: yellow; position: absolute; z-index: 1; top: 50; left: 50; width: 200; height: 200">
+<div id="remove" style="z-index: 5; background: red; position: absolute; top: 0; left: 20; width: 100; height: 100">
+</div>
+</div>
+</body>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/layerZOrderCrash-expected.png b/tests/tests/webkitsecurity/assets/layerZOrderCrash-expected.png
new file mode 100644
index 0000000..419d4bf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/layerZOrderCrash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/layerZOrderCrash.html b/tests/tests/webkitsecurity/assets/layerZOrderCrash.html
new file mode 100644
index 0000000..e2ee631
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/layerZOrderCrash.html
@@ -0,0 +1,48 @@
+<html>
+<head>
+<style type="text/css">
+html, table {
+position: relative;
+}
+</style>
+</head>
+
+<body>
+
+To reproduce this bug outside of DumpRenderTree, click the link below. If broken,
+we will crash. <br>
+
+<script>
+function disappear() {
+    var e = document.getElementById('foo');
+    
+    if(e.style.display !='none') 
+        e.style.display='none'; 
+    else 
+        e.style.display=''; 
+    
+    return false;
+}
+</script>
+
+<table>
+<tr><td><a href="#" onclick="disappear()">link</a></td></tr>
+<tr id="foo" style="">
+    <td>
+    <table>
+        <tr><td>content<br>content<br>content<br></td></tr>
+    </table>
+    </td>
+</tr>
+</table>
+
+<script>
+    if (window.eventSender) {
+        eventSender.mouseMoveTo(30,20);
+        eventSender.mouseDown();
+        eventSender.mouseUp();
+    }
+</script>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/layoutHorizontalBox-crash.html b/tests/tests/webkitsecurity/assets/layoutHorizontalBox-crash.html
new file mode 100755
index 0000000..d4addfa
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/layoutHorizontalBox-crash.html
@@ -0,0 +1,25 @@
+<style>
+.c6:first-letter { visibility: hidden; }
+.c6:nth-last-child(2n+10000000000000000) { text-align: -webkit-center; width: 10px; }
+.c26:first-letter { visibility: inherit; overflow: scroll; float: left;</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest() {
+    var button = document.createElement('button');
+    button.setAttribute('class', 'c6');
+    document.documentElement.appendChild(button);
+    document.documentElement.appendChild(document.createElement('dfn'));
+    var figCaption = document.createElement('figcaption');
+    figCaption.setAttribute('class', 'c26');
+    document.documentElement.appendChild(document.createElement('var'));
+    document.documentElement.appendChild(document.createElement('summary'));
+    var text = document.createTextNode("bug 70183: Crash in RenderDeprecatedFlexibleBox::layoutHorizontalBox");
+    figCaption.appendChild(text);
+    button.appendChild(figCaption);
+    document.body.offsetTop;
+    document.documentElement.appendChild(document.createTextNode("If this test did not CRASH or show errors in valgrind, it has PASSED."));
+}
+window.onload = runTest;
+</script>
diff --git a/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash-expected.png b/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash-expected.png
new file mode 100644
index 0000000..e903887
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash.html b/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash.html
new file mode 100644
index 0000000..2c10abd
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/li-style-alpha-huge-value-crash.html
@@ -0,0 +1,7 @@
+<blockquote>
+<blockquote>
+<ol>
+<li value=1234567890 type=A>
+<br>
+SUCCESS (you didn't crash)  Our behavior here matches WinIE not FireFox.
+http://bugzilla.opendarwin.org/show_bug.cgi?id=8542
diff --git a/tests/tests/webkitsecurity/assets/line-clamp-crash.html b/tests/tests/webkitsecurity/assets/line-clamp-crash.html
new file mode 100644
index 0000000..8746f13
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/line-clamp-crash.html
@@ -0,0 +1,38 @@
+<p>
+    Test that an incremental layout of a block with line-clamp truncation does not trigger a crash.
+</p>
+<div style="-webkit-box-orient: vertical; -webkit-line-clamp: 5; display: -webkit-box;">
+    <div>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <br>
+        <span id="target">Running </span>
+        <a href="#">X</a>
+    </div>
+</div>
+<script>
+    function test()
+    {
+        var placeholder = document.getElementById("target");
+        placeholder.parentNode.removeChild(placeholder);
+    }
+
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    document.body.offsetTop;
+    test();
+    document.body.offsetTop;
+</script>
diff --git a/tests/tests/webkitsecurity/assets/list-item-pseudo-nocrash.html b/tests/tests/webkitsecurity/assets/list-item-pseudo-nocrash.html
new file mode 100644
index 0000000..bb01236
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/list-item-pseudo-nocrash.html
@@ -0,0 +1,52 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <title>List-item + :after pseudo-class</title>
+        <style type="text/css">
+#anchor {
+    display: block;
+}
+#anchor:hover {}
+#anchor:after {
+    content: ".";
+    display: block;
+}
+span {
+    float: left;
+}
+        </style>
+        <script type="application/javascript">
+function run() {
+    if (!window.layoutTestController)
+        return;
+
+    window.layoutTestController.dumpAsText();
+    window.layoutTestController.waitUntilDone();
+    window.eventSender.mouseMoveTo(0, 0);
+    window.setTimeout(hover, 100);
+}
+
+function hover() {
+    var element = document.getElementById('text');
+    var x = element.offsetLeft + element.offsetWidth / 2;
+    var y = element.offsetTop + element.offsetHeight / 2;
+    window.eventSender.mouseMoveTo(x, y);
+    window.setTimeout(finalize, 100);
+}
+
+function finalize() {
+    window.layoutTestController.notifyDone();
+}
+
+window.addEventListener('load', run, false);
+        </script>
+    </head>
+    <body>
+        <p>This is a test for <a href="https://bugs.webkit.org/show_bug.cgi?id=30944">bug 30944</a>. Passes if it does not crash.</p>
+        <ul>
+            <li>
+                <a id="anchor" href="#"><span id="text">Hover me</span></a>
+            </li>
+        </ul>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/list-style-none-crash-expected.png b/tests/tests/webkitsecurity/assets/list-style-none-crash-expected.png
new file mode 100644
index 0000000..4d5d9c3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/list-style-none-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/list-style-none-crash.html b/tests/tests/webkitsecurity/assets/list-style-none-crash.html
new file mode 100644
index 0000000..78576e4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/list-style-none-crash.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<style>
+li { list-style: none; }
+</style>
+
+<script>
+function hide()
+{
+    document.getElementById("list").style.display = "none";
+}
+</script>
+</head>
+
+<body onload="hide()">
+<p>This test verifies that setting a list with list-style: none to
+display: none does not crash. It checks for regression against <a
+href="https://bugs.webkit.org/show_bug.cgi?id=6860">6860</a></p>
+
+<ol id="list">
+<li></li>
+<li></li>
+</ol>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/list-wrapping-image-crash.html b/tests/tests/webkitsecurity/assets/list-wrapping-image-crash.html
new file mode 100644
index 0000000..0583cbf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/list-wrapping-image-crash.html
@@ -0,0 +1,10 @@
+<body>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+document.designMode = "on";
+document.execCommand('selectall');
+document.execCommand('insertimage');
+document.execCommand('insertorderedlist');
+document.body.innerHTML = "PASSED - this test case didn't ASSERT, bug 19066";
+</script>
diff --git a/tests/tests/webkitsecurity/assets/load-defer-resume-crash.html b/tests/tests/webkitsecurity/assets/load-defer-resume-crash.html
new file mode 100644
index 0000000..560cfc9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/load-defer-resume-crash.html
@@ -0,0 +1,24 @@
+<html>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function run() {
+    var frameElement = document.createElement('iframe')
+    frameElement.setAttribute("src", "resources/images.html");
+    document.getElementById("frameDiv").appendChild(frameElement);
+    if (window.layoutTestController) {
+        layoutTestController.setDefersLoading(true);
+        setTimeout("layoutTestController.setDefersLoading(false);layoutTestController.notifyDone();",1000);
+    } else
+        alert("Deferring loads");
+}
+
+</script>
+<body onload='run()'>
+<p>For the test to pass there should be no crash.</p>
+<div id="frameDiv"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/location-new-window-no-crash.html b/tests/tests/webkitsecurity/assets/location-new-window-no-crash.html
new file mode 100644
index 0000000..7b2816f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/location-new-window-no-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/location-new-window-no-crash.js"></script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/location-new-window-no-crash.js b/tests/tests/webkitsecurity/assets/location-new-window-no-crash.js
new file mode 100644
index 0000000..e8d1942
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/location-new-window-no-crash.js
@@ -0,0 +1,59 @@
+description("Tests that manipulating location properties in a just-created window object does not crash. Note: Turn off pop-up blocking to run this in-browser.");
+
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.setCanOpenWindows();
+}
+
+var testWindow = open("data:text/plain,a");
+
+// Note that the window does not navigate to the new URL right away, and that is a crucial element
+// of the test. We're checking behavior when the object was just created and is not yet at its new
+// location.
+
+shouldBe("testWindow.location.toString()", "'about:blank'");
+shouldBe("testWindow.location.href", "'about:blank'");
+shouldBe("testWindow.location.protocol", "'about:'");
+shouldBe("testWindow.location.host", "''"); // Firefox throws an exception
+shouldBe("testWindow.location.hostname", "''"); // Firefox throws an exception
+shouldBe("testWindow.location.port", "''");
+shouldBe("testWindow.location.pathname", "'blank'"); // Firefox returns the empty string
+shouldBe("testWindow.location.search", "''");
+shouldBe("testWindow.location.hash", "''");
+
+shouldBe("testWindow.location.href = 'data:text/plain,b'", "'data:text/plain,b'");
+shouldBe("testWindow.location.protocol = 'data'", "'data'"); // Firefox throws an exception
+shouldBe("testWindow.location.host = 'c'", "'c'"); // Firefox throws an exception
+shouldBe("testWindow.location.hostname = 'd'", "'d'"); // Firefox throws an exception
+shouldBe("testWindow.location.port = 'e'", "'e'"); // Firefox throws an exception
+shouldBe("testWindow.location.pathname = 'f'", "'f'"); // Firefox throws an exception
+shouldBe("testWindow.location.search = 'g'", "'g'");
+shouldBe("testWindow.location.hash = 'h'", "'h'");
+
+shouldBe("testWindow.location.assign('data:text/plain,i')", "undefined");
+shouldBe("testWindow.location.replace('data:text/plain,j')", "undefined");
+shouldBe("testWindow.location.reload()", "undefined");
+
+shouldBe("testWindow.location.toString()", "'about:blank'");
+shouldBe("testWindow.location.href", "'about:blank'");
+shouldBe("testWindow.location.protocol", "'about:'");
+shouldBe("testWindow.location.host", "''"); // Firefox throws an exception
+shouldBe("testWindow.location.hostname", "''"); // Firefox throws an exception
+shouldBe("testWindow.location.port", "''");
+shouldBe("testWindow.location.pathname", "'blank'"); // Firefox returns the empty string
+shouldBe("testWindow.location.search", "''");
+shouldBe("testWindow.location.hash", "''");
+
+testWindow.close();
+
+if (window.layoutTestController) {
+    function doneHandler()
+    {
+        if (testWindow.closed) {
+            layoutTestController.notifyDone();
+            return;
+        }
+        setTimeout(doneHandler, 0);
+    }
+    doneHandler();
+}
diff --git a/tests/tests/webkitsecurity/assets/mainresource-null-mimetype-crash.html b/tests/tests/webkitsecurity/assets/mainresource-null-mimetype-crash.html
new file mode 100644
index 0000000..e73215b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/mainresource-null-mimetype-crash.html
@@ -0,0 +1,9 @@
+<html>
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+    }
+    
+    window.location="resources/mainresource-null-mimetype.webarchive";
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/mask-missing-image-crash.html b/tests/tests/webkitsecurity/assets/mask-missing-image-crash.html
new file mode 100644
index 0000000..6561fdf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/mask-missing-image-crash.html
@@ -0,0 +1,8 @@
+<p>Test for <a href="rdar://problem/5959165">rdar://problem/5959165</a>: Crash in a number of iExploder tests in WebCore::CachedImage::notifyObservers.</a>
+<p>Passed if the browser didn't crash.</p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<object style="-webkit-mask-image: url(url-not-found);">text
+<object style="-webkit-mask-box-image: url(url-not-found); ">text
diff --git a/tests/tests/webkitsecurity/assets/math-options-crash.html b/tests/tests/webkitsecurity/assets/math-options-crash.html
new file mode 100644
index 0000000..74bc216
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/math-options-crash.html
@@ -0,0 +1,3 @@
+<script src="../../resources/dump-as-markup.js"></script>
+This test passes if it doesn't crash.
+<math><option><option></html><option></option>
diff --git a/tests/tests/webkitsecurity/assets/matrix-as-function-crash.html b/tests/tests/webkitsecurity/assets/matrix-as-function-crash.html
new file mode 100644
index 0000000..9e2a974
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/matrix-as-function-crash.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+    <title>Calling WebKitCSSMatrix constructor as function should not cause a crash</title>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        function runTest()
+        {
+            var result = document.getElementById("result");
+            try {
+                WebKitCSSMatrix();
+                
+            }
+            catch (e) {
+                result.innerHTML = "PASS";
+                return;
+            }
+            result.innerHTML = "FAIL";
+        }
+
+    </script>
+</head>
+<body onload="runTest()">
+    <p>Calling <code>WebKitCSSMatrix</code> constructor as function should throw an exception and not cause a crash.</p>
+    <div id="result"></div>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/media-controls-clone-crash.html b/tests/tests/webkitsecurity/assets/media-controls-clone-crash.html
new file mode 100644
index 0000000..70a93c1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/media-controls-clone-crash.html
@@ -0,0 +1,25 @@
+<html>

+    <body onload="runTest();">

+        Test passes if it does not crash.

+        <script>

+            if (window.layoutTestController)

+            {

+                layoutTestController.dumpAsText();

+                layoutTestController.waitUntilDone();

+            }

+

+            function runTest() {

+                node = document.createElement('audio');

+                node.setAttribute('src', 'foo');

+                node.setAttribute('controls', 'foo');

+                node.style.fontWeight = '100';

+                var clone = node.cloneNode(false);

+                clone.load();

+ 

+                if (window.layoutTestController)

+                    setTimeout("layoutTestController.notifyDone()", 0);

+            }

+        </script>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/media-query-evaluator-crash.html b/tests/tests/webkitsecurity/assets/media-query-evaluator-crash.html
new file mode 100644
index 0000000..089b49b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/media-query-evaluator-crash.html
@@ -0,0 +1,12 @@
+<html>
+Test passes if it does not crash.
+<iframe id="test"></iframe>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var iframe = document.getElementById("test");
+var obj = iframe.contentWindow.matchMedia("(min-width: 0em)");
+</script>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/media-svg-crash.html b/tests/tests/webkitsecurity/assets/media-svg-crash.html
new file mode 100644
index 0000000..1ef08ca
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/media-svg-crash.html
@@ -0,0 +1,8 @@
+<html>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<img src='data:image/svg+xml,<!DOCTYPEg PUBLIC "" "/"><g xmlns="http://www.w3.org/2000/svg"><style>@media(max-color:5){*{</style>'>
+PASS - SVG image with media type does not crash.
+</html>
diff --git a/tests/tests/webkitsecurity/assets/menulist-popup-crash.html b/tests/tests/webkitsecurity/assets/menulist-popup-crash.html
new file mode 100644
index 0000000..7560850
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/menulist-popup-crash.html
@@ -0,0 +1,53 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+</head>
+<body>
+<p id="description">&lt;select> test for opening two popup menus.</p>
+<div id="console"></div>
+<p id="debug">PASS if the test didn't crash.</p>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var parent = document.createElement('div');
+    parent.innerHTML = '<select id="sl1">'
+        + '<option>one</option>'
+        + '<option>two</option>'
+        + '<option>three</option>'
+        + '<option>four</option>'
+        + '<option>five</option>'
+        + '<option>six</option>'
+        + '<option>seven</option>'
+        + '<option>eight</option>'
+        + '<option>nine</option>'
+        + '<option>ten</option>'
+        + '<option>eleven</option>'
+        + '<option>twelve</option>'
+        + '<option>thirteen</option>'
+        + '<option>fourteen</option>'
+        + '<option>fifteen</option>'
+        + '<option>sixteen</option>'
+        + '<option>seventeen</option>'
+        + '</select>'
+        + '<select id="sl2">'
+        + '<option>one</option>'
+        + '<option>two</option>'
+        + '<option>three</option>'
+        + '</select>';
+    document.body.appendChild(parent);
+
+    function mouseDownOnSelect(selId)
+    {
+        var sl = document.getElementById(selId);
+        var event = document.createEvent("MouseEvent");
+        event.initMouseEvent("mousedown", true, true, document.defaultView, 1, sl.offsetLeft, sl.offsetTop, sl.offsetLeft, sl.offsetTop, false, false, false, false, 0, document);
+        sl.dispatchEvent(event);
+    }
+
+    mouseDownOnSelect("sl1");
+    mouseDownOnSelect("sl2");
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/merge-anonymous-block-remove-child-crash.html b/tests/tests/webkitsecurity/assets/merge-anonymous-block-remove-child-crash.html
new file mode 100644
index 0000000..7fb458c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/merge-anonymous-block-remove-child-crash.html
@@ -0,0 +1,38 @@
+<html>

+<body onload="runTest();">

+<span style="display: run-in" id="runIn">

+</span>

+<span style="display: list-item" id="listItem">

+</span>

+<div id="result"></div>

+<script>

+if (window.layoutTestController)

+{

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+function runTest()

+{

+    document.body.offsetTop;

+    var runIn = document.getElementById('runIn');

+    var listItem = document.getElementById('listItem');

+

+    runIn.appendChild(document.createElement('menu'));

+    

+    ol = document.createElement('ol');

+    listItem.appendChild(ol);

+    listItem.appendChild(document.createElement('i'));

+    

+    document.body.offsetTop;

+    listItem.removeChild(ol);

+    document.body.removeChild(runIn);

+    document.body.removeChild(listItem);

+

+    document.getElementById('result').innerHTML = "PASS";

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+</script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/merge-anonymous-block-remove-child-crash2.html b/tests/tests/webkitsecurity/assets/merge-anonymous-block-remove-child-crash2.html
new file mode 100644
index 0000000..dc0d911
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/merge-anonymous-block-remove-child-crash2.html
@@ -0,0 +1,39 @@
+<html>

+<body onload="runTest();">

+<span style="display: run-in" id="runIn">

+</span>

+<span style="display: list-item" id="listItem">

+</span>

+<div id="result"></div>

+<script>

+if (window.layoutTestController)

+{

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+function runTest()

+{

+    document.body.offsetTop;

+    var runIn = document.getElementById('runIn');

+    var listItem = document.getElementById('listItem');

+

+    var layerChild = document.createElement('layer');

+    var noteChild = document.createElement('note');

+    var blockquoteChild = document.createElement('blockquote');

+    

+    runIn.appendChild(layerChild);

+    layerChild.appendChild(noteChild);

+    noteChild.appendChild(blockquoteChild);

+    

+    document.body.offsetTop;

+    

+    document.body.removeChild(listItem);

+

+    document.getElementById('result').innerHTML = "PASS";

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+</script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/meter-element-crash.html b/tests/tests/webkitsecurity/assets/meter-element-crash.html
new file mode 100644
index 0000000..a812511
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/meter-element-crash.html
@@ -0,0 +1,26 @@
+<!-- Test for Bug 50026. PASS unless crash. -->
+<style>
+ meter {
+   -webkit-appearance: none;
+ }  
+</style>
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+    setTimeout(function() {
+        document.body.offsetTop;
+        document.getElementById('test').innerHTML="PASS";
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }, 0);
+</script>
+<span id="test">
+    <script>
+    document.body.offsetTop;
+    </script>
+    <input type="text">
+    <meter>
+    </meter>
+</span>
diff --git a/tests/tests/webkitsecurity/assets/meter-element-with-child-crash.html b/tests/tests/webkitsecurity/assets/meter-element-with-child-crash.html
new file mode 100644
index 0000000..6990a2a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/meter-element-with-child-crash.html
@@ -0,0 +1,16 @@
+<html>
+<body>
+<h1>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=48019">Bug 48019</a>. It is OK not to crash.</h1>
+
+<meter><isindex>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+document.designMode = "on";
+document.execCommand("SelectAll");
+document.execCommand("CreateLink", 0, 'foo');
+document.execCommand("JustifyCenter");
+</script>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/mod-crash.html b/tests/tests/webkitsecurity/assets/mod-crash.html
new file mode 100644
index 0000000..d9c596c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/mod-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/mod-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/mod-crash.js b/tests/tests/webkitsecurity/assets/mod-crash.js
new file mode 100644
index 0000000..77fd2f5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/mod-crash.js
@@ -0,0 +1,39 @@
+description(
+"This test checks that n % 0 doesn't crash with a floating-point exception."
+);
+
+shouldBe("2 % 0", "NaN");
+
+var n = 2;
+shouldBe("n % 0", "NaN");
+
+function f()
+{
+    return 2 % 0;
+}
+
+shouldBe("f()", "NaN");
+
+function g()
+{
+    var n = 2;
+    return n % 0;
+}
+
+shouldBe("g()", "NaN");
+
+// Test that reusing a floating point value after use in a modulus works correctly.
+function nonSpeculativeModReuseInner(argument, o1, o2)
+{
+ 	// The + operator on objects is a reliable way to avoid the speculative JIT path for now at least.
+    o1 + o2;
+
+    var knownDouble = argument - 0;
+    return knownDouble % 1 + knownDouble;
+}
+function nonSpeculativeModReuse(argument)
+{
+    return nonSpeculativeModReuseInner(argument, {}, {});
+}
+
+shouldBe("nonSpeculativeModReuse(0.5)", "1");
diff --git a/tests/tests/webkitsecurity/assets/mouse-moved-remove-frame-crash.html b/tests/tests/webkitsecurity/assets/mouse-moved-remove-frame-crash.html
new file mode 100644
index 0000000..3b81d08
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/mouse-moved-remove-frame-crash.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function onMouseMove()
+{
+    document.body.innerHTML = "PASS";
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function runTest()
+{
+    root = document.getElementById('root').contentDocument;
+    root.addEventListener('mousemove', onMouseMove, 0);
+    eventSender.mouseMoveTo(1, 1);
+    eventSender.mouseMoveTo(0, 0);
+}
+</script>
+<style>body { margin: 0px; }</style>
+<object data="resources/mouse-move.html" id="root" onload="runTest()"></object>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-1.html b/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-1.html
new file mode 100644
index 0000000..e8d8da5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-1.html
@@ -0,0 +1,19 @@
+<script src="resources/move-by-word-visually.js"></script>
+<script>
+
+onload = function() {
+    try {
+        runTest();
+        document.body.innerHTML = "Crash test passed";
+    } finally {
+    }
+};
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.setEditingBehavior('win');
+}
+</script>
+<textarea></textarea>
+<base><div title="0|0" class="test_move_by_word">
+
diff --git a/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-2.html b/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-2.html
new file mode 100644
index 0000000..d10abe3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-2.html
@@ -0,0 +1,18 @@
+<script src="resources/move-by-word-visually.js"></script>
+<script>
+
+onload = function() {
+    try {
+        runTest();
+        document.body.innerHTML = "Crash test passed";
+    } finally {
+    }
+};
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.setEditingBehavior('win');
+}
+</script>
+<vkern></vkern><marquee><div title="0|0" class="test_move_by_word">abc def
+
diff --git a/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-3.html b/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-3.html
new file mode 100644
index 0000000..968ec02
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-3.html
@@ -0,0 +1,18 @@
+<script src="resources/move-by-word-visually.js"></script>
+<script>
+
+onload = function() {
+    try {
+        runTest();
+        document.body.innerHTML = "Crash test passed";
+    } finally {
+    }
+};
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.setEditingBehavior('win');
+}
+</script>
+<video></video><meter><image class="test_move_by_word" title="0|0">
+
diff --git a/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-4.html b/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-4.html
new file mode 100644
index 0000000..fad8b1c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-4.html
@@ -0,0 +1,17 @@
+<script src="resources/move-by-word-visually.js"></script>
+<script>
+
+onload = function() {
+    try {
+        runTest();
+        document.body.innerHTML = "Crash test passed";
+    } finally {
+    }
+};
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.setEditingBehavior('win');
+}
+</script>
+><div title="0|0" class="test_move_by_word" dir=ltr><keygen><base>
diff --git a/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-textarea.html b/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-textarea.html
new file mode 100644
index 0000000..b069940
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/move-by-word-visually-crash-test-textarea.html
@@ -0,0 +1,24 @@
+<script>
+
+onload = function() {
+    var sel = window.getSelection();
+    sel.empty();
+
+    var test = document.getElementById("test_move_by_word");
+    test.focus();
+    test.selectionDirection = 'none';
+    test.selectionStart = 1;
+    test.selectionEnd = 1;
+
+    getSelection().modify("move", "left", "-webkit-visual-word");
+    getSelection().modify("move", "left", "-webkit-visual-word");
+    document.body.innerHTML = "Crash test passed";
+};
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.setEditingBehavior('win');
+}
+</script>
+
+<textarea dir=ltr title="0|0" id="test_move_by_word">At where are you</textarea>
diff --git a/tests/tests/webkitsecurity/assets/msub-anonymous-child-render-crash.html b/tests/tests/webkitsecurity/assets/msub-anonymous-child-render-crash.html
new file mode 100644
index 0000000..a9affe5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/msub-anonymous-child-render-crash.html
@@ -0,0 +1,29 @@
+<html>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<body>
+<p>This test passes if it does not crash.</p>
+<math xmlns="http://www.w3.org/1998/Math/MathML">
+    <msub>
+        <mi>X</mi>
+        <mtr>3</mtr>
+    </msub>
+    <msub>
+        <mi>Y</mi>
+        <mtd>3</mtd>
+    </msub>
+    <msubsup>
+        <mi>X</mi>
+        <mtr>3</mtr>
+        <mn>2</mn>
+    </msubsup>
+    <msubsup>
+        <mi>Y</mi>
+        <mtd>3</mtd>
+        <mn>2</mn>
+    </msubsup>
+</math>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/multiline-and-object-inside-isolate-crash.html b/tests/tests/webkitsecurity/assets/multiline-and-object-inside-isolate-crash.html
new file mode 100755
index 0000000..9ad42e3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/multiline-and-object-inside-isolate-crash.html
@@ -0,0 +1,12 @@
+<pre>
+    <bdi>
+	PASS if this text displays only once, and no exception or crash
+        <object></object>
+        <div></div>
+    </bdi>    
+</pre>
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/multiple-captions-crash.xhtml b/tests/tests/webkitsecurity/assets/multiple-captions-crash.xhtml
new file mode 100644
index 0000000..de9773c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/multiple-captions-crash.xhtml
@@ -0,0 +1,32 @@
+<html xmlns="http://www.w3.org/1999/xhtml">

+    <script type="text/javascript">

+    function runTest()

+    {

+        if (window.layoutTestController)

+            layoutTestController.dumpAsText();

+

+        test = document.getElementById("test");

+        test2 = document.getElementById("test2");

+        inp = document.createElement("input");

+                                        

+        document.body.offsetTop;

+        test.appendChild(inp);

+        test2.appendChild(inp);     

+        document.body.offsetTop;

+    }

+    </script>

+    <body onload="runTest()">

+        Test passes if it does not crash.

+        <table>

+            <caption>Text in caption 1</caption>

+            <caption id="test">

+                <a>Text in caption 2</a>

+            </caption>

+            <caption>

+                <div id="test2">

+                    <a>Text in caption 3</a>

+                </div>

+            </caption>

+        </table>

+    </body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/multiple-captions-crash2.xhtml b/tests/tests/webkitsecurity/assets/multiple-captions-crash2.xhtml
new file mode 100644
index 0000000..7fd6c5f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/multiple-captions-crash2.xhtml
@@ -0,0 +1,30 @@
+<html xmlns="http://www.w3.org/1999/xhtml">

+    <script type="text/javascript">

+    function runTest()

+    {

+        if (window.layoutTestController)

+            layoutTestController.dumpAsText();

+

+        test = document.getElementById("test");

+        test2 = document.getElementById("test2");

+        inp = document.createElement("input");

+                                        

+        document.body.offsetTop;

+        test.appendChild(inp);

+        test2.appendChild(inp);     

+        document.body.offsetTop;

+    }

+    </script>

+    <body onload="runTest()">

+        Test passes if it does not crash.

+        <caption>Text in caption 1</caption>

+        <caption id="test">

+            <a>Text in caption 2</a>

+        </caption>

+        <caption>

+            <div id="test2">

+                <a>Text in caption 3</a>

+            </div>

+        </caption>

+    </body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/multiple-captions-crash3-expected.html b/tests/tests/webkitsecurity/assets/multiple-captions-crash3-expected.html
new file mode 100644
index 0000000..ca0b43e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/multiple-captions-crash3-expected.html
@@ -0,0 +1,46 @@
+<html>
+<head>
+<style>
+.c2 { display: table-caption; position: relative; }
+.c9 { visibility: collapse; height: 65536px; }
+.c15 { display: inline; float: right;}
+</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+}
+
+var nodes = Array();
+
+function tryToCrash()
+{
+    document.execCommand("SelectAll", false, "");
+    setTimeout('layoutTestController.notifyDone();',1000);
+}
+
+function boom() {
+    try { nodes[3] = document.createElement('tbody'); } catch(e) {}
+    try { nodes[3].setAttribute('class', 'c2'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[3]); } catch(e) {}
+    try { nodes[4] = document.createElement('col'); } catch(e) {}
+    try { nodes[4].setAttribute('class', 'c15'); } catch(e) {}
+    try { nodes[3].appendChild(nodes[4]); } catch(e) {}
+    try { nodes[6] = document.createElement('keygen'); } catch(e) {}
+    try { nodes[6].setAttribute('class', 'c2'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[6]); } catch(e) {}
+    try { nodes[8] = document.createElement('a'); } catch(e) {}
+    try { nodes[4].appendChild(nodes[8]); } catch(e) {}
+    try { nodes[21] = document.createElement('tr'); } catch(e) {}
+    try { nodes[21].setAttribute('class', 'c9'); } catch(e) {}
+    try { nodes[8].appendChild(nodes[21]); } catch(e) {}
+    try { nodes[29] = document.createElement('caption'); } catch(e) {}
+    setTimeout('try { nodes[29].appendChild(nodes[4]); } catch(e) {}', 561);
+    setTimeout('window.scrollBy(-37, 59);', 203);
+    setTimeout('tryToCrash();', 402);
+}
+</script>
+</head>
+<body onLoad="setTimeout('boom();',0)">
+Passes if it doesn't crash!
+</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/multiple-captions-crash3.html b/tests/tests/webkitsecurity/assets/multiple-captions-crash3.html
new file mode 100644
index 0000000..ca0b43e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/multiple-captions-crash3.html
@@ -0,0 +1,46 @@
+<html>
+<head>
+<style>
+.c2 { display: table-caption; position: relative; }
+.c9 { visibility: collapse; height: 65536px; }
+.c15 { display: inline; float: right;}
+</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+}
+
+var nodes = Array();
+
+function tryToCrash()
+{
+    document.execCommand("SelectAll", false, "");
+    setTimeout('layoutTestController.notifyDone();',1000);
+}
+
+function boom() {
+    try { nodes[3] = document.createElement('tbody'); } catch(e) {}
+    try { nodes[3].setAttribute('class', 'c2'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[3]); } catch(e) {}
+    try { nodes[4] = document.createElement('col'); } catch(e) {}
+    try { nodes[4].setAttribute('class', 'c15'); } catch(e) {}
+    try { nodes[3].appendChild(nodes[4]); } catch(e) {}
+    try { nodes[6] = document.createElement('keygen'); } catch(e) {}
+    try { nodes[6].setAttribute('class', 'c2'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[6]); } catch(e) {}
+    try { nodes[8] = document.createElement('a'); } catch(e) {}
+    try { nodes[4].appendChild(nodes[8]); } catch(e) {}
+    try { nodes[21] = document.createElement('tr'); } catch(e) {}
+    try { nodes[21].setAttribute('class', 'c9'); } catch(e) {}
+    try { nodes[8].appendChild(nodes[21]); } catch(e) {}
+    try { nodes[29] = document.createElement('caption'); } catch(e) {}
+    setTimeout('try { nodes[29].appendChild(nodes[4]); } catch(e) {}', 561);
+    setTimeout('window.scrollBy(-37, 59);', 203);
+    setTimeout('tryToCrash();', 402);
+}
+</script>
+</head>
+<body onLoad="setTimeout('boom();',0)">
+Passes if it doesn't crash!
+</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/multiple-captions-crash4-expected.html b/tests/tests/webkitsecurity/assets/multiple-captions-crash4-expected.html
new file mode 100644
index 0000000..d09954c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/multiple-captions-crash4-expected.html
@@ -0,0 +1,49 @@
+<html>
+<head>
+<style>
+.c10 { display: table-caption; width: 65536px; }
+.c12 > .c7 { visibility: hidden; float: left; }
+.c13:nth-of-type(2n) { color: Yellow; }
+.c15:nth-last-of-type(-n+6) { display: -webkit-box; padding-left: 65536px; }
+</style>
+
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+}
+
+var nodes = Array();
+
+function tryToCrash()
+{
+    try { nodes[84].setAttribute('class', 'c18'); } catch(e) {};
+    setTimeout('layoutTestController.notifyDone();',1000);
+}
+
+function boom() {
+    try { nodes[8] = document.createElement('select'); } catch(e) {}
+    try { nodes[8].setAttribute('class', 'c7'); } catch(e) {}
+    try { nodes[16] = document.createElement('abbr'); } catch(e) {}
+    try { nodes[84] = document.createElement('li'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[84]); } catch(e) {}
+    try { nodes[91] = document.createElement('caption'); } catch(e) {}
+    try { nodes[91].setAttribute('class', 'c12'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[91]); } catch(e) {}
+    try { nodes[92] = document.createElement('details'); } catch(e) {}
+    try { nodes[92].setAttribute('class', 'c10'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[92]); } catch(e) {}
+    try { nodes[94] = document.createElement('ruby'); } catch(e) {}
+    try { nodes[94].setAttribute('class', 'c13'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[94]); } catch(e) {}
+
+    setTimeout("try { nodes[8].setAttribute('class', 'c15'); } catch(e) {}", 616);
+    setTimeout('try { nodes[91].appendChild(nodes[8]); } catch(e) {}', 502);
+    setTimeout('try { nodes[92].appendChild(nodes[16]); } catch(e) {}', 461);
+    setTimeout('tryToCrash();', 519);
+}
+</script>
+</head>
+<body onLoad="setTimeout('boom();',0)">
+Passes if it doesn't crash!
+</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/multiple-captions-crash4.html b/tests/tests/webkitsecurity/assets/multiple-captions-crash4.html
new file mode 100644
index 0000000..d09954c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/multiple-captions-crash4.html
@@ -0,0 +1,49 @@
+<html>
+<head>
+<style>
+.c10 { display: table-caption; width: 65536px; }
+.c12 > .c7 { visibility: hidden; float: left; }
+.c13:nth-of-type(2n) { color: Yellow; }
+.c15:nth-last-of-type(-n+6) { display: -webkit-box; padding-left: 65536px; }
+</style>
+
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+}
+
+var nodes = Array();
+
+function tryToCrash()
+{
+    try { nodes[84].setAttribute('class', 'c18'); } catch(e) {};
+    setTimeout('layoutTestController.notifyDone();',1000);
+}
+
+function boom() {
+    try { nodes[8] = document.createElement('select'); } catch(e) {}
+    try { nodes[8].setAttribute('class', 'c7'); } catch(e) {}
+    try { nodes[16] = document.createElement('abbr'); } catch(e) {}
+    try { nodes[84] = document.createElement('li'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[84]); } catch(e) {}
+    try { nodes[91] = document.createElement('caption'); } catch(e) {}
+    try { nodes[91].setAttribute('class', 'c12'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[91]); } catch(e) {}
+    try { nodes[92] = document.createElement('details'); } catch(e) {}
+    try { nodes[92].setAttribute('class', 'c10'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[92]); } catch(e) {}
+    try { nodes[94] = document.createElement('ruby'); } catch(e) {}
+    try { nodes[94].setAttribute('class', 'c13'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[94]); } catch(e) {}
+
+    setTimeout("try { nodes[8].setAttribute('class', 'c15'); } catch(e) {}", 616);
+    setTimeout('try { nodes[91].appendChild(nodes[8]); } catch(e) {}', 502);
+    setTimeout('try { nodes[92].appendChild(nodes[16]); } catch(e) {}', 461);
+    setTimeout('tryToCrash();', 519);
+}
+</script>
+</head>
+<body onLoad="setTimeout('boom();',0)">
+Passes if it doesn't crash!
+</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/multiple-captions-crash5-expected.html b/tests/tests/webkitsecurity/assets/multiple-captions-crash5-expected.html
new file mode 100644
index 0000000..b29454c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/multiple-captions-crash5-expected.html
@@ -0,0 +1,42 @@
+<html>
+<head>
+<style>
+.c0 { display: table-caption; width: 0px; }
+.c7 { float: right; padding-right: 100px; padding-bottom: 100px;}
+</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+}
+
+var nodes = Array();
+
+function tryToCrash()
+{
+    try { nodes[91].appendChild(nodes[39]); } catch(e) {}
+    setTimeout('layoutTestController.notifyDone();',1000);
+}
+
+function boom() {
+    try { nodes[8] = document.createElement('dfn'); } catch(e) {}
+    try { nodes[8].setAttribute('class', 'c7'); } catch(e) {}
+    try { nodes[30] = document.createElement('span'); } catch(e) {}
+    try { nodes[39] = document.createElement('strong'); } catch(e) {}
+    try { nodes[69] = document.createElement('header'); } catch(e) {}
+    try { nodes[39].appendChild(nodes[69]); } catch(e) {}
+    try { nodes[89] = document.createElement('nav'); } catch(e) {}
+    try { nodes[89].setAttribute('class', 'c0'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[89]); } catch(e) {}
+    try { nodes[91] = document.createElement('form'); } catch(e) {}
+    try { nodes[91].setAttribute('class', 'c0'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[91]); } catch(e) {}
+    try { nodes[89].appendChild(nodes[8]); } catch(e) {}
+    setTimeout('try { nodes[30].appendChild(nodes[89]); } catch(e) {}', 4);
+    setTimeout('tryToCrash();', 0);
+}
+</script>
+</head>
+<body onLoad="setTimeout('boom();',0)">
+Passes if it doesn't crash!
+</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/multiple-captions-crash5.html b/tests/tests/webkitsecurity/assets/multiple-captions-crash5.html
new file mode 100644
index 0000000..b29454c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/multiple-captions-crash5.html
@@ -0,0 +1,42 @@
+<html>
+<head>
+<style>
+.c0 { display: table-caption; width: 0px; }
+.c7 { float: right; padding-right: 100px; padding-bottom: 100px;}
+</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+}
+
+var nodes = Array();
+
+function tryToCrash()
+{
+    try { nodes[91].appendChild(nodes[39]); } catch(e) {}
+    setTimeout('layoutTestController.notifyDone();',1000);
+}
+
+function boom() {
+    try { nodes[8] = document.createElement('dfn'); } catch(e) {}
+    try { nodes[8].setAttribute('class', 'c7'); } catch(e) {}
+    try { nodes[30] = document.createElement('span'); } catch(e) {}
+    try { nodes[39] = document.createElement('strong'); } catch(e) {}
+    try { nodes[69] = document.createElement('header'); } catch(e) {}
+    try { nodes[39].appendChild(nodes[69]); } catch(e) {}
+    try { nodes[89] = document.createElement('nav'); } catch(e) {}
+    try { nodes[89].setAttribute('class', 'c0'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[89]); } catch(e) {}
+    try { nodes[91] = document.createElement('form'); } catch(e) {}
+    try { nodes[91].setAttribute('class', 'c0'); } catch(e) {}
+    try { document.documentElement.appendChild(nodes[91]); } catch(e) {}
+    try { nodes[89].appendChild(nodes[8]); } catch(e) {}
+    setTimeout('try { nodes[30].appendChild(nodes[89]); } catch(e) {}', 4);
+    setTimeout('tryToCrash();', 0);
+}
+</script>
+</head>
+<body onLoad="setTimeout('boom();',0)">
+Passes if it doesn't crash!
+</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/multiple-cursors-crash.html b/tests/tests/webkitsecurity/assets/multiple-cursors-crash.html
new file mode 100644
index 0000000..ef7e6d2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/multiple-cursors-crash.html
@@ -0,0 +1,55 @@
+<html>
+<script>
+svgNS = "http://www.w3.org/2000/svg";
+
+gc = window.gc || function()
+{
+    if (window.GCController)
+        GCController.collect();
+        
+    for (var i = 0; i < 10000; ++i)
+        var s = new String("AAAA");
+}
+
+window.onload = function()
+{
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }    
+
+    cursor = document.body.appendChild(document.createElementNS(svgNS, "cursor"));
+    cursor.id = "cursor";
+
+    element = document.body.appendChild(document.createElementNS(svgNS, "element"));
+    element.style.setProperty("cursor", "url(#cursor)");
+  
+    setTimeout(step2, 0);
+}
+
+function step2()
+{
+    fakeCursor = document.body.insertBefore(document.createElementNS(svgNS, "cursor"), cursor);
+    fakeCursor.id = "cursor";
+  
+    element.style.removeProperty("cursor");
+    
+    document.body.removeChild(element);
+    element = null;
+    gc();
+  
+    setTimeout(finishTest, 0);
+}
+
+function finishTest()
+{
+    document.body.removeChild(cursor);
+    cursor = null;
+    gc();
+  
+    document.body.innerHTML = "PASS";
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/mutation-callback-non-element-crash.html b/tests/tests/webkitsecurity/assets/mutation-callback-non-element-crash.html
new file mode 100755
index 0000000..75f22ef
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/mutation-callback-non-element-crash.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function mutationCallback(mutations, observer) {
+    mutations[0].addedNodes[-1];
+}
+
+var mutationObserver = new WebKitMutationObserver(mutationCallback);
+mutationObserver.observe(document.body, {childList: true});
+document.body.appendChild(document.createTextNode("PASS. WebKit didn't crash"));
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/navigation-redirect-schedule-crash.html b/tests/tests/webkitsecurity/assets/navigation-redirect-schedule-crash.html
new file mode 100755
index 0000000..831006c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/navigation-redirect-schedule-crash.html
@@ -0,0 +1,29 @@
+<html>
+<style>
+@font-face { font-family: "A"; src: url(); }
+summary { font-family: A; }
+</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function loadComplete() { 
+    document.open(); 
+    document.write('PASS'); 
+    document.close();
+    setTimeout("finish()", 0);
+}
+
+function finish() {
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+<body onload="loadComplete()">
+<summary>
+<OBJECT CODEBASE="http://xw2k.sdct.itl.nist.gov/brady/dom/" DATA="./pix/logo.gif">
+</summary>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/navigator-cookieEnabled-no-crash.html b/tests/tests/webkitsecurity/assets/navigator-cookieEnabled-no-crash.html
new file mode 100644
index 0000000..9dee33c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/navigator-cookieEnabled-no-crash.html
@@ -0,0 +1,22 @@
+<html>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function run_test() {
+    var nav = window.navigator;
+    document.getElementsByTagName("form")[0].submit();
+    nav.cookieEnabled;
+}
+</script>
+<body onload="run_test()">
+<form action="resources/test-successful-destination.html" method="GET"></form>
+This tests that navigator.cookieEnabled does not crash the browser after
+the frame navigates away from the original page. <br>
+
+You should not see this page if the test passes.<br>
+<div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/navigator-detached-no-crash.html b/tests/tests/webkitsecurity/assets/navigator-detached-no-crash.html
new file mode 100644
index 0000000..20b1b6b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/navigator-detached-no-crash.html
@@ -0,0 +1,86 @@
+<html>
+<script>
+if (window.layoutTestController) {
+  layoutTestController.dumpAsText();
+  layoutTestController.waitUntilDone();
+}
+
+function log(strings) {
+  var node = document.getElementById('result');
+  for (var i in strings) {
+    node.innerHTML += strings[i] + '<br>';
+  }
+}
+
+function gc()
+{
+    if (window.GCController) {
+        GCController.collect();
+    } else {
+        for (var i = 0; i < 10000; i++) {
+            var s = new String("abc");
+        }
+    }
+}
+
+var old_nav;
+
+function test() {
+  // remember the old navigator
+  old_nav = window.frames[0].navigator;
+  // detach the old navigator
+  var p = document.getElementById("subframe");
+  p.parentNode.removeChild(p);
+  if (window.GCController)
+    window.GCController.collect();
+
+  // Check once immediately
+  check_navigator();
+
+  gc();
+
+  // Check one more time later, when the frame is likely to be destroyed.
+  setTimeout(check_navigator_and_done, 200);
+}
+
+function check_navigator_and_done() {
+  check_navigator();
+  if (window.layoutTestController)
+    layoutTestController.notifyDone();
+}
+
+function check_navigator() {
+  var strings = [ ];
+  for (p in old_nav) {
+    if (p == 'geolocation' || p == 'webkitGetUserMedia') // Don't include Geolocation or the Media Stream API functions until most platforms have support.
+      continue;
+
+    if (typeof old_nav[p] == 'function') {
+      try {
+        var v = old_nav[p]();
+        // no crash, it is ok
+        strings.push("navigator."+p+"() is OK");
+      } catch(err) {
+        // navigator.registerXXX will throw on invalid input.
+        strings.push("navigator."+p+"() threw err "+err);
+      }
+    } else {
+      var v = old_nav[p];
+      // no crash, it is ok.
+      strings.push("navigator."+p+" is OK");
+    }
+  }
+  strings.sort();
+  log(strings);
+}
+
+</script>
+<body onload="test()">
+This tests that the navigator object of a deleted frame is disconnected
+properly. Accessing fields or methods shouldn't crash the browser.
+<br>
+<iframe id="subframe" src="about:blank"></iframe>
+<button onclick="check_navigator()">Check Navigator</button><br>
+<div id="result"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/navigator-plugins-crash.html b/tests/tests/webkitsecurity/assets/navigator-plugins-crash.html
new file mode 100644
index 0000000..c64ff94
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/navigator-plugins-crash.html
@@ -0,0 +1,38 @@
+<html>
+<script>
+
+if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+var plugins = new Array;
+for (var i = 0; i < navigator.plugins.length; ++i) {
+    plugins.push(navigator.plugins[i]);
+}
+
+var mimeTypes = new Array;
+for (var i = 0; i < navigator.mimeTypes.length; ++i) {
+    mimeTypes.push(navigator.mimeTypes[i]);
+}
+
+navigator.plugins.refresh();
+
+var output = "<pre>";
+
+for (var i = 0; i < plugins.length; ++i) {
+    output += plugins[i].name;
+    output += "\n";
+}
+
+for (var i = 0; i < mimeTypes.length; ++i) {
+    output += mimeTypes[i].type;
+    output += "\n";
+}
+
+output += "</pre>";
+
+//document.writeln(output);
+document.writeln("Tests access to previously received arrays from navigator.plugins and mimetypes after calling plugins.refresh(). If this text appears and there is no crash, then the test succeeded.");
+
+</script>
+<body>
+</body></html>
diff --git a/tests/tests/webkitsecurity/assets/negative-remaining-length-crash.html b/tests/tests/webkitsecurity/assets/negative-remaining-length-crash.html
new file mode 100644
index 0000000..802065b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/negative-remaining-length-crash.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+    <title></title>
+    <script type="text/javascript">
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<frameset cols="6,*">
+    <frame src="data:text/html,
+        <frameset cols='*,*,50%'>
+            <frame>
+            <frame>
+            <frame>
+        </frameset>
+    ">
+    <frame src='data:text/html,
+        <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=12082">Test for http://bugs.webkit.org/show_bug.cgi?id=12082</a>
+        REGRESSION (r18333): Crash in RenderFrameSet::layOutAxis()</i>.
+        </p>
+        <p>
+        On an Intel machine, no crash means SUCCESS.
+        </p>
+    '>
+</frameset>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/nested-bidi-isolate-crash.html b/tests/tests/webkitsecurity/assets/nested-bidi-isolate-crash.html
new file mode 100644
index 0000000..6fd58c8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/nested-bidi-isolate-crash.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<p>This tests nesting two spans with -webkit-isolate followed by a br. The test passes if WebKit doesn't crash.</p>
+<span style="unicode-bidi:-webkit-isolate;"><span style="unicode-bidi:-webkit-isolate;">a</span></span><br>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+</script>
diff --git a/tests/tests/webkitsecurity/assets/nested-event-remove-node-crash.html b/tests/tests/webkitsecurity/assets/nested-event-remove-node-crash.html
new file mode 100644
index 0000000..4205c03
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/nested-event-remove-node-crash.html
@@ -0,0 +1,76 @@
+<html>
+<head>
+<script>
+function sendXHR()
+{
+    XHR[numXHRs] = new XMLHttpRequest();
+    XHR[numXHRs].onreadystatechange = handleStateChange;
+    XHR[numXHRs].open("GET", "nested-event-remove-node-crash-expected.txt", true);
+    XHR[numXHRs].send(null);
+    numXHRs = numXHRs + 1;
+}
+
+function callback(response)
+{
+    document.getElementById("replaceMe").innerHTML = "";
+    document.getElementById("replaceMe").innerHTML = response;
+    if (window.layoutTestController && (run == 2))
+        layoutTestController.notifyDone();
+}
+
+function handleStateChange()
+{
+    if ((XHR[0].readyState == 4) && (run < 2)) { // yes this looks wrong but it's how to reproduce the bug
+        run = run + 1;
+        callback(XHR[0].responseText);
+    }
+}
+
+function test()
+{
+/*
+    1. focus a node
+    2. send an XHR who's handler will remove the node
+    3. the focused node's onblur will fire
+    4. the onblur event handler will send off an XHR who's handler will remove the node
+*/
+    document.getElementById("theSelect").focus();
+    sendXHR();
+    
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+    }
+}
+
+function GC()
+{
+    // Force GC.
+    if (window.GCController)
+        GCController.collect();
+    else {
+        for (var i = 0; i < 10000; ++i) {
+            ({ });
+        }
+    }
+}
+
+/* GLOBALS */
+var XHR = new Array();
+var numXHRs = 0;
+var run = 0;
+
+</script>
+</head>
+<body onload="test()">
+
+<div id="replaceMe">
+
+<div>
+<select id="theSelect" onblur="sendXHR();GC();">
+</select>
+</div>
+
+</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/nested-first-letter-with-float-crash.html b/tests/tests/webkitsecurity/assets/nested-first-letter-with-float-crash.html
new file mode 100755
index 0000000..6565ab1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/nested-first-letter-with-float-crash.html
@@ -0,0 +1,26 @@
+<html>
+    <style type="text/css">
+        .parentStyle { position: absolute; }
+        .parentStyle:first-letter { position: inherit; }
+        .positionedChildStyle { position: absolute; }
+        .divChildStyle:first-letter { float: left; }
+        .divChildStyle:after { float: inherit; content: counter(blah); }
+    </style>
+    PASS, if the script does not cause a crash or ASSERT failure
+    <script>
+        function runTest() {
+            parentDiv = document.createElement('div');
+            parentDiv.setAttribute('class', 'parentStyle');
+            document.documentElement.appendChild(parentDiv);
+            positionedDiv = document.createElement('div');
+            positionedDiv.setAttribute('class', 'positionedChildStyle');
+            parentDiv.appendChild(positionedDiv);
+            divChild = document.createElement('div');
+            divChild.setAttribute('class', 'divChildStyle');
+            parentDiv.appendChild(divChild);
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+        }
+        window.onload = runTest;
+    </script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/nested-fragment-parser-crash.html b/tests/tests/webkitsecurity/assets/nested-fragment-parser-crash.html
new file mode 100644
index 0000000..49b32cb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/nested-fragment-parser-crash.html
@@ -0,0 +1,22 @@
+x<h4><strike>x
+This test passes if it doesn't crash.
+<script>
+  if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+  var counter = 0;
+  window.onload=function(){
+    document.execCommand("SelectAll");
+    document.designMode="on";
+    document.execCommand("Indent");
+    document.execCommand("InsertOrderedList", false);
+  };
+  function handler() {
+    // This constant is somewhat magic. It's the smallest constant such that
+    // we'll exceed the maxium call stack size.
+    if (++counter >= 34)
+      document.removeEventListener("DOMSubtreeModified", handler, false);
+    document.execCommand("outdent", false);
+  };
+  document.addEventListener("DOMSubtreeModified", handler, false);
+</script>
diff --git a/tests/tests/webkitsecurity/assets/nested-layout-crash.html b/tests/tests/webkitsecurity/assets/nested-layout-crash.html
new file mode 100644
index 0000000..4da7020
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/nested-layout-crash.html
@@ -0,0 +1,31 @@
+<p>
+    Test for <i><a href="rdar://problem/7050773">rdar://problem/7050773</a>
+    Crash at WebCore::RenderBlock::layoutBlock()</i>.
+</p>
+<p>
+    The test passes if it does not crash or cause an assertion failure.
+</p>
+<textarea rows="5" id="container">
+
+
+
+
+
+
+
+
+</textarea>
+<script>
+    var container = document.getElementById("container");
+    container.focus();
+    container.scrollTop = 200;
+    document.body.offsetTop;
+
+    container.rows = "20";
+
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+
+        accessibilityController.focusedElement;
+    }
+</script>
diff --git a/tests/tests/webkitsecurity/assets/nested-tables-with-before-after-content-crash-expected.png b/tests/tests/webkitsecurity/assets/nested-tables-with-before-after-content-crash-expected.png
new file mode 100644
index 0000000..83c70ac
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/nested-tables-with-before-after-content-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/nested-tables-with-before-after-content-crash.html b/tests/tests/webkitsecurity/assets/nested-tables-with-before-after-content-crash.html
new file mode 100755
index 0000000..6501e03
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/nested-tables-with-before-after-content-crash.html
@@ -0,0 +1,18 @@
+<!DOCTYPE>
+<html style="font: 1em/1 Ahem, sans-serif;">
+<style type="text/css">
+.c1 { display: inline-table; color: blue}
+.c1:before { overflow: hidden; content: counter(section); color: red}
+.c1:nth-child(2n) { text-decoration: overline; }
+</style>
+<body>
+<div class="c1" id="div1"><q style="display:inline-table"></q></div>
+</body>
+<script>
+    function runTest() {
+        document.getElementById('div1').setAttribute('class', 'c1');
+        document.body.offsetTop;
+    }
+    window.onload = runTest;
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/no-crash-with-svg-content-in-html-document-expected.png b/tests/tests/webkitsecurity/assets/no-crash-with-svg-content-in-html-document-expected.png
new file mode 100644
index 0000000..c7e7c06
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/no-crash-with-svg-content-in-html-document-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/no-crash-with-svg-content-in-html-document.svg b/tests/tests/webkitsecurity/assets/no-crash-with-svg-content-in-html-document.svg
new file mode 100644
index 0000000..5f70c2d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/no-crash-with-svg-content-in-html-document.svg
@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<!-- Only valid svg subdocuments (enclosed by <svg xmlns="svgNS">) are allowed in fO documents. No renderers should be created for <g> and children -->
+<foreignObject width="300" height="100">
+    <html xmlns="http://www.w3.org/1999/xhtml">
+        <p>This should not crash</p>
+        <g xmlns="http://www.w3.org/2000/svg">
+            <text y="20">This should not be shown</text>
+        </g>
+        <g/>
+    </html>
+</foreignObject>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/no-overhanging-float-crash.html b/tests/tests/webkitsecurity/assets/no-overhanging-float-crash.html
new file mode 100644
index 0000000..ff00062
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/no-overhanging-float-crash.html
@@ -0,0 +1,23 @@
+<html>
+<body onload="runTest()">
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+        
+    function runTest()
+    { 
+        document.body.offsetTop;
+        var child = document.getElementById('test');
+        child.parentNode.removeChild(child);
+    }
+</script>
+<div style="padding-bottom: 10500000000000%; -webkit-columns: initial;">
+    PASS
+    <p></p>
+    <span id="test">
+        <link></link>
+    </span>
+</div>
+</body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/node-filter-detached-iframe-crash.html b/tests/tests/webkitsecurity/assets/node-filter-detached-iframe-crash.html
new file mode 100644
index 0000000..091698f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/node-filter-detached-iframe-crash.html
@@ -0,0 +1,38 @@
+<html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+    }
+
+    var dummyFilterCalled = false;
+    var foundNode;
+
+    function dummyFilter() {
+        dummyFilterCalled = true;
+        return NodeFilter.FILTER_ACCEPT;
+    }
+
+    function test() {
+        var iframe = document.createElement("iframe");
+        document.body.appendChild(iframe);
+        var doc = iframe.contentWindow.document;
+        document.body.removeChild(iframe);
+        var iterator = doc.createNodeIterator(doc, NodeFilter.SHOW_ELEMENT, dummyFilter, false);
+        foundNode = iterator.nextNode();
+        testPassed("Did not crash.");
+        shouldBeTrue("dummyFilterCalled");
+        shouldBe("foundNode.toString()", "\"[object HTMLHtmlElement]\"");
+
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+</script>
+</head>
+<body onload="test()">
+<p>Ensure that using node filter with a detached iframe doesn't crash.</p>
+<div id="console"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/node-iterator-document-moved-crash.html b/tests/tests/webkitsecurity/assets/node-iterator-document-moved-crash.html
new file mode 100644
index 0000000..c9333da
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/node-iterator-document-moved-crash.html
@@ -0,0 +1,42 @@
+<html>

+    <head>

+        <script>

+            if (window.layoutTestController) {

+                layoutTestController.dumpAsText();

+                layoutTestController.waitUntilDone();

+            }

+            

+            function gc()

+            {

+                if (window.GCController)

+                    return GCController.collect();

+

+                for (var i = 0; i < 10000; i++) { // force garbage collection (FF requires about 9K allocations before a collect).

+                    var s = new String("abc");

+                }

+            }

+            

+            function runTest()

+            {

+                aElement = document.createElement('a');

+                divElement = document.createElement('div');

+                document.body.appendChild(divElement);

+                nodeIterator = win.document.createNodeIterator(aElement);

+                win.document.body.appendChild(aElement);

+

+                delete nodeIterator;

+                gc();

+                document.body.removeChild(divElement);

+                gc();

+                

+                if (window.layoutTestController)

+                    layoutTestController.notifyDone();

+            }

+        </script>

+    </head>

+    <body>

+        <iframe onload="this.onload = null; win = this.contentWindow; runTest();"></iframe>

+        Test passes if it does not crash.

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/node-iterator-reference-node-moved-crash.html b/tests/tests/webkitsecurity/assets/node-iterator-reference-node-moved-crash.html
new file mode 100644
index 0000000..a51ac4f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/node-iterator-reference-node-moved-crash.html
@@ -0,0 +1,49 @@
+<html>

+    <head>

+        <script>

+            if (window.layoutTestController) {

+                layoutTestController.dumpAsText();

+                layoutTestController.waitUntilDone();

+            }

+            

+            function gc()

+            {

+                if (window.GCController)

+                    return GCController.collect();

+

+                for (var i = 0; i < 10000; i++) { // force garbage collection (FF requires about 9K allocations before a collect).

+                    var s = new String("abc");

+                }

+            }

+            

+            function runTest()

+            {

+                iteratorRoot = document.createElement();

+                element = iteratorRoot.appendChild(document.createElement());

+                element.appendChild(document.createElement());

+  

+                iterator = document.createNodeIterator(iteratorRoot, -1);

+                iterator.nextNode(); iterator.nextNode(); iterator.nextNode();

+                iterator.previousNode();

+  

+                iteratorRoot.removeChild(element);

+  

+                otherDocument = document.implementation.createHTMLDocument();

+                otherDocument.body.appendChild(iteratorRoot);

+

+                delete iterator;

+                gc();

+                div = document.body.appendChild(document.createElement('div'));

+                document.body.removeChild(div);

+                gc();

+                

+                if (window.layoutTestController)

+                    layoutTestController.notifyDone();

+            }

+        </script>

+    </head>

+    <body onload="runTest()">

+        Test passes if it does not crash.

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/node-move-to-new-document-crash-main.html b/tests/tests/webkitsecurity/assets/node-move-to-new-document-crash-main.html
new file mode 100755
index 0000000..fedbde1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/node-move-to-new-document-crash-main.html
@@ -0,0 +1,36 @@
+<html>
+<body>
+<script src="../js/resources/js-test-pre.js"></script>
+<script>
+description("Tests that moving nodes across documents does not crash.");
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function runTest()
+{
+    root = document.getElementById('root').contentDocument;
+    test = root.getElementById('test');
+    var doc = document.implementation.createDocument();
+    doc.adoptNode(test);
+    test.appendChild(root.getElementById('svg').cloneNode(0));
+    document.open();
+    document.write('PASS');
+    document.close();
+    setTimeout('finish();', 0);
+}
+
+function finish()
+{
+    gc();
+    document.adoptNode(test);
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+<object data="resources/node-move-to-new-document-crash.svg" id="root" onload="runTest()"/></object>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/node-move-to-new-document-crash.svg b/tests/tests/webkitsecurity/assets/node-move-to-new-document-crash.svg
new file mode 100755
index 0000000..340c9ad
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/node-move-to-new-document-crash.svg
@@ -0,0 +1,3 @@
+<svg id="svg" xmlns="http://www.w3.org/2000/svg">
+    <marker id="test"></marker>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/non-existent-eventsource-status-error-iframe-crash.html b/tests/tests/webkitsecurity/assets/non-existent-eventsource-status-error-iframe-crash.html
new file mode 100644
index 0000000..fe5feca
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/non-existent-eventsource-status-error-iframe-crash.html
@@ -0,0 +1,27 @@
+<html>
+  <iframe id="test"></iframe>
+  <div id="result"></div>
+  <script>
+    if (window.layoutTestController)
+    {
+      layoutTestController.dumpAsText();
+      layoutTestController.waitUntilDone();
+    }
+
+    function runTest()
+    {
+      document.getElementById("test").src = "resources/request-non-existent-eventsource-error.html";
+    }
+
+    function finish()
+    {
+      document.body.removeChild(document.getElementById("test"));
+  
+      document.getElementById("result").innerHTML = "PASS";
+      if (window.layoutTestController)
+        layoutTestController.notifyDone();
+    }
+
+    runTest();
+  </script>
+<html>
diff --git a/tests/tests/webkitsecurity/assets/non-native-image-crash.html b/tests/tests/webkitsecurity/assets/non-native-image-crash.html
new file mode 100644
index 0000000..f12364f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/non-native-image-crash.html
@@ -0,0 +1,41 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<div role="img" aria-label="ASCII art of a helicopter" title="Incorrect text equivalent. When available, node should use aria-label instead of title.">
+     <div class="ascii">
+  ========================
+          ___][_____
+ *     __/     [___]\
+***====___           \
+ *        \___________]
+            I      I
+          ------------/
+</div>
+</div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This tests that a non native image (one created through ARIA) does not cause an assert. Test passes if it does not crash in debug builds");
+
+    if (window.accessibilityController) {
+
+          var body = document.getElementById("body");
+          body.focus();
+          var image = accessibilityController.focusedElement.childAtIndex(0);
+          var w = image.width;
+          var h = image.height;
+          
+    }
+
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/non-styled-element-id-crash.html b/tests/tests/webkitsecurity/assets/non-styled-element-id-crash.html
new file mode 100644
index 0000000..f9d13d0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/non-styled-element-id-crash.html
@@ -0,0 +1,40 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+gc = window.gc || function()
+{
+    if (window.GCController)
+        return GCController.collect();
+
+    for (var i = 0; i < 10000; ++i)
+        var s = new String("AAAA");
+}
+
+window.onload = function()
+{
+    element = document.body.appendChild(document.createElementNS("foo", "bar"));
+    element.id = "bar";
+    element.setAttribute("id", "bar");
+    document.body.removeChild(element);
+
+    element = null;
+    gc();
+
+    setTimeout(finishTest, 0);
+}
+
+finishTest = function()
+{
+    document.getElementById("bar");
+    
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+<body>PASS</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/normalize-crash.html b/tests/tests/webkitsecurity/assets/normalize-crash.html
new file mode 100644
index 0000000..6eb8ef7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/normalize-crash.html
@@ -0,0 +1,26 @@
+<p>This test passes if it does not crash.</p>

+<div id="test1"></div>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+var elem = document.getElementById("test1");

+

+function go()

+{

+    var str = "c";

+    for (var i = 0; i < 0x10000; i++)

+        var b = str + str;

+}

+

+function handler()

+{

+    elem.removeAttribute("b");

+    go();

+}

+

+elem.setAttribute("b", "a");

+elem.attributes[0].appendChild(document.createTextNode("hi"));

+elem.attributes[0].addEventListener("DOMSubtreeModified", handler,  false);

+elem.normalize();

+</script>

diff --git a/tests/tests/webkitsecurity/assets/notifications-document-close-crash.html b/tests/tests/webkitsecurity/assets/notifications-document-close-crash.html
new file mode 100644
index 0000000..5bcf09a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/notifications-document-close-crash.html
@@ -0,0 +1,50 @@
+<html>

+    <body>

+        <div id="result"></div>

+        <script>

+            if (window.layoutTestController)

+            {

+                layoutTestController.dumpAsText();

+                layoutTestController.setCanOpenWindows();

+                layoutTestController.grantDesktopNotificationPermission("file://");

+                layoutTestController.waitUntilDone();

+            }

+            

+            if (!window.webkitNotifications) {

+                log("FAIL: No webkitNotifications interface!");

+            }

+

+            var target = window.open("about:blank");

+            var notification = target.webkitNotifications;

+            target.location.reload();

+            var timer = setInterval("crash()", 60);

+            setTimeout("finish()", 100);

+

+            function crash()

+            {

+                var a = [];

+                for (var i = 0; i < 0x100; i++)

+                {

+                    try

+                    {

+                        a.push(new WebGLByteArray());

+                    } 

+                    catch (e) {}

+                    a.push(Array(i).join("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"));

+                }

+                delete a;

+                notification.requestPermission();

+            }

+            

+            function finish()

+            {

+                clearInterval(timer);

+                document.getElementById("result").innerHTML = "PASS";

+                target.close();

+                if (window.layoutTestController)

+                    layoutTestController.notifyDone();

+            }

+        </script>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/notifications-window-close-crash.html b/tests/tests/webkitsecurity/assets/notifications-window-close-crash.html
new file mode 100644
index 0000000..c8717f8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/notifications-window-close-crash.html
@@ -0,0 +1,23 @@
+<html> 

+    <head> 

+        <script> 

+            function runTest()

+            {

+                if (window.layoutTestController)

+                    layoutTestController.dumpAsText();

+                else

+                {

+                    var win = window.open("about:blank");

+                    var notification = win.webkitNotifications.createNotification('');

+                    notification.show();

+                    win.close();

+                    notification.cancel();

+                }

+            }

+         </script> 

+    </head> 

+    <body onload="runTest()"> 

+        <p>This test needs to run manually and cannot run inside DumpRenderTree. Passes if it does not crash on running the test alongwith with a couple of page reloads.</p>

+    </body> 

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/null-chardata-crash.html b/tests/tests/webkitsecurity/assets/null-chardata-crash.html
new file mode 100644
index 0000000..b08857f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/null-chardata-crash.html
@@ -0,0 +1,15 @@
+<html>
+<body>
+  <p>To pass, this test should not crash</p>
+  <script>
+    if (window.layoutTestController)
+      window.layoutTestController.dumpAsText();
+
+    var o = document.createTextNode();
+    try {
+      o.data = null;
+      o.splitText(1);
+    } catch (e) {}
+  </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/null-document-location-assign-crash.html b/tests/tests/webkitsecurity/assets/null-document-location-assign-crash.html
new file mode 100644
index 0000000..a61515a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/null-document-location-assign-crash.html
@@ -0,0 +1,39 @@
+<p>This test checks for a NULL document crash that can happen when calling
+location.assign. If the test passes, you'll see a PASS message below.</p>
+<hr>
+<pre id="pre"></pre>
+<iframe style="visibility:hidden" src="does-not-exist.bogus"></iframe> <!-- forces asynchronous load -->
+<script>
+<!--
+function log(s)
+{
+    document.getElementById("pre").appendChild(document.createTextNode(s));
+}
+
+function test()
+{
+    frames[0].location.assign("javascript:'<script>parent.pass()</script>'");
+}
+
+function pass()
+{
+    log("PASS: You didn't crash.");
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function main()
+{
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }    
+    
+    // setTimeout forces execution in the context of the frame
+    frames[0].setTimeout(test, 0);
+}
+
+main();
+-->
+</script>
diff --git a/tests/tests/webkitsecurity/assets/null-document-location-href-put-crash.html b/tests/tests/webkitsecurity/assets/null-document-location-href-put-crash.html
new file mode 100644
index 0000000..dd045d3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/null-document-location-href-put-crash.html
@@ -0,0 +1,39 @@
+<p>This test checks for a NULL document crash that can happen when setting
+location.href. If the test passes, you'll see a PASS message below.</p>
+<hr>
+<pre id="pre"></pre>
+<iframe style="visibility:hidden" src="does-not-exist.bogus"></iframe> <!-- forces asynchronous load -->
+<script>
+<!--
+function log(s)
+{
+    document.getElementById("pre").appendChild(document.createTextNode(s));
+}
+
+function test()
+{
+    frames[0].location.href = "javascript:'<script>parent.pass()</script>'";
+}
+
+function pass()
+{
+    log("PASS: You didn't crash.");
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function main()
+{
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }    
+    
+    // setTimeout forces execution in the context of the frame
+    frames[0].setTimeout(test, 0);
+}
+
+main();
+-->
+</script>
diff --git a/tests/tests/webkitsecurity/assets/null-document-location-put-crash.html b/tests/tests/webkitsecurity/assets/null-document-location-put-crash.html
new file mode 100644
index 0000000..0c6f777
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/null-document-location-put-crash.html
@@ -0,0 +1,39 @@
+<p>This test checks for a NULL document crash that can happen when setting
+location. If the test passes, you'll see a PASS message below.</p>
+<hr>
+<pre id="pre"></pre>
+<iframe style="visibility:hidden" src="does-not-exist.bogus"></iframe> <!-- forces asynchronous load -->
+<script>
+<!--
+function log(s)
+{
+    document.getElementById("pre").appendChild(document.createTextNode(s));
+}
+
+function test()
+{
+    frames[0].location = "javascript:'<script>parent.pass()</script>'";
+}
+
+function pass()
+{
+    log("PASS: You didn't crash.");
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function main()
+{
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }    
+    
+    // setTimeout forces execution in the context of the frame
+    frames[0].setTimeout(test, 0);
+}
+
+main();
+-->
+</script>
diff --git a/tests/tests/webkitsecurity/assets/null-document-location-replace-crash.html b/tests/tests/webkitsecurity/assets/null-document-location-replace-crash.html
new file mode 100644
index 0000000..d74e451
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/null-document-location-replace-crash.html
@@ -0,0 +1,39 @@
+<p>This test checks for a NULL document crash that can happen when calling
+location.replace. If the test passes, you'll see a PASS message below.</p>
+<hr>
+<pre id="pre"></pre>
+<iframe style="display:none" src="does-not-exist.bogus"></iframe> <!-- forces asynchronous load -->
+<script>
+<!--
+function log(s)
+{
+    document.getElementById("pre").appendChild(document.createTextNode(s));
+}
+
+function test()
+{
+    frames[0].location.replace("javascript:'<script>parent.pass()</script>'");
+}
+
+function pass()
+{
+    log("PASS: You didn't crash.");
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function main()
+{
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }    
+    
+    // setTimeout forces execution in the context of the frame
+    frames[0].setTimeout(test, 0);
+}
+
+main();
+-->
+</script>
diff --git a/tests/tests/webkitsecurity/assets/null-document-window-open-crash.html b/tests/tests/webkitsecurity/assets/null-document-window-open-crash.html
new file mode 100644
index 0000000..f5ac60e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/null-document-window-open-crash.html
@@ -0,0 +1,39 @@
+<p>This test checks for a NULL document crash that can happen when calling
+window.open. If the test passes, you'll see a PASS message below.</p>
+<hr>
+<pre id="pre"></pre>
+<iframe name="iframe" style="visibility:hidden" src="does-not-exist.bogus"></iframe> <!-- forces asynchronous load -->
+<script>
+<!--
+function log(s)
+{
+    document.getElementById("pre").appendChild(document.createTextNode(s));
+}
+
+function test()
+{
+    window.open("javascript:'<script>parent.pass()</script>'", "iframe");
+}
+
+function pass()
+{
+    log("PASS: You didn't crash.");
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function main()
+{
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }    
+    
+    // setTimeout forces execution in the context of the frame
+    frames[0].setTimeout(test, 0);
+}
+
+main();
+-->
+</script>
diff --git a/tests/tests/webkitsecurity/assets/null-page-show-modal-dialog-crash.html b/tests/tests/webkitsecurity/assets/null-page-show-modal-dialog-crash.html
new file mode 100644
index 0000000..e86ba9a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/null-page-show-modal-dialog-crash.html
@@ -0,0 +1,25 @@
+This is a test for <a href="https://bugs.webkit.org/show_bug.cgi?id=19541">https://bugs.webkit.org/show_bug.cgi?id=19541</a> 
+RBug 19541: Null pointer in showModalDialog()
+
+This tests calling the showModalDialog() function on a window object from a detached iframe, both calling the saved showModalDialog() function and getting the property again after the iframe has been detached.
+
+If there is no crash this test passes.
+<script type="text/javascript">
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var iframe = document.createElement("iframe");
+
+iframe.onload = function() {
+    var iframeWindow = iframe.contentWindow;
+    var f = iframeWindow.showModalDialog;
+
+    iframe.parentNode.removeChild(iframe);
+    if (iframeWindow.showModalDialog)
+        iframeWindow.showModalDialog();
+    if (f)
+        f.call(iframeWindow);
+};
+
+document.body.appendChild(iframe);
+</script>
diff --git a/tests/tests/webkitsecurity/assets/number-parsing-crash-2.html b/tests/tests/webkitsecurity/assets/number-parsing-crash-2.html
new file mode 100644
index 0000000..7756228
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/number-parsing-crash-2.html
@@ -0,0 +1,47 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
+<html><head>
+
+  
+    <meta http-equiv="Content-type" content="text/html; charset=UTF-8">
+    <title>Bouncing Box example</title>
+    <style type="text/css" media="screen">
+
+      @-webkit-keyframes bounce {
+       from {
+         left: 0px;
+       }
+       to {
+         left: 200px;
+       }
+      }
+
+      div {
+       -webkit-animation-name: bounce;
+       -webkit-animation-duration: 4s;
+       -webkit-animation-iteration-count: 10;
+       -webkit-animation-direction: alternate;
+        width: 40%;
+        padding: 0.11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111em 1em;
+        position: relative;
+        left: 0px;
+        background: #aaaaff;
+      }
+      
+    </style>
+  </head><body>
+This should not crash.
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+
+    <h1>An example of a bouncing box</h1>
+    
+    <div>
+      <p>
+        It's just a jump to the left. And then a step to the right.
+      </p>
+    </div>
+    
+  </body></html>
diff --git a/tests/tests/webkitsecurity/assets/number-parsing-crash.html b/tests/tests/webkitsecurity/assets/number-parsing-crash.html
new file mode 100644
index 0000000..9bc972f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/number-parsing-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/number-parsing-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/number-parsing-crash.js b/tests/tests/webkitsecurity/assets/number-parsing-crash.js
new file mode 100644
index 0000000..611f1fb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/number-parsing-crash.js
@@ -0,0 +1,7 @@
+description(
+"This tests edge cases of number parsing."
+);
+
+var x = 0.111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111;
+
+shouldBe("x.toString()", "0.1111111111111111");
diff --git a/tests/tests/webkitsecurity/assets/one-letter-transform-crash.html b/tests/tests/webkitsecurity/assets/one-letter-transform-crash.html
new file mode 100644
index 0000000..5415359
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/one-letter-transform-crash.html
@@ -0,0 +1,18 @@
+<html>

+    Test passes if it does not crash.

+    <style>

+        div:first-letter {

+            text-decoration: overline;

+        }

+        div {

+            text-transform: capitalize;

+        }

+    </style>

+    <script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+    </script>

+    <div/>

+    <summary>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/onload-remove-iframe-crash-2.html b/tests/tests/webkitsecurity/assets/onload-remove-iframe-crash-2.html
new file mode 100644
index 0000000..345bb1f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/onload-remove-iframe-crash-2.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+    <title></title>
+    <script>
+        function done()
+        {
+            var f = document.getElementById("iframe");
+            f.parentNode.removeChild(f); 
+            parent.frameLoaded();
+        }
+    </script>
+</head>
+<body>
+    <div>
+        <iframe id="iframe" onload="done()" src="onload-remove-iframe.html">
+        </iframe>
+    </div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/onload-remove-iframe-crash.html b/tests/tests/webkitsecurity/assets/onload-remove-iframe-crash.html
new file mode 100644
index 0000000..d1dab6d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/onload-remove-iframe-crash.html
@@ -0,0 +1,18 @@
+<p>This test checks for a crash that once happened in WebKit. The crash was caused
+by an onload handler for a synchronously loaded iframe removing the iframe from the 
+document.
+</p>
+<p>(For compatibility, WebKit loads about:blank and javascript: URLs synchronously).
+</p>
+<hr>
+<p>PASS: You didn't crash.
+</p>
+
+<div id="div"></div>
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+document.getElementById('div').innerHTML = '<iframe src="about:blank" onload="this.parentNode.removeChild(this)"></iframe>';
+</script>
diff --git a/tests/tests/webkitsecurity/assets/onloadFrameCrash.html b/tests/tests/webkitsecurity/assets/onloadFrameCrash.html
new file mode 100644
index 0000000..c9778f0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/onloadFrameCrash.html
@@ -0,0 +1,8 @@
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.dumpChildFramesAsText();
+}
+</script>
+<!-- This test PASSED if we don't crash. -->
+<body onload="document.body.style.display = 'none'"><iframe src="_self"></iframe>This is the text</body>
diff --git a/tests/tests/webkitsecurity/assets/onunload-form-submit-crash-2.html b/tests/tests/webkitsecurity/assets/onunload-form-submit-crash-2.html
new file mode 100644
index 0000000..a286611
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/onunload-form-submit-crash-2.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+    <title>Test for http://bugs.webkit.org/show_bug.cgi?id=13015</title>
+    <script>
+        function test()
+        {
+            if (location.href.indexOf("?") == -1) {
+                if (window.layoutTestController) {
+                    layoutTestController.dumpAsText();
+                    layoutTestController.waitUntilDone();
+                }
+                location.href = "resources/onunload-form-submit-success.html";
+            } else {
+                document.getElementById("result").innerText = "FAIL";
+                if (window.layoutTestController)
+                    layoutTestController.notifyDone();
+            }
+        }
+
+        function handleUnload()
+        {
+            if (location.href.indexOf("?") == -1)
+                document.myForm.submit();
+        }
+    </script>
+</head>
+<body onload="test()" onunload="handleUnload()">
+    <form name="myForm">
+    </form>
+    <p id="result">
+        Test did not finish.
+    </p>
+</body>
+<html>
diff --git a/tests/tests/webkitsecurity/assets/onunload-form-submit-crash.html b/tests/tests/webkitsecurity/assets/onunload-form-submit-crash.html
new file mode 100644
index 0000000..1cd9e18
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/onunload-form-submit-crash.html
@@ -0,0 +1,14 @@
+<html>
+    <body onUnload="document.myForm.submit()">
+        <script>
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+            }
+
+            window.setTimeout("location.href='resources/onunload-form-submit-success.html'", 0);
+        </script>
+        <p>This is just a dummy page that loads the next page to see if we crash.</p>
+        <form name="myForm" action="resources/onunload-form-submit-crash2.html"></form>
+    </body>
+<html>
diff --git a/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-1.html b/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-1.html
new file mode 100644
index 0000000..002603b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-1.html
@@ -0,0 +1,11 @@
+<body onload="
+if (window.layoutTestController) {layoutTestController.dumpAsText();}
+document.designMode='on';
+document.execCommand('selectall');
+document.execCommand('italic');
+document.execCommand('RemoveFormat');
+document.designMode= 'off';
+document.execCommand('Undo');
+document.designMode ='on';
+document.execCommand('inserthtml', false);
+document.body.innerHTML='PASS';">x
diff --git a/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-2.html b/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-2.html
new file mode 100644
index 0000000..690795f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-2.html
@@ -0,0 +1,23 @@
+<BODY></BODY>

+<SCRIPT>

+if (window.layoutTestController)

+  layoutTestController.dumpAsText();

+document.execCommand("Outdent", false, 262140);

+document.designMode = "on";

+document.execCommand("SelectAll", false, "https://www.example.com");

+document.execCommand("insertimage", false, "data:image/png;base64,iVBORw0KGrkJggg==");

+document.execCommand("selectall", false, NaN);

+document.execCommand("strikethrough", false, "gopher://www.example.com");

+document.execCommand("MoveWordForward", false, 4100);

+document.execCommand("justifyfull", false, 4092);

+document.execCommand("OverWrite", false, 4);

+document.designMode = "off";

+document.execCommand("outdent", false, 16391);

+document.execCommand("paste", false, Infinity);

+document.execCommand("decreasefontsize", false, 268435456);

+document.execCommand("Undo", false, "data:text/html;charset=utf-8,%3C!DOCTYPE%20HTML%20PUBLIC%20%22-%2F%2FW3C%2F%2FDTD%20HTML%tle%3E%3C%2Fhead%3E%0D%0A%3Cbody%3E%3Ch1%3E42%3C%2Fh1%3E%3C%2Fbody%3E%0D%0A%3C%2Fhtml%3E%0D%0A");

+document.designMode = "on";

+document.execCommand("PasteAndMatchStyle", false, "<input type=subm\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\xa7\xa7\xa7\xa7,\' dialogHeight=`ssssssss\x06\x06\x06\x06\x06\x06\x06\x06\x06\x06\xba\xba` counterIncremen");

+document.execCommand("InsertText", false, "ftp://www.example.com");

+document.body.innerHTML='PASS';

+</SCRIPT>

diff --git a/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-3.html b/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-3.html
new file mode 100644
index 0000000..068027e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-3.html
@@ -0,0 +1,15 @@
+<BODY></BODY>
+<SCRIPT>
+  if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+  document.designMode="on";
+  document.execCommand("selectall");
+  document.execCommand("InsertHorizontalRule");
+  document.execCommand("SelectAll");
+  document.execCommand("ForwardDelete");
+  document.designMode="off";
+  document.execCommand("undo");
+  document.designMode="on";
+  document.execCommand("ForeColor",false,3);
+  document.body.innerHTML='PASS';
+</SCRIPT>
diff --git a/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-4.html b/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-4.html
new file mode 100644
index 0000000..dbf3661
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/orphaned-selection-crash-bug32823-4.html
@@ -0,0 +1,14 @@
+<BODY></BODY>
+<SCRIPT>
+  if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+  document.execCommand("selectall",false,true);
+  document.designMode="on";
+  document.execCommand("inserthorizontalrule",8);
+  document.execCommand("InsertImage",false,"");
+  document.execCommand("justifyleft",false,1);
+  document.execCommand("insertparagraph",false);
+  document.execCommand("SelectAll",false,undefined);
+  document.execCommand("InsertOrderedList",false,null);
+  document.body.innerHTML='PASS';
+</SCRIPT>
diff --git a/tests/tests/webkitsecurity/assets/orphaned_units_crash.html b/tests/tests/webkitsecurity/assets/orphaned_units_crash.html
new file mode 100644
index 0000000..f0916cc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/orphaned_units_crash.html
@@ -0,0 +1,18 @@
+<html>
+<head>
+    <style>
+        .test {
+            -webkit-border-bottom-left-radius: 1 px;
+        }
+    </style>
+    <script language="javascript">
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<body>
+This test verifies that styles with orphaned units do not crash the browser.  You should see the word "PASS" below.
+    <div class="test">PASS</div>
+</body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/overflow-custom-scrollbar-crash.html b/tests/tests/webkitsecurity/assets/overflow-custom-scrollbar-crash.html
new file mode 100644
index 0000000..29d1021
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/overflow-custom-scrollbar-crash.html
@@ -0,0 +1,125 @@
+<head>
+<style>
+
+body {
+  margin: 0;
+}
+::-webkit-scrollbar {
+    width: 20px;
+    height: 20px;
+}
+
+/* Horizontal Scrollbar Styles */
+
+::-webkit-scrollbar:horizontal {
+    -webkit-border-image: url(resources/horizontal-button.png) 0 2 0 2;
+    border-color: transparent;
+    border-width: 0 2px;
+    background-image: url(resources/horizontal-button-background.png);
+    background-repeat: repeat-x;
+}
+
+::-webkit-scrollbar-thumb:horizontal {
+    -webkit-border-image: url(resources/horizontal-thumb.png) 0 20 0 20;
+    border-color: transparent;
+    border-width: 0 20px;
+    min-width: 20px;
+}
+
+::-webkit-scrollbar-track-piece:horizontal:decrement {
+    -webkit-border-image: url(resources/horizontal-track.png) 0 20 0 20;
+    border-color: transparent;
+    border-width: 0 0 0 20px;
+}
+
+::-webkit-scrollbar-track-piece:horizontal:increment {
+    -webkit-border-image: url(resources/horizontal-track.png) 0 20 0 20;
+    border-color: transparent;
+    border-width: 0 20px 0 0;
+}
+
+::-webkit-scrollbar-button:horizontal {
+    width: 20px;
+    -webkit-border-image: url(resources/horizontal-button.png) 0 2 0 2;
+    border-color: transparent;
+    border-width: 0 2px;
+}
+
+::-webkit-scrollbar-button:horizontal:decrement {
+    background-image: url(resources/horizontal-decrement-arrow.png), url(resources/horizontal-button-background.png);
+    background-repeat: no-repeat, repeat-x;
+    background-position: 2px 3px, 0 0;
+}
+
+::-webkit-scrollbar-button:horizontal:increment {
+    background-image: url(resources/horizontal-increment-arrow.png), url(resources/horizontal-button-background.png);
+    background-repeat: no-repeat, repeat-x;
+    background-position: 7px 3px, 0 0;
+}
+
+.container {
+  position: absolute;
+  height: 100px;
+  width: 100px;
+  background-color: silver;
+}
+
+.scroller {
+  position: absolute;
+  top: 50px;
+  left: 0;
+  width: 300px;
+  height: 50px;
+  -webkit-box-sizing: border-box;
+  border: 1px solid black;
+  overflow-x: scroll;
+}
+
+.inner {
+  width: 400px;
+}
+</style>
+<script>
+  function showScroller()
+  {
+    var scroller = document.createElement('div');
+    scroller.className = 'scroller';
+    
+    var contents = document.createElement('div')
+    contents.className = 'inner';
+    contents.appendChild(document.createTextNode('inner'));
+  
+    scroller.appendChild(contents);
+    
+    document.getElementById('container').appendChild(scroller);
+  }
+  
+  function hideScroller()
+  {
+    var scroller = document.getElementById('container').querySelectorAll('.scroller')[0];
+    scroller.parentNode.removeChild(scroller);
+  }
+  
+  function doTest() {
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    if (window.eventSender) {
+        eventSender.dragMode = false;
+        eventSender.mouseMoveTo(50, 40);
+        eventSender.mouseMoveTo(50, 55);
+        eventSender.mouseMoveTo(50, 90);
+        eventSender.mouseDown();
+        eventSender.mouseUp();
+        eventSender.mouseMoveTo(50, 120);
+    }
+  }
+
+  window.addEventListener('load', doTest, false);
+</script>
+</head>
+<body>
+  <div id="container" class="container" onmouseover="showScroller()" onmouseout="hideScroller()">
+  </div>
+  <p>This test should not crash</p>
+</body>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/overflow-height-float-not-removed-crash.html b/tests/tests/webkitsecurity/assets/overflow-height-float-not-removed-crash.html
new file mode 100644
index 0000000..e736b05
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/overflow-height-float-not-removed-crash.html
@@ -0,0 +1,20 @@
+<html>

+    <head>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+            

+            function finish()

+            {

+                document.getElementById("result").innerHTML = "PASS";

+            } 

+        </script>

+    </head>

+    <body onload="finish()">

+        <div id="result"></div>

+        <textarea rows="100000000"></textarea>

+        <textarea style="width: 100%" rows="100000000"></textarea>

+        <object data="a" align="right"></object>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/overflow-height-float-not-removed-crash2.html b/tests/tests/webkitsecurity/assets/overflow-height-float-not-removed-crash2.html
new file mode 100644
index 0000000..6cb6a54
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/overflow-height-float-not-removed-crash2.html
@@ -0,0 +1,20 @@
+<html>

+    <head>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+            

+            function finish()

+            {

+                document.getElementById("result").innerHTML = "PASS";

+            } 

+        </script>

+    </head>

+    <body onload="finish()">

+        <div id="result"></div>

+        <textarea style="width: 100%" rows="100000000"></textarea>

+        <object data="x" align="left"></object>

+        <textarea rows="100000000"></textarea>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/overflow-height-float-not-removed-crash3.html b/tests/tests/webkitsecurity/assets/overflow-height-float-not-removed-crash3.html
new file mode 100644
index 0000000..899e0b7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/overflow-height-float-not-removed-crash3.html
@@ -0,0 +1,19 @@
+<html>

+Test passes if it does not crash.

+<script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+</script>

+<style>

+.test { -webkit-columns: 1px; }

+</style>

+<div class="test">

+<textarea></textarea>

+<object data="x" align="left">

+<textarea rows="100000000"></textarea>

+sometextsometextsometextsometextsometextsometext

+<div></div>

+<textarea style="width: 100%" rows="100000000"></textarea>

+<object data="x" align="left"></object>

+</div>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/overhanging-float-legend-crash.html b/tests/tests/webkitsecurity/assets/overhanging-float-legend-crash.html
new file mode 100644
index 0000000..969dc22
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/overhanging-float-legend-crash.html
@@ -0,0 +1,31 @@
+<html>

+    <script>

+    if (window.layoutTestController)

+    {

+        layoutTestController.dumpAsText();

+        layoutTestController.waitUntilDone();

+    }

+

+    window.setTimeout('crash();', 0);

+

+    function crash()

+    {

+        block1.style.position = 'absolute';

+        float1.style.display = 'none';

+        document.body.offsetTop;

+ 

+        document.getElementById("result").innerHTML = "PASS";

+        if (window.layoutTestController)

+            layoutTestController.notifyDone();

+    }

+    </script>

+    <div id="result"></div>

+    <div id="block1">

+        <span id="float1" style="float:left; margin-bottom:10000px;"></span>

+    </div>

+    <legend>

+        <fieldset></fieldset>

+        <junk>

+    </legend>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/overhanging-floats-not-removed-crash.html b/tests/tests/webkitsecurity/assets/overhanging-floats-not-removed-crash.html
new file mode 100755
index 0000000..8729451
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/overhanging-floats-not-removed-crash.html
@@ -0,0 +1,46 @@
+<!DOCTYPE html>

+<html>

+<body>

+<style>

+#test1 {

+    display: -webkit-flexbox;

+}

+#test1::before {

+    content: "A";

+}

+#test2::before {

+    content: "B";

+    float: right;

+}

+</style>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+function runTest() {

+    document.body.offsetTop;

+

+    test1 = document.createElement('div');

+    test1.setAttribute('id', 'test1');

+    document.body.appendChild(test1);

+

+    test2 = document.createElement('span'); 

+    test2.setAttribute('id', 'test2');

+    test1.appendChild(test2);

+

+    test3 = document.createElement('div');

+    test1.appendChild(test3);

+    test3Child = document.createElement('div');

+    test3.appendChild(test3Child);

+

+    document.body.offsetTop;

+    test2.style.display = '-webkit-flexbox';

+    

+    document.body.offsetTop;

+    document.body.innerHTML = "PASS";

+}

+

+window.onload = runTest;

+</script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/override-transition-crash.html b/tests/tests/webkitsecurity/assets/override-transition-crash.html
new file mode 100644
index 0000000..9f3989c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/override-transition-crash.html
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+  <style type="text/css" media="screen">
+    #box {
+      position: relative;
+      height: 100px;
+      width: 100px;
+      background-color: blue;
+      -webkit-transition-duration: 1s;
+      -webkit-transition-property: top, -webkit-text-fill-color, text-shadow, all;
+    }
+    #box.change {
+      -webkit-text-fill-color: white;
+      top: 100px;
+      text-shadow: 1px 1px 1px rgba(0,0,0, .8);
+    }
+  </style>
+  <script>
+    if (window.layoutTestController) {
+      layoutTestController.dumpAsText();
+    }
+    
+    function start()
+    {
+        var box = document.getElementById('box');
+        box.className = "change";
+    }
+    
+    window.addEventListener('load', start, false);
+  </script>
+</head>
+<body>
+
+<p>
+This tests a crash that was occuring when you have both an explicit property and 'all' in the -webkit-transition-property CSS property. The crash would occur when you start the transition 
+of the explicit property. Transitions of 3 sample properties are used (top, -webkit-text-fill-color, 
+and text-shadow), to test 3 separate code paths for property animation.
+
+This test should not crash.
+</p>
+<div id="box">
+    Text With a Shadow
+</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/page-cache-crash-on-data-urls.html b/tests/tests/webkitsecurity/assets/page-cache-crash-on-data-urls.html
new file mode 100644
index 0000000..9bef46e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/page-cache-crash-on-data-urls.html
@@ -0,0 +1,36 @@
+<html>
+<script>
+window.finish = function()
+{
+    if (layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+window.log = function(message) {
+     document.getElementById("result").innerHTML += message + "<br>";
+}
+
+window.failure = function(message) {
+    log("FAIL: " + message);
+    finish();
+}
+
+function test()
+{
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+        layoutTestController.setCanOpenWindows();
+        layoutTestController.overridePreference("WebKitUsesPageCachePreferenceKey", 1);
+    }
+    log("open page with data urls");
+    window.open("resources/cached-page-with-data-urls.html");
+}
+</script>
+
+<body onload="test()">
+<p>This tests that going back in history with page cache enabled is
+not going to crash/ASSERT when the previous page has data:// URLs.</p>
+<div id="result"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/paginated-layer-crash.html b/tests/tests/webkitsecurity/assets/paginated-layer-crash.html
new file mode 100644
index 0000000..4a6c6da
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/paginated-layer-crash.html
@@ -0,0 +1,31 @@
+<style>
+    .section {
+        position: absolute;
+        -webkit-column-count: 2;
+    }
+
+    .graph {
+        overflow: hidden;
+    }
+
+    .img {
+        position: relative;
+        width: 180px;
+    }
+</style>
+<p>
+    Test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=48983">https://bugs.webkit.org/show_bug.cgi?id=48983</a>
+    REGRESSION: multicol crashes with positioned elements</i>.
+</p>
+<p>
+    This test should not cause a crash.
+</p>
+<div class="section">
+    <div class="graph">
+        <div class="img"></div>
+    </div>
+</div>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/parent-box-not-box-crash.html b/tests/tests/webkitsecurity/assets/parent-box-not-box-crash.html
new file mode 100644
index 0000000..1d9272b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/parent-box-not-box-crash.html
@@ -0,0 +1,24 @@
+<html>

+    <head>

+        <style>

+            .test1 { 

+                display: list-item; 

+            }

+            .test2 { 

+                display: run-in; 

+            }

+        </style>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+        </script>

+    </head>

+    <body>

+        <div class="test1">

+            <div class="test2">

+                PASS

+            </div>

+        <div>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/parent-view-layout-crash.html b/tests/tests/webkitsecurity/assets/parent-view-layout-crash.html
new file mode 100644
index 0000000..e28f3d4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/parent-view-layout-crash.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>

+<html>

+Test passes if it does not crash.

+<style></style>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+function runTest()

+{

+    document.styleSheets[0].insertRule("font {}", 0);

+}

+</script>

+<object data="resources/svg-font-face.svg"></object>

+<object style="content:counter(item)" data="resources/svg-font-face.svg" onload="runTest()"></object>

+</script>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/parse-color-int-or-percent-crash.html b/tests/tests/webkitsecurity/assets/parse-color-int-or-percent-crash.html
new file mode 100644
index 0000000..5c58f66
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/parse-color-int-or-percent-crash.html
@@ -0,0 +1,15 @@
+<html>

+    <body>

+        <script>    

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+

+            var stopElement = document.createElementNS("http://www.w3.org/2000/svg", "stop");

+            stopElement.style.stopColor = "blue";

+

+            var colorString = "rgb(00000000000000000000";

+            stopElement.style.setProperty("stop-color", colorString);

+            document.body.innerHTML = stopElement.style.stopColor == "#0000ff" ? "PASS" : "FAIL";

+        </script>

+    </body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/parse-timing-function-crash.html b/tests/tests/webkitsecurity/assets/parse-timing-function-crash.html
new file mode 100644
index 0000000..573da31
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/parse-timing-function-crash.html
@@ -0,0 +1,5 @@
+<p style="-webkit-transition-timing-function: cubic-bezier(0.5, 0.2, 0.8, 0.9);">This paragraph has a -webkit-transition-timing-function property that uses the cubic-bezier function. Parsing its style should not cause the browser to crash.</p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/path-getPresentationAttribute-crash.html b/tests/tests/webkitsecurity/assets/path-getPresentationAttribute-crash.html
new file mode 100644
index 0000000..46f6ed3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/path-getPresentationAttribute-crash.html
@@ -0,0 +1,8 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var path = document.createElementNS("http://www.w3.org/2000/svg", "path");
+path.getPresentationAttribute("");
+document.write("PASSED -- WebKit did not crash!");
+</script>
diff --git a/tests/tests/webkitsecurity/assets/path-getTotalLength-on-big-segment-crash.svg b/tests/tests/webkitsecurity/assets/path-getTotalLength-on-big-segment-crash.svg
new file mode 100644
index 0000000..9cf653c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/path-getTotalLength-on-big-segment-crash.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<text x="10" y="30">Test passes if it does not crash.</text>
+<script>
+<![CDATA[
+    var path = document.createElementNS("http://www.w3.org/2000/svg", "path");
+    path.setAttribute("d", "M0,0");
+    var x   = -764285429.594597,  y = -4016805151.510674,
+        x1  = -1.227687,          y1 = -4089196561.699610,
+        x2  = -2172808631,        y2 = .990756267;
+    pathSeg = path.createSVGPathSegCurvetoCubicAbs(x, y, x1 ,y1 ,x2 ,y2);
+    pathSegList = path.pathSegList;
+    pathSegList.appendItem(pathSeg);
+    path.getTotalLength();
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+]]>
+</script>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/path-marker-removed-crash.svg b/tests/tests/webkitsecurity/assets/path-marker-removed-crash.svg
new file mode 100644
index 0000000..734eb21
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/path-marker-removed-crash.svg
@@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg"> 

+    <defs id="test"> 

+        <marker id="marker"></marker> 

+    </defs>  

+    <path marker-end="url(#marker)" d="M 130 13L 180 185"/>

+    <path marker-end="url(#marker)" d="M 138 13L 180 185"/>

+    <text x="50" y="50">PASS</text>

+    <script>

+    <![CDATA[

+        if (window.layoutTestController) 

+        {

+            layoutTestController.dumpAsText();

+            layoutTestController.waitUntilDone();

+            gc = function() {

+                GCController.collect();

+    

+                for (var i = 0; i < 10000; ++i) 

+                    var s = new String("abc");

+            };

+        } else if (!window.gc)

+            gc = function() {};

+

+        function runTest()

+        {

+            var test = document.getElementById('test');

+            test.removeChild(document.getElementById('marker'));

+            gc();

+            

+            if (window.layoutTestController)

+                layoutTestController.notifyDone();

+        }

+

+        setTimeout("runTest()", 0);

+    ]]>

+    </script>

+</svg>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/pause-crash.html b/tests/tests/webkitsecurity/assets/pause-crash.html
new file mode 100644
index 0000000..a59dd4f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/pause-crash.html
@@ -0,0 +1,59 @@
+<html>
+<head>
+  <title>Pause and resume animation should not crash</title>
+  <style type="text/css" media="screen">
+    .box {
+      height: 100px;
+      width: 100px;
+      margin: 10px;
+      background-color: blue;
+      -webkit-animation-duration: 2s;
+      -webkit-animation-direction: alternate;
+      -webkit-animation-iteration-count: infinite;
+    }
+    
+    @-webkit-keyframes anim {
+        from { -webkit-transform: matrix3d(1,0,0,0, 0,1,0,0, 0,0,1,0, 0,0,0,1); }
+        to   { -webkit-transform: matrix3d(1,0,0,0, 0,1,0,0, 0,0,1,0, 400,0,0,1); }
+    }
+  </style>
+  <script type="text/javascript" charset="utf-8">
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    function animationStarted()
+    {
+        setTimeout(function() {
+            document.getElementById('box1').style.webkitAnimationPlayState = "paused";
+            setTimeout(function() {
+                document.getElementById('box1').style.webkitAnimationPlayState = "running";
+                setTimeout(function() {
+                    document.getElementById('results').innerHTML = 'Did not crash, so PASSED';
+                    if (window.layoutTestController)
+                        layoutTestController.notifyDone();
+                }, 50);
+            }, 50);
+        }, 50);
+    }
+    
+    function startTest()
+    {
+        document.getElementById('box1').addEventListener('webkitAnimationStart', animationStarted);
+        document.getElementById('box1').style.webkitAnimationName = "anim";
+    }
+
+    window.addEventListener('load', startTest, false);
+  </script>
+</head>
+<body>
+
+<p>Tests pause and resume animation. Should not crash. (https://bugs.webkit.org/show_bug.cgi?id=67510)</p>
+
+<div id="container">
+  <div id="box1" class="box"></div>
+</div>
+<div id="results"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/pending-images-crash.html b/tests/tests/webkitsecurity/assets/pending-images-crash.html
new file mode 100644
index 0000000..d337c3c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/pending-images-crash.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+  <style type="text/css" media="screen">
+    ul {
+      list-style-image: url('foopy.png');
+      background-image: url('foopy1.png');
+      -webkit-border-image: url('foopy2.png');
+      -webkit-mask-box-image: url('foopy3.png');
+      -webkit-mask: below url('foopy4.png');
+    }
+    
+    ul {
+      list-style-image: none;
+      background-image: none;
+      -webkit-border-image: none;
+      -webkit-mask-box-image: none;
+      -webkit-mask: below none;
+    }
+    
+    .box {
+      content: url('foopy5.png') url('foopy6.png');
+    }
+    
+    .box {
+      content: none url('');
+    }
+    
+    
+  </style>
+  <script type="text/javascript" charset="utf-8">
+    if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+  </script>
+</head>
+<body>
+  <ul>
+    <li>This test passes if it does not crash.</li>
+  </ul>
+  <div class="box">
+  </div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/pending-reflection-mask-crash.html b/tests/tests/webkitsecurity/assets/pending-reflection-mask-crash.html
new file mode 100644
index 0000000..77bc3b2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/pending-reflection-mask-crash.html
@@ -0,0 +1,11 @@
+<style>
+  *{
+    -webkit-box-reflect: none !important;
+    -webkit-box-reflect: below 0 url(x);
+  }
+</style>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<p>This test should not crash.</p>
diff --git a/tests/tests/webkitsecurity/assets/percent-height-descendant-not-removed-crash.html b/tests/tests/webkitsecurity/assets/percent-height-descendant-not-removed-crash.html
new file mode 100644
index 0000000..069324f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/percent-height-descendant-not-removed-crash.html
@@ -0,0 +1,26 @@
+<html>

+    <head>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+             

+            function runTest()

+            {

+                test1 = document.getElementById('test1');

+                test2 = document.getElementById('test2');

+                test3 = document.getElementById('test3');

+

+                document.body.offsetTop;    

+                test1.removeChild(test2);

+                test1.removeChild(test3);

+            }

+        </script>

+    </head>

+    <body onload="runTest();">

+        Test passes if it does not crash.

+        <div id="test1" style="-webkit-writing-mode: vertical-rl;">

+            <div id="test2"></div>

+            <div id="test3" style="width: 100%"></div>

+        </div>

+    </body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/placeholder-crash-with-scrollbar-corner.html b/tests/tests/webkitsecurity/assets/placeholder-crash-with-scrollbar-corner.html
new file mode 100644
index 0000000..0c1c267
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/placeholder-crash-with-scrollbar-corner.html
@@ -0,0 +1,26 @@
+<style>
+::-webkit-scrollbar-corner {
+    color: Red;
+}
+</style>
+<p>Focus on the input and hit Escape and see if the browser crashes.</p>
+<input placeholder="foo" id=i>
+<div id=console></div>
+<script>
+document.getElementById('i').addEventListener("keydown", function() {
+    this.style.display = "none";
+    document.getElementById('console').innerText = 'PASS (not crashed)';
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+});
+
+if (window.layoutTestController && window.eventSender) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+    setTimeout(function() {
+        document.getElementById('i').focus();
+        eventSender.keyDown('a');
+    }, 0);
+}
+
+</script>
diff --git a/tests/tests/webkitsecurity/assets/png-extra-row-crash.html b/tests/tests/webkitsecurity/assets/png-extra-row-crash.html
new file mode 100644
index 0000000..6d05101
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/png-extra-row-crash.html
@@ -0,0 +1,20 @@
+<html>
+  <head>
+    <script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    function loaded()
+    {
+        var p = document.createElement("p");
+        p.appendChild(document.createTextNode("PASS"));
+        document.body.appendChild(p);
+    }
+    </script>
+  </head>
+  <body>
+    The following PNG will attempt to render a bad row.
+    If the test succeeds this should not crash.
+    <img onload="loaded()" src="resources/png-extra-row-crash.png">
+  </body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/png-extra-row-crash.png b/tests/tests/webkitsecurity/assets/png-extra-row-crash.png
new file mode 100644
index 0000000..c49f2d1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/png-extra-row-crash.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/policy-ignore-crash.php b/tests/tests/webkitsecurity/assets/policy-ignore-crash.php
new file mode 100644
index 0000000..08ccb56
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/policy-ignore-crash.php
@@ -0,0 +1,30 @@
+<?php
+header('Content-type: multipart/x-mixed-replace;boundary=asdf');
+?>--asdf
+Content-type: text/html
+
+<p>This test passes if it does not crash.</p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+
+<?php
+# Add some padding because CFNetwork merges small multipart segments together.
+echo str_pad('', 5000);
+
+ob_flush();
+flush();
+?>
+--asdf
+Content-type: text/random
+
+This chunk doesn't have a content type, which can cause the policy
+for this load to be ignored. This causes the request to be canceled.
+
+<?php
+# Add some padding because CFNetwork merges small multipart segments together.
+echo str_pad('', 5000);
+?>
+
+--asdf--
diff --git a/tests/tests/webkitsecurity/assets/polyline-points-crash.html b/tests/tests/webkitsecurity/assets/polyline-points-crash.html
new file mode 100644
index 0000000..65c4dcf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/polyline-points-crash.html
@@ -0,0 +1,12 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var polyline = document.createElementNS("http://www.w3.org/2000/svg", "polyline");
+try {
+    polyline.points.appendItem(null);
+} catch (e) {
+    document.write("Caught exception: " + e + "<br>");
+}
+document.write("PASSED -- WebKit did not crash!")
+</script>
diff --git a/tests/tests/webkitsecurity/assets/position-absolute-to-fixed-crash.html b/tests/tests/webkitsecurity/assets/position-absolute-to-fixed-crash.html
new file mode 100644
index 0000000..0b46028
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/position-absolute-to-fixed-crash.html
@@ -0,0 +1,35 @@
+<head>
+    <script>
+        if (layoutTestController)
+            layoutTestController.dumpAsText();
+
+        function test()
+        {
+            document.body.offsetTop;
+            var s = document.getElementById("target").style;
+            s.setProperty("position", "fixed");
+            document.body.offsetTop;
+            s.setProperty("overflow", "hidden");
+            s.setProperty("height", "0");
+            s.setProperty("width", "0");
+            document.body.offsetTop;
+            s.setProperty("display", "none");
+        }
+    </script>
+</head>
+<body onload="test()">
+    <p>
+        Test for <i><a href="rdar://problem/7094146">rdar://problem/7094146</a>
+        Reproducible crash at RenderObject::localToAbsolute()</i>.
+    </p>
+    <p>
+        This crash occurred after an object&rsquo;s position changed directly
+        from absolute to fixed, and it was not added to the RenderView&rsquo;s
+        positioned objects list nor removed from its old container&rsquo;s list. 
+    </p>
+    <div style="position: relative;">
+        <div id="target" style="top: 50px; position: absolute;">
+            <div style="height: 50px; width: 50px; background-color: red;"></div>
+        </div>
+    </div>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/positioned-background-hit-test-crash.html b/tests/tests/webkitsecurity/assets/positioned-background-hit-test-crash.html
new file mode 100644
index 0000000..395014b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/positioned-background-hit-test-crash.html
@@ -0,0 +1,57 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+   <head>
+       <title></title>
+       <style type="text/css">
+           h1
+           {
+               /* required for crash */
+               position: relative;
+           }
+           
+           h1:before
+           {
+               /* required for crash */
+               content: "";
+               position: absolute;
+               
+               /* Width and height so we can drag over it, values not important */
+               height: 200px;
+               width: 200px;
+               
+               /* border so we can see it */
+               border: 1px solid red;
+           }       
+        </style>
+        <script type="text/javascript">
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            function finishTest()
+            {
+                eventSender.mouseUp();
+                getSelection().removeAllRanges();
+                layoutTestController.notifyDone();
+            }
+
+            function test()
+            {
+                if (!window.layoutTestController)
+                    return;
+                layoutTestController.waitUntilDone();
+                eventSender.dragMode = false;
+                eventSender.mouseMoveTo(1, 1);
+                eventSender.mouseDown();
+                // Start autoscroll.
+                eventSender.mouseMoveTo(2, 2);
+                // Move into position.
+                eventSender.mouseMoveTo(50, 50);
+                // Wait for the autoscroll timer to fire.
+                setTimeout(finishTest, 200);
+            }
+        </script>
+   </head>
+   <body onload="test()">
+       <h1 id="heading">No crash means PASS</h1>
+   </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/positioned-child-not-removed-crash.html b/tests/tests/webkitsecurity/assets/positioned-child-not-removed-crash.html
new file mode 100755
index 0000000..aef7b9d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/positioned-child-not-removed-crash.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<body>
+Test passes if it does not crash.
+<style>
+.caption1 { -webkit-column-width: 1px; }
+.div1 { position: absolute; }
+.keygen1:nth-last-child(even) { display: block; -webkit-column-span: all; }
+.flexbox1 { display: -webkit-flexbox; padding-right: 10px; -webkit-transform: rotate3d(0, 1, 0, 90deg); }
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest() {
+    caption1 = document.createElement('caption');
+    caption1.setAttribute('class', 'caption1');
+    div1 = document.createElement('div');
+    div1.setAttribute('class', 'div1');
+    flexbox1 = document.createElement('div');
+    flexbox1.setAttribute('class', 'flexbox1');
+    keygen1 = document.createElement('keygen');
+    keygen1.setAttribute('class', 'keygen1');
+
+    div2 = document.createElement('div');
+    div3 = document.createElement('div');
+
+    flexbox1.appendChild(keygen1);
+    flexbox1.appendChild(div1);
+    flexbox1.appendChild(div3);
+    caption1.appendChild(flexbox1);
+    document.body.appendChild(caption1);
+    document.body.offsetTop;
+    flexbox1.appendChild(div2);
+    document.body.offsetTop;
+    flexbox1.removeChild(div1);
+}
+window.onload = runTest;
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/positioned-count-crash.html b/tests/tests/webkitsecurity/assets/positioned-count-crash.html
new file mode 100644
index 0000000..a62568a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/positioned-count-crash.html
@@ -0,0 +1,19 @@
+<div>
+<span>
+<li>
+<li id="test" style="position: absolute;list-style-type: upper-roman;">II
+</div>
+
+<div>
+<br>
+<br>
+For manual test: If you see no crash and "II II", it means this test PASS.
+</div>
+
+<script src="resources/dump-list.js"></script>
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        document.write(testListItemMarkerEqualsListItemText(document.getElementById("test")));
+    }
+</script>
diff --git a/tests/tests/webkitsecurity/assets/positioned-div-with-floating-after-content-crash-frame1.html b/tests/tests/webkitsecurity/assets/positioned-div-with-floating-after-content-crash-frame1.html
new file mode 100644
index 0000000..5d5524a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/positioned-div-with-floating-after-content-crash-frame1.html
@@ -0,0 +1,31 @@
+<style>
+.c1 { display: table; }
+.c1::after { position: fixed; content: counter(section); }
+.c2 { display: table-caption; float: left; }
+</style>
+<script>
+var node = document.createElement('q');
+
+function changeQClass() {
+    node.setAttribute('class', 'c1');
+    setTimeout("appendQ();", 10);
+}
+
+function appendQ() {
+    document.getElementById('positionedDiv').appendChild(node);
+    setTimeout("navigateAway();");
+}
+
+function navigateAway() {
+    // Bug only manifests on document destruction
+    window.location="positioned-div-with-floating-after-content-crash-frame2.html";
+}
+
+function runTest() {
+    setTimeout("changeQClass();", 10);
+}
+window.onload = runTest;
+</script>
+<div class="c2"><textarea></textarea></div>
+<div id="positionedDiv" class="c1">FAIL</div>
+<div class="c2"></div>
diff --git a/tests/tests/webkitsecurity/assets/positioned-div-with-floating-after-content-crash-frame2.html b/tests/tests/webkitsecurity/assets/positioned-div-with-floating-after-content-crash-frame2.html
new file mode 100644
index 0000000..0e6de68
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/positioned-div-with-floating-after-content-crash-frame2.html
@@ -0,0 +1,8 @@
+<script>
+function finishTest() {
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+window.onload = finishTest;
+</script>
+PASS, if no exception or crash
diff --git a/tests/tests/webkitsecurity/assets/positioned-div-with-floating-after-content-crash.html b/tests/tests/webkitsecurity/assets/positioned-div-with-floating-after-content-crash.html
new file mode 100644
index 0000000..8301dd4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/positioned-div-with-floating-after-content-crash.html
@@ -0,0 +1,11 @@
+<script>
+function runTest() {
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+        layoutTestController.dumpChildFramesAsText();
+    }
+}
+window.onload = runTest;
+</script>
+<iframe id="frame" src="resources/positioned-div-with-floating-after-content-crash-frame1.html"></iframe>
diff --git a/tests/tests/webkitsecurity/assets/positioned-generated-content-under-run-in-crash.html b/tests/tests/webkitsecurity/assets/positioned-generated-content-under-run-in-crash.html
new file mode 100755
index 0000000..60d02a4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/positioned-generated-content-under-run-in-crash.html
@@ -0,0 +1,22 @@
+<style>
+.testclass::before { position: absolute; content: ""; }
+.testclass { display: run-in; }
+</style>
+PASS, if no exceptions or crash observed
+<script>
+function runTest() 
+{
+    test1 = document.createElement('div');
+    test1.setAttribute('class', 'testclass');
+    document.documentElement.appendChild(test1);
+    test2 = document.createElement('b');
+    test2.setAttribute('class', 'testclass');
+    document.documentElement.appendChild(test2);
+    test3 = document.createElement('div');
+    document.documentElement.appendChild(test3);
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+}
+window.onload = runTest;
+</script>
+
diff --git a/tests/tests/webkitsecurity/assets/positioned-in-relative-position-inline-crash.html b/tests/tests/webkitsecurity/assets/positioned-in-relative-position-inline-crash.html
new file mode 100644
index 0000000..22b3ce3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/positioned-in-relative-position-inline-crash.html
@@ -0,0 +1,37 @@
+<html>
+<style type="text/css">
+.inlineContainer {
+  position: relative;
+  display: inline;
+}
+#positioned {
+  position: absolute;
+  top: 100px;
+}
+</style>
+<script type="text/javascript">
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+}
+
+function dumpTest() {
+    if (window.layoutTestController) {
+        layoutTestController.notifyDone();
+    }
+}
+function runTest() {
+    document.getElementById('positioned').innerHTML = '2';
+    document.getElementById('positioned').style.color = 'red';
+    setTimeout('dumpTest()', 10);
+}
+setTimeout('runTest()', 0);
+</script>
+<body>
+PASS, if no exception or crash in debug
+  <div class='inlineContainer'>
+    <div>div1</div>
+    <div id='positioned'>div2</div>
+  </div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/print-close-crash.html b/tests/tests/webkitsecurity/assets/print-close-crash.html
new file mode 100644
index 0000000..de8f51c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/print-close-crash.html
@@ -0,0 +1,18 @@
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    // DumpRenderTree requires waitUntilDone for this test even though it's not needed.
+    layoutTestController.waitUntilDone();
+    layoutTestController.setCanOpenWindows();
+    layoutTestController.setCloseRemainingWindowsWhenComplete(true);
+}
+var w = window.open("data:text/html,foo");
+w.print();
+w.close();
+
+window.onload = function() {
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+This test passes if it doesn't crash.
diff --git a/tests/tests/webkitsecurity/assets/process-end-tag-for-inbody-crash.html b/tests/tests/webkitsecurity/assets/process-end-tag-for-inbody-crash.html
new file mode 100644
index 0000000..c2430d3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/process-end-tag-for-inbody-crash.html
@@ -0,0 +1,8 @@
+<rt>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+	
+document.body.innerHTML = "PASS";
+</script>
+</rt>
diff --git a/tests/tests/webkitsecurity/assets/progress-element-with-child-crash.html b/tests/tests/webkitsecurity/assets/progress-element-with-child-crash.html
new file mode 100644
index 0000000..a3c4e7d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/progress-element-with-child-crash.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+  <h1>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=48019">Bug 48019</a>. It is OK not to crash.</h1>
+  <progress value=50 max=100>
+    <b>
+      <menu>
+        <select autofocus>
+      </menu>
+      <input>
+    </b>
+  </progress>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/progress-element-with-style-crash.html b/tests/tests/webkitsecurity/assets/progress-element-with-style-crash.html
new file mode 100644
index 0000000..cb4214a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/progress-element-with-style-crash.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function test() {
+    // It is necessary to allow some time for the progress bar to render the
+    // progress and produce the crash.
+    window.setTimeout(function() {
+          if (window.layoutTestController)
+              layoutTestController.notifyDone();
+    }, 10);
+}
+</script>
+</head>
+<body onload="test();">
+  <h1>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=50341">Bug 50341</a>. It is not OK to crash.</h1>
+  <progress style='font: 1 required'/>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/range-delete-contents-event-fire-crash.html b/tests/tests/webkitsecurity/assets/range-delete-contents-event-fire-crash.html
new file mode 100644
index 0000000..fec43ec
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/range-delete-contents-event-fire-crash.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>

+<html>

+<div id="test1">

+<input id="test2"/>

+<input id="test3"/>

+<ol></ol>

+</div>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+function runTest() {

+    var range = document.createRange();

+    var test1 = document.getElementById("test1");

+    var test2 = document.getElementById("test2");

+    var test3 = document.getElementById("test3");

+    

+    range.setStartBefore(test2);

+    range.selectNodeContents(test3);

+    range.setEndAfter(test1);

+    range.commonAncestorContainer;

+    range.deleteContents();

+}

+

+document.addEventListener("DOMSubtreeModified", runTest, true);

+document.body.appendChild(document.createTextNode("PASS"));

+</script>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/range-extract-contents-event-fire-crash.html b/tests/tests/webkitsecurity/assets/range-extract-contents-event-fire-crash.html
new file mode 100644
index 0000000..3ffb575
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/range-extract-contents-event-fire-crash.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>
+    <span>
+        <span id="start"></span>
+    </span>
+</p>
+<p>
+    <span>
+        <span id="end"></span>
+    </span>
+</p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest()
+{
+    document.removeEventListener("DOMSubtreeModified", runTest, false);
+    document.body.innerHTML = 'PASS: does not crash';
+}
+
+document.addEventListener("DOMSubtreeModified", runTest, false);
+
+var r = document.createRange();
+r.setStartBefore(document.getElementById('start'));
+r.setEndAfter(document.getElementById('end'));
+r.extractContents();
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/range-extract-contents-event-fire-crash2.html b/tests/tests/webkitsecurity/assets/range-extract-contents-event-fire-crash2.html
new file mode 100644
index 0000000..018a1d7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/range-extract-contents-event-fire-crash2.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>
+    <span>
+        <span id="start"></span>
+    </span>
+    <span>
+        <span id="end"></span>
+    </span>
+</p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest()
+{
+    document.removeEventListener("DOMSubtreeModified", runTest, false);
+    document.body.innerHTML = 'PASS: does not crash';
+}
+
+document.addEventListener("DOMSubtreeModified", runTest, false);
+
+var r = document.createRange();
+r.setStartBefore(document.getElementById('start'));
+r.setEndAfter(document.getElementById('end'));
+r.extractContents();
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/range-selection-across-documents-crash.html b/tests/tests/webkitsecurity/assets/range-selection-across-documents-crash.html
new file mode 100644
index 0000000..dcc2340
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/range-selection-across-documents-crash.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>

+<html>

+<head>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+function runTest()

+{

+    var iframeElement = document.getElementById('iframe1');

+    var iframeDocument = iframeElement.contentDocument;

+    var iframeDocumentRoot = iframeDocument.documentElement;

+

+    var selection = window.getSelection();

+    var range = document.createRange();

+    selection.addRange(range);

+    range.selectNode(iframeDocumentRoot);

+    selection.addRange(range);

+    iframeDocument.removeChild(iframeDocumentRoot);

+}

+</script>

+</head>

+<body>

+Test passes if it does not crash.

+<iframe id="iframe1" onload="runTest()"></iframe>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/re-enter-and-crash.html b/tests/tests/webkitsecurity/assets/re-enter-and-crash.html
new file mode 100644
index 0000000..563c6fa
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/re-enter-and-crash.html
@@ -0,0 +1,7 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+alert("This test pases if it doesn't crash.");
+</script>
+xxx<iframe onload="document.write('<iframe onload=&quot;document.write(\'<script>\');document.close();&quot;></iframe>');">yyy
diff --git a/tests/tests/webkitsecurity/assets/recalc-section-first-body-crash-main.html b/tests/tests/webkitsecurity/assets/recalc-section-first-body-crash-main.html
new file mode 100644
index 0000000..371986c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/recalc-section-first-body-crash-main.html
@@ -0,0 +1,11 @@
+<html>
+    <body>
+        PASS
+        <iframe width="0" height="0" src="resources/recalc-section-first-body-crash.html"></iframe>
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+        </script>
+    </body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/recalc-section-first-body-crash.html b/tests/tests/webkitsecurity/assets/recalc-section-first-body-crash.html
new file mode 100644
index 0000000..ddacc14
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/recalc-section-first-body-crash.html
@@ -0,0 +1,48 @@
+<html>
+    <body onload="runTest();">
+        <junk>a</junk>
+        <junk>a</junk>
+        <junk id="test1" style="display: -webkit-box; visibility: collapse;">
+            <iframe>a</iframe><junk style="display: table-row-group;">a</junk>
+        </junk>
+        <div>a</div><junk></junk>
+        <div id="test2" style="display: table-cell;"></div>
+
+        <script type="text/javascript">
+            function reference(domNode)
+            {
+                this.domNode = domNode;
+            }
+
+            function walk(arr, currentPrefix, index, domNode)
+            {
+                if (domNode == null)
+                    return;
+                newPrefix = currentPrefix + "_" + index;
+                walk(arr, currentPrefix, index + 1, domNode.nextSibling);
+                walk(arr, newPrefix, 0, domNode.firstChild);
+                arr[newPrefix] = new reference(domNode);
+            }
+
+            function removeAll()
+            {
+                var arr = new Array();
+                walk(arr, "", 0, document.body);
+                for (key in arr) {
+                    arr[key].domNode.parentNode.removeChild(arr[key].domNode);
+                    if (document.body)
+                        document.body.offsetTop;
+                }
+            }
+
+            function runTest()
+            {
+                var test1 = document.getElementById('test1');
+                test1.parentNode.removeChild(test1);
+                var test2 = document.getElementById('test2');
+                test2.appendChild(test1);
+                removeAll();
+            }
+        </script>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/recursive-before-unload-crash.html b/tests/tests/webkitsecurity/assets/recursive-before-unload-crash.html
new file mode 100644
index 0000000..bb4f0d8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/recursive-before-unload-crash.html
@@ -0,0 +1,47 @@
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+}
+
+var haveAddedIFrame = false;
+
+window.onbeforeunload = function() {
+    if (!haveAddedIFrame)
+        alert("onbeforeunload called, and iframe hasn't been added yet.");
+    var a = document.createEvent("MouseEvents");
+    a.initEvent("click", true, true);
+    var d = document.createElement("a");
+    d.href = "http://localhost:1234/";
+    d.dispatchEvent(a);
+}
+
+function clicked() {
+    window.location.href="http://127.0.0.1:1234/";
+}
+
+function addiframe() {
+    alert("Adding iframe");
+    var frame = document.createElement("iframe");
+    frame.src = "http://localhost:1234/"
+    document.body.appendChild(frame);
+    haveAddedIFrame = true;
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function runTest() {
+   clicked();
+   setTimeout("addiframe();", 0);
+}
+
+</script>
+<body onload="runTest();">
+This test demonstrates a problem with our handling of the beforeunload event.<br>
+If a script manages to try and navigate the frame from beforeunload - when a navigation is already pending - we end up blowing out the stack by recursively consulting the policy delegate then running onbeforeunload repeatedly.<br>
+After this happens, the FrameLoader is in a bogus state where it thinks it is in the middle of a provisional load, but it doesn't have a provisional document loader.<br>
+In this state, the frame is very difficult to navigate anywhere else, and attempts to load new things within the frame can result in a crash.<br>
+This was reproducibly identified on sears.com following a bizarre Safari specific code path.<br>
+<a href="javascript:void(clicked())">Click here to run the beforeunload test and blow out the stack</a><br>
+<a href="javascript:void(addiframe())">Click here to append an iframe and crash</a><br>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/redirect-with-no-location-crash.html b/tests/tests/webkitsecurity/assets/redirect-with-no-location-crash.html
new file mode 100644
index 0000000..352c937
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/redirect-with-no-location-crash.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+    <title>Test for https://bugs.webkit.org/show_bug.cgi?id=29293</title>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<body>
+  <iframe src="resources/redirect-with-no-location-crash.php"></iframe>
+</body>
+<html>
diff --git a/tests/tests/webkitsecurity/assets/redirect-with-no-location-crash.php b/tests/tests/webkitsecurity/assets/redirect-with-no-location-crash.php
new file mode 100644
index 0000000..3d62c30
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/redirect-with-no-location-crash.php
@@ -0,0 +1,3 @@
+<?php
+header("HTTP/1.0 302 Found");
+?>
diff --git a/tests/tests/webkitsecurity/assets/reflected-img-crash.html b/tests/tests/webkitsecurity/assets/reflected-img-crash.html
new file mode 100644
index 0000000..6b0b186
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/reflected-img-crash.html
@@ -0,0 +1,43 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+   "http://www.w3.org/TR/html4/loose.dtd">
+
+<html lang="en">
+<head>
+  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+  <title>Reflections</title>
+  <style type="text/css" media="screen">
+
+    img {
+      position: absolute;
+      height: 100px;
+      width: 200px;
+      border: 1px solid black;
+      -webkit-box-reflect: below;
+    }
+    
+    img.unreflected {
+      -webkit-box-reflect: none;
+    }
+
+  </style>
+  <script type="text/javascript" charset="utf-8">
+    
+    if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+
+    function runTest()
+    {
+      var image = document.getElementById('image');
+      image.className = 'unreflected';
+    }
+    
+    window.addEventListener('load', runTest, false);
+  </script>
+</head>
+<body>
+
+  <p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=28289">https://bugs.webkit.org/show_bug.cgi?id=28289</a>. Should not crash.</p>
+  <img id="image">
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/regexp-charclass-crash.html b/tests/tests/webkitsecurity/assets/regexp-charclass-crash.html
new file mode 100644
index 0000000..3a600a8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/regexp-charclass-crash.html
@@ -0,0 +1,13 @@
+<p>Tests a crash in the regular expression engine. If this test prints a PASS message, then it succeeded.</p>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+var string = "";
+for (i = 0; i < 1000; ++i)
+    string += "[[**]]";
+while (string.length < 8192) {
+    string += "[[**]]";
+    new RegExp(string);
+}
+document.writeln("<div>PASS: Got to pattern length of 8192 without crashing.</div>");
+</script>
diff --git a/tests/tests/webkitsecurity/assets/regexp-compile-crash.html b/tests/tests/webkitsecurity/assets/regexp-compile-crash.html
new file mode 100644
index 0000000..d8773b5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/regexp-compile-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/regexp-compile-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/regexp-compile-crash.js b/tests/tests/webkitsecurity/assets/regexp-compile-crash.js
new file mode 100644
index 0000000..887413a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/regexp-compile-crash.js
@@ -0,0 +1,10 @@
+description("Test regexp compiling to make sure it doens't crash like bug 16127");
+
+shouldBeTrue('!!/\\)[;\s]+/');
+shouldThrow('/[/');
+shouldThrow('/[a/');
+shouldThrow('/[-/');
+shouldBeTrue('!!/(a)\1/');
+shouldBeTrue('!!/(a)\1{1,3}/');
+
+testPassed("No crashes, yay!")
diff --git a/tests/tests/webkitsecurity/assets/regexp-extended-characters-crash.html b/tests/tests/webkitsecurity/assets/regexp-extended-characters-crash.html
new file mode 100644
index 0000000..96c38a2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/regexp-extended-characters-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/regexp-extended-characters-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/regexp-extended-characters-crash.js b/tests/tests/webkitsecurity/assets/regexp-extended-characters-crash.js
new file mode 100644
index 0000000..f987df5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/regexp-extended-characters-crash.js
@@ -0,0 +1,13 @@
+description(
+'This test checks for a regression against <a href="rdar://problem/4161606">JavaScript regular expressions with certain ranges of Unicode characters cause a crash</a>. If it fails, it may crash.'
+);
+
+
+// test ranges reported in bug	
+shouldBe('new RegExp("[\u00c0-\u1f4d]").toString()', '/[\u00c0-\u1f4d]/.toString()');
+shouldBe('new RegExp("[\u3041-\u3094]").toString()', '/[\u3041-\u3094]/.toString()');
+shouldBe('new RegExp("[\u4d00-\u4db5]").toString()', '/[\u4d00-\u4db5]/.toString()');
+shouldBe('new RegExp("[\u4e00-\u9fa5]").toString()', '/[\u4e00-\u9fa5]/.toString()');
+
+// test first char < 255, last char > 255
+shouldBe('new RegExp("[\u0001-\u1f4d]").toString()', '/[\u0001-\u1f4d]/.toString()');
diff --git a/tests/tests/webkitsecurity/assets/region-range-for-box-crash.html b/tests/tests/webkitsecurity/assets/region-range-for-box-crash.html
new file mode 100644
index 0000000..99d850d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/region-range-for-box-crash.html
@@ -0,0 +1,42 @@
+<!doctype html>
+<html>
+    <head>
+        <style>
+            #el0 {
+                -webkit-flow-from: a;
+                content: counter(c);
+            }
+            #el2 {
+                -webkit-flow-into: a;
+            }
+        </style>
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            function crash() {
+                el0 = document.createElement('div');
+                el0.setAttribute('id', 'el0');
+                document.body.appendChild(el0);
+                el1 = document.createElement('div');
+                document.body.appendChild(el1);
+                el2 = document.createElement('div');
+                el2.setAttribute('id', 'el2');
+                el1.appendChild(el2);
+                el2.appendChild(document.createTextNode('A'));
+                el3 = document.createElement('input');
+                el3.setAttribute('id', 'el3');
+                el2.appendChild(el3);
+                document.body.style.zoom=2;
+                document.execCommand('selectall');
+                el2.style.display='table-header-group';
+                document.body.style.zoom=1;
+            }
+            window.onload=crash
+        </script>
+    </head>
+    <body>
+        <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=74781">74781</a>: Crash in RenderFlowThread::getRegionRangeForBox</p>
+        <p> This test PASSES if it does not CRASH or ASSERT.</p>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/relative-position-replaced-in-table-display-crash.html b/tests/tests/webkitsecurity/assets/relative-position-replaced-in-table-display-crash.html
new file mode 100755
index 0000000..1a1ace5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/relative-position-replaced-in-table-display-crash.html
@@ -0,0 +1,32 @@
+<html>

+<style type="text/css">

+.firstDivStyle + .secondDivStyle { display: table-footer-group;  }

+.rubyStyle { position: relative; }

+.secondDivStyle { -webkit-appearance: button; }

+.posAbsolute { position: absolute; }

+</style>

+<script type="text/javascript">

+function dumpTest() {

+    layoutTestController.notifyDone();

+}

+function runTest() {

+    document.getElementById('ruby').innerHTML = '<audio controls="controls" id="aud" src="blah.ogg" class="posAbsolute"></audio>';

+    height = document.body.clientHeight; // Force layout

+    document.body.removeChild(document.getElementById('remove')); // Cause anonymous blocks containing 'secondDivStyle' and 'ruby' to be merged

+    document.getElementById('aud').style.color = "blue"; // Force style recalc

+    setTimeout('dumpTest()', 10);

+    if (window.layoutTestController) {

+        layoutTestController.waitUntilDone();

+	layoutTestController.dumpAsText();

+    }

+}

+window.onload = runTest;

+</script>

+<body>

+PASS, if no exception or crash in debug

+  <div class="firstDivStyle"></div>

+  <div class="secondDivStyle"></div>

+  <div id="remove"></div>

+  <ruby id="ruby" class="rubyStyle"></ruby>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/relative-positioned-rtl-crash.html b/tests/tests/webkitsecurity/assets/relative-positioned-rtl-crash.html
new file mode 100644
index 0000000..9e300a3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/relative-positioned-rtl-crash.html
@@ -0,0 +1,9 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<body style="direction: rtl;">
+    <div style="display: inline-block; width: 100px; position: relative; height: 10px;">
+        <img style="position: absolute;"/>
+    </div>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/relayout-nested-positioned-elements-crash.html b/tests/tests/webkitsecurity/assets/relayout-nested-positioned-elements-crash.html
new file mode 100644
index 0000000..85d981a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/relayout-nested-positioned-elements-crash.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+<script src="../../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<div style="position:absolute">
+    <span style="position:relative">
+        <div style="position:absolute">
+            <input id="hideMe"/>
+        </div>
+    </span>
+</div>
+<script>
+description("This tests that we don't cause an assertion failure on relayout of nested positioned elements. This test pass if we don't cause an assertion failure.");
+window.jsTestIsAsync = true;
+
+window.setTimeout(runTest, 0); // For some reason we need the setTimeout() for this test to work.
+function runTest()
+{
+    document.getElementById("hideMe").style.display = "none";
+    window.setTimeout(finalizeTest, 0);
+}
+
+function finalizeTest()
+{
+    shouldBeEqualToString('document.getElementById("hideMe").style.display', 'none');
+    finishJSTest();
+}
+</script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/reload-crash-iframe.html b/tests/tests/webkitsecurity/assets/reload-crash-iframe.html
new file mode 100644
index 0000000..f83d921
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/reload-crash-iframe.html
@@ -0,0 +1,16 @@
+<html>
+<head>
+<script src="../../../../../js-test-resources/js-test-pre.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+<script type="text/javascript">
+var reloadCount = parent.document.iframeReady();
+if (!reloadCount) {
+    var ws = new WebSocket("ws://127.0.0.1:8880/websocket/tests/hybi/close-on-unload");
+    location.reload();
+}
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/reload-crash.html b/tests/tests/webkitsecurity/assets/reload-crash.html
new file mode 100644
index 0000000..5d6026b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/reload-crash.html
@@ -0,0 +1,39 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../../../js-test-resources/js-test-pre.js"></script>
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+<script type="text/javascript">
+description("Test if it doesn't crash when reloading while Web Socket is busy");
+
+window.jsTestIsAsync = true;
+if (window.layoutTestController)
+    layoutTestController.overridePreference("WebKitHixie76WebSocketProtocolEnabled", 0);
+
+var frameDiv;
+var reloadCount = 0;
+
+document.iframeReady = function ()
+{
+    if (reloadCount == 0)
+        debug("PASS iframe is ready.");
+    else if (reloadCount == 1) {
+        debug("PASS reloaded iframe while WebSocket is busy");
+        finishJSTest();
+    } else
+        testFailed("iframe should not get reloaded more than once. (reloadCount = " + reloadCount + ")");
+    return reloadCount++;
+};
+
+frameDiv = document.createElement("iframe");
+frameDiv.src = "resources/reload-crash-iframe.html";
+document.body.appendChild(frameDiv);
+debug("PASS insert a iframe");
+
+</script>
+<script src="../../../../js-test-resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/removal-before-attach-crash.html b/tests/tests/webkitsecurity/assets/removal-before-attach-crash.html
new file mode 100644
index 0000000..4ff8ce8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/removal-before-attach-crash.html
@@ -0,0 +1,35 @@
+<body onload="test(); crash();">
+    <div id="parent"></div>
+    <script>
+        var parent = document.getElementById("parent");
+
+        function test()
+        {
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            var script = document.createElement("script");
+            script.appendChild(document.createTextNode("document.body.removeChild(parent);"));
+            var iframe = document.createElement("iframe");
+            var container = document.createElement("div");
+            container.appendChild(script);
+            container.appendChild(iframe);
+            parent.appendChild(container);
+            parent = null;
+        }
+
+        function crash()
+        {
+            if (window.GCController) {
+                GCController.collect();
+                document.body.appendChild(document.createElement("div"));
+            }
+        }
+    </script>
+    <p>
+        Test for <a href="http://bugs.webkit.org/show_bug.cgi?id=13792">bug 13792</a>.
+    </p>
+    <p>
+        To test manually, close this Safari window, click the &ldquo;Garbage Collect JavaScript Objects&rdquo; button in the Caches window, and then open a new Safari window. The browser should not crash.
+    </p>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/removal-of-multicol-span-crash.html b/tests/tests/webkitsecurity/assets/removal-of-multicol-span-crash.html
new file mode 100755
index 0000000..fca19f5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/removal-of-multicol-span-crash.html
@@ -0,0 +1,24 @@
+<style>
+body { -webkit-column-width: 0; }
+#container { position: relative; }
+.hardware:last-of-type { -webkit-column-span: all; }
+</style>
+
+<script>
+    function clear() {
+        document.documentElement.removeChild(document.body);
+        document.documentElement.innerHTML='PASS, if no exception or crash';
+        if (window.layoutTestController) {
+            layoutTestController.notifyDone();
+        }
+    }
+    setTimeout("clear();", 0);
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+    }
+</script>
+<body>
+<div id="container">
+    <div class="hardware box">
+</body>
diff --git a/tests/tests/webkitsecurity/assets/remove-all-children-crash.html b/tests/tests/webkitsecurity/assets/remove-all-children-crash.html
new file mode 100644
index 0000000..e40fce0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-all-children-crash.html
@@ -0,0 +1,39 @@
+<body>
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=28697">bug 28697</a>.</p>
+<div id="div"><p id="one"></p><p id="two">FAIL, the test did not start.</p></div>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function gc() {
+    if (typeof GCController !== "undefined")
+        GCController.collect();
+    else {
+        function gcRec(n) {
+            if (n < 1)
+                return {};
+            var temp = {i: "ab" + i + (i / 100000)};
+            temp += "foo";
+            gcRec(n-1);
+        }
+        for (var i = 0; i < 1000; i++)
+            gcRec(10)
+    }
+}
+
+var div = document.getElementById("div");
+var two = document.getElementById("two");
+var range = document.createRange();
+range.setStart(two, 0);
+range.setEnd(two, 0);
+
+div.innerHTML = "FAIL, the test did not complete.";
+
+gc();
+
+range.startOffset;
+div.innerHTML = "PASS, the test did not crash.";
+if (window.layoutTestController) {
+    layoutTestController.notifyDone();
+}
+</script>
diff --git a/tests/tests/webkitsecurity/assets/remove-div-from-flexible-box-with-floating-after-content-crash.html b/tests/tests/webkitsecurity/assets/remove-div-from-flexible-box-with-floating-after-content-crash.html
new file mode 100644
index 0000000..14ed364
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-div-from-flexible-box-with-floating-after-content-crash.html
@@ -0,0 +1,18 @@
+<style>
+.c1::after { float: left; content: open-quote; }
+.c1:first-letter { display: table-column; }
+.c1[class~="c1"] { display: -webkit-inline-box; }
+</style>
+<script>
+var parentDiv = document.createElement('div');
+var childDiv = document.createElement('div');
+
+parentDiv.setAttribute('class', 'c1');
+document.documentElement.appendChild(parentDiv);
+parentDiv.appendChild(childDiv);
+parentDiv.appendChild(document.createTextNode('PASS if no exception or crash'));
+document.documentElement.offsetHeight; // forces a layout
+parentDiv.removeChild(childDiv);
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/remove-element-from-within-focus-handler-crash.html b/tests/tests/webkitsecurity/assets/remove-element-from-within-focus-handler-crash.html
new file mode 100644
index 0000000..4b48a41
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-element-from-within-focus-handler-crash.html
@@ -0,0 +1,14 @@
+<select id="bomb" onfocus="this.parentNode.removeChild(this)">
+    <option>Clicking on this select element should not crash</option>
+</select>
+<h2>Layout test for <a href='https://bugs.webkit.org/show_bug.cgi?id=23858'>bug 23858</a></h2>
+<p>If this page is displayed without crashing then the test has passed.</p>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var select = document.getElementById('bomb');
+    var mouseEvent = document.createEvent("MouseEvents");
+    mouseEvent.initMouseEvent("mousedown", true, true, document.defaultView, 1, select.offsetLeft + 1, select.offsetTop + 1, select.offsetLeft + 1, select.offsetTop + 1, false, false, false, false, 0, document);
+    select.dispatchEvent(mouseEvent);
+</script>
diff --git a/tests/tests/webkitsecurity/assets/remove-format-non-html-element-crash.html b/tests/tests/webkitsecurity/assets/remove-format-non-html-element-crash.html
new file mode 100644
index 0000000..8b1396c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-format-non-html-element-crash.html
@@ -0,0 +1,18 @@
+<html>

+<body>

+Test passes if it does not crash.

+<div id="test" contenteditable="true">

+<ins><math>ABCD</math></ins>

+</div>

+<script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+

+    var test = document.getElementById("test");

+    test.focus();

+    document.execCommand("SelectAll");

+    document.execCommand("RemoveFormat");

+    document.body.removeChild(test);

+</script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/remove-frame-with-scrollbars-crash.html b/tests/tests/webkitsecurity/assets/remove-frame-with-scrollbars-crash.html
new file mode 100644
index 0000000..6e683f9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-frame-with-scrollbars-crash.html
@@ -0,0 +1,25 @@
+<p>This test checks for a crash when removing an iframe with scrollbars from a document. See &lt;rdar://problem/5061807&gt;.</p>
+<p>If the test passes, you'll see a PASS message below.</p>
+<hr>
+<pre id="console"></pre>
+<iframe id="iframe" src="data:text/html,<body style='overflow-x: hidden'><div style='height:1000px'</body>" style="width:152px; height:300px"></iframe>
+
+<script>
+function log(s)
+{
+    document.getElementById("console").appendChild(document.createTextNode(s));
+}
+
+var iframe = document.getElementById("iframe");
+
+function destroyIframe()
+{
+    iframe.parentNode.removeChild(iframe);
+    log("PASS: Yout didn't crash.");
+    layoutTestController.notifyDone();
+}
+
+iframe.onload = function() { setTimeout(destroyIframe, 0); }
+layoutTestController.dumpAsText();
+layoutTestController.waitUntilDone();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/remove-iframe-crash.html b/tests/tests/webkitsecurity/assets/remove-iframe-crash.html
new file mode 100644
index 0000000..7d83299
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-iframe-crash.html
@@ -0,0 +1,44 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+  <style type="text/css" media="screen">
+    iframe {
+        border: 10px solid black;
+        padding: 5px;
+        margin: 20px;
+        height: 150px;
+        width: 300px;
+        -webkit-box-shadow: 0 0 20px black;
+        -webkit-transform: translateZ(0);
+    }
+
+    .overlay {
+      position: absolute;
+      width: 50px;
+      height: 50px;
+      top: 5px;
+      left: 5px;
+      background-color: rgba(0, 0, 0, 0.2);
+    }
+  </style>
+  <script type="text/javascript" charset="utf-8">
+    if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+
+    function doTest()
+    {
+      var iframe = document.getElementsByTagName('iframe')[0];
+      iframe.parentNode.removeChild(iframe);
+    }
+    
+    window.addEventListener('load', doTest, false);
+  </script>
+</head>
+<body>
+  
+  <iframe src="resources/composited-subframe.html"></iframe>
+  <div class="overlay"></div>
+  <p>This test should not crash.</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/remove-listmarker-from-anonblock-with-continuation-crash.html b/tests/tests/webkitsecurity/assets/remove-listmarker-from-anonblock-with-continuation-crash.html
new file mode 100644
index 0000000..61b6430
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-listmarker-from-anonblock-with-continuation-crash.html
@@ -0,0 +1,25 @@
+<style>
+.listItem { display: list-item; text-decoration: none; -webkit-column-width: 10px; }
+.colSpanAll { display: block; -webkit-column-span: all; }
+.absPosition { display: inherit; position: absolute; }
+</style>
+<script>
+theadElement = document.createElement('thead');
+theadElement.setAttribute('class', 'listItem');
+document.documentElement.appendChild(theadElement);
+
+listItemElement = document.createElement('li');
+listItemElement.appendChild(document.createTextNode('PASS if no crash or assert in debug'));
+
+theadElement.appendChild(listItemElement);
+theadElement.appendChild(document.createElement('progress'));
+theadElement.appendChild(document.createElement('hgroup'));
+
+document.documentElement.offsetHeight;
+listItemElement.setAttribute('class', 'absPosition');
+document.documentElement.offsetHeight;
+listItemElement.setAttribute('class', 'colSpanAll');
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/remove-named-attribute-crash.html b/tests/tests/webkitsecurity/assets/remove-named-attribute-crash.html
new file mode 100644
index 0000000..b1b51c2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-named-attribute-crash.html
@@ -0,0 +1,10 @@
+<p>Test for <a href="http://bugs.webkit.org/show_bug.cgi?id=17876">Bug 17876: REGRESSION (r31060): Attempting to visit Ofcom page causes crash</a>.</p>
+<p>Loading this page should not cause a crash.</p>
+
+<button disabled>PASS</button>
+<script>
+    document.getElementsByTagName('button')[0].disabled = false;
+
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/remove-reflection-crash.html b/tests/tests/webkitsecurity/assets/remove-reflection-crash.html
new file mode 100644
index 0000000..b2a048f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-reflection-crash.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+  <style>
+    .box {
+      width: 100px;
+      height: 100px;
+      background-color: blue;
+    }
+    
+    #reflected {
+      position: relative;
+      z-index: 0;
+      -webkit-box-reflect: below 10px;
+    }
+    
+    .child {
+      position: absolute;
+      z-index: 1;
+    }
+  </style>
+  <script>
+    if (window.layoutTestController) {
+      layoutTestController.waitUntilDone();
+      layoutTestController.dumpAsText();
+    }
+
+    function doTest()
+    {
+      window.setTimeout(function() {
+        var reflection = document.getElementById('reflected');
+        var targetContainer = document.getElementById('container');
+        targetContainer.appendChild(reflection);
+        if (window.layoutTestController)
+          layoutTestController.notifyDone();
+      }, 0);
+    }
+    window.addEventListener('load', doTest, false);
+  </script>
+</head>
+<body>
+  <p>This test should not crash when run with MallocScribble enabled.</p>
+  <div id="reflected" class="box">
+    <div class="child box"></div>
+  </div>
+  <div id="container"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/remove-remote-context-in-error-callback-crash-inner.html b/tests/tests/webkitsecurity/assets/remove-remote-context-in-error-callback-crash-inner.html
new file mode 100644
index 0000000..82b366b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-remote-context-in-error-callback-crash-inner.html
@@ -0,0 +1,14 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+  <head>
+    <script>
+      function init() {
+          if (window.layoutTestController)
+              layoutTestController.setGeolocationPermission(false);
+          window.parent.onIframeReady()
+      }
+    </script>
+  </head>
+  <body onload="init()">
+  </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/remove-remote-context-in-error-callback-crash.html b/tests/tests/webkitsecurity/assets/remove-remote-context-in-error-callback-crash.html
new file mode 100644
index 0000000..62a1578
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-remote-context-in-error-callback-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/remove-remote-context-in-error-callback-crash.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/remove-remote-context-in-error-callback-crash.js b/tests/tests/webkitsecurity/assets/remove-remote-context-in-error-callback-crash.js
new file mode 100644
index 0000000..8743941
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-remote-context-in-error-callback-crash.js
@@ -0,0 +1,30 @@
+description("Tests that we do not crash when a Geolocation request is made from a remote frame, which is then removed from the DOM in the error callback.");
+
+function gc() {
+    if (window.GCController) {
+        GCController.collect();
+        return;
+    }
+
+    for (var i = 0; i < 10000; i++)
+        new String(i);
+}
+
+function onIframeReady() {
+    // Make request from remote frame
+    iframe.contentWindow.navigator.geolocation.getCurrentPosition(function() {
+        testFailed('Success callback invoked unexpectedly');
+        finishJSTest();
+    }, function() {
+        testPassed('Error callback invoked.');
+        document.body.removeChild(iframe);
+        gc();
+        finishJSTest();
+    });
+}
+
+var iframe = document.createElement('iframe');
+iframe.src = 'resources/remove-remote-context-in-error-callback-crash-inner.html';
+document.body.appendChild(iframe);
+
+window.jsTestIsAsync = true;
diff --git a/tests/tests/webkitsecurity/assets/remove-shadow-host-crash.html b/tests/tests/webkitsecurity/assets/remove-shadow-host-crash.html
new file mode 100644
index 0000000..4c91104
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-shadow-host-crash.html
@@ -0,0 +1,35 @@
+<html>
+<head>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function mouseOver(element)
+{
+    if (!window.eventSender)
+        return;
+
+    var x = element.offsetLeft + element.offsetWidth / 2;
+    var y = element.offsetTop + element.offsetHeight / 2;
+    eventSender.mouseMoveTo(x, y);
+}
+
+function runTest()
+{
+    var area = document.getElementById('area');
+    mouseOver(area);
+    area.innerHTML = '';
+    mouseOver(document.getElementById('description'));
+}
+
+</script>
+</head>
+<body onload="runTest()">
+    <p id="description">Ensures that a "mouseout" event, fired on shadow DOM element of a destroyed host element doesn't crash the browser.
+    <p>Passes if doesn't crash.
+    <div id="area" style="width:100px;height:100px">
+        <textarea style="width:100px;height:100px">Foo</textarea>
+    </div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/remove-timeout-crash.html b/tests/tests/webkitsecurity/assets/remove-timeout-crash.html
new file mode 100644
index 0000000..9569099
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/remove-timeout-crash.html
@@ -0,0 +1,19 @@
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=23007">bug 23007</a>:
+Timer-related crash when closing Web Inspector.</p>
+<p>PASS if no crash.</p>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+}
+
+var timeoutID;
+function test()
+{
+    clearTimeout(timeoutID);
+    if (window.layoutTestController)
+        setTimeout(function() { layoutTestController.notifyDone() }, 0);
+}
+
+timeoutID = setTimeout(test, 0);
+</script>
diff --git a/tests/tests/webkitsecurity/assets/removed-anonymous-block-child-causes-crash.html b/tests/tests/webkitsecurity/assets/removed-anonymous-block-child-causes-crash.html
new file mode 100644
index 0000000..85c733c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/removed-anonymous-block-child-causes-crash.html
@@ -0,0 +1,52 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">

+<html>

+<head>

+<script>

+

+    function removeElement() {

+        document.getElementById('div').removeChild(document.getElementById('div').children[2]);

+    }

+

+    function queryIsEnabledOnDecendants(accessibilityObject) {

+        accessibilityObject.isEnabled

+

+        var count = accessibilityObject.childrenCount;

+        for (var i = 0; i < count; ++i)

+            queryIsEnabledOnDecendants(accessibilityObject.childAtIndex(i));

+    }

+</script>

+<script src="../fast/js/resources/js-test-pre.js"></script>

+</head>

+<body>

+

+<div id="div">

+  <span>

+    <div>a</div>

+  </span>

+  <div style="float:left">a</div>

+  <span title="title">b</span>

+</div>

+

+<p id="description"></p>

+<div id="console"></div>

+

+<script>

+    description("In certain cases removing a decendent from an anonymous block element does not update the parent chain correctly. This can cause a crash.");

+

+    if (window.accessibilityController) {

+        // First build up full accessibility tree.

+        document.body.focus();

+        queryIsEnabledOnDecendants(accessibilityController.focusedElement);

+        

+        removeElement()

+        

+        // Now call isEnabled on each accessibility object.

+        document.body.focus();

+        queryIsEnabledOnDecendants(accessibilityController.focusedElement);

+    }

+

+</script>

+

+<script src="../fast/js/resources/js-test-post.js"></script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/removed-continuation-element-causes-crash.html b/tests/tests/webkitsecurity/assets/removed-continuation-element-causes-crash.html
new file mode 100644
index 0000000..dc1f37e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/removed-continuation-element-causes-crash.html
@@ -0,0 +1,45 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script>
+
+function removeElement() {
+   document.getElementById("h3").parentNode.removeChild(document.getElementById("h3"));
+}
+
+</script>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+
+<A href="#" tabindex=0 id="link">
+<h3 id="h3">asdfasdf</h3>
+<img src="asdf.gif" width=100 height=100>
+asdfasdf
+</a>
+
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("When you have elements that are continuations, and one of those elements is removed, the parent chain is not being updated accordingly. This can cause a crash.");
+
+    if (window.accessibilityController) {
+
+        document.getElementById("link").focus();
+        var link = accessibilityController.focusedElement;
+        link.attributesOfChildren();
+
+        removeElement();
+
+        // should not cause a crash...
+        link.attributesOfChildren();
+    }
+
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/removed-media-rule-deleted-parent-crash.html b/tests/tests/webkitsecurity/assets/removed-media-rule-deleted-parent-crash.html
new file mode 100644
index 0000000..6459558
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/removed-media-rule-deleted-parent-crash.html
@@ -0,0 +1,44 @@
+<html>

+<head>

+<script>

+if (window.layoutTestController)

+{

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+function runTest()

+{

+    style = document.createElement('style');

+    style.textContent = '@media all { body { color: red } }';

+    document.head.appendChild(style);

+ 

+    ruleList = getMatchedCSSRules(document.body);

+ 

+    document.styleSheets[0].cssRules[0].deleteRule(0);

+    document.head.removeChild(style);

+    

+    gc();

+

+    if (!ruleList[0].parentStyleSheet)

+        document.getElementById('result').innerHTML = "PASS";

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+

+function gc()

+{

+    if (window.GCController)

+        return GCController.collect();

+

+    for (var i = 0; i < 10000; i++) { // > force garbage collection (FF requires about 9K allocations before a collect)

+        var s = new String("abc");

+    }

+}

+</script>

+</head>

+<body onload="runTest()">

+<div id="result"></div>

+</body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/removed-stylesheet-rule-deleted-parent-crash.html b/tests/tests/webkitsecurity/assets/removed-stylesheet-rule-deleted-parent-crash.html
new file mode 100644
index 0000000..0523c50
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/removed-stylesheet-rule-deleted-parent-crash.html
@@ -0,0 +1,44 @@
+<html>

+<head>

+<script>

+if (window.layoutTestController)

+{

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+function runTest()

+{

+    style = document.createElement('style');

+    style.textContent = 'body { color: red }';

+    document.head.appendChild(style);

+  

+    ruleList = getMatchedCSSRules(document.body);

+  

+    document.styleSheets[0].deleteRule(0);

+    document.head.removeChild(style);

+

+    gc();

+

+    if (!ruleList[0].parentStyleSheet)

+        document.getElementById('result').innerHTML = "PASS";

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+

+function gc()

+{

+    if (window.GCController)

+        return GCController.collect();

+

+    for (var i = 0; i < 10000; i++) { // > force garbage collection (FF requires about 9K allocations before a collect)

+        var s = new String("abc");

+    }

+}

+</script>

+</head>

+<body onload="runTest()">

+<div id="result"></div>

+</body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/removing-inside-relpositioned-inline-crash.html b/tests/tests/webkitsecurity/assets/removing-inside-relpositioned-inline-crash.html
new file mode 100644
index 0000000..ec701ab
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/removing-inside-relpositioned-inline-crash.html
@@ -0,0 +1,27 @@
+<html>
+    <body onload="runTest()">
+        <style>
+            a { position: relative; }
+            span { position: absolute; }
+        </style>
+        <script>
+            if (window.layoutTestController)
+                layoutTestController.dumpAsText();
+
+            function runTest()
+            {
+                document.body.offsetTop;
+                child = document.getElementById('test');
+                child.parentNode.removeChild(child);
+                document.body.offsetTop;
+                document.body.innerHTML = 'PASS';
+            }
+        </script>
+        <script></script>
+        <div><a><span>
+            <table id="test">
+            <isindex>
+        </span></a></div>
+    </body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/removing-textarea-after-edit-crash.html b/tests/tests/webkitsecurity/assets/removing-textarea-after-edit-crash.html
new file mode 100644
index 0000000..ed6b8dd
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/removing-textarea-after-edit-crash.html
@@ -0,0 +1,61 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<div class="hidden" id="div">
+
+<div>
+<textarea placeholder="hello" id="textarea">a</textarea>
+text
+</div>
+
+<input type="text" id="textfield">
+
+</div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+    description("This tests that when an element is removed from the DOM while a notification referencing it is pending, it will not crash.");
+
+    // Triggering this is quite complicated, because the ValueChange notification needs to be the one to trigger the layoutUpdate
+    // Sending the XMLHttpRequest after a timeout and then having a handler set the display: NONE, seems to do it.
+    function processStateChange() {
+        if (req.readyState == 4) {
+            document.getElementById("textarea").value = "";
+            document.getElementById("div").style.display = "NONE";
+
+            // we now have to wait for the value change to be propagated to trigger the crash.
+            setTimeout("window.layoutTestController.notifyDone();", 1);
+        }
+    }
+</script>
+
+<script>
+    var req = 0;
+    if (window.accessibilityController) {  
+        window.layoutTestController.waitUntilDone();
+        document.getElementById("body").focus();
+        body = accessibilityController.focusedElement;
+
+        // Access the text area so that an accessibility element is created (so that it will send out notifications).        
+        body.childAtIndex(0).childAtIndex(0);
+
+        document.getElementById("textarea").focus();
+
+        req = new XMLHttpRequest;
+        req.onreadystatechange = processStateChange;
+        req.open("get", "../../../http/tests/xmlhttprequest/methods.cgi", true);
+        // Sending this after a timeout makes is so that the layout does not happen until the value change is sent.
+        setTimeout("req.send('')", 1);
+
+    }
+
+</script>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/render-text-crash.html b/tests/tests/webkitsecurity/assets/render-text-crash.html
new file mode 100644
index 0000000..3fee346
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/render-text-crash.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>To run this test manually, press arrow keys three times. WebKit should not crash. On DRT, you see see PASS:</p>
+<input type="text" onkeydown="move(this.nextSibling)"
+><input type="text" onkeydown="move(this.nextSibling)"
+><input type="text" onkeydown="move(this.nextSibling)"
+><input type="text" onkeydown="move(this.nextSibling)"
+><input type="text" onkeydown="move(this.nextSibling)"
+><input type="text" onkeydown="move(this.nextSibling)">
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var activeInput = null;
+
+function move(newInput)
+{
+    newInput.className = '';
+    newInput.style.dispaly = '';
+    newInput.focus();
+    if (activeInput)
+        activeInput.style.display = 'none';
+    activeInput = newInput;
+}
+
+var inputs = document.getElementsByTagName('input');
+move(inputs[0]);
+
+if (window.eventSender) {
+    layoutTestController.waitUntilDone();
+    for (var i = 0; i < inputs.length - 1; i++)
+        eventSender.keyDown('downArrow', []);
+    layoutTestController.notifyDone();
+}
+
+document.body.appendChild(document.createTextNode('PASS'));
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/render-tree-reorg-crash.html b/tests/tests/webkitsecurity/assets/render-tree-reorg-crash.html
new file mode 100644
index 0000000..b4b7849
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/render-tree-reorg-crash.html
@@ -0,0 +1,16 @@
+<spacer style='counter-increment: a'>

+<spacer>

+<f id='f'>

+</spacer>

+<c>

+  <spacer style='counter-increment: a'>

+</c>

+<spacer style='counter-increment: a'>

+<div id='p' style='counter-reset: a'>

+<script>

+  if (window.layoutTestController)

+    layoutTestController.dumpAsText();   

+  document.getElementById('f').appendChild(document.getElementById("p"));

+</script>

+This test passes if it does not crash.<br>

+Bug: <a href="https://bugs.webkit.org/show_bug.cgi?id=54478">54478</a>

diff --git a/tests/tests/webkitsecurity/assets/renderer-destruction-by-invalidateSelection-crash-expected.png b/tests/tests/webkitsecurity/assets/renderer-destruction-by-invalidateSelection-crash-expected.png
new file mode 100644
index 0000000..fcbc9fa
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/renderer-destruction-by-invalidateSelection-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/renderer-destruction-by-invalidateSelection-crash.html b/tests/tests/webkitsecurity/assets/renderer-destruction-by-invalidateSelection-crash.html
new file mode 100644
index 0000000..2ba0ca9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/renderer-destruction-by-invalidateSelection-crash.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+    <link rel="stylesheet" type="text/css" href="data:text/css," />
+</head>
+<body>
+    <div>
+        <input id="focusMe">
+    </div>
+    &nbsp;
+    <script>
+        document.getElementById("focusMe").focus();
+    </script>
+    <div></div>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.display();
+    </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/renderer-positioned-assert-crash.html b/tests/tests/webkitsecurity/assets/renderer-positioned-assert-crash.html
new file mode 100644
index 0000000..4336081
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/renderer-positioned-assert-crash.html
@@ -0,0 +1,17 @@
+<html>

+    <script>

+        if (window.layoutTestController)

+            layoutTestController.dumpAsText();

+    </script>

+    <style>

+        .box

+        {

+            position: absolute;

+            -webkit-columns: 1px;

+        }

+    </style>

+    <div class="box">

+        PASS

+        <video>

+    </div>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/repaint-display-none-crash.html b/tests/tests/webkitsecurity/assets/repaint-display-none-crash.html
new file mode 100644
index 0000000..38424e3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/repaint-display-none-crash.html
@@ -0,0 +1,28 @@
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    function test()
+    {
+        var t = document.getElementById('t');
+        document.body.offsetTop;
+        t.style.display='none';
+        t.src='about:blank';
+        t.contentDocument.body.offsetTop;
+        if (window.layoutTestController) {
+            layoutTestController.notifyDone();
+        }
+    }
+</script>
+<body onload="test()">
+    <p>
+        This is a test for <i><a href="https://bugs.webkit.org/show_bug.cgi?id=9862">https://bugs.webkit.org/show_bug.cgi?id=9862</a>
+        REGRESSION: GMail: Crash in RenderView::repaintViewRectangle when spoofing as FF</i>.
+    </p>
+    <p>
+        No crash means test PASS.
+    </p>
+    <iframe id="t"></iframe>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/reparent-table-children-with-counters-crash.html b/tests/tests/webkitsecurity/assets/reparent-table-children-with-counters-crash.html
new file mode 100644
index 0000000..2b10878
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/reparent-table-children-with-counters-crash.html
@@ -0,0 +1,18 @@
+<html>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+</script>

+<table>

+    <tbody>

+        <td style="counter-increment: list-item"></td>

+    </tbody>

+    <ol><ol>

+    </ol></ol>

+    <td>PASS: Reparenting nodes outside of table body does not trigger crash.</td>

+    <li></li>

+</table>

+<table>

+    <td style="counter-increment: list-item"></td>

+</table>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/replace-selection-crash-expected.png b/tests/tests/webkitsecurity/assets/replace-selection-crash-expected.png
new file mode 100644
index 0000000..29725b6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/replace-selection-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/replace-selection-crash.html b/tests/tests/webkitsecurity/assets/replace-selection-crash.html
new file mode 100644
index 0000000..7876389
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/replace-selection-crash.html
@@ -0,0 +1,32 @@
+<html>
+    <head>
+        <script>
+            function test()
+            {
+                if (window.layoutTestController)
+                    layoutTestController.dumpAsText();
+
+                document.getElementsByTagName("div")[0].focus();
+
+                var sel = window.getSelection();
+                var paragraphs = document.getElementsByTagName("p");
+                sel.setBaseAndExtent(paragraphs[0].lastChild, 0, paragraphs[0].lastChild, 2);
+                document.execCommand("InsertHTML", false, '<p>No crash!</p>');
+                sel.setBaseAndExtent(paragraphs[1].lastChild, 2, paragraphs[1].lastChild, 4);
+                document.execCommand("InsertHTML", false, '<p>No crash!</p>');
+                sel.setBaseAndExtent(paragraphs[2].lastChild, 4, paragraphs[2].lastChild, 6);
+                document.execCommand("InsertHTML", false, '<p>No crash!</p>');
+                sel.setBaseAndExtent(paragraphs[3].lastChild, 0, paragraphs[3].lastChild, 6);
+                document.execCommand("InsertHTML", false, '<p>No crash!</p>');
+            }
+        </script>
+    </head>
+    <body onload="test()">
+        <div contenteditable>
+            <p><span style="white-space: pre">    </span>select&nbsp;</p>
+            <p><span style="white-space: pre">    </span>select&nbsp;</p>
+            <p><span style="white-space: pre">    </span>select&nbsp;</p>
+            <p><span style="white-space: pre">    </span>select&nbsp;</p>
+        </div>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/replace-text-in-node-preserving-markers-crash.html b/tests/tests/webkitsecurity/assets/replace-text-in-node-preserving-markers-crash.html
new file mode 100644
index 0000000..78892ba
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/replace-text-in-node-preserving-markers-crash.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>

+<html>

+<style>

+.editing { width: 12px; }

+</style>

+<script src="../editing.js"></script>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+function editingTest() {

+    moveSelectionForwardByWordCommand();

+    moveSelectionForwardByWordCommand();

+    deleteCommand();

+    deleteCommand();

+    deleteCommand();

+    deleteCommand();

+}

+</script>

+<div contenteditable class="editing">

+<ul>PASSED<symbol id="test">abcd efg hijkl

+<script>

+runEditingTest();

+</script>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/replacement-fragment-remove-unrendered-node-crash.html b/tests/tests/webkitsecurity/assets/replacement-fragment-remove-unrendered-node-crash.html
new file mode 100644
index 0000000..bb39c7e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/replacement-fragment-remove-unrendered-node-crash.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>

+<html>

+Test passes if it does not crash.

+<input id="test" contenteditable="true">

+<script src="../editing.js"></script>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+var e = document.getElementById("test");

+var s = window.getSelection();

+

+s.setPosition(e, 10500000000);

+insertHTMLCommand("<noscript>baz");

+</script>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/resize-layer-deletion-crash.html b/tests/tests/webkitsecurity/assets/resize-layer-deletion-crash.html
new file mode 100644
index 0000000..102716c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/resize-layer-deletion-crash.html
@@ -0,0 +1,33 @@
+<html>
+<head>
+    <script>
+        function test()
+        {
+            if (!window.layoutTestController)
+                return;
+            layoutTestController.dumpAsText();
+            document.body.offsetTop;
+            eventSender.mouseMoveTo(50, 50);
+            eventSender.mouseDown();
+            eventSender.mouseMoveTo(125, 125);
+            eventSender.mouseMoveTo(135, 135);
+            eventSender.mouseUp();
+            layoutTestController.notifyDone();
+        }
+    </script>
+</head>
+<body style="margin: 0" onload="test()">
+    <div id="q" style="width: 50px; height: 50px; overflow: hidden; resize: both; border: solid;"></div>
+    <div style="position: absolute; left: 120px; top: 120px; height: 100px; width: 20px; height: 20px; background-color: blue;" onmouseover="q.style.display='none';"></div>
+    <div style="position: absolute; left: 8px; right: 8p; top: 150px;">
+        <p>
+            Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=16603">http://bugs.webkit.org/show_bug.cgi?id=16603</a>
+            Crash when resizing text field</i>.
+        </p>
+        <p>
+            Drag the bottom right corner of the black box over the blue square.
+            The black box should disappear but the browser should not crash.
+        </p>
+    </div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/resource-invalidation-crash-expected.png b/tests/tests/webkitsecurity/assets/resource-invalidation-crash-expected.png
new file mode 100644
index 0000000..14ce185
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/resource-invalidation-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/resource-invalidation-crash.svg b/tests/tests/webkitsecurity/assets/resource-invalidation-crash.svg
new file mode 100644
index 0000000..7c6b83a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/resource-invalidation-crash.svg
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<defs>
+
+    <pattern id="a" />
+    <pattern id="b" >
+        <rect  fill="url(#a)"/>
+    </pattern>
+
+    <pattern id="a" xlink:href="#b"/>
+    <pattern id="b" >
+        <rect  fill="url(#a)"/>
+    </pattern>
+
+    <pattern id="a" xlink:href="#b"/>
+        <rect  fill="url(#a)"/>
+
+</defs>
+
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/root-inlinebox-selected-children-crash-expected.png b/tests/tests/webkitsecurity/assets/root-inlinebox-selected-children-crash-expected.png
new file mode 100644
index 0000000..00197f5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/root-inlinebox-selected-children-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/root-inlinebox-selected-children-crash.html b/tests/tests/webkitsecurity/assets/root-inlinebox-selected-children-crash.html
new file mode 100644
index 0000000..2319d86
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/root-inlinebox-selected-children-crash.html
@@ -0,0 +1,19 @@
+<html>

+    <junk>

+        <blockquote>

+            Test passes if it does not crash.

+            <junk id="start">

+            </junk>

+        </blockquote>

+        <junk id="end">

+            PASS

+        </junk>

+    </junk>

+    <script>

+        if (window.layoutTestController)

+            layoutTestController.dumpAsText();

+

+        window.getSelection().setBaseAndExtent(start, 0, end, 0);

+    </script>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/root-object-premature-delete-crash-expected.png b/tests/tests/webkitsecurity/assets/root-object-premature-delete-crash-expected.png
new file mode 100644
index 0000000..680a231
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/root-object-premature-delete-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/root-object-premature-delete-crash.html b/tests/tests/webkitsecurity/assets/root-object-premature-delete-crash.html
new file mode 100644
index 0000000..7568661
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/root-object-premature-delete-crash.html
@@ -0,0 +1,64 @@
+<p>This test verifies that an Objective-C reference to a DOM object remains valid
+after the frame that provided the DOM object navigates to a new location.
+</p>
+<p>If the test passes, you'll see a 'PASS' message below.
+</p>
+<hr>
+<pre id="log"></pre>
+
+<iframe id="iframe" src="data:text/html, " style="width: 0; height: 0; visibility: hidden"></iframe>
+
+<script>
+function log(s)
+{
+    document.getElementById("log").appendChild(document.createTextNode(s));
+}
+
+var iframe = document.getElementById("iframe");
+
+var count = 0;
+
+function runTest()
+{
+    // Use a possibly stale pointer.
+    objCController.accessStoredWebScriptObject(); 
+
+    // Repeat, just to be sure.
+    if (++count < 100) { // >
+        queueTest();
+        return;
+    }
+
+    log("PASS: You didn't crash.\n");
+    layoutTestController.notifyDone();
+}
+
+function queueTest()
+{
+    iframe.onload = runTest;
+    objCController.storeWebScriptObject(count % 2 == 0 ? iframe.contentWindow : iframe.contentDocument.documentElement);
+    iframe.contentWindow.location.reload();
+}
+
+function timeoutTest()
+{
+    log("FAIL: Test timed-out after " + count + " runs.\n");
+    layoutTestController.notifyDone();
+}
+
+window.onload = function onload()
+{
+    if (!("layoutTestController" in window) || !("objCController" in window)) {
+        var errorMessage = "FAIL: This test can only run inside DumpRenderTree on the mac.";
+        log(errorMessage);
+        throw errorMessage;
+    }
+
+    timeoutIdentifier = setTimeout(timeoutTest, 30000); // timeout after 30 seconds
+
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+
+    queueTest();
+}
+</script>
diff --git a/tests/tests/webkitsecurity/assets/row-in-tbody-before-misnested-text-crash-css.html b/tests/tests/webkitsecurity/assets/row-in-tbody-before-misnested-text-crash-css.html
new file mode 100644
index 0000000..9592388
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/row-in-tbody-before-misnested-text-crash-css.html
@@ -0,0 +1,54 @@
+<html>
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.createElementNS("http://www.w3.org/1999/xhtml", "tr"), xxx);
+}
+</script>
+<style>
+.table {
+    display: table;
+}
+
+.tbody {
+    display: table-row-group;
+}
+
+.tr {
+    display: table-row;
+}
+
+.td {
+    display: table-cell;
+}
+
+</style>
+</head>
+
+<body onload="boom()">
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<div class="table" border="1">
+<div class="tbody" id="tr1"> xxx
+ <div class="tr">
+  <div class="td">Whee</div>
+ </div>
+</div>
+</div>
+
+<form id="f1">QQQ</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/row-in-tbody-before-misnested-text-crash.xhtml b/tests/tests/webkitsecurity/assets/row-in-tbody-before-misnested-text-crash.xhtml
new file mode 100644
index 0000000..5413d20
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/row-in-tbody-before-misnested-text-crash.xhtml
@@ -0,0 +1,39 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.createElementNS("http://www.w3.org/1999/xhtml", "tr"), xxx);
+}
+
+
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<table border="1">
+<tbody id="tr1"> xxx
+ <tr>
+  <td>Whee</td>
+ </tr>
+</tbody>
+</table>
+
+<form id="f1">QQQ</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/rtl-first-letter-text-iterator-crash.html b/tests/tests/webkitsecurity/assets/rtl-first-letter-text-iterator-crash.html
new file mode 100644
index 0000000..73b6c8c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/rtl-first-letter-text-iterator-crash.html
@@ -0,0 +1,31 @@
+<style>
+  #el0 {
+    visibility: collapse;
+  }
+  #el1::first-letter {
+    height: 1;
+</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function crash(){
+    el0=document.createElement('div')
+    document.body.appendChild(el0)
+    el0.setAttribute('id','el0')
+    el1=document.createElement('div')
+    document.body.appendChild(el1)
+    el1.setAttribute('id','el1')
+    el0.appendChild(document.createTextNode(unescape(Array(40).join('A')+'%ufed5')));
+    el1.appendChild(document.createTextNode(unescape('A%u074b')));
+    document.body.offsetTop;
+    setTimeout(function () {
+        document.body.innerHTML = "PASS. WebKit didn't crash.";
+        layoutTestController.notifyDone();
+    }, 0);
+}
+window.scrollTop;
+window.onload=crash
+</script>
diff --git a/tests/tests/webkitsecurity/assets/rtl-nth-child-first-letter-crash.html b/tests/tests/webkitsecurity/assets/rtl-nth-child-first-letter-crash.html
new file mode 100644
index 0000000..67c65a3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/rtl-nth-child-first-letter-crash.html
@@ -0,0 +1,11 @@
+}

+<style>

+ *:nth-child(2):first-letter {float: left;direction: rtl;

+</style>

+<p>NULL pointer crash in TextIterator::handleTextBox() when using RTL text.

+If there is no crash, then the test passes.</p>

+<script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+</script>

+<p>If you can see this, then the test passes.</p>

diff --git a/tests/tests/webkitsecurity/assets/rtl-selection-crash.html b/tests/tests/webkitsecurity/assets/rtl-selection-crash.html
new file mode 100644
index 0000000..de251e3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/rtl-selection-crash.html
@@ -0,0 +1,23 @@
+<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
+<body>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var div = document.createElement('div');
+div.contentEditable = 'true';
+div.innerHTML = "אחת ש<a id='bar'>תיים </a>שלוש";
+document.body.appendChild(div);
+div.focus();
+
+var sel = window.getSelection();
+sel.selectAllChildren(bar);
+var range = sel.getRangeAt(0);
+range.insertNode(document.createElement('span'));
+range.detach();
+
+// This part can be any number of actions, e.g., clicking anywhere on the page also crashes.
+sel.selectAllChildren(bar);
+</script>
+<p>This test passes if it doesn't crash.</p>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/ruby-base-merge-block-children-crash-expected.png b/tests/tests/webkitsecurity/assets/ruby-base-merge-block-children-crash-expected.png
new file mode 100644
index 0000000..cf77fe8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/ruby-base-merge-block-children-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/ruby-base-merge-block-children-crash.html b/tests/tests/webkitsecurity/assets/ruby-base-merge-block-children-crash.html
new file mode 100644
index 0000000..a6b232d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/ruby-base-merge-block-children-crash.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>

+<html style="font: 1em/1 Ahem, sans-serif;">

+<body>

+<ruby>

+PASS

+<rt id="rt1"></rt>

+<i>

+<table id="table1"></table><table id="table2"><span><span>

+</i>

+</ruby>

+</body>

+<script>

+document.body.offsetTop;

+var table1 = document.getElementById('table1');

+table1.parentNode.removeChild(table1);

+document.body.offsetTop;

+var table2 = document.getElementById('table2');

+table2.parentNode.removeChild(table2);

+document.body.offsetTop;

+var rt1 = document.getElementById('rt1');

+rt1.parentNode.removeChild(rt1);

+</script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/ruby-overhang-crash.html b/tests/tests/webkitsecurity/assets/ruby-overhang-crash.html
new file mode 100644
index 0000000..cdd7725
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/ruby-overhang-crash.html
@@ -0,0 +1,23 @@
+<html>

+<body>

+Test passes if it does not crash.

+<ruby><svg><table><span><div><tr></tr><rt id="test"></rt></ruby>

+<script>

+function runTest()

+{

+    var child = document.getElementById('test');

+    child.parentNode.removeChild(child);

+    

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+

+if (window.layoutTestController) {

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+setTimeout("runTest()", 0);

+</script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/run-in-crash.html b/tests/tests/webkitsecurity/assets/run-in-crash.html
new file mode 100644
index 0000000..4a7fe43
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/run-in-crash.html
@@ -0,0 +1,22 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+
+<p>This tests a case where a particular DOM tree involving the run-in style
+causes multiple continuations to be created in the render tree in a configuration where
+the same render tree node would be destroyed twice. If there is no crash, the test passes.</p>
+
+<span style="display: run-in">
+    <span></span>
+    <marquee>
+        <span>
+            <span>
+                <div></div>
+            </span>
+        </span>
+    </marquee>
+</span>
+<div></div>
+
+<p>If you can see this the test almost certainly passed.</p>
diff --git a/tests/tests/webkitsecurity/assets/runin-continuation-crash.html b/tests/tests/webkitsecurity/assets/runin-continuation-crash.html
new file mode 100755
index 0000000..f523c29
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/runin-continuation-crash.html
@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html>
+<body>
+<style>
+.div1 { -webkit-column-span: all; }
+.divContainer::after { content: ''; }
+.divContainer { -webkit-column-width: 1px; }
+.runin { display: run-in; }
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+document.body.offsetTop;
+div1 = document.createElement('div');
+div1.setAttribute('class', 'div1');
+div2 = document.createElement('div');
+div3 = document.createElement('div');
+
+divContainer = document.createElement('div');
+divContainer.setAttribute('class', 'divContainer');
+document.documentElement.appendChild(divContainer);
+
+div2.appendChild(div1);
+divContainer.appendChild(div2);
+divContainer.appendChild(div3);
+document.body.offsetTop;
+div2.setAttribute('class', 'runin');
+document.body.offsetTop;
+document.body.innerHTML = "PASS";
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/runin-reparent-crash.html b/tests/tests/webkitsecurity/assets/runin-reparent-crash.html
new file mode 100644
index 0000000..a06679f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/runin-reparent-crash.html
@@ -0,0 +1,16 @@
+<html>

+    <body>

+        Test passes if it does not crash.

+        <p style="display: run-in; "></p>

+        <details id="test"></details>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+

+            document.body.offsetTop;

+            

+            var details = document.getElementById("test");

+            document.body.removeChild(details);

+        </script>

+    </body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/sandboxed-plugin-crash.html b/tests/tests/webkitsecurity/assets/sandboxed-plugin-crash.html
new file mode 100644
index 0000000..41903ed
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/sandboxed-plugin-crash.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+</script>
+</head>
+<body>
+This test makes sure that we don't crash if an iframe is sandboxed and has a plugin resource as it's src.<br>
+<iframe src="resources/test.swf" sandbox="allow-same-origin allow-forms allow-scripts"></iframe><br>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/saved-state-adoptNode-crash.html b/tests/tests/webkitsecurity/assets/saved-state-adoptNode-crash.html
new file mode 100644
index 0000000..39b5641
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/saved-state-adoptNode-crash.html
@@ -0,0 +1,20 @@
+<select id="select">
+    <option>Truffles</option>
+</select>
+<textarea id="textarea">
+Marshmallows
+</textarea>
+<iframe id="iframe" src="data:text/html,"></iframe>
+<input type="password" id="password" value="seikooC">
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    var newDoc = document.getElementById("iframe").contentDocument;
+    newDoc.adoptNode(document.getElementById("select"));
+    newDoc.adoptNode(document.getElementById("textarea"));
+    newDoc.adoptNode(document.getElementById("password"));
+    location.href="data:text/html,SUCCESS<script>if (window.layoutTestController) layoutTestController.notifyDone()</scr" + "ipt>";
+</script>
diff --git a/tests/tests/webkitsecurity/assets/script-element-without-frame-crash.html b/tests/tests/webkitsecurity/assets/script-element-without-frame-crash.html
new file mode 100644
index 0000000..a6edbba
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/script-element-without-frame-crash.html
@@ -0,0 +1,14 @@
+<p>
+This page tests for a crash in the HTML tokenizer when adding a &lt;script&gt;
+element to a document without a frame.
+</p>
+
+<pre>PASS: You didn't crash.</pre>
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+    
+var doc = document.implementation.createHTMLDocument("");
+doc.write("<\script src=''>;<\/script>");
+</script>
diff --git a/tests/tests/webkitsecurity/assets/scrollable-iframe-remove-crash.html b/tests/tests/webkitsecurity/assets/scrollable-iframe-remove-crash.html
new file mode 100644
index 0000000..0d7fce1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/scrollable-iframe-remove-crash.html
@@ -0,0 +1,27 @@
+<html>

+<script>

+if (window.layoutTestController)

+{

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+function scrollEventFired()

+{

+    document.getElementById('console').innerHTML = "Scrolled by JavaScript scrollTo(): PASS";

+ 

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+

+function runTest()

+{

+    window.frames[0].onscroll = scrollEventFired;

+    window.frames[0].scrollTo(0, 50);

+}

+</script>

+<junk id="console">

+<iframe onload="runTest();" src="resources/scrollable-iframe.html">

+</junk>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/scrollbar-crash-on-refresh.html b/tests/tests/webkitsecurity/assets/scrollbar-crash-on-refresh.html
new file mode 100644
index 0000000..fd3b543
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/scrollbar-crash-on-refresh.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<script>
+function runTest()
+{
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    window.frames.myframe.location.reload(true);
+}
+</script>
+</head>
+<body onload="runTest()">
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=26326">bug 26326</a>:
+This tests that there is no crash when refreshing a page with a custom scrollbar.  On success you should see a frame with scrollbars and one PASS message in it.<p/>
+<iframe name="myframe" id="myframe" src="resources/page-with-custom-scrollbars.html">
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/scrollbar-gradient-crash.html b/tests/tests/webkitsecurity/assets/scrollbar-gradient-crash.html
new file mode 100644
index 0000000..46d6723
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/scrollbar-gradient-crash.html
@@ -0,0 +1,30 @@
+<style type="text/css">
+::-webkit-scrollbar {
+  width: 0.8em;
+  height: 0.8em;
+}
+::-webkit-scrollbar-thumb {
+  background: #666 -webkit-gradient(linear, left top, right top, from(rgba(255,255,255,0.5)), color-stop(0.5, rgba(255,255,255,0.1)), color-stop(0.5, rgba(0,0,0,0)), to(rgba(0,0,0,0.01)));
+}
+</style>
+
+<body>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function test()
+{
+    // Force a layout.
+    window.x = document.body.offsetTop;
+
+    var styles = document.getElementsByTagName("style");
+    for (var i = 0; i < styles.length; ++i)
+        document.head.appendChild(styles[i]);
+}
+document.addEventListener('DOMContentLoaded', test, false);
+</script>
+<div style="height: 1000px;">
+This test passes if it does not crash.
+</div>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/scrollbar-part-created-with-no-parent-crash.html b/tests/tests/webkitsecurity/assets/scrollbar-part-created-with-no-parent-crash.html
new file mode 100644
index 0000000..7f5f653
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/scrollbar-part-created-with-no-parent-crash.html
@@ -0,0 +1,53 @@
+<html>

+Test passes if it does not crash.

+<style>

+body

+{

+    margin: 0;

+}

+::-webkit-scrollbar {

+    -webkit-logical-height: 65536;

+    -webkit-border-image: url(does_not_exist) 0 2 0 2;

+}

+

+.inner:not(table) {

+    padding: 400px;

+}

+</style>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+function showScroller()

+{

+    var scroller = document.createElement('div');

+    scroller.className = 'scroller';

+

+    var contents = document.createElement('div')

+    contents.className = 'inner';

+    scroller.appendChild(contents);

+

+    document.getElementById('container').appendChild(scroller);

+}

+  

+function hideScroller()

+{

+    var scroller = document.getElementById('container').querySelectorAll('.scroller')[0];

+    scroller.parentNode.removeChild(scroller);

+}

+  

+function doTest()

+{

+    if (window.eventSender) {

+        eventSender.mouseMoveTo(50, 40);

+        eventSender.mouseMoveTo(50, 55);

+        eventSender.mouseMoveTo(50, 0);

+    }

+}

+

+window.addEventListener('load', doTest, false);

+</script>

+<div id="container" onmouseover="showScroller()" onmouseout="hideScroller()">

+<p>PASS</p>

+</div>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/search-field-crash-in-designmode.html b/tests/tests/webkitsecurity/assets/search-field-crash-in-designmode.html
new file mode 100644
index 0000000..1c938f6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/search-field-crash-in-designmode.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This test ensures WebKit does not crash when user modifies the contents of search fields in the design mode.
+WebKit should not crash and you should see PASS below:</p>
+<input type="search">
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+document.designMode = 'on';
+document.getElementsByTagName('input')[0].focus();
+document.execCommand('delete', false, null);
+
+document.write('PASS');
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/search-popup-crasher.html b/tests/tests/webkitsecurity/assets/search-popup-crasher.html
new file mode 100644
index 0000000..bdacda0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/search-popup-crasher.html
@@ -0,0 +1,26 @@
+<HTML>
+<HEAD>
+<script>
+window.onload = function()
+{
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    if (window.location.href.indexOf('formSubmitted') != -1)
+        return;
+    document.getElementById('searchBox').value= 'quentin';
+    document.getElementById('searchForm').submit();
+};
+</script>
+</HEAD>
+<BODY>
+
+<p>This page tests that a page with a search popup does not crash, as reported in <a href='https://bugs.webkit.org/show_bug.cgi?id=37141'>this bug</a>. Below is a search input that the test automatically fills then submits. Pass if this does not crash.</p><br><br>
+<FORM action="" id="searchForm">
+<INPUT autosave="my.search" id="searchBox" type="search" results="10" value=""><br>
+<INPUT type="hidden" name="state" value="formSubmitted"><br>
+<INPUT type="submit" value="Search">
+</FORM>
+
+</BODY>
+</HTML>
diff --git a/tests/tests/webkitsecurity/assets/search-shadow-host-crash.html b/tests/tests/webkitsecurity/assets/search-shadow-host-crash.html
new file mode 100644
index 0000000..d14c5a2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/search-shadow-host-crash.html
@@ -0,0 +1,31 @@
+<html>
+<head>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function clickOn(element)
+{
+    if (!window.eventSender)
+        return;
+
+    var x = element.offsetLeft + element.offsetWidth / 2;
+    var y = element.offsetTop + element.offsetHeight / 2;
+    eventSender.mouseMoveTo(x, y);
+    eventSender.mouseDown();
+    eventSender.mouseUp();
+}
+
+function runTest()
+{
+    clickOn(document.getElementsByTagName('input')[0]);
+}
+
+</script>
+</head>
+<body onload="runTest()">
+    <p>Click on the search box. This test passes if does not crash.</p>
+    <input type="search" onclick="this.style.display = 'none';">
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/section-in-table-before-misnested-text-crash-css.html b/tests/tests/webkitsecurity/assets/section-in-table-before-misnested-text-crash-css.html
new file mode 100644
index 0000000..661c1e7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/section-in-table-before-misnested-text-crash-css.html
@@ -0,0 +1,55 @@
+<html>
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.createElementNS("http://www.w3.org/1999/xhtml", "thead"), xxx);
+}
+</script>
+<style>
+.table {
+    display: table;
+}
+
+.tbody {
+    display: table-row-group;
+}
+
+.tr {
+    display: table-row;
+}
+
+.td {
+    display: table-cell;
+}
+
+</style>
+</head>
+
+<body onload="boom()">
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<div class="table" border="1" id="tr1">
+ xxx
+<div class="tbody">
+ <div class="tr">
+  <div class="td">Whee</div>
+ </div>
+</div>
+</div>
+
+<form id="f1">QQQ</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/section-in-table-before-misnested-text-crash.xhtml b/tests/tests/webkitsecurity/assets/section-in-table-before-misnested-text-crash.xhtml
new file mode 100644
index 0000000..c15ccb5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/section-in-table-before-misnested-text-crash.xhtml
@@ -0,0 +1,40 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function boom()
+{
+  var tr = document.getElementById("tr1");
+  var xxx = document.getElementById("tr1").firstChild;
+
+  tr.insertBefore(document.createTextNode("0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99"), xxx);
+
+  tr.insertBefore(document.createElementNS("http://www.w3.org/1999/xhtml", "thead"), xxx);
+}
+
+
+
+</script>
+</head>
+
+<body onload="boom()">
+
+<div>This test checks whether a particular odd arrangement of DOM
+nodes results in render tree consistency violations.</div>
+
+<table border="1" id="tr1">
+ xxx
+<tbody>
+ <tr>
+  <td>Whee</td>
+ </tr>
+</tbody>
+</table>
+
+<form id="f1">QQQ</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/select-crash-001-expected.png b/tests/tests/webkitsecurity/assets/select-crash-001-expected.png
new file mode 100644
index 0000000..0773b49
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/select-crash-001-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/select-crash-001.html b/tests/tests/webkitsecurity/assets/select-crash-001.html
new file mode 100644
index 0000000..1601957
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/select-crash-001.html
@@ -0,0 +1,23 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+<head>
+<title></title>
+<style type="text/css">
+html,body,h1{font-size:100%;font-style:inherit;font-weight:inherit;margin:0;padding:0;text-decoration:inherit;}
+</style>
+<script src=../editing.js language="javascript" type="text/javascript" ></script>
+</head>
+<body>
+<h1 id="test">The Longest German Word?</h1>
+<script type="text/javascript" language="javascript">
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        var element = document.getElementById("test");
+        var selection = window.getSelection();
+        selection.setPosition(element.firstChild, 2);
+        extendSelectionForwardByCharacterCommand();
+        copyCommand();
+    }
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/select-crash-002-expected.png b/tests/tests/webkitsecurity/assets/select-crash-002-expected.png
new file mode 100644
index 0000000..7554ed9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/select-crash-002-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/select-crash-002.html b/tests/tests/webkitsecurity/assets/select-crash-002.html
new file mode 100644
index 0000000..c3ae342
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/select-crash-002.html
@@ -0,0 +1,20 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html>
+<head>
+<title></title>
+<style type="text/css">
+html,body,h1{font-size:100%;font-style:inherit;font-weight:inherit;margin:0;padding:0;text-decoration:inherit;}
+</style>
+<script src=../editing.js language="javascript" type="text/javascript" ></script>
+</head>
+<body>
+<h1>The Longest German Word?</h1>
+<script type="text/javascript" language="javascript">
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        selectAllCommand();
+        copyCommand();
+    }
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/select-in-region-crash.html b/tests/tests/webkitsecurity/assets/select-in-region-crash.html
new file mode 100644
index 0000000..b98dbce
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/select-in-region-crash.html
@@ -0,0 +1,44 @@
+<!doctype html>
+<html>
+    <head>
+        <style>
+		    #el1 { -webkit-flow-into: A; }
+		    #el3 { -webkit-flow-from: A; }
+	    </style>
+        <script>
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+            }
+
+            onload = function() {
+                el1=document.createElement('div')
+                el1.setAttribute('id','el1')
+                document.body.appendChild(el1)
+
+                el2=document.createElement('div')
+                document.body.appendChild(el2)
+
+                el3=document.createElement('hr')
+                el3.setAttribute('id','el3')
+                el2.appendChild(el3)
+
+                el4=document.createElement('select')
+                el1.appendChild(el4)
+                el4.style.display='block'
+
+                setTimeout(function() {
+                    el4.style.display='inline'
+                    el4.style.visibility = 'hidden'
+
+                    if (window.layoutTestController)
+                        layoutTestController.notifyDone();
+                },0)
+            }
+        </script>
+    </head>
+    <body>
+        <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=77474">77474</a>: Crash in RenderFlowThread::setRegionBoxesRegionStyle</p>
+        <p> This test PASSES if it does not CRASH or ASSERT.</p>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/select-onchange-crash.html b/tests/tests/webkitsecurity/assets/select-onchange-crash.html
new file mode 100644
index 0000000..6cfc13b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/select-onchange-crash.html
@@ -0,0 +1,37 @@
+<html>

+  <head>

+    <script>

+        if (window.layoutTestController)

+        {

+            layoutTestController.dumpAsText();

+            layoutTestController.waitUntilDone();

+        }

+        window.onload = function ()

+        {

+            var element = document.getElementById("test");

+            element.onchange = function() { element.size = 30; }

+            element.focus();

+            if (window.layoutTestController)

+            {

+                // This triggers selection of second option in the select and press Enter.

+                eventSender.keyDown("e");

+                eventSender.keyDown("\r", []);

+                // This triggers repaint.

+                document.body.offsetTop;

+                

+                document.getElementById("log").innerHTML = "<span style='color: green;'>PASS:</span> Did not crash";

+                layoutTestController.notifyDone();

+            }

+         }

+    </script>

+  </head>

+  <body>

+    This test is to ensure that we do not crash when onchange handler changes the select from a menu list to a list box.

+    <p id="log"><span style='color: red;'>FAIL:</span> Did not complete test or not running inside DumpRenderTree</p>

+    <select id="test">

+      <option selected>abcd</option>

+      <option>efgh</option>

+    </select>

+  </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/select-option-accesskey-crash.html b/tests/tests/webkitsecurity/assets/select-option-accesskey-crash.html
new file mode 100644
index 0000000..2b619ef
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/select-option-accesskey-crash.html
@@ -0,0 +1,36 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<form>
+<select id="target">
+<option accesskey="x">foo</option>
+</select>
+</form>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+description('This test is to ensure that we do not crash when selecting an item from a menu list in a list box through an access key.')
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+
+    var selectElement = document.getElementById("target");
+    selectElement.focus();
+    if (window.eventSender) {
+        var modifiers;
+        if (navigator.userAgent.search(/\bMac OS X\b/) != -1)
+            modifiers = ['ctrlKey', 'altKey'];
+        else
+            modifiers = ['altKey'];
+
+        eventSender.keyDown('x', modifiers);
+        testPassed("Did not crash");
+    }
+}
+</script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/select-start-remove-root-crash.html b/tests/tests/webkitsecurity/assets/select-start-remove-root-crash.html
new file mode 100644
index 0000000..b18faa0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/select-start-remove-root-crash.html
@@ -0,0 +1,24 @@
+<html>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function runTest()
+{
+    document.write("PASS");
+    
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function select()
+{
+    document.execCommand("SelectAll");
+}
+
+window.addEventListener("selectstart", runTest, true);
+window.setInterval(select, 0);
+</script>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/selected-tab-crash.html b/tests/tests/webkitsecurity/assets/selected-tab-crash.html
new file mode 100644
index 0000000..b3e29e1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/selected-tab-crash.html
@@ -0,0 +1,48 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../../fast/js/resources/js-test-style.css">
+<script>
+var successfullyParsed = false;
+</script>
+<script src="../../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<div role="tablist" tabindex="0" id="tablist">
+<div role="tab" aria-checked="true" id="selectedtab">tab 1</div>
+<div role="tab">tab 2</div>
+<div role="tab">tab 3</div>
+</div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This tests that if a tablists children are updated, we will not crash accessing an old object.");
+
+    if (window.accessibilityController) {
+
+        document.getElementById("tablist").focus();
+        var tablist = accessibilityController.focusedElement;
+
+        // Iterate all the children so we have a cache of them.
+        tablist.attributesOfChildren();
+
+        // Retrieve and verify we have the right selected child.
+        var selectedTab = tablist.uiElementAttributeValue("AXValue");
+
+        // Delete the selected child.
+        document.getElementById("tablist").removeChild(document.getElementById("selectedtab"));
+
+        // Retrieve the tab. We should not crash here!
+        var selectedTab = tablist.uiElementAttributeValue("AXValue");
+    }
+
+    successfullyParsed = true;
+</script>
+
+<script src="../../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/selection-gap-clip-out-tiger-crash.html b/tests/tests/webkitsecurity/assets/selection-gap-clip-out-tiger-crash.html
new file mode 100644
index 0000000..0b03499
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/selection-gap-clip-out-tiger-crash.html
@@ -0,0 +1,125 @@
+<html>
+<head>
+    <style >
+        div.label {
+            float: left;
+            padding-top: 2px;
+        }
+    </style>
+</head>
+
+<body>
+        <div>
+            <div>
+                Simply do a select all to see the crash
+            </div>
+            <div>
+                C
+            </div>
+            <div >
+                D
+            </div>
+            <div>
+                E
+            </div>
+            <div>
+                F
+            </div>
+            <div>
+                G
+            </div>
+            <div>
+                H
+            </div>
+            <div>
+                I
+            </div>
+            <div class="label">
+                K
+            </div>
+            <div >
+                L
+            </div>
+            <div>
+                M
+            </div>
+            <div class="label">
+                N
+            </div>
+            <div >
+                O
+            </div>
+        </div>
+        <div>P
+            <div class="label">
+                Q
+            </div>
+            <div >
+                R
+            </div>
+        </div>
+        <div >S
+            <div class="label">
+                T
+            </div>
+            <div >
+                U
+            </div>
+        </div>
+        <div >V
+            <div class="label">
+                W
+            </div>
+        </div>
+        <div >
+            <div class="label">
+                X
+            </div>
+            <div >
+                Y
+            </div>
+        </div>
+        <div >Z
+            <div class="label">
+                AA
+            </div>
+            <div >
+                BB
+            </div>
+        </div>
+        <div >CC
+            <div class="label">
+                DD
+            </div>
+            <div >
+                EE
+            </div>
+        </div>
+        <div >FF
+            <div class="label">
+                GG
+            </div>
+            <div >
+                HH
+            </div>
+        </div>
+        <div>II
+            <div class="label">
+                JJ
+            </div>
+            <div>
+                KK
+            </div>
+        </div>
+
+    <div>
+        <div>END!</div>
+    </div>
+    <script>
+           document.execCommand("SelectAll");
+           if (window.layoutTestController) {
+               layoutTestController.dumpAsText();
+           }
+    </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/selection-modify-crash-expected.png b/tests/tests/webkitsecurity/assets/selection-modify-crash-expected.png
new file mode 100644
index 0000000..5cbdfe9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/selection-modify-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/selection-modify-crash.html b/tests/tests/webkitsecurity/assets/selection-modify-crash.html
new file mode 100644
index 0000000..f5ebc84
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/selection-modify-crash.html
@@ -0,0 +1,34 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function test()
+{
+    var htmlElement = document.firstChild;
+    // Create a range.
+    var staleRange = document.createRange();
+
+    // Delete document.body:
+    var range = document.createRange();
+    range.setEndAfter(htmlElement);
+    range.deleteContents();
+
+    var selection = window.getSelection();
+    selection.addRange(staleRange);
+    selection.modify("extend", "forward", "documentboundary"); // WebKit crashed here.
+
+    // Recreate the HTML element to show 'PASS'.
+    document.appendChild(document.createElement('html'));
+    document.firstChild.innerHTML = '<body>PASS</body>';
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+</head>
+<body onload="test()">
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/selection-plugin-clear-crash.html b/tests/tests/webkitsecurity/assets/selection-plugin-clear-crash.html
new file mode 100644
index 0000000..b8456a4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/selection-plugin-clear-crash.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>

+<html>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+    

+function runTest()

+{

+    var obj = document.getElementById("test");

+    var s = window.getSelection();

+    s.setPosition(obj, 0);

+	document.body.innerHTML = "PASS";

+}

+</script>

+<body onload="runTest()">

+<div>

+<object id="test"></object>

+<embed type="application/x-webkit-test-netscape" cleardocumentduringnew></embed>

+</div>

+</body>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/set-box-style-in-region-crash.html b/tests/tests/webkitsecurity/assets/set-box-style-in-region-crash.html
new file mode 100644
index 0000000..54b74d5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/set-box-style-in-region-crash.html
@@ -0,0 +1,42 @@
+<!doctype html>
+<html>
+    <head>
+        <style>
+            .regionBox2 { width: 280px; height: 100px; }
+
+            #article { -webkit-flow-into: flow; }
+            #region { -webkit-flow-from: flow; }
+
+            @-webkit-region #region { span { background-color: red } };
+        </style>
+        <script>
+            if (window.layoutTestController) {
+                window.layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+            }
+
+            function test()
+            {
+                try {
+                    child = document.getElementById("li");
+                    child.parentNode.removeChild(child);
+                } catch(e) {
+                }
+
+                if (window.layoutTestController)
+                    layoutTestController.notifyDone();
+            }
+
+            setTimeout("test()", 0);
+        </script>
+    <body>
+        <p> Bug <a href="https://bugs.webkit.org/show_bug.cgi?id=78298">78298</a>: Crash in RenderFlowThread::setRegionBoxesRegionStyle</p>
+        <p> This test PASSES if it does not CRASH or ASSERT.</p>
+        <div id="article">
+            <li id="li">
+                <p id="p"></p>
+            </li>
+        </div>
+        <div id="region" class="regionBox2"></div>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/set-type-to-null-crash.html b/tests/tests/webkitsecurity/assets/set-type-to-null-crash.html
new file mode 100644
index 0000000..66653c8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/set-type-to-null-crash.html
@@ -0,0 +1,8 @@
+<body onload="crash.type=null">
+<object type="" id="crash"></object>
+
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+PASS - The test didn't crash.
diff --git a/tests/tests/webkitsecurity/assets/shorthand-mismatched-list-crash.html b/tests/tests/webkitsecurity/assets/shorthand-mismatched-list-crash.html
new file mode 100644
index 0000000..cdceceb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/shorthand-mismatched-list-crash.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<title>Test for WebKit bug 31559: Crash with mismatched lists and shorthands.</title>
+<script src="../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+  <p id="description">Test for WebKit bug <a href="https://bugs.webkit.org/show_bug.cgi?id=31559">31559</a>: Crash with mismatched lists and shorthands.</p>
+  <div id="console"></div>
+
+  <div id="test"></div>
+
+<script>
+  var para = document.getElementById('test');
+  
+  // Test longer shorthand
+  para.style.webkitTransition = 'width 1s, left 1s, top 1s';
+  para.style.webkitTransitionProperty = 'width, left';
+
+  shouldBeEqualToString("para.style.webkitTransition", "width 1s, left 1s, 1s");
+
+  // Test shorter shorthand
+  para.style.webkitTransition = 'width 1s, left 1s';
+  para.style.webkitTransitionProperty = 'width, left, top';
+
+  // the next line will crash
+  shouldBeEqualToString("para.style.webkitTransition", "width 1s, left 1s, top");
+</script>
+<script src="../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/slider-crash-expected.png b/tests/tests/webkitsecurity/assets/slider-crash-expected.png
new file mode 100644
index 0000000..8c8f003
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/slider-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/slider-crash.html b/tests/tests/webkitsecurity/assets/slider-crash.html
new file mode 100644
index 0000000..9eaceae
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/slider-crash.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+<p style="-webkit-appearance: slider-vertical; height: 15px"></p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/small-caps-crash.html b/tests/tests/webkitsecurity/assets/small-caps-crash.html
new file mode 100644
index 0000000..e59f630
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/small-caps-crash.html
@@ -0,0 +1,17 @@
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+<script>
+    if(window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body style="font-variant: small-caps;">
+This test verifies that using characters not found in the default font along with the small-caps font variant does
+not crash the browser.
+
+If successful, this test should not crash, and an odd character below:
+

+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/smil-element-not-removed-crash.html b/tests/tests/webkitsecurity/assets/smil-element-not-removed-crash.html
new file mode 100644
index 0000000..55ee0e0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/smil-element-not-removed-crash.html
@@ -0,0 +1,35 @@
+<html>

+    <body onload="runSMILTest()">

+        <svg>

+            <animAttributeAttrs>

+                <feImage id="test"></feImage>

+            </animAttributeAttrs>

+            <set id="set1" xlink:href="#test"></set>

+        </svg>

+        <script>

+            if (window.layoutTestController) {

+                layoutTestController.dumpAsText();

+                layoutTestController.waitUntilDone();

+                gc = function() { window.GCController.collect() };

+            } else if (!window.gc)

+                gc = function(){};

+

+            window.onload = function() {

+                if (location.hash != "#2") {

+                    if (location.hash)

+                        location.hash = "#" + (parseInt(location.hash.slice(1)) + 1).toString();

+                    else

+                        location.hash = "#1";

+                    

+                    gc();

+                    setTimeout(function(){location.reload()}, 0);

+                } else {

+                    document.body.innerHTML = "PASS";

+                    if (window.layoutTestController)

+                        layoutTestController.notifyDone();

+                }

+            }

+        </script>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/sort-no-jit-code-crash.html b/tests/tests/webkitsecurity/assets/sort-no-jit-code-crash.html
new file mode 100644
index 0000000..8c6a909
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/sort-no-jit-code-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/sort-no-jit-code-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/sort-no-jit-code-crash.js b/tests/tests/webkitsecurity/assets/sort-no-jit-code-crash.js
new file mode 100644
index 0000000..9ecc77a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/sort-no-jit-code-crash.js
@@ -0,0 +1,23 @@
+description(
+"This test checks that non-numeric sort functions always have JIT code. This test passes if it does not crash."
+);
+
+function f()
+{
+}
+
+[].sort(f);
+
+function g()
+{
+}
+
+function h(x)
+{
+    x();
+}
+
+h(g);
+h(g);
+h(g);
+h(f);
diff --git a/tests/tests/webkitsecurity/assets/spellcheck-api-crash.html b/tests/tests/webkitsecurity/assets/spellcheck-api-crash.html
new file mode 100644
index 0000000..5fb6960
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/spellcheck-api-crash.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+<title></title>
+<script language="javascript" type="text/javascript">
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function Test() {
+    var node0 = document.getElementById('test0');
+    if (node0.removeSpellcheckRange)
+        node0.removeSpellcheckRange(null);
+    var node1 = document.getElementById('test1');
+    if (node1.removeSpellcheckRange)
+        node1.removeSpellcheckRange(null);
+    var node2 = document.getElementById('test2');
+    if (node2.removeSpellcheckRange)
+        node2.removeSpellcheckRange(null);
+}
+</script>
+</head>
+<body onload="Test()">
+<p>This tests thats WebKit does not crash when we call removeSpellcheckRange() with a null parameter. To test manually, open this HTML file and check if the browser can open this file without a crash.</p>
+<textarea id="test0" rows="10" cols="80">wellcome</textarea><br />
+<input id="test1" type="text" value="wellcome" /><br />
+<div id="test2" contenteditable="true">wellcome</div><br />
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/spellcheck-input-search-crash.html b/tests/tests/webkitsecurity/assets/spellcheck-input-search-crash.html
new file mode 100644
index 0000000..e98116e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/spellcheck-input-search-crash.html
@@ -0,0 +1,33 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+<script>
+var clicked = false;
+
+function handleClicked()
+{
+    clicked = true;
+}
+
+function test()
+{
+    description("This test passes if it doesn't crash and the context menu is shown for the search input");
+    if (!window.eventSender)
+        return;
+    var target = document.getElementById("target");
+    var clickX = target.offsetLeft + target.offsetWidth - 2;
+    var clickY = target.offsetTop + target.offsetHeight / 2;
+    eventSender.mouseMoveTo(clickX, clickY);
+    eventSender.contextClick();
+    shouldBe("clicked", "true");
+}
+</script>
+</head>
+<body onload="test();">
+<p id="description"></p>
+<div id="console"></div>
+<input id="target" type="search" oncontextmenu="handleClicked()">
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/split-flow-anonymous-wrapper-crash.html b/tests/tests/webkitsecurity/assets/split-flow-anonymous-wrapper-crash.html
new file mode 100755
index 0000000..865e8ba
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/split-flow-anonymous-wrapper-crash.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>

+<html>

+Test passes if it does crash.

+<style>

+.b1 { display: block; -webkit-column-width: 100px; }

+.d1 { -webkit-column-span: all; }

+</style>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+function runTest() {

+div1 = document.createElement('div');

+div1.setAttribute('class', 'd1');

+button1 = document.createElement('button');

+button1.setAttribute('class', 'b1');

+document.documentElement.appendChild(button1);

+document.documentElement.offsetTop;

+button1.appendChild(div1);

+document.documentElement.offsetTop;

+document.documentElement.innerHTML = "PASS";

+}

+window.onload = runTest;

+</script>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/split-inline-wrong-post-block-crash.html b/tests/tests/webkitsecurity/assets/split-inline-wrong-post-block-crash.html
new file mode 100755
index 0000000..367aa01
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/split-inline-wrong-post-block-crash.html
@@ -0,0 +1,27 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest() {
+    var container = document.createElement('div');
+    container.style['-webkit-column-count'] = 1;
+    document.body.appendChild(container);
+    var test1 = document.createElement('div');
+    test1.style['-webkit-column-span'] = 'all';
+    container.appendChild(test1);
+    var test2 = document.createElement('span'); 
+    container.appendChild(test2);
+    test2.appendChild(document.createElement('div'));
+    var test3 = document.createElement('div');
+    test3.style.display = 'table-column';
+    container.appendChild(test3);
+    container.appendChild(document.createElement('div'));
+}
+</script>
+</head>
+<body onload="runTest()">
+Test passes if it does not crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/stale-grid-crash-expected.png b/tests/tests/webkitsecurity/assets/stale-grid-crash-expected.png
new file mode 100644
index 0000000..8a0f650
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/stale-grid-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/stale-grid-crash.html b/tests/tests/webkitsecurity/assets/stale-grid-crash.html
new file mode 100644
index 0000000..ceb169c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/stale-grid-crash.html
@@ -0,0 +1,36 @@
+<head>
+    <title></title>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.waitUntilDone();
+
+        function test()
+        {
+            document.getElementById("topCell").style.display = "none";
+            document.getElementById("bottomCell").style.backgroundImage="url(../replaced/resources/1x1-green.png)";
+            document.getElementById("result").innerText = "SUCCESS"
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
+    </script>
+</head>
+<body>
+    <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=13774">http://bugs.webkit.org/show_bug.cgi?id=13774</a>
+        REGRESSION: Crash emailing blog entry using Google Reader</i>.
+    </p>
+    <p id="result">
+        FAIL (test did not complete)
+    </p>
+    <img src="../replaced/resources/1x1-green.png" onload="test()">
+    <table style="border-collapse: collapse;">
+        <tbody>
+            <tr>
+                <td id="topCell"></td>
+            </tr>
+            <tr>
+                <td id="bottomCell"></td>
+            </tr>
+        </tbody>
+    </table>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/stale-style-selector-crash-1.html b/tests/tests/webkitsecurity/assets/stale-style-selector-crash-1.html
new file mode 100644
index 0000000..0461148
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/stale-style-selector-crash-1.html
@@ -0,0 +1,47 @@
+<html>
+<head id="head">
+    <style id="inlineRules">
+        #foo { background-color: red; }
+    </style>
+</head>
+<body>
+    <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=13563">http://bugs.webkit.org/show_bug.cgi?id=13563</a>
+        REGRESSION: Crash loading message in Yahoo! Mail</i>.
+    </p>
+    <p>
+        The following line should say SUCCESS in green letters over a white background.
+    </p>
+    <div id="foo">SUCCESS</div>
+    <script>
+        function test()
+        {
+            var head = document.getElementById("head");
+            var link = document.createElement("link");
+            link.setAttribute("href", "data:text/css,");
+            link.setAttribute("rel", "stylesheet");
+            // This will increase the pending stylesheet count
+            head.appendChild(link);
+    
+            var inline = document.getElementById("inlineRules");
+            // This will delete the rule (duh) but since we have
+            // pending stylesheets, will NOT update the style selector
+            inline.sheet.deleteRule(0);
+    
+            // Make ourselves need a style recalc, so that
+            // updateRendering() will do something when called soon
+            document.getElementById("foo").style.color = "green";
+
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
+
+        if (window.layoutTestController) {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+        }
+
+        setTimeout(test, 0);
+    </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/stale-style-selector-crash-2.html b/tests/tests/webkitsecurity/assets/stale-style-selector-crash-2.html
new file mode 100644
index 0000000..efe9da8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/stale-style-selector-crash-2.html
@@ -0,0 +1,34 @@
+<html>
+<head id="head">
+    <style id="inlineRules">
+        #foo { background-color: red; }
+    </style>
+    <link rel="stylesheet" href="data:text/css,">
+</head>
+<body>
+    <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=13563">http://bugs.webkit.org/show_bug.cgi?id=13563</a>
+        REGRESSION: Crash loading message in Yahoo! Mail</i>.
+    </p>
+    <p>
+        The following line should say SUCCESS in green letters over a white background.
+    </p>
+    <div id="foo">SUCCESS</div>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        // Force a layout ignoring pending stylesheets
+        document.body.offsetTop;
+
+        var inline = document.getElementById("inlineRules");
+        // This will delete the rule (duh) but since we have
+        // pending stylesheets, will NOT update the style selector
+        inline.sheet.deleteRule(0);
+
+        // Make ourselves need a style recalc, so that
+        // updateRendering() will do something when called soon
+        document.getElementById("foo").style.color = "green";
+    </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/state-api-on-detached-frame-crash.html b/tests/tests/webkitsecurity/assets/state-api-on-detached-frame-crash.html
new file mode 100644
index 0000000..bb71bf7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/state-api-on-detached-frame-crash.html
@@ -0,0 +1,31 @@
+<html>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest()
+{
+    var ifr = frames[0];
+    document.body.removeChild(document.getElementsByTagName("iframe")[0])
+    try {
+        ifr.history.replaceState("foo", "bar");
+    } catch (e) {
+      // Ignore, expected
+    }
+    try {
+        ifr.history.pushState("fu", "barred");
+    } catch (e) {
+      // Ignore, expected    
+    }
+    document.getElementById("log").textContent = "PASSED";
+}
+
+</script>
+<body onload="runTest();">
+Tests that calling <code>pushState</code> or <code>replaceState</code> on a detached frame doesn't crash.
+<iframe src="about:blank">
+</iframe>
+<pre id="log"></pre>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/statement-list-register-crash.html b/tests/tests/webkitsecurity/assets/statement-list-register-crash.html
new file mode 100644
index 0000000..90f9e64
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/statement-list-register-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/statement-list-register-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/statement-list-register-crash.js b/tests/tests/webkitsecurity/assets/statement-list-register-crash.js
new file mode 100644
index 0000000..8374ab7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/statement-list-register-crash.js
@@ -0,0 +1,15 @@
+description(
+'Tests that code generation of statement lists properly reference counts registers.'
+);
+
+function f()
+{
+    for(; ; i++) {
+        a = 0;
+        
+        if (1)
+            return true;
+    }
+}
+
+shouldBeTrue("f()");
diff --git a/tests/tests/webkitsecurity/assets/stop-crash.html b/tests/tests/webkitsecurity/assets/stop-crash.html
new file mode 100644
index 0000000..879713f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/stop-crash.html
@@ -0,0 +1,29 @@
+<html>
+<head>
+    <script>
+        if (window.layoutTestController) {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+        }
+
+        function firstPartLoaded()
+        {
+            window.stop();
+            document.getElementById("results").innerHTML = "PASS";
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
+    </script>
+</head>
+<body>
+    <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=13360">http://bugs.webkit.org/show_bug.cgi?id=13360</a>
+        REGRESSION: Crash closing live web cam viewer page</i>.
+    </p>
+    <p>
+        If WebKit does not assert or crash after the test, then it passed.
+    </p>
+    <img width=24 height=24 src="resources/multipart.php?interval=0&img1=2x2-green.png&img2=2x2-green.png&wait=3" onload="firstPartLoaded()">
+    <p id="results"></p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/stop-crash.svg b/tests/tests/webkitsecurity/assets/stop-crash.svg
new file mode 100644
index 0000000..b758686
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/stop-crash.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <stop/>
+  <script>
+  if (window.layoutTestController)
+     layoutTestController.dumpAsText();
+  </script>
+  <text x="10" y="25">PASS -- if this test doesn't crash it passes.</text>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/string-replace-exception-crash.html b/tests/tests/webkitsecurity/assets/string-replace-exception-crash.html
new file mode 100644
index 0000000..b542c54
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/string-replace-exception-crash.html
@@ -0,0 +1,64 @@
+<p>This page tests for a crash when throwing an exception from a callback provided
+to String.prototype.replace.
+</p>
+
+<p>If the test passes, you'll see a series of PASS messages below.
+</p>
+
+<pre id="console"></pre>
+
+<script>
+function log(s)
+{
+    document.getElementById("console").appendChild(document.createTextNode(s + "\n"));
+}
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+// these should not crash
+
+try {
+    (function () {
+        "aa".replace(/a/g, function() {
+            var bogus;
+            bogus.property;
+        });
+    })();
+} catch(e) {
+    log ("PASS: You didn't crash.");
+}
+
+try {
+    (function () {
+        "aa".replace("a", function() {
+            ({})();
+        });
+    })();
+} catch(e) {
+    log ("PASS: You didn't crash.");
+}
+
+// this should not continue execution after an exception
+
+var message = "PASS: String.prototype.replace did not continue executing after an exception was thrown.";
+try {
+    (function () {
+        var count = 0;
+        "aa".replace(/a/g, function() {
+            if (++count > 1)
+                message = "FAIL: String.prototype.replace continued executing after an exception was thrown.";
+
+            var bogus;
+            bogus.property;
+        });
+    })();
+} catch(e) {
+    try {
+        (function x() { return 'blargh'.replace(/a/g, x) })()
+    } catch(e) {
+        log (message);
+    }
+}
+
+</script>
diff --git a/tests/tests/webkitsecurity/assets/style-access-during-imageChanged-crash.html b/tests/tests/webkitsecurity/assets/style-access-during-imageChanged-crash.html
new file mode 100644
index 0000000..6ddd729
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/style-access-during-imageChanged-crash.html
@@ -0,0 +1,24 @@
+<style>
+    @font-face {
+      font-family: test;
+      src: url(data:text/plain,1);
+    }
+</style>
+<p>
+    This test passes if it does not cause an assertion failure or a crash.
+</p>
+A <img id="target" alt="A">
+<script>
+    function test()
+    {
+        document.body.offsetTop;
+        document.body.style.fontFamily="test";
+        document.body.offsetTop;
+        document.getElementById("target").src = "data:text/plain,2";
+    }
+
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    test();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/styled-clone-inline-style-decl-parent-crash.html b/tests/tests/webkitsecurity/assets/styled-clone-inline-style-decl-parent-crash.html
new file mode 100644
index 0000000..437ae3b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/styled-clone-inline-style-decl-parent-crash.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>

+<html>

+<head>

+<script src="../js/resources/js-test-pre.js"></script>

+</head>

+<body>

+Test passes if it does not crash.

+<div id="console"></div>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+iframe1 = document.createElement('iframe');

+document.body.appendChild(iframe1);

+document1 = iframe1.contentDocument.implementation.createHTMLDocument("document");

+var div1 = document1.createElement('div');

+document1.body.appendChild(div1);

+div1.style.color = "blue";

+var div2 = div1.cloneNode(true);

+document1.body.removeChild(div1);

+delete document1;

+gc();

+div2.style.color = "red";

+

+</script>

+<script src="../js/resources/js-test-post.js"></script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/styled-not-in-document-clone-inline-style-decl-parent-crash.html b/tests/tests/webkitsecurity/assets/styled-not-in-document-clone-inline-style-decl-parent-crash.html
new file mode 100644
index 0000000..5356e92
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/styled-not-in-document-clone-inline-style-decl-parent-crash.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>

+<html>

+<head>

+<script src="../js/resources/js-test-pre.js"></script>

+</head>

+<body>

+Test passes if it does not crash.

+<div id="console"></div>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+iframe1 = document.createElement('iframe');

+document.body.appendChild(iframe1);

+document1 = iframe1.contentDocument.implementation.createHTMLDocument("document");

+var div1 = document1.createElement('div');

+div1.style.color = "blue";

+var div2 = div1.cloneNode(true);

+delete document1;

+gc();

+div2.style.color = "red";

+

+</script>

+<script src="../js/resources/js-test-post.js"></script>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/stylesheet-candidate-node-crash-main.html b/tests/tests/webkitsecurity/assets/stylesheet-candidate-node-crash-main.html
new file mode 100644
index 0000000..60ea357
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/stylesheet-candidate-node-crash-main.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function runTest() {
+    svgdoc = document.getElementById('root').contentDocument;
+    var style = document.createElement('style');
+    var test1 = svgdoc.getElementById('test1');
+    test1.appendChild(style);
+    svgdoc.getElementById('test2').setAttribute('xlink:href', 0);
+    svgdoc.getElementById('test').setAttribute('stroke', 0);
+}
+</script>
+<object data="resources/stylesheet-candidate-node-crash.svg" id="root" onload="runTest();" type="image/svg+xml"></object>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/stylesheet-candidate-node-crash.svg b/tests/tests/webkitsecurity/assets/stylesheet-candidate-node-crash.svg
new file mode 100644
index 0000000..5961cac
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/stylesheet-candidate-node-crash.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<g id="test">
+<text id="test1">PASS</text>
+</g>
+<use id="test2" xlink:href="#test"/>
+<use xlink:href="#test"/>
+<set attributeName="font-style" to="italic"/>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/stylesheet-candidate-nodes-crash.xhtml b/tests/tests/webkitsecurity/assets/stylesheet-candidate-nodes-crash.xhtml
new file mode 100644
index 0000000..d0ecff4
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/stylesheet-candidate-nodes-crash.xhtml
@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:svg="http://www.w3.org/2000/svg" xmlns:xht="http://www.w3.org/1999/xhtml">

+    <html xmlns="http://www.w3.org/1999/xhtml">

+        <body>

+            <script type="text/javascript">

+                if (window.layoutTestController)

+                {

+                    layoutTestController.dumpAsText();

+                    layoutTestController.waitUntilDone();

+                }

+                

+                function runTest()

+                {

+                    document.getElementsByTagNameNS('http://www.w3.org/1999/xhtml', 'style')[0];

+                    if (document.body)

+                        document.body.innerHTML = "PASS";

+                    

+                    if (window.layoutTestController)

+                        layoutTestController.notifyDone();

+                }

+            </script>

+            <svg:style>

+                <xht:caption>

+                    <xht:iframe onload="runTest();"></xht:iframe>             

+                    <style></style>

+                </xht:caption>

+            </svg:style>

+        </body>

+    </html>

+    <!----->

+</svg>

diff --git a/tests/tests/webkitsecurity/assets/subframe-load-crash-main.html b/tests/tests/webkitsecurity/assets/subframe-load-crash-main.html
new file mode 100755
index 0000000..340dd99
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/subframe-load-crash-main.html
@@ -0,0 +1,18 @@
+<html>
+<object data="resources/subframe-load-crash.svg" id="root" onload="runTest()"></object>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+function runTest() {
+    root = document.getElementById('root').contentDocument;
+    root.addEventListener('load', function() { document.open(); document.write("PASS"); document.close(); }, 1);
+    setTimeout(function() {
+        root.getElementById('test').appendChild(document.createElement('iframe'));
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();      
+    }, 0);
+}
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/subframe-load-crash.svg b/tests/tests/webkitsecurity/assets/subframe-load-crash.svg
new file mode 100755
index 0000000..b4dacde
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/subframe-load-crash.svg
@@ -0,0 +1,2 @@
+<g id="test"></g>
+
diff --git a/tests/tests/webkitsecurity/assets/subresource-load-failed-crash.html b/tests/tests/webkitsecurity/assets/subresource-load-failed-crash.html
new file mode 100644
index 0000000..e1cde29
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/subresource-load-failed-crash.html
@@ -0,0 +1,27 @@
+<html>
+<body id='console'>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+var xhr = new XMLHttpRequest;
+function secondRequest()
+{
+    xhr.onreadystatechange = function()
+    {
+        if (xhr.readyState == xhr.DONE) {
+            document.getElementById('console').appendChild(document.createTextNode("PASS"));
+            layoutTestController.notifyDone();
+        }
+    }
+    xhr.open("GET", "", true);
+    xhr.send();
+}
+window.addEventListener("DOMSubtreeModified", secondRequest, true);
+
+document.head.appendChild(document.createTextNode('X'));
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/surround-contents-font-face-crash.svg b/tests/tests/webkitsecurity/assets/surround-contents-font-face-crash.svg
new file mode 100644
index 0000000..0426080
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/surround-contents-font-face-crash.svg
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+<font>
+    <font-face id="f" font-family="SVGArial"/>
+<stop id="s"/>
+<script>
+
+if (!window.layoutTestController)
+    alert("This test requires GCController")
+else {
+    var range = document.createRange();
+    range.selectNodeContents( document.getElementById('s') );
+    GCController.collect();
+    range.surroundContents( document.getElementById('f') );
+    GCController.collect();
+
+    layoutTestController.dumpAsText();
+    alert("PASS. WebKit didn't crash.");
+}
+
+</script>
diff --git a/tests/tests/webkitsecurity/assets/svg-background-crash-on-refresh.html b/tests/tests/webkitsecurity/assets/svg-background-crash-on-refresh.html
new file mode 100644
index 0000000..d1b1599
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/svg-background-crash-on-refresh.html
@@ -0,0 +1,31 @@
+<html>
+<body>
+<div id="status">FAIL</div>
+<div>http://bugs.webkit.org/show_bug.cgi?id=12310</div>
+<div style="width: 200px; height: 200px; background-image: url(resources/butterfly.svg)"></div>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+    gc = function() { window.GCController.collect() };
+} else if (!window.gc)
+    gc = function() { };
+
+window.onload = function() {
+    if (location.hash != "#2") {
+        if (location.hash)
+            location.hash = "#" + (parseInt(location.hash.slice(1)) + 1).toString();
+        else
+            location.hash = "#1";
+
+        gc();
+        setTimeout(function() { location.reload() }, 0);
+    } else {
+        document.getElementById('status').innerHTML = "PASS";
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+}
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/svg-ellipse-render-crash.html b/tests/tests/webkitsecurity/assets/svg-ellipse-render-crash.html
new file mode 100644
index 0000000..fb74f1c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/svg-ellipse-render-crash.html
@@ -0,0 +1,40 @@
+<html>
+<head>
+    <style type="text/css">
+      .cls1 {
+        stroke: black;
+        fill: rgb(0,255,0);
+        stroke-width: 1;
+      }
+    </style>
+
+<script type="text/javascript">
+function setup() {
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    var svg = document.createElementNS("http://www.w3.org/2000/svg", "svg");
+    svg.width.baseVal.valueAsString = "400px";
+    svg.height.baseVal.valueAsString = "400px";
+    svg.viewBox.baseVal.x = 0;
+    svg.viewBox.baseVal.y = 0;
+    svg.viewBox.baseVal.width = 90;
+    svg.viewBox.baseVal.height = 90;
+    var ellipse = document.createElementNS("http://www.w3.org/2000/svg", "ellipse");
+    ellipse.cx.baseVal.value = 50;
+    ellipse.cy.baseVal.value = 50;
+    ellipse.rx.baseVal.value = 30;
+    ellipse.ry.baseVal.value = 10;
+    ellipse.className.baseVal = "cls1";
+    var drawing = document.getElementById("drawing");
+    svg.appendChild(ellipse);
+    drawing.appendChild(svg);
+}
+</script>
+</head>
+<body onload="setup()">
+<p>Here is an html paragraph. And below is a svg drawing. This should render without crashing.</p>
+<div id="drawing"/>
+</body>
+</html>
+
+
diff --git a/tests/tests/webkitsecurity/assets/svg-rtl-text-crash.html b/tests/tests/webkitsecurity/assets/svg-rtl-text-crash.html
new file mode 100644
index 0000000..52615a6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/svg-rtl-text-crash.html
@@ -0,0 +1,18 @@
+<html>

+  <script>

+  if (window.layoutTestController)

+      layoutTestController.dumpAsText();

+  </script>

+  <style>

+    svg {

+  	direction: rtl;

+    }

+    :before {

+      content: "]";

+    }

+  </style>

+  <svg>

+    <text>*</text>

+  </svg>

+  PASS

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/svg-transform-blur-crash.svg b/tests/tests/webkitsecurity/assets/svg-transform-blur-crash.svg
new file mode 100644
index 0000000..a1023c9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/svg-transform-blur-crash.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">

+  <script>

+  if (window.layoutTestController)

+      layoutTestController.dumpAsText();

+  </script>

+  <defs>

+    <filter id="blur" filterUnits="userSpaceOnUse" x="200" filterRes="200">

+      <feGaussianBlur stdDeviation="1 1"/>

+    </filter>

+  </defs>

+  <text filter="url(#blur)" transform="skewX(1) translate(0,1)">

+    PASS

+  </text>

+</svg>

diff --git a/tests/tests/webkitsecurity/assets/svg-use-style-float-crash.svg b/tests/tests/webkitsecurity/assets/svg-use-style-float-crash.svg
new file mode 100644
index 0000000..663e418
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/svg-use-style-float-crash.svg
@@ -0,0 +1,9 @@
+<svg xmlns="http://www.w3.org/2000/svg"> 
+<use style="float:left"/>  
+<text x="10" y="30">Test for https://bugs.webkit.org/show_bug.cgi?id=49316</text>
+<text id="console" x="10" y="60">PASSED (did not crash)</text>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/svglength-animation-retarget-crash.html b/tests/tests/webkitsecurity/assets/svglength-animation-retarget-crash.html
new file mode 100644
index 0000000..c613e4c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/svglength-animation-retarget-crash.html
@@ -0,0 +1,25 @@
+<p>This test verifies that SVG animation targets can change during the animation.</p>

+<p id="result"></p>

+<svg id="svg">

+    <text id="text"></text>

+    <animate xlink:href="#text" id="a" attributeName="y" begin="0.0" from="0" to="1" dur="1s" repeatCount="indefinite">

+</svg>

+<script>

+if (window.layoutTestController) {

+    layoutTestController.dumpAsText()

+    layoutTestController.waitUntilDone()

+}

+

+setTimeout(function() {

+    text = document.getElementById('text')

+    text.id = 'not_text'

+    svg = document.getElementById('svg')

+    svg.id = 'text'

+    svg.appendChild(document.getElementById('a').cloneNode())

+    setTimeout(function() {

+      document.getElementById("result").innerText = "TEST PASSED"

+      if (window.layoutTestController)

+          layoutTestController.notifyDone()

+    }, 0)

+}, 0)

+</script>

diff --git a/tests/tests/webkitsecurity/assets/switch-multiple-list-items-crash.html b/tests/tests/webkitsecurity/assets/switch-multiple-list-items-crash.html
new file mode 100644
index 0000000..5dab1c0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/switch-multiple-list-items-crash.html
@@ -0,0 +1,19 @@
+<html><head><script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function go() {
+    document.execCommand("selectall");
+    document.designMode="on";
+    document.execCommand("InsertLineBreak");
+    document.execCommand("insertimage");
+    document.execCommand("InsertOrderedList");
+    document.execCommand("inserthtml", false, "z");
+    document.execCommand("InsertHorizontalRule");
+    document.execCommand("selectall");
+    document.execCommand("createlink", false, "z");
+    document.execCommand("insertunorderedlist");
+    document.body.innerHTML = 'This test ensures WebKit does not crash when switching the type of a list with multiple list items.<br>PASS';
+}
+</script></head><body onload="go();"></body></html>
diff --git a/tests/tests/webkitsecurity/assets/symbol-viewport-element-crash.svg b/tests/tests/webkitsecurity/assets/symbol-viewport-element-crash.svg
new file mode 100755
index 0000000..09283c9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/symbol-viewport-element-crash.svg
@@ -0,0 +1,14 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">

+  <use>

+    <symbol>

+      <rect>

+        <animate attributeName="width" to="0%"></animate>

+      </rect>

+    </symbol>

+  </use>

+  <script>

+    if (window.layoutTestController)

+        layoutTestController.dumpAsText();

+  </script>

+  <text x="10px" y="100px">This test passes if it did not crash</text>

+</svg>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/tab-crash-with-image-map.html b/tests/tests/webkitsecurity/assets/tab-crash-with-image-map.html
new file mode 100644
index 0000000..9221e27
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/tab-crash-with-image-map.html
@@ -0,0 +1,72 @@
+<html>
+<head>
+    <script>
+
+        function dispatchTabPress(element, shiftKey)
+        {
+            var event = document.createEvent('KeyboardEvents');
+            var tabKeyIdentifier = 'U+0009';
+            event.initKeyboardEvent('keydown', true, true, document.defaultView, tabKeyIdentifier, 0, false, true, shiftKey, false, false);
+            element.dispatchEvent(event);
+        }
+
+        function test()
+        {
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+            }
+
+            document.getElementById("link1").focus();
+
+            for (var i = 0; i < 40; ++i) {
+                dispatchTabPress(document, false);
+            }
+         }
+    </script>
+</head>
+<body onload="test()">
+
+  Test passes if there is no crash
+
+  <p><a tabindex="5" id="link1" href="http://www.google.com/">Google (tabindex 5)</a></p>
+
+  <p><a tabindex="2" href="http://www.yahoo.com/">Yahoo (tabindex 2)</a></p>
+
+  <p><img src="resources/cake.png" usemap="#firstmap" alt=
+  "This is a alt text" style="border: 0px none;">
+  <map name="firstmap" title="map" id="firstmap">
+    <area shape="rect" id="upper_left" tabindex="3" coords="12,15,82,86" href=
+    "up_left.htm" title="upper left" alt="Blue rectangle">
+    <area shape="rect" id="middle_middle" tabindex="7" coords="122,103,191,172"
+    href="mid_mid.htm" title="middle middle" alt="Blue rectangle">
+    <area shape="rect" id="lower_middle" coords="121,192,192,261"
+    href="low_mid.htm" alt="Blue rectangle">
+    <area shape="circle" id="upper_middle" coords="157,52,33" href=
+    "up_mid.htm" alt="Red circle">
+    <area shape="circle" id="middle_left" tabindex="1" coords="47,135,33" href=
+    "mid_left.htm" alt="Red circle">
+    <area shape="circle" id="lower_right" coords="259,227,34" href=
+    "low_rt.htm" alt="Red circle">
+    <area shape="poly" id="lower_left" coords=
+    "57,198,23,221,23,241,58,265,93,241,93,221" href="low_left.htm" alt="Yellow hexagon">
+    <area shape="poly" id="middle_right" coords=
+    "264,106,232,127,230,148,264,171,298,148,298,126" href="mid_rt.htm" alt="Yellow hexagon">
+    <area shape="poly" id="upper_right" coords=
+    "261,18,226,41,226,59,263,85,295,59,296,38" href="up_rt.htm" alt="Yellow hexagon">
+    <area shape="poly" id="left_brown" coords=
+    "89,8,89,156,5,193,9,223,63,190,97,214,97,246,62,274,109,275,109,98,140,97"
+    href="left_brn.htm" alt="Brown polygon">
+    <area shape="poly" id="top_brown" coords="94,4,105,22,166,11,164,5" href=
+    "top_brn.htm" alt="Brown polygon">
+    <area shape="poly" id="right_brown" coords=
+    "168,5,169,11,194,33,194,257,265,283,265,270,220,247,220,200,255,179,227,158,227,123,265,98,221,68,220,36,269,6"
+    href="rt_brn.htm" alt="Brown polygon">
+    <area shape="default" href="default.htm" alt="foo">
+  </map></p>
+
+  <p><a href="http://www.google.com/" tabindex="4">Google (tabindex 4)</a></p>
+
+  <p><a href="http://www.yahoo.com/" tabindex="6">Yahoo (tabindex 6)</a></p>
+</body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/table-anonymous-block-destroy-crash.html b/tests/tests/webkitsecurity/assets/table-anonymous-block-destroy-crash.html
new file mode 100644
index 0000000..3062058
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-anonymous-block-destroy-crash.html
@@ -0,0 +1,26 @@
+<html>

+    <head>

+        <style>

+            div

+            {  

+                -webkit-column-span: all; 

+                -webkit-columns: 2; 

+                display: table-cell; 

+            }

+            div:last-of-type

+            { 

+                display: table-caption;

+            }

+        </style>

+    </head>

+    <body>

+        <div>

+            <div></div>

+        </div>

+        PASS

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+        </script>

+    </body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/table-captions-child-visible-crash.html b/tests/tests/webkitsecurity/assets/table-captions-child-visible-crash.html
new file mode 100644
index 0000000..5234b35
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-captions-child-visible-crash.html
@@ -0,0 +1,17 @@
+<html>

+    <body>

+	    Test passes if it does not crash.

+        <div style="visibility: collapse;">

+            <table>

+                <caption></caption>

+                <caption>

+                    <span style="visibility: visible;"></span>

+                </caption>

+            </table>

+        </div>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+        </script>

+    </body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/table-columns-blocks-calc-crash.html b/tests/tests/webkitsecurity/assets/table-columns-blocks-calc-crash.html
new file mode 100644
index 0000000..5f5e387
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-columns-blocks-calc-crash.html
@@ -0,0 +1,22 @@
+<html>

+    <head>

+        <style>

+            div

+            {

+                -webkit-column-span: all; 

+                display: table-cell;

+            }

+        </style>

+    </head>

+    <body>

+        <div>

+            <div></div>

+        </div>

+        PASS

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+        </script>

+    </body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/table-continuation-outline-paint-crash-expected.png b/tests/tests/webkitsecurity/assets/table-continuation-outline-paint-crash-expected.png
new file mode 100644
index 0000000..5a5437e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-continuation-outline-paint-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/table-continuation-outline-paint-crash.html b/tests/tests/webkitsecurity/assets/table-continuation-outline-paint-crash.html
new file mode 100644
index 0000000..1323768
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-continuation-outline-paint-crash.html
@@ -0,0 +1,32 @@
+<html>

+<body onload="runTest();">

+You should see a PASS with a solid outline around it.

+<script>

+function runTest()

+{

+    table = document.createElement('table');

+    document.body.appendChild(table);

+    

+    span1 = document.createElement('span');

+    span1.style.outlineStyle = 'solid';

+    span1.appendChild(document.createTextNode('PASS'));

+

+    span2 = document.createElement('span');

+    span1.appendChild(span2);

+

+    table.appendChild(span1);

+

+    span4 = document.createElement('span');

+    span4.style.display = 'list-item';

+    span2.appendChild(span4);

+

+    document.body.offsetTop;

+

+    span1.removeChild(span2);

+    span3 = document.createElement('span');

+    span3.insertBefore(span2, null);

+}

+</script>

+</body>

+</html>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/table-modification-crash.html b/tests/tests/webkitsecurity/assets/table-modification-crash.html
new file mode 100644
index 0000000..1634c9e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-modification-crash.html
@@ -0,0 +1,50 @@
+<html>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+
+<body id="body">
+
+    <!-- This test makes sure we do not crash if javascript changes a table element -->
+ 
+    <table border=1 id='table1'><tr><td>a</td><td>b</td><td>c</td></tr></table>
+
+    <div id="result"></div>
+     
+    <script>
+        if (window.accessibilityController) {
+            var result = document.getElementById("result");
+
+            var table = document.getElementById("table1");
+            table.focus();
+            tableAX = accessibilityController.focusedElement;
+
+            var string = tableAX.attributesOfChildren();
+
+             var row = document.createElement("tr")
+             var td1 = document.createElement("td")
+             td1.appendChild(document.createTextNode("column 1"))
+             row.appendChild(td1);
+
+             var td2 = document.createElement("td")
+             td2.appendChild(document.createTextNode("column 2"))
+             row.appendChild(td2);
+
+             var td3 = document.createElement("td")
+             td3.appendChild(document.createTextNode("column 3"))
+             row.appendChild(td3);
+
+             table.childNodes[0].appendChild(row);
+
+             string = tableAX.attributesOfChildren();
+ 
+             table.childNodes[0].removeChild(table.childNodes[0].childNodes[0]);
+
+             string = tableAX.attributesOfChildren();
+         
+             result.innerText += "Test passed\n";
+        }
+    </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/table-multi-column-crash.html b/tests/tests/webkitsecurity/assets/table-multi-column-crash.html
new file mode 100755
index 0000000..e36ca59
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-multi-column-crash.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<body>
+Test passes if it does not crash.
+<style>
+.table_span { -webkit-column-span: all;}
+.table_container { -webkit-column-count: 2; }
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+document.body.offsetTop;
+table_span = document.createElement('table');
+table_span.setAttribute('class', 'table_span');
+table_container = document.createElement('table');
+table_container.setAttribute('class', 'table_container');
+table_caption = document.createElement('caption');
+table_caption.appendChild(table_span);
+table_container.appendChild(table_caption);
+document.body.appendChild(table_container);
+document.body.offsetTop;
+
+table_caption.parentNode.removeChild(table_caption);
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/table-residual-style-crash-expected.png b/tests/tests/webkitsecurity/assets/table-residual-style-crash-expected.png
new file mode 100644
index 0000000..dc14b60
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-residual-style-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/table-residual-style-crash.html b/tests/tests/webkitsecurity/assets/table-residual-style-crash.html
new file mode 100644
index 0000000..4f6dd90
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-residual-style-crash.html
@@ -0,0 +1,8 @@
+<table>
+    <font>
+        <form>
+    </font>
+        </form>
+</table>
+
+<td>
diff --git a/tests/tests/webkitsecurity/assets/table-row-after-no-crash.html b/tests/tests/webkitsecurity/assets/table-row-after-no-crash.html
new file mode 100644
index 0000000..a614935
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-row-after-no-crash.html
@@ -0,0 +1,23 @@
+<html>
+  <head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+    <style>
+      body :after {
+        content: ".";
+      }
+    </style>
+  </head>
+  <body>
+<p>This test should load without crashing. It checks that generated
+content in tables is initialized properly.</p>
+    <table style="border-collapse: collapse;">
+      <tr>
+        <td><input type="text"></td>
+        <td><input type="submit"></td>
+      </tr>
+    </table>
+  </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/table-row-compositing-repaint-crash.html b/tests/tests/webkitsecurity/assets/table-row-compositing-repaint-crash.html
new file mode 100644
index 0000000..43c5949
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-row-compositing-repaint-crash.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
+   "http://www.w3.org/TR/html4/loose.dtd">
+
+<html lang="en">
+<head>
+  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+  <title>Table-row compositing crash</title>
+  <style type="text/css" media="screen">
+
+    .content {
+      height: 100px;
+      width: 100px;
+      -webkit-transform: translate3d(0, 0, 0);
+      display: table-row;
+    }
+  </style>
+  <script type="text/javascript" charset="utf-8">
+    if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+  </script>
+</head>
+<body>
+
+  <p><a href="https://bugs.webkit.org/show_bug.cgi?id=27796">https://bugs.webkit.org/show_bug.cgi?id=27796</a><br>Should not crash.</p>
+  <div class="content">
+    Table row.
+  </div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/table-section-node-at-point-crash.html b/tests/tests/webkitsecurity/assets/table-section-node-at-point-crash.html
new file mode 100755
index 0000000..a9abfe0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-section-node-at-point-crash.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<html>
+<body>
+Test passes if it does not crash.
+<style>
+#test1 {
+    display: table-cell;
+    content: counter(c);
+    counter-reset: c;
+    width: 1000px;
+    height: 1000px;
+}
+#test1::after {
+    content: counter(c);
+    counter-reset: c;
+}
+#test2 {
+    -webkit-flow-into: a;
+}
+#test2::before {
+    content: counter(c);
+    counter-reset: c;
+}
+</style>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function crash() {
+    test1 = document.createElement('div');
+    test1.setAttribute('id', 'test1');
+    document.body.appendChild(test1);
+    test2 = document.createElement('div'); 
+    test2.setAttribute('id', 'test2');
+    test1.appendChild(test2);
+    document.body.offsetTop;
+    document.body.style.zoom = 2;
+	if (window.layoutTestController) {
+	    GCController.collect();
+        eventSender.mouseMoveTo(500, 500);
+        layoutTestController.notifyDone();
+	}
+}
+window.onload = crash;
+</script>
+</body>
+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/table-with-empty-thead-causes-crash.html b/tests/tests/webkitsecurity/assets/table-with-empty-thead-causes-crash.html
new file mode 100644
index 0000000..6cc6926
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/table-with-empty-thead-causes-crash.html
@@ -0,0 +1,39 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script>
+
+    function buildAccessibilityTree(accessibilityObject) {
+        accessibilityObject.isEnabled
+
+        var count = accessibilityObject.childrenCount;
+        for (var i = 0; i < count; ++i)
+            buildAccessibilityTree(accessibilityObject.childAtIndex(i));
+    }
+</script>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+
+<table summary="table">
+    <thead>
+    </thead>
+<tr><td>1</td><td>2</td></tr>
+</table>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+    description("Construct accessibility objects for a table with an empty thread tag. This can cause a crash.");
+
+    if (window.accessibilityController) {
+        document.body.focus();
+        buildAccessibilityTree(accessibilityController.focusedElement);
+    }
+
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/teardown-crash.html b/tests/tests/webkitsecurity/assets/teardown-crash.html
new file mode 100644
index 0000000..1bd5ad0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/teardown-crash.html
@@ -0,0 +1,11 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+<p>
+    To pass this test, WebKit should not crash under GuardMalloc during render tree tear down.
+</p>
+<div style="-webkit-box-reflect: below; height: 100px; width: 100px; background-color: blue;">
+    <div style="position: absolute; height: 50px; width: 50px; background-color: teal;"></div>
+    <div style="height: 50px; width: 100px; background-color: silver;"></div>
+</div>
diff --git a/tests/tests/webkitsecurity/assets/temporary-span-crash.html b/tests/tests/webkitsecurity/assets/temporary-span-crash.html
new file mode 100644
index 0000000..6071193
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/temporary-span-crash.html
@@ -0,0 +1,19 @@
+<style>
+span { display: none }
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<body contenteditable>
+<p>Editing code creates temporary SPANs in some situations. Check we don't crash if we have style span { display: none }
+<p>
+<b id=b>select me fully </b><i id=i>select me partially ----------</i>
+<script>
+var selection = window.getSelection();
+var b = document.getElementById('b');
+var i = document.getElementById('i');
+selection.setBaseAndExtent(b, 0, i.firstChild, 20);
+document.execCommand("Delete");
+</script>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/text-before-table-col-crash.html b/tests/tests/webkitsecurity/assets/text-before-table-col-crash.html
new file mode 100644
index 0000000..9220331
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-before-table-col-crash.html
@@ -0,0 +1,19 @@
+<html>

+    <head>

+        <style>

+            div::before { 

+                display: table-column-group; 

+                content: "Before Generated Content"

+            }

+        </style>

+        <script>

+            if (window.layoutTestController)

+                layoutTestController.dumpAsText();

+        </script>

+    </head>

+    <body>

+        <div>

+            PASS

+        </div>

+    </body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/text-block-child-crash.xhtml b/tests/tests/webkitsecurity/assets/text-block-child-crash.xhtml
new file mode 100644
index 0000000..1dbe16b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-block-child-crash.xhtml
@@ -0,0 +1,13 @@
+<html xmlns="http://www.w3.org/1999/xhtml">

+    Test passes if it does not crash.

+    <script>

+        if (window.layoutTestController)

+            layoutTestController.dumpAsText();

+    </script>

+    <style>

+        svg text:before { display: list-item; content: 'PASS'; }

+    </style>

+    <svg xmlns="http://www.w3.org/2000/svg">

+        <text></text>

+    </svg>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/text-content-crash-2.html b/tests/tests/webkitsecurity/assets/text-content-crash-2.html
new file mode 100644
index 0000000..341cf57
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-content-crash-2.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+    <title></title>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<body>
+    <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=15008">http://bugs.webkit.org/show_bug.cgi?id=15008</a>
+        ASSERTION FAILED: !firstLineBox() == !lastLineBox() setting content on image</i>.
+    </p>
+    <p>
+        No crash means SUCCESS.
+    </p>
+    <img style="content: 'foo';" src="resources/animated.gif">
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/text-content-crash.html b/tests/tests/webkitsecurity/assets/text-content-crash.html
new file mode 100644
index 0000000..2a5c950
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-content-crash.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+    <title></title>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</head>
+<body>
+    <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=13242">http://bugs.webkit.org/show_bug.cgi?id=13242</a>
+        REGRESSION: Repro crash when specifying the content property for an image</i>.
+    </p>
+    <p>
+        No crash means SUCCESS.
+    </p>
+    <img style="content: 'foo';">
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/text-control-crash-on-select.html b/tests/tests/webkitsecurity/assets/text-control-crash-on-select.html
new file mode 100644
index 0000000..35199a9
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-control-crash-on-select.html
@@ -0,0 +1,38 @@
+Tests that we don't crash when killing an text input's or textarea's renderer and then calling select.
+<textarea id="textarea1">textarea</textarea>
+<textarea id="textarea2">textarea</textarea>
+<textarea id="textarea3">textarea</textarea>
+<textarea id="textarea4">textarea</textarea>
+<input id="input1">
+<input id="input2">
+<input id="input3">
+<input id="input4">
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function $(id) {
+        return document.getElementById(id);
+    }
+
+    function testSettingSelection(tagName) {
+        var id = tagName + '1';
+        $(id).style.display = "none";
+        $(id).select();
+
+        id = tagName + '2';
+        $(id).style.display = "none";
+        $(id).setSelectionRange(1, 2);
+
+        id = tagName + '3';
+        $(id).style.display = "none";
+        $(id).selectionStart = 2;
+
+        id = tagName + '4';
+        $(id).style.display = "none";
+        $(id).selectionEnd = 1;
+    }
+    
+    testSettingSelection('textarea');
+    testSettingSelection('input');
+</script>
diff --git a/tests/tests/webkitsecurity/assets/text-control-selection-crash.html b/tests/tests/webkitsecurity/assets/text-control-selection-crash.html
new file mode 100644
index 0000000..77843a1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-control-selection-crash.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>

+<html>

+Test passes if it does not crash.

+<textarea id="A"></textarea>

+<textarea id="B"></textarea>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+A.selectionStart = 0;

+B.style.display = "none";

+B.selectionStart = 0;

+</script>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/text-field-setvalue-crash.html b/tests/tests/webkitsecurity/assets/text-field-setvalue-crash.html
new file mode 100644
index 0000000..74edc0f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-field-setvalue-crash.html
@@ -0,0 +1,28 @@
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function test()
+{
+	var emailID=document.apply.EmailAdd;
+	emailID.focus();
+	document.execCommand("InsertText", false, "aaa")
+	emailID.value="";
+	document.execCommand("InsertText", false, "aaa")
+	document.execCommand("Undo");
+	document.execCommand("Undo");
+}
+
+</script>
+
+<BODY onload="test()">
+<p>This test checks that undoing across a programmatic change to a
+text field's value doesn't cause crashes or assertion failures. If
+this test does not crash, it has passed.</p>
+
+<form name="apply"> 
+<input name="EmailAdd" type="text" onBlur="javascript:ValidateForm();">
+</form>
+
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/text-node-append-data-remove-crash.html b/tests/tests/webkitsecurity/assets/text-node-append-data-remove-crash.html
new file mode 100644
index 0000000..28fb29a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-node-append-data-remove-crash.html
@@ -0,0 +1,50 @@
+<html>
+<body onload="runTest()">
+<script>
+var count = 0;
+if (window.layoutTestController)
+{
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function runTest()
+{   
+    try {
+       divBlock.addEventListener("DOMCharacterDataModified", eventListener, false);
+       pBlock.outerText = "text";
+       divBlock.innerHTML = "PASS, didn't crash.";
+    }
+    catch (exception) {
+       divBlock.innerHTML = "Threw an exception - " + exception;
+    }
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+function eventListener()
+{
+    try {
+      var range = document.createRange();
+      range.setStart(divBlock, 0);
+      range.setEnd(divBlock, divBlock.childNodes.length - 1);
+      range.deleteContents();
+      gc();
+  } catch(e) { }
+}
+
+function gc()
+{
+    if (window.GCController)
+        return GCController.collect();
+
+    for (var i = 0; i < 10000; i++) { // > force garbage collection (FF requires about 9K allocations before a collect)
+        var s = new String("");
+    }
+}
+</script>
+<div id="divBlock">
+<br/>textnode1<p id="pBlock"></p>textnode2<br/>
+</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/text-set-value-crash.html b/tests/tests/webkitsecurity/assets/text-set-value-crash.html
new file mode 100644
index 0000000..d378521
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-set-value-crash.html
@@ -0,0 +1,36 @@
+<html>
+<head>
+    <title></title>
+</head>
+<body>
+    <p>
+        Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=11115">http://bugs.webkit.org/show_bug.cgi?id=11115</a>
+        REGRESSION: Crash on Flickr after hitting cancel from adding a note</i>.
+    </p>
+    <p>
+        No crash means test PASS.
+    </p>
+    <div id="q">
+        <textarea id="t">Lorem ipsum</textarea>
+    </div>
+    <div id="r">
+        <input id="u" value="Lorem ipsum">
+    </div>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+    
+        var t = document.getElementById("t");
+        var q = document.getElementById("q");
+        t.focus();
+        q.style.display='none';
+        t.value='';
+
+        var u = document.getElementById("u");
+        var r = document.getElementById("r");
+        u.focus();
+        r.style.display='none';
+        u.value='';
+    </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/text-style-recalc-crash.html b/tests/tests/webkitsecurity/assets/text-style-recalc-crash.html
new file mode 100644
index 0000000..a5bceb8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-style-recalc-crash.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<svg viewBox="0 0 1 1">
+<font-face font-family="A">
+<font-face-src>
+<font-face-uri xlink:href="A"/>
+</font-face-src>
+</font-face>
+<g font-family="A">
+<text>PASS</text>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    document.execCommand("SelectAll");
+</script>
+<g>
+<text></text>
+</g>
+</g>
+</svg>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/text-transform-nontext-node-crash.xhtml b/tests/tests/webkitsecurity/assets/text-transform-nontext-node-crash.xhtml
new file mode 100644
index 0000000..80e2512
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/text-transform-nontext-node-crash.xhtml
@@ -0,0 +1,26 @@
+<html xmlns="http://www.w3.org/1999/xhtml">

+<head>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+function finish() {

+    document.getElementById("result").innerHTML = "PASS";

+}

+</script>

+</head>

+<body onload="finish()">

+<p>Tests that text transformation applied to a non-text node does not result in crash.</p>

+<div id="result"></div>

+<br>

+<style type="text/css">

+br {

+    text-transform: lowercase;

+}

+br:first-letter {

+    text-transform: lowercase;

+}

+</style>

+</br>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/textarea-checkValidity-crash.html b/tests/tests/webkitsecurity/assets/textarea-checkValidity-crash.html
new file mode 100644
index 0000000..ed943e5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/textarea-checkValidity-crash.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description">Bug 45681: Assertion failure about dirty flag changes of textarea elements.</p>
+<div id="console"></div>
+<script>
+var ta = document.createElement('textarea');
+ta.setAttribute('maxlength', '1');
+ta.value = 'abc'; // Make it dirty && invalid.
+ta.checkValidity(); // This made an assertion failure.
+testPassed('Not crashed.');
+
+ta.value = 'a'; // Make it dirty && valid.
+ta.defaultValue = 'abc'; // Make it non-dirty && invalid.
+ta.checkValidity(); // This made an assertion fail.
+testPassed('Not crashed.');
+</script>
+<script src="../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/textarea-node-removed-from-document-crash.html b/tests/tests/webkitsecurity/assets/textarea-node-removed-from-document-crash.html
new file mode 100644
index 0000000..32f5842
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/textarea-node-removed-from-document-crash.html
@@ -0,0 +1,23 @@
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:xht="http://www.w3.org/1999/xhtml">

+    <script type="text/javascript">

+        if (window.layoutTestController)

+        {

+            layoutTestController.dumpAsText();

+            layoutTestController.waitUntilDone();

+        }

+        

+        function runTest()

+        {

+            var elements = document.getElementsByTagNameNS('http://www.w3.org/1999/xhtml','html');

+            elements[0].textContent = "PASS";

+            

+            if (window.layoutTestController)

+                layoutTestController.notifyDone();

+        }

+    </script> 

+    <xht:object>

+        <input autofocus="" onfocus="runTest();"/> 

+        <xht:textarea></xht:textarea>

+    </xht:object>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/textarea-submit-crash.html b/tests/tests/webkitsecurity/assets/textarea-submit-crash.html
new file mode 100644
index 0000000..4102137
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/textarea-submit-crash.html
@@ -0,0 +1,31 @@
+<p>This tests that a display:none textarea doesn't crash when submitted in a form.</p>
+<form action="?" id="form">
+    <textarea id="textarea" name=value style="-webkit-appearance:textarea" wrap=hard>123456789</textarea>
+</form>
+
+<pre id="console"></pre>
+
+<script>
+function log(s) {
+    document.getElementById('console').appendChild(document.createTextNode(s + "\n"));
+}
+
+(function () {    
+    if (document.URL.indexOf('?') == -1) {
+        if (window.layoutTestController) {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+        }
+
+        document.getElementById("textarea").style.display = "none";
+        document.getElementById("form").submit();
+        return;
+    }
+
+    log("PASS: You didn't crash.");
+    log("Submitted form value: " + location.search);
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+})();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/textbox-not-removed-crash.html b/tests/tests/webkitsecurity/assets/textbox-not-removed-crash.html
new file mode 100755
index 0000000..c06ca00
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/textbox-not-removed-crash.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+#test1 {
+    text-indent: -1em;
+    content: counter(c);
+    -webkit-column-count: 1;
+}
+#test3 {
+    -webkit-column-span: all;
+}
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function crash() {
+    test1 = document.createElement('div'); 
+    test1.setAttribute('id', 'test1'); 
+    document.body.appendChild(test1);
+    test2 = document.createElement('div'); 
+    test1.appendChild(test2);
+    test3 = document.createElement('div'); 
+    test3.setAttribute('id', 'test3');
+    test2.appendChild(test3);
+    test2.appendChild(document.createTextNode('A')); 
+    test2.style.display = '-webkit-box';
+    document.body.offsetTop;
+    test3.style.display = 'list-item';
+    document.body.offsetTop;
+    document.body.style.zoom = 2;
+}
+window.onload = crash;
+</script>
+</head>
+<body>
+Test passes if it does not crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/textbox-role-on-contenteditable-crash.html b/tests/tests/webkitsecurity/assets/textbox-role-on-contenteditable-crash.html
new file mode 100644
index 0000000..ffcf31c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/textbox-role-on-contenteditable-crash.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<body>
+<p>This tests a crashing scenario where an element with a textbox role attribute which also contenteditable has its content changed.</p>
+<div id="textbox" role="textbox" aria-multiline="true" contenteditable="true" tabindex="0">
+Textbox content.
+</div>
+
+<script>
+
+if (window.accessibilityController) {
+    layoutTestController.dumpAsText();
+    var textbox = document.getElementById("textbox");
+    textbox.focus();
+    var textboxAXElement = accessibilityController.focusedElement;
+
+    getSelection().setBaseAndExtent(textbox.firstChild, 0, textbox.firstChild, 0);
+
+    // This should not crash.
+    document.execCommand("InsertParagraph");
+
+    document.write("PASS");
+}
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/thumbslider-crash.html b/tests/tests/webkitsecurity/assets/thumbslider-crash.html
new file mode 100644
index 0000000..e84104e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/thumbslider-crash.html
@@ -0,0 +1,14 @@
+<html>
+<head>
+    <style type="text/css">
+        * { -webkit-appearance: sliderthumb-horizontal; }
+    </style>
+</head>
+<body>
+PASS If this test does not crash. http://bugs.webkit.org/show_bug.cgi?id=12045
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/tiling-regular-hexagonal-crash.svg b/tests/tests/webkitsecurity/assets/tiling-regular-hexagonal-crash.svg
new file mode 100644
index 0000000..5a3ba08
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/tiling-regular-hexagonal-crash.svg
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg id="Tiling_Regular_6_3_Hexagonal" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="400" height="400">
+<script>
+  if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+</script>
+
+<defs>
+   <polygon id="Hexagon" stroke="#000000" stroke-width="4" points="0,0 52,0 78,45 52,90 0,90 -26,45"/>
+
+   <g id="Hex_Group">
+      <use xlink:href="#Hexagon" transform="translate(-26)"/>
+      <use xlink:href="#Hexagon" transform="translate(130)"/>
+      <use xlink:href="#Hexagon" transform="translate(52, -135)"/>
+      <text x="10" y="30">PASS - didn't crash, bug 36231</text>
+   </g>
+   
+   <pattern id="Hex_Pattern" patternUnits="userSpaceOnUse" patternTransform="translate(4, 20) scale(0.5)" width="156" height="270">
+      <use xlink:href="#Hex_Group" fill="#99BBDD" transform="translate(0, 90) scale(1, -1)"/>
+      <use xlink:href="#Hex_Group" fill="#BB99DD" transform="translate(0, 90)"/>
+      <use xlink:href="#Hex_Group" fill="#DD99BB" transform="translate(0, 180)"/>
+      <use xlink:href="#Hexagon" fill="#BB99DD" transform="translate(52, 225)"/>
+   </pattern>
+   
+</defs>
+
+<rect x="2" y="2" height="394" width="394" stroke="#000000" stroke-width="2" fill="url(#Hex_Pattern)"/>
+
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/toggle-reflection-crash.html b/tests/tests/webkitsecurity/assets/toggle-reflection-crash.html
new file mode 100644
index 0000000..202ddd5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/toggle-reflection-crash.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+<script>
+  var reflectionOn = true;
+  function toggleReflection() {
+    reflectionOn = !reflectionOn;
+    var box = document.getElementById('box');
+    box.style.webkitBoxReflect = reflectionOn ? 'below' : 'none';
+  };
+
+  function finishTest() {
+    toggleReflection();
+    if (window.layoutTestController)
+      layoutTestController.notifyDone();
+  };
+
+  function startTest() {
+    if (window.layoutTestController) {
+      layoutTestController.waitUntilDone();
+      layoutTestController.dumpAsText();
+    }
+    toggleReflection();
+    window.setTimeout(function() { finishTest(); }, 0);
+  };
+
+  window.addEventListener('load', startTest, false);
+
+</script>
+</head>
+
+<body>
+  <p>This test should not crash when run with Address Sanitizer.</p>
+  <div id="box" style="-webkit-box-reflect: below;"</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/touch-stale-node-crash.html b/tests/tests/webkitsecurity/assets/touch-stale-node-crash.html
new file mode 100644
index 0000000..0d7f36b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/touch-stale-node-crash.html
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div style="background-color:red;height:100px;width:100px;"></div>
+<div id="console"></div>
+<script src="resources/touch-stale-node-crash.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/touch-stale-node-crash.js b/tests/tests/webkitsecurity/assets/touch-stale-node-crash.js
new file mode 100644
index 0000000..c546a69
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/touch-stale-node-crash.js
@@ -0,0 +1,20 @@
+document.ontouchstart = touchStartHandler;
+
+function touchStartHandler(e)
+{
+    var target = e.touches[0].target;
+    document.body.removeChild(target);
+    window.location = 'resources/send-touch-up.html';
+}
+
+description("If this test does not crash then you pass!");
+
+if (window.layoutTestController)
+    layoutTestController.waitUntilDone();
+
+if (window.eventSender) {
+    eventSender.clearTouchPoints();
+    eventSender.addTouchPoint(50, 150);
+    eventSender.touchStart();
+} else
+    debug('This test requires DRT.');
diff --git a/tests/tests/webkitsecurity/assets/track-text-track-destructor-crash.html b/tests/tests/webkitsecurity/assets/track-text-track-destructor-crash.html
new file mode 100644
index 0000000..c2d0760
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/track-text-track-destructor-crash.html
@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+
+        <script src=../media-file.js></script>
+        <script src=../video-test.js></script>
+        <script>
+
+            tracks = [];
+
+            function startTest()
+            {
+                consoleWrite("Create video and add text tracks.");
+                var video = document.createElement('video');
+                for (var i = 0; i < 1000; i++)
+                    tracks[i] = video.addTextTrack('captions', 'Captions Track', 'en');
+                testExpected("tracks.length", 1000);
+                consoleWrite("");
+                consoleWrite("Destroy the video and force a garbage collection.");
+                video = 0;
+                forceGC();
+                consoleWrite("SUCCESS: Did not crash");
+                endTest();
+            }
+            
+            function forceGC()
+            {
+                if (window.GCController)
+                    return GCController.collect();
+            
+                // Force garbage collection
+                for (var ndx = 0; ndx < 99000; ndx++)
+                    var str = new String("1234");
+            }
+
+        </script>
+    </head>
+    <body onload="startTest()">
+    <p>Tests that we don't crash when a media element that has text tracks is destructed.</p>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/transaction-callback-exception-crash.html b/tests/tests/webkitsecurity/assets/transaction-callback-exception-crash.html
new file mode 100644
index 0000000..4bcc732
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/transaction-callback-exception-crash.html
@@ -0,0 +1,20 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+var db = openDatabase("15976Test", "1.0", "Test for http://bugs.webkit.org/show_bug.cgi?id=15976", 1);
+db.transaction(function(tx) {
+   if (window.layoutTestController)
+       window.setTimeout(function() { layoutTestController.notifyDone() }, 0);
+   throw "TransactionCallbackError";
+});
+</script>
+</head>
+<body>
+If WebKit doesn't crash, this test has passed
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/transaction-crash-on-abort.html b/tests/tests/webkitsecurity/assets/transaction-crash-on-abort.html
new file mode 100644
index 0000000..80c2d13
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/transaction-crash-on-abort.html
@@ -0,0 +1,47 @@
+<html>
+<head>
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+<script src="resources/shared.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+
+description("Test IndexedDB transaction does not crash on abort.");
+if (window.layoutTestController)
+    layoutTestController.waitUntilDone();
+
+function test()
+{
+    shouldBeTrue("'webkitIndexedDB' in window");
+    shouldBeFalse("webkitIndexedDB == null");
+
+    request = evalAndLog("webkitIndexedDB.open('transaction-crash-on-abort')");
+    request.onsuccess = openSuccess;
+    request.onerror = unexpectedErrorCallback;
+}
+
+function openSuccess()
+{
+    debug("openSuccess():");
+    db = evalAndLog("db = event.target.result");
+    request = evalAndLog("db.setVersion('1.0')");
+    request.onsuccess = setVersionSuccess;
+    request.onerror = unexpectedErrorCallback;
+}
+
+function setVersionSuccess()
+{
+    evalAndLog("db.createObjectStore('foo')");
+    evalAndLog("db.transaction('foo')");
+    evalAndLog("window.gc()");
+    done();
+}
+
+
+test();
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/transition-cache-dictionary-crash.html b/tests/tests/webkitsecurity/assets/transition-cache-dictionary-crash.html
new file mode 100644
index 0000000..fc99ac1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/transition-cache-dictionary-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/transition-cache-dictionary-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/transition-cache-dictionary-crash.js b/tests/tests/webkitsecurity/assets/transition-cache-dictionary-crash.js
new file mode 100644
index 0000000..464b35f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/transition-cache-dictionary-crash.js
@@ -0,0 +1,18 @@
+description("Test to ensure we don't attempt to cache new property transitions on dictionary.  Passes if you don't crash.");
+
+var cacheableDictionary = {};
+for (var i = 0; i < 500; i++)
+    cacheableDictionary["a" + i] = i;
+
+function f(o) {
+    o.crash = "doom!";
+}
+f({});
+f(cacheableDictionary);
+f(cacheableDictionary);
+f(cacheableDictionary);
+f(cacheableDictionary);
+f(cacheableDictionary);
+f(cacheableDictionary);
+f(cacheableDictionary);
+f(cacheableDictionary);
diff --git a/tests/tests/webkitsecurity/assets/transition-duration-cleared-in-transitionend-crash.html b/tests/tests/webkitsecurity/assets/transition-duration-cleared-in-transitionend-crash.html
new file mode 100644
index 0000000..0c01a86
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/transition-duration-cleared-in-transitionend-crash.html
@@ -0,0 +1,19 @@
+<html>
+    <body>
+        This tests that we don't crash if we clear a transitions duration during the transition end callback.
+        <div id="t" style="background-color:#000">test</div> 
+        <script>
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.waitUntilDone();
+            }
+            var el = document.getElementById('t');
+            el.addEventListener('webkitTransitionEnd', function(){
+                el.style.webkitTransitionDuration = '';
+                if (window.layoutTestController)
+                    layoutTestController.notifyDone();
+            });
+            el.style.cssText += ';-webkit-transition:background-color 0.2s;background-color:#fff'
+        </script>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/tree-scope-crash.html b/tests/tests/webkitsecurity/assets/tree-scope-crash.html
new file mode 100644
index 0000000..02de496
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/tree-scope-crash.html
@@ -0,0 +1,53 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src="../../../resources/dump-as-markup.js"></script>
+<script>
+RELOAD_THRESHOULD = 10;
+
+if (window.layoutTestController)
+    layoutTestController.waitUntilDone();
+
+Markup.noAutoDump();
+    
+function assertMarkup(name, element, expected)
+{
+    var markup = Markup.get(element);
+}
+
+function currentCount()
+{
+   var match = /=(.*)/.exec(window.location.search)
+   if (!match)
+       return 0;
+   return parseInt(match[1]);
+}
+
+function runTest()
+{
+    var items = document.getElementsByTagName('li');
+    document.getElementById('testReplace').outerHTML = '<progress> node';
+    assertMarkup('replace', items[0], '| \n|   "Replaced"\n| " node using outerHTML."');
+
+    
+    var count = currentCount();
+    if (RELOAD_THRESHOULD <= count && window.layoutTestController) {
+        layoutTestController.notifyDone();
+        return;
+    }
+
+    document.getElementById("counter").value = (count + 1).toString();
+    document.getElementById("theForm").submit();
+}
+</script>
+</head>
+<body onload="runTest()">
+<h1>PASS unless crash</h1>
+<ul>
+  <li><span id="testReplace"></span></li>
+</ul>
+<form id="theForm">
+  <input id="counter" name="counter" value="">
+<form>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/tref-clone-crash.html b/tests/tests/webkitsecurity/assets/tref-clone-crash.html
new file mode 100644
index 0000000..818efb7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/tref-clone-crash.html
@@ -0,0 +1,33 @@
+<svg xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
+  <defs>
+    <style id="style"/>
+    <text id="ref"></text>
+  </defs>
+  <g><use xlink:href="#ref"/></g>
+  <g><text><tref id="tref" xlink:href="#ref"/></text></g>
+  <script>
+    function gc() {
+      if (window.GCController)
+        GCController.collect();
+      else {
+        for (var i = 0; i < 10000; ++i)
+          new Object;
+      }
+    }
+    if (window.layoutTestController) {
+      layoutTestController.dumpAsText();
+      layoutTestController.waitUntilDone();
+    }
+    function runTest() {
+      var tref = document.getElementById("tref");
+      tref.cloneNode(true);
+      gc();
+      var elem = document.getElementById("style");
+      var parent = elem.parentNode;
+      parent.insertBefore(document.createElement("source"), elem);
+      document.body.innerHTML = "PASS";
+      if (window.layoutTestController)
+        layoutTestController.notifyDone();
+    }
+  </script>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/tref-event-listener-crash.svg b/tests/tests/webkitsecurity/assets/tref-event-listener-crash.svg
new file mode 100644
index 0000000..49fc958
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/tref-event-listener-crash.svg
@@ -0,0 +1,15 @@
+<html xmlns="http://www.w3.org/1999/xhtml">

+Test passes if it does not crash.

+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" id="container">

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+window.onload = function() {

+    document.getElementById("container").textContent = "1";

+}

+</script>

+<desc id="test-desc"></desc>

+<tref xlink:href="#test-desc"></tref>

+</svg>

+</html>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/tref-remove-target-crash-expected.svg b/tests/tests/webkitsecurity/assets/tref-remove-target-crash-expected.svg
new file mode 100644
index 0000000..3d1557d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/tref-remove-target-crash-expected.svg
@@ -0,0 +1,3 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <text x="200" y="50" font-family="Verdana" font-size="25" fill="green">QUX</text>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/tref-remove-target-crash.svg b/tests/tests/webkitsecurity/assets/tref-remove-target-crash.svg
new file mode 100644
index 0000000..e268a90
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/tref-remove-target-crash.svg
@@ -0,0 +1,26 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <text x="100" y="50" font-family="Verdana" font-size="25" fill="green">
+    <!-- Removing the referenced text element should not cause a crash -->
+    <tref xlink:href="#text1"/>
+  </text>
+  <text x="200" y="50" font-family="Verdana" font-size="25" fill="green">
+    <!-- This should pick up the replaced text element and its updated text content -->
+    <tref xlink:href="#text2"/>
+  </text>
+
+  <text x="100" y="100" id="text1">FOO</text>
+  <text x="200" y="100" id="text2">BAR</text>
+
+<script>
+  var el1 = document.getElementById('text1');
+  el1.parentNode.removeChild(el1);
+  var el2 = document.getElementById('text2');
+  el2.parentNode.removeChild(el2);
+  var newel = document.createElementNS('http://www.w3.org/2000/svg', 'text');
+  newel.setAttribute('id', 'text2');
+  newel.setAttribute('visibility', 'hidden');
+  newel.textContent = 'BAZ';
+  document.documentElement.appendChild(newel);
+  document.getElementById('text2').textContent = 'QUX';
+</script>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/try-catch-crash.html b/tests/tests/webkitsecurity/assets/try-catch-crash.html
new file mode 100644
index 0000000..bfde9d8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/try-catch-crash.html
@@ -0,0 +1,34 @@
+This test checks whether funky scope chains created by catch blocks
+are properly protected from GC. It should not crash.
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function Test_Error() {
+    for( var i = 0; i <= 5000; i++ ) {
+        try {
+            throw new Error("Ungraceful Error");
+        }
+        catch (e) {
+            try { 
+                throw new Error("Graceful Error"); 
+            } 
+            catch (e)  { 
+                Test_Error_isPrime(147457); //Do something CPU-intensive
+            }
+            finally{
+                Test_Error_isPrime(147457); //Do something CPU-intensive
+            }
+        }
+    }
+}
+function Test_Error_isPrime(PrimeTest) {
+    for(i=2;i<=Math.sqrt(147457)+1;i++) {
+        if (PrimeTest % i == 0) {
+            return false;
+        }
+    }
+    return true;
+}
+Test_Error();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/typeof-codegen-crash.html b/tests/tests/webkitsecurity/assets/typeof-codegen-crash.html
new file mode 100644
index 0000000..986ccaa
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/typeof-codegen-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/typeof-codegen-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/typeof-codegen-crash.js b/tests/tests/webkitsecurity/assets/typeof-codegen-crash.js
new file mode 100644
index 0000000..6e632dc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/typeof-codegen-crash.js
@@ -0,0 +1,13 @@
+description(
+"This test for a crash when optimizing expressions of the form 'typeof o == constant' where 'constant' is not a string."
+);
+
+var o = { };
+
+shouldBeFalse("typeof o == undefined");
+shouldBeFalse("typeof o == null");
+shouldBeFalse("typeof o == true");
+shouldBeFalse("typeof o == false");
+shouldBeFalse("typeof o == 1");
+shouldBeFalse("typeof o == 1.0");
+shouldBeFalse("typeof o == { }");
diff --git a/tests/tests/webkitsecurity/assets/undefined-property-crash-expected.png b/tests/tests/webkitsecurity/assets/undefined-property-crash-expected.png
new file mode 100644
index 0000000..ea8b775
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/undefined-property-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/undefined-property-crash.html b/tests/tests/webkitsecurity/assets/undefined-property-crash.html
new file mode 100644
index 0000000..30cc13a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/undefined-property-crash.html
@@ -0,0 +1,59 @@
+<html>
+<head>
+<script>
+function print(message) {
+    var paragraph = document.createElement("p");
+    paragraph.appendChild(document.createTextNode(message));
+    document.getElementById("console").appendChild(paragraph);
+}
+
+function test2()
+{
+    return objCController.doesNotExist;
+}
+
+function test()
+{
+    if (!window.objCController) {
+        print("FAIL: window.objCController does not exist");
+        return;
+    }
+
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var crasher = test2();
+    delete objCController;
+    
+    // create lots of objects to force a garbage collection
+    var i = 0;
+    var s;
+    while (i < 5000) {
+        i = i + 1.11;
+        s = s + " ";
+    }
+    
+    if (crasher) {} // force call to toBoolean
+    if (crasher == null) {} // force call to type() through call to equal
+    
+    if (window.objCController)
+        print("FAIL: unable to delete objCController");
+    else
+        print("PASS: You didn't crash.");
+}
+</script>
+</head>
+<body onload="test()">
+<p>
+This test checks for a regression against: rdar://problem/4176077 CrashTracer: 
+6569 crashes in DashboardClient at com.apple.JavaScriptCore:
+KJS::Bindings::ObjcFallbackObjectImp::type()
+</p>
+<p>
+This test only works in DumpRenderTree, because it depends on having a plugin object 
+that it can 'delete.'
+</p>
+<hr>
+<div id="console"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/undo-crash.html b/tests/tests/webkitsecurity/assets/undo-crash.html
new file mode 100644
index 0000000..e68b8d3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/undo-crash.html
@@ -0,0 +1,44 @@
+<html><head>
+<title>Undo crash</title>
+</head>
+<body onload="load()">
+To run this test manually, type some text in the input field, then click the "Crash me" button.
+<input id="testinput" type="text"></input>
+<input id='testbutton' type="button" value="Crash me" onclick="crash()">
+<ul id="console"></ul>
+<script>
+
+function load()
+{
+    document.getElementById('testinput').focus();
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+    document.execCommand('InsertText', false, 'b');
+    document.execCommand('InsertText', false, 'l');
+    document.execCommand('InsertText', false, 'a');
+    document.execCommand('InsertText', false, 'h');
+    if (eventSender) {
+        var button = document.getElementById('testbutton');
+        eventSender.mouseMoveTo(button.offsetLeft + 10, button.offsetTop + 5)
+        eventSender.mouseDown();
+        eventSender.mouseUp();
+    }
+}
+
+function crash()
+{
+    var elem = document.getElementById('testinput');
+    elem.style.display = 'none';
+    document.execCommand('undo');
+    log("SUCCEEDED");
+}
+
+function log(str) {
+    var li = document.createElement("li");
+    li.appendChild(document.createTextNode(str));
+    var console = document.getElementById("console");
+    console.appendChild(li);
+}
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/unexpected-constant-crash.html b/tests/tests/webkitsecurity/assets/unexpected-constant-crash.html
new file mode 100644
index 0000000..86ceb69
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/unexpected-constant-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/unexpected-constant-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/unexpected-constant-crash.js b/tests/tests/webkitsecurity/assets/unexpected-constant-crash.js
new file mode 100644
index 0000000..0431687
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/unexpected-constant-crash.js
@@ -0,0 +1,7 @@
+description(
+"This test checks that the regexp and unexpected constant counters are not confused with each other. It will fail with an assertion failure in a debug build if this is the case."
+);
+
+var r = / /;
+var s;
+delete s;
diff --git a/tests/tests/webkitsecurity/assets/uniscribe-item-boundary-crash.html b/tests/tests/webkitsecurity/assets/uniscribe-item-boundary-crash.html
new file mode 100644
index 0000000..81dc2f7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/uniscribe-item-boundary-crash.html
@@ -0,0 +1,15 @@
+<HTML>

+<HEAD>

+<META http-equiv="Content-Type" content="text/html; charset=utf-8">

+<title>Test for bug 41554 : Crash reading past end of block in UniscribeController::shapeAndPlaceItem</title>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+</script>

+</HEAD>

+<BODY>

+<p>

+Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=41554">https://bugs.webkit.org/show_bug.cgi?id=41554</a>. Crash reading past end of block in UniscribeController::shapeAndPlaceItem</p>

+<p>Full page heap (gflags +hpa) should be enabled reproduce a crash.  No crash means test passed.</p>

+<span>ผู้เชี่ยมชมเวบไซต์</span>

+</BODY></HTML>

diff --git a/tests/tests/webkitsecurity/assets/unsupported-attribute-does-not-crash.html b/tests/tests/webkitsecurity/assets/unsupported-attribute-does-not-crash.html
new file mode 100644
index 0000000..b6d29b6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/unsupported-attribute-does-not-crash.html
@@ -0,0 +1,29 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<a href="http://www.webkit.org" id="link">link</a>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This tests that aria-label works on area elements.");
+
+    if (window.accessibilityController) {
+
+        document.getElementById("link").focus();
+
+        // This should not crash DRT even though it is an unsupported attribute for the element.
+        accessibilityController.focusedElement.cellForColumnAndRow(1, 1);
+    }
+
+</script>
+
+<script src="../../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/update-always-create-line-boxes-full-layout-crash.html b/tests/tests/webkitsecurity/assets/update-always-create-line-boxes-full-layout-crash.html
new file mode 100644
index 0000000..7e01717
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/update-always-create-line-boxes-full-layout-crash.html
@@ -0,0 +1,27 @@
+<!DOCTYPE HTML>

+<html>

+<style>

+.table:nth-last-child(even) { line-height: 100%; }

+</style>

+<script>

+if (window.layoutTestController) {

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+function runTest()

+{

+    var test = document.getElementById('test');

+    test.parentNode.removeChild(test);

+

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+

+setTimeout("runTest()", 0); 

+</script>

+<table class=table>

+<td><rt>PASS</rt></junk></td>

+<table><span id="test"></table>

+</table>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/update-from-element-during-editing-crash-1.html b/tests/tests/webkitsecurity/assets/update-from-element-during-editing-crash-1.html
new file mode 100644
index 0000000..dd73539
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/update-from-element-during-editing-crash-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<body>
+<style>
+#container + * { clear: both; }
+</style>
+<p id="container"><textarea></textarea></p>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var textarea = document.getElementsByTagName('textarea')[0];
+textarea.focus();
+textarea.innerHTML = 'a\n';
+textarea.selectionStart = 1;
+textarea.selectionEnd = 1;
+document.execCommand('InsertLineBreak', false, null);
+
+document.body.innerText = "This test verifies WebKit doesn't crash even if the DOM changes in shadow DOM caused the shadow host's style to change.\nPASS";
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/update-from-element-during-editing-crash-2.html b/tests/tests/webkitsecurity/assets/update-from-element-during-editing-crash-2.html
new file mode 100644
index 0000000..82ef7d0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/update-from-element-during-editing-crash-2.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html>
+<body>
+<style>
+div + * {}
+</style>
+<p id="container"><textarea>a
+</textarea></p>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var textarea = document.getElementsByTagName('textarea')[0];
+textarea.focus();
+textarea.selectionStart = 1;
+textarea.selectionEnd = 1;
+document.execCommand('InsertLineBreak', false, null);
+
+document.body.innerText = "This test verifies WebKit doesn't crash even if the DOM changes in shadow DOM caused the shadow host's style to change.\nPASS";
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/update-midpoints-for-trailing-boxes-crash.html b/tests/tests/webkitsecurity/assets/update-midpoints-for-trailing-boxes-crash.html
new file mode 100644
index 0000000..0b0eb87
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/update-midpoints-for-trailing-boxes-crash.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+.a {
+	display: table-cell;
+	white-space: nowrap;
+}
+.b {
+	padding-left: 4px;
+	white-space: pre-wrap;
+}
+</style>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<div class='a'>
+<span class='b'>PASS,</span>
+<span>
+<span>does not crash</span>
+<span class='b'></span>
+</span>
+</div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/update-widgets-crash.html b/tests/tests/webkitsecurity/assets/update-widgets-crash.html
new file mode 100644
index 0000000..f6b42bf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/update-widgets-crash.html
@@ -0,0 +1,54 @@
+<!DOCTYPE html>
+
+<html>
+<head>
+    <style type="text/css" media="screen">
+        embed {
+            position: relative;
+            width: 100px;
+            height: 100px;
+        }
+    </style>
+    <script type="text/javascript" charset="utf-8">
+    if (window.layoutTestController) {
+        layoutTestController.dumpAsText();
+        layoutTestController.waitUntilDone();
+    }
+
+    // This gets called automatically from the test plugin.
+    var doingTest = false;
+    function setWindowCalled()
+    {
+        if (!doingTest)
+            return;
+
+        var victim = document.getElementById('victim');
+        victim.parentNode.removeChild(victim);
+        document.body.offsetTop;
+
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+        doingTest = false;
+    }
+    
+    function doTest()
+    {
+        doingTest = true;
+        document.getElementById('plugin').style.top = "120px";
+        document.body.offsetTop;
+        doingTest = false;
+    }
+    
+    window.addEventListener('load', doTest, false);
+    </script>
+</head>
+<body>
+
+    <p>This test should not crash.</p>
+    <embed type="application/x-webkit-test-netscape"
+        onSetWindow="setWindowCalled()"
+        id="plugin">
+    <embed name="victim" type="application/x-webkit-test-netscape" id="victim">
+  
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/updating-attribute-in-table-causes-crash.html b/tests/tests/webkitsecurity/assets/updating-attribute-in-table-causes-crash.html
new file mode 100644
index 0000000..440e9af
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/updating-attribute-in-table-causes-crash.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<table id="table">
+<tr id="row"><td id="tablecell" tabindex=0>1</td><td>2</td></tr>
+<tr id="row2"><td id="tablecell2" tabindex=0>1</td><td>2</td></tr>
+</table>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+    description("This tests for a crash that can occur while altering an attribute on a table cell because it accesses the table when its in a bad state.");
+
+    if (window.accessibilityController) {
+        document.getElementById("body").focus();
+        var body = accessibilityController.focusedElement;
+        var tr = document.createElement("tr");
+        var td = document.createElement("td");
+        td.appendChild(document.createTextNode("asdf"));
+        tr.appendChild(td);
+
+        // To reproduce, we need to remove a row and replace with another row, then set an attribute in the meantime.
+        document.getElementById("table").getElementsByTagName("TBODY")[0].removeChild(document.getElementById("row2"));
+        document.getElementById("table").getElementsByTagName("TBODY")[0].appendChild(tr);
+        document.getElementById("tablecell").setAttribute("title", "test");
+    }
+
+</script>
+
+<script src="../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/updating-attribute-in-table-row-crash.html b/tests/tests/webkitsecurity/assets/updating-attribute-in-table-row-crash.html
new file mode 100644
index 0000000..e007cc2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/updating-attribute-in-table-row-crash.html
@@ -0,0 +1,37 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<table id="table">
+<tr id="row"><td id="tablecell" tabindex=0>1</td><td>2</td></tr>
+<tr id="row2"><td id="tablecell2" tabindex=0>1</td><td>2</td></tr>
+</table>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+    description("This tests for a crash that can occur while altering an attribute on a table row because it accesses the table when its in a bad state.");
+
+    if (window.accessibilityController) {
+        document.getElementById("body").focus();
+        var body = accessibilityController.focusedElement;
+        var tr = document.createElement("tr");
+        var td = document.createElement("td");
+        td.appendChild(document.createTextNode("asdf"));
+        tr.appendChild(td);
+
+        // To reproduce, we need to remove a row and replace with another row, then set an attribute in the meantime.
+        document.getElementById("table").getElementsByTagName("TBODY")[0].removeChild(document.getElementById("row2"));
+        document.getElementById("table").getElementsByTagName("TBODY")[0].appendChild(tr);
+        document.getElementById("row").setAttribute("title", "gridrow");
+    }
+
+</script>
+
+<script src="../../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/use-crash-in-non-wellformed-document.svg b/tests/tests/webkitsecurity/assets/use-crash-in-non-wellformed-document.svg
new file mode 100644
index 0000000..0f7df77
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-crash-in-non-wellformed-document.svg
@@ -0,0 +1,19 @@
+<?xml version="1.0" standalone="no"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.0" onload="runTest()">
+    <text x="0" y="30">PASS without crash.</text>
+    <use xlink:href="#undefined">
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        function runTest() {
+            try {
+                var errorElement = document.getElementsByTagName("parsererror")[0];
+                errorElement.parentNode.removeChild(errorElement);
+                var useElement = document.getElementsByTagName("use")[0];
+                useElement.parentNode.removeChild(useElement);
+            } catch(e) {
+            }
+        }
+    </script>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/use-crash-pending-resource.svg b/tests/tests/webkitsecurity/assets/use-crash-pending-resource.svg
new file mode 100644
index 0000000..17fd2bc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-crash-pending-resource.svg
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <defs>
+    <text id="text1" font-size="20" fill="yellow">PASS</text>
+  </defs>
+
+  <!-- Don't crash when setting the href attribute while a filter resource is pending. -->
+  <use id="crasher" xlink:href="foo" filter="url(#nosuchfilter)"/>
+
+  <!-- Test both updating the href attribute and picking up the pending filter. -->
+  <use id="text_use" y="20" xlink:href="#foo" filter="url(#filter2)"/>
+
+  <filter id="filter2">
+    <!-- Green filter -->
+    <feColorMatrix type="matrix" values="0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0"/>
+  </filter>
+
+  <script>
+    <!-- Should not crash. -->
+    document.getElementById("crasher").setAttribute("xlink:href", "bar");
+
+    <!-- Should yield the filtered text -->
+    document.getElementById("text_use").setAttribute("xlink:href", "#text1");
+
+    if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+  </script>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/use-crash-using-children-before-destroy.svg b/tests/tests/webkitsecurity/assets/use-crash-using-children-before-destroy.svg
new file mode 100644
index 0000000..b9b2ec6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-crash-using-children-before-destroy.svg
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <text>PASS if no crash/assert</text>
+    <g id="outer"><use id="a"></use></g>
+    <use id="b" xlink:href="#outer" />
+<script><![CDATA[
+var useobj = document.getElementById("b").instanceRoot;
+
+function test() {
+    var elem = document.getElementById("b");
+    elem.parentNode.removeChild(elem);
+}
+test();
+
+document.getElementById("a").appendChild(document.createElement("g"));
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+}
+]]></script>
+</svg>
\ No newline at end of file
diff --git a/tests/tests/webkitsecurity/assets/use-crash-when-href-change.svg b/tests/tests/webkitsecurity/assets/use-crash-when-href-change.svg
new file mode 100644
index 0000000..5a75af1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-crash-when-href-change.svg
@@ -0,0 +1,22 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" onload="runTest()">
+
+<g>
+    <use id="use" xlink:href="#rect" />
+</g>
+
+<defs>
+    <rect id="rect" x="0" y="0" width="100" height="60" />
+</defs>
+
+<text x="10" y= "30">PASS without crash in debug mode.</text>
+
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    function runTest() {
+        document.getElementById("use").setAttribute("xlink:href", "");
+    }
+</script>
+
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/use-events-crash-expected.png b/tests/tests/webkitsecurity/assets/use-events-crash-expected.png
new file mode 100644
index 0000000..1ae33b5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-events-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/use-events-crash.svg b/tests/tests/webkitsecurity/assets/use-events-crash.svg
new file mode 100644
index 0000000..a98c952
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-events-crash.svg
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>

+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1 Tiny//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11-tiny.dtd">

+

+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" baseProfile="tiny" id="svg-root" width="480" height="360" viewBox="0 0 480 360" onload="test()">

+<script>

+function test()

+{

+    if (window.eventSender) {

+	eventSender.mouseMoveTo(370, 45);

+	eventSender.contextClick();

+    }

+}

+

+</script>

+

+    <g id="test-body-content">

+        <defs>

+            <g fill="red" stroke="yellow" stroke-width="3">

+                <rect id="usedRect" width="40" height="40"/>

+            </g>

+        </defs>

+        <g>

+            <g id="labels" transform="translate(330, 40)" font-size="12" text-anchor="end">

+                <text>Right-clicking on green box using a debug build</text>

+            </g>

+            <g id="labels" transform="translate(330, 54)" font-size="12" text-anchor="end">

+                <text>should not cause an assert (Bugzilla Bug 12580)</text>

+            </g>

+        </g>

+        <g transform="translate(350, 25)">

+            <use xlink:href="#usedRect" fill="#0F0"/>

+        </g>

+    </g>

+

+</svg>

diff --git a/tests/tests/webkitsecurity/assets/use-font-face-crash-expected.png b/tests/tests/webkitsecurity/assets/use-font-face-crash-expected.png
new file mode 100644
index 0000000..1f473c1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-font-face-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/use-font-face-crash.svg b/tests/tests/webkitsecurity/assets/use-font-face-crash.svg
new file mode 100644
index 0000000..c3e9d4b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-font-face-crash.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><text y="20">This should not crash, but display an error document.</text><font-face id="foo"/> <use xlink:href="#foo"/><error>
diff --git a/tests/tests/webkitsecurity/assets/use-mutation-event-crash.svg b/tests/tests/webkitsecurity/assets/use-mutation-event-crash.svg
new file mode 100644
index 0000000..463ec67
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-mutation-event-crash.svg
@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<script>
+  if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+  // Prevent insertion of any content into the document.
+  document.documentElement.addEventListener("DOMNodeInserted", function() {
+    var insertedNode = event.target;
+    insertedNode.parentNode.removeChild(insertedNode);
+  }, true);
+</script>
+  <defs>
+    <g id="inner">
+      <rect width="100px" height="100px" fill="green" />
+      <text x="10" y="30">PASS - didn't crash, bug 25092</text>
+    </g>
+    <g id="outer">
+      <use id="use" xlink:href="url(#inner)" />
+    </g>
+  </defs>
+  <use id="outerUse" xlink:href="url(#outer)" x="0" y="0" width="100px" height="100px" />
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/use-non-existing-symbol-crash.svg b/tests/tests/webkitsecurity/assets/use-non-existing-symbol-crash.svg
new file mode 100644
index 0000000..5ebca46
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-non-existing-symbol-crash.svg
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns:svg="http://www.w3.org/2000/svg" 
+     xmlns="http://www.w3.org/2000/svg" 
+     xmlns:xlink="http://www.w3.org/1999/xlink" 
+     width="800px" height="800px"
+     onload="init()">
+
+<script type="application/ecmascript">
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+    
+function init() {
+  var cell = document.getElementById('foo');
+      cell.setAttributeNS(null, 'visibility','display');
+  
+}
+</script>
+<use id="foo" xlink:href="#doesNotExist"/>
+<text x="10" y="10" > PASS -- not crashing,  https://bugs.webkit.org/show_bug.cgi?id=27693 </text>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/use-property-synchronization-crash-expected.png b/tests/tests/webkitsecurity/assets/use-property-synchronization-crash-expected.png
new file mode 100644
index 0000000..14ce185
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-property-synchronization-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/use-property-synchronization-crash.svg b/tests/tests/webkitsecurity/assets/use-property-synchronization-crash.svg
new file mode 100644
index 0000000..6c3f4a2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-property-synchronization-crash.svg
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
+  <g>
+    <g id="setOneRef">
+        <polyline points="0"/>
+    </g>
+    <use xlink:href="#setOneRef"/>
+  </g>
+  <g/>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/use-recalcStyle-crash-expected.png b/tests/tests/webkitsecurity/assets/use-recalcStyle-crash-expected.png
new file mode 100644
index 0000000..14ce185
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-recalcStyle-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/use-recalcStyle-crash.svg b/tests/tests/webkitsecurity/assets/use-recalcStyle-crash.svg
new file mode 100644
index 0000000..b643a2f
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-recalcStyle-crash.svg
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+    <defs>
+        <symbol id="checkBoxRectInvisible" />
+    </defs>
+    <g display="none">
+        <use xlink:href="#checkBoxRectInvisible" />
+    </g>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/use-referencing-style-crash.svg b/tests/tests/webkitsecurity/assets/use-referencing-style-crash.svg
new file mode 100644
index 0000000..deecb53
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-referencing-style-crash.svg
@@ -0,0 +1,9 @@
+<!-- This test is designed to have errors in the svg content. It should not crash. -->
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+  <use xlink:href="#foo"/>
+  <script>
+    if (window.layoutTestController)
+      layoutTestController.dumpAsText();
+  </script>
+  <symbol id="foo">
+    <style>
diff --git a/tests/tests/webkitsecurity/assets/use-setAttribute-crash-expected.png b/tests/tests/webkitsecurity/assets/use-setAttribute-crash-expected.png
new file mode 100644
index 0000000..ef19466
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-setAttribute-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/use-setAttribute-crash.svg b/tests/tests/webkitsecurity/assets/use-setAttribute-crash.svg
new file mode 100644
index 0000000..f7c55cc
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-setAttribute-crash.svg
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN" "http://www.w3.org/2002/04/xhtml-math-svg/xhtml-math-svg.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:svg="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+<head>
+<script src="../../fast/repaint/resources/repaint.js"></script>
+<script type="text/javascript"><![CDATA[
+function repaintTest() {
+    var svg = document.getElementById('svg');
+    var circle = document.getElementById('circle');
+    var use = document.getElementById('use');
+    use.setAttribute('fill', '#f00');
+    svg.setAttribute('width', 200);
+    svg.setAttribute('height', 200);
+    circle.setAttribute('transform', 'scale(' + 10 + ')');
+ }
+]]></script>
+</head>
+<body onload="runRepaintTest()">
+<svg:svg id="svg" width="100" height="100">
+<svg:defs>
+<svg:symbol id="symbol" overflow="visible">
+<svg:circle id="circle" cx="0" cy="0" r="2" stroke="#000" transform="scale(2)" />
+</svg:symbol>
+</svg:defs>
+<svg:use id="use" x="50" y="50" fill="#fff" xlink:href="#symbol" />
+</svg:svg>
+</body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/use-style-recalc-script-execute-crash.html b/tests/tests/webkitsecurity/assets/use-style-recalc-script-execute-crash.html
new file mode 100644
index 0000000..74ec2a5
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/use-style-recalc-script-execute-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>

+<html>

+Test passes if it does not crash and "script" inside "rect" executes.

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+</script>

+<svg>

+<g>

+<use xlink:href="#test"/>

+<rect id="test">

+<script>

+document.body.innerHTML = "PASS";

+</script>

+</rect>

+</g>

+</svg>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/user-stylesheet-crash.html b/tests/tests/webkitsecurity/assets/user-stylesheet-crash.html
new file mode 100644
index 0000000..e7ebc60
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/user-stylesheet-crash.html
@@ -0,0 +1,31 @@
+<html>
+<head>
+<script>
+function createIframe()
+{
+    var iframe = document.createElement("iframe");
+    document.body.appendChild(iframe);
+    var iframeDocument = iframe.contentDocument;
+    var link = iframeDocument.createElement("link");
+    link.setAttribute("rel", "stylesheet");
+    link.setAttribute("href", "does_not_exist.css");
+    iframeDocument.head.appendChild(link);
+    if (window.layoutTestController) {
+        layoutTestController.addUserStyleSheet("#test { color: blue: }", true);
+        setTimeout("window.layoutTestController.notifyDone()", 100);
+    }
+}
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+    layoutTestController.addUserStyleSheet("#test { color: red: }", true);
+}
+setTimeout("createIframe()", 0);
+
+</script>
+</head>
+<body>
+This test requires DRT. It passes if it doesn't crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/value-list-out-of-bounds-crash-expected.png b/tests/tests/webkitsecurity/assets/value-list-out-of-bounds-crash-expected.png
new file mode 100644
index 0000000..f0b8d33
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/value-list-out-of-bounds-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/value-list-out-of-bounds-crash.html b/tests/tests/webkitsecurity/assets/value-list-out-of-bounds-crash.html
new file mode 100644
index 0000000..9431d74
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/value-list-out-of-bounds-crash.html
@@ -0,0 +1,26 @@
+<head>
+<style>
+    #div {
+        width: 200px;
+        height: 200px;
+        background-image:url(resources/bikes.bmp); 
+        -webkit-background-size: 50% 100%;
+    }
+</style>
+</head>
+
+<body>
+
+<div id='pass'>Failed! This test should not crash, and this text should be changed to a passing message.</div>
+<div id='div'></div>
+
+<script>
+    var div = document.getElementById('div');
+    var style = document.defaultView.getComputedStyle(div);
+    var valueList = style.getPropertyCSSValue('-webkit-background-size');
+    var one = valueList.item(100);
+
+    var pass = document.getElementById('pass');
+    pass.innerHTML = 'PASS! This test passes if it does not crash.';
+</script>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/value-without-selection-crash.html b/tests/tests/webkitsecurity/assets/value-without-selection-crash.html
new file mode 100644
index 0000000..e4c6be2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/value-without-selection-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+document.designMode = 'on';
+window.getSelection().removeAllRanges();
+document.queryCommandValue('backColor', false, null);
+document.queryCommandValue('fontSize', false, null);
+document.queryCommandValue('fontName', false, null);
+document.queryCommandValue('foreColor', false, null);
+
+document.writeln('PASS - WebKit did not crash when querying command value without selection.');
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/var-shadows-arg-crash.html b/tests/tests/webkitsecurity/assets/var-shadows-arg-crash.html
new file mode 100644
index 0000000..9e4c6cb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/var-shadows-arg-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/var-shadows-arg-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/var-shadows-arg-crash.js b/tests/tests/webkitsecurity/assets/var-shadows-arg-crash.js
new file mode 100644
index 0000000..ef25290
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/var-shadows-arg-crash.js
@@ -0,0 +1,13 @@
+description(
+'Tests to ensure that activations are built correctly in the face of duplicate parameter names and do not cause crashes.'
+);
+
+
+function test(a) {
+    var b, a = "success";
+    return function() {
+        return a;
+    }
+}
+
+shouldBe('test()()', '"success"');
diff --git a/tests/tests/webkitsecurity/assets/var-shadows-arg-gc-crash.html b/tests/tests/webkitsecurity/assets/var-shadows-arg-gc-crash.html
new file mode 100644
index 0000000..563fc7b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/var-shadows-arg-gc-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/var-shadows-arg-gc-crash.js"></script>
+<script src="resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/var-shadows-arg-gc-crash.js b/tests/tests/webkitsecurity/assets/var-shadows-arg-gc-crash.js
new file mode 100644
index 0000000..3e33ae3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/var-shadows-arg-gc-crash.js
@@ -0,0 +1,34 @@
+description(
+'Tests to ensure that activations mark their values correctly in the face of duplicate parameter names and does not crash.'
+);
+
+function gc()
+{
+    if (this.GCController)
+        GCController.collect();
+    else
+        for (var i = 0; i < 10000; ++i) // Allocate a sufficient number of objects to force a GC.
+            ({});
+}
+
+function eatRegisters(param)
+{
+    if (param > 10)
+        return;
+    eatRegisters(param + 1);
+}
+
+function test(a, c) {
+    var b = ["success"], a, c;
+    return function() {
+        return b[0];
+    }
+}
+
+var testClosure = test();
+
+var extra = test();
+eatRegisters(0);
+gc();
+
+shouldBe('testClosure()', '"success"');
diff --git a/tests/tests/webkitsecurity/assets/video-display-none-crash.html b/tests/tests/webkitsecurity/assets/video-display-none-crash.html
new file mode 100644
index 0000000..4f66c1c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/video-display-none-crash.html
@@ -0,0 +1,11 @@
+<video controls></video>
+<p>Test that pause() after changing display to "none" doesn't cause a crash.</p>
+<script src="media-file.js"></script>
+<script src="video-test.js"></script>
+<script>
+    video.src = findMediaFile("video", "content/test");
+    video.play();
+    video.style.display = "none";
+    video.pause();
+    endTest();
+</script>
diff --git a/tests/tests/webkitsecurity/assets/video-element-other-namespace-crash.html b/tests/tests/webkitsecurity/assets/video-element-other-namespace-crash.html
new file mode 100644
index 0000000..e2e0d08
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/video-element-other-namespace-crash.html
@@ -0,0 +1,29 @@
+<html>

+<script>

+if (window.layoutTestController)

+{ 

+    layoutTestController.dumpAsText();

+    layoutTestController.waitUntilDone();

+}

+

+function runTest()

+{

+    frame = document.body.appendChild(document.createElement('iframe'));

+    frame.onload = function() {

+        frame.onload = null;

+        container = frame.contentDocument.body.appendChild(frame.contentDocument.createElement('div'));

+        otherVideo = container.appendChild(frame.contentDocument.createElementNS('other', 'video'));

+        event = frame.contentDocument.createEvent('KeyboardEvents');

+        event.initKeyboardEvent('keydown', 1, 1, frame.contentWindow, 'U+0020');

+        container.dispatchEvent(event);

+        

+        document.body.appendChild(document.createTextNode('PASS, did not crash.'));

+        if (window.layoutTestController)

+            layoutTestController.notifyDone();

+    }

+

+    frame.src = 'content/test.mp4';

+}

+</script>

+<body onload="runTest()"/>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/video-layer-crash-expected.png b/tests/tests/webkitsecurity/assets/video-layer-crash-expected.png
new file mode 100644
index 0000000..06dca88
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/video-layer-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/video-layer-crash.html b/tests/tests/webkitsecurity/assets/video-layer-crash.html
new file mode 100644
index 0000000..b5844d6
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/video-layer-crash.html
@@ -0,0 +1,20 @@
+<html>
+    <head>
+        <script src="media-file.js"></script>
+        <script src="video-paint-test.js"></script>
+        <style>
+            video { width:200px; border: 3px solid red; -webkit-box-reflect: below 5px; }
+        </style>
+    </head>
+    <body>
+        <p>Test dynamic removal of transformed and reflected video </p>
+        &nbsp;<video id="one" style="-webkit-transform:rotate(20deg)"></video><br>
+        &nbsp;<video style="-webkit-transform:scale(0.5)"></video><br>
+        &nbsp;<video style="-webkit-transform:skew(20deg)"></video><br>
+        <script>
+            setSrcByTagName('video', findMediaFile('video', 'content/test'));
+            document.body.removeChild(document.getElementById('one')); document.body.offsetLeft;
+            init();
+        </script>
+    </body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/viewport-container-crash.svg b/tests/tests/webkitsecurity/assets/viewport-container-crash.svg
new file mode 100644
index 0000000..0066a81
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/viewport-container-crash.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+    <text>PASS</text>
+    <defs>
+        <pattern id="Pattern" width="20" height="20">
+            <svg></svg>
+        </pattern>
+    </defs>
+    <rect width="430" height="80" fill="url(#Pattern)"/>
+    <script>
+        if (layoutTestController)
+            layoutTestController.dumpAsText();
+    </script>
+</svg>
diff --git a/tests/tests/webkitsecurity/assets/visible-position-crash-for-text-node.html b/tests/tests/webkitsecurity/assets/visible-position-crash-for-text-node.html
new file mode 100644
index 0000000..b319537
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/visible-position-crash-for-text-node.html
@@ -0,0 +1,40 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../../fast/js/resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<div id="content" tabindex="0" style="width:200px;">
+This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. 
+This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text.
+This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text. This is a lot of text.
+</div>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("This protects against a crash in asking for visible point for position to ensure that it can handle all RenderText objects.");
+
+    if (window.accessibilityController) {
+
+          document.getElementById("content").focus();
+          var content = accessibilityController.focusedElement;
+
+          // Get the text marker at this point. It should not crash.
+          var markerAtPoint = content.textMarkerForPoint(content.x + content.width/2, content.y + content.height/2);
+          var textElement = content.accessibilityElementForTextMarker(markerAtPoint);
+
+          // Verify the element is the same as the one we wanted.
+          var textElement = content.accessibilityElementForTextMarker(markerAtPoint);
+          shouldBeTrue("content.childAtIndex(0).isEqual(textElement)");
+    }
+
+</script>
+
+<script src="../../../fast/js/resources/js-test-post.js"></script>
+</body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/assets/vkern-element-crash.html b/tests/tests/webkitsecurity/assets/vkern-element-crash.html
new file mode 100644
index 0000000..a1abfb2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/vkern-element-crash.html
@@ -0,0 +1,51 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+gc = window.gc || function()
+{
+    if (window.GCController)
+        return GCController.collect();
+        
+    for (var i = 0; i < 10000; ++i)
+        var s = new String("AAAA");
+}
+
+window.onload = function()
+{   
+    element1 = document.body.appendChild(document.createElement());
+    element1.id = "foo";
+    
+    parent = document.createElementNS("http://www.w3.org/2000/svg", "vkern");
+    element2 = parent.appendChild(document.createElement());
+    element2.id = "foo";
+    document.body.appendChild(parent);
+    
+    element3 = document.body.appendChild(document.createElement());
+    element3.id = "foo";
+    
+    document.body.removeChild(element1);
+    document.getElementById("foo");
+    
+    parent.removeChild(element2);
+    element2 = null;
+    gc();
+    
+    setTimeout(finishTest, 0);
+}
+
+function finishTest()
+{
+    document.getElementById("foo");
+    
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+</script>
+</head>
+<body>PASS</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/wbr-in-mroot-crash.html b/tests/tests/webkitsecurity/assets/wbr-in-mroot-crash.html
new file mode 100644
index 0000000..90b40b7
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/wbr-in-mroot-crash.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<body>
+<p>This test shouldn't crash.</p>
+<p><math><mroot><mrow><mroot><mrow><mroot><mrow><mroot><mrow><mroot><mrow><mroot><mrow><mroot><mrow id="insertion-point"></mrow></mroot></mrow></mroot></mrow></mroot></mrow></mroot></mrow></mroot></mrow></mroot></mrow></mroot></math></p></body></html>
+<script>
+var elem = document.getElementById("insertion-point"); 
+var parent = elem.parentNode;
+var wbr = document.createElement("wbr");
+parent.insertBefore(wbr, elem);
+</script>
diff --git a/tests/tests/webkitsecurity/assets/wbr-in-pre-crash-expected.png b/tests/tests/webkitsecurity/assets/wbr-in-pre-crash-expected.png
new file mode 100644
index 0000000..f60ce50
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/wbr-in-pre-crash-expected.png
Binary files differ
diff --git a/tests/tests/webkitsecurity/assets/wbr-in-pre-crash.html b/tests/tests/webkitsecurity/assets/wbr-in-pre-crash.html
new file mode 100644
index 0000000..93751f8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/wbr-in-pre-crash.html
@@ -0,0 +1,8 @@
+<p>
+    Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=17464">http://bugs.webkit.org/show_bug.cgi?id=17464</a>
+    REGRESSION: Crash in RenderBlock::findNextLineBreak reading r30444 commit email in GMail</i>.
+</p>
+<p>
+    No crash means success.
+</p>
+<div style="width: 100px; white-space: pre-wrap;">Lorem ipsum<wbr>dolor sit amet</div>
diff --git a/tests/tests/webkitsecurity/assets/webkit-empty-transform-preserve3d-crash.html b/tests/tests/webkitsecurity/assets/webkit-empty-transform-preserve3d-crash.html
new file mode 100644
index 0000000..8f0bacf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/webkit-empty-transform-preserve3d-crash.html
@@ -0,0 +1,19 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<style>
+span {
+  display: table-column;
+  -webkit-transform-style: preserve-3d;
+}
+</style>
+</head>
+<body>
+<span></span>
+<p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=51465">51465</a>: chrome.dll!WebCore::RenderLayer::currentTransform ReadAV@NULL (8968fc97874fa23b6799ff8f09c142e4)</p>
+<p>If it did not crash, this test has PASSED</p>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/webkit-keyframes-crash.html b/tests/tests/webkitsecurity/assets/webkit-keyframes-crash.html
new file mode 100644
index 0000000..c07bd66
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/webkit-keyframes-crash.html
@@ -0,0 +1,24 @@
+<html>

+<body>

+    <p>Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=62384">62384</a>: WebCore::WebKitCSSKeyframesRuleInternal::nameAttrSetter() - crash</p>

+    <p>This test passed if it did not crash</p>

+    <p id="console">FAILED (test not run)</p>

+    <script>

+        if (window.layoutTestController)

+            layoutTestController.dumpAsText();

+

+        function main(){

+            var e = window.document.styleSheets[0].cssRules[0];

+            e.cssRules.item().parentStyleSheet.removeRule();

+            e.name = 'bar';

+            document.getElementById('console').innerHTML = "PASSED";

+        }

+        window.onload = main;

+    </script>

+    <style>

+        @-webkit-keyframes foo {

+            0% {foo: bar;}

+        }

+    </style>

+</body>

+</html>

diff --git a/tests/tests/webkitsecurity/assets/webkit-marquee-anonymous-node-crash.html b/tests/tests/webkitsecurity/assets/webkit-marquee-anonymous-node-crash.html
new file mode 100644
index 0000000..f25d422
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/webkit-marquee-anonymous-node-crash.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>

+<style>p:first-letter { overflow: -webkit-marquee; float: left; }</style>

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+</script>

+<body>

+    <p>Should not crash</p>

+</body>

diff --git a/tests/tests/webkitsecurity/assets/webkit-mask-crash-fieldset-legend.html b/tests/tests/webkitsecurity/assets/webkit-mask-crash-fieldset-legend.html
new file mode 100644
index 0000000..13110ef
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/webkit-mask-crash-fieldset-legend.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<head>
+<style>
+* {
+    -webkit-mask-image:none,none,url(x);
+}
+</style>
+</head>
+<body>
+<fieldset><legend>
+<script>
+    if (window.internals) {
+        layoutTestController.dumpAsText();
+        internals.paintControlTints(document);
+    }
+</script>
+Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=68133">68133</a>: Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled<br>
+This test has PASSED (no crash).
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/webkit-mask-crash-figure.html b/tests/tests/webkitsecurity/assets/webkit-mask-crash-figure.html
new file mode 100644
index 0000000..dd7fd6d
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/webkit-mask-crash-figure.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<head>
+<style>
+.box {
+display: table-footer-group; -webkit-mask-box-image: url("bogus.png");
+}
+</style>
+</head>
+<body>
+<div class="box"><figure>
+<script>
+    if (window.internals) {
+        layoutTestController.dumpAsText();
+        internals.paintControlTints(document);
+    }
+</script>
+Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=68133">68133</a>: Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled<br>
+This test has PASSED (no crash).
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/webkit-mask-crash-table.html b/tests/tests/webkitsecurity/assets/webkit-mask-crash-table.html
new file mode 100644
index 0000000..3dd44c1
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/webkit-mask-crash-table.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<head>
+<style>
+*{
+    -webkit-mask-image:none,none,url(x);
+}
+</style>
+</head>
+</body>
+<table><tr>
+<script>
+    if (window.internals) {
+        layoutTestController.dumpAsText();
+        internals.paintControlTints(document);
+    }
+</script>
+Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=68133">68133</a>: Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled<br>
+This test has PASSED (no crash).
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/webkit-mask-crash-td-2.html b/tests/tests/webkitsecurity/assets/webkit-mask-crash-td-2.html
new file mode 100644
index 0000000..afaaa7b
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/webkit-mask-crash-td-2.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<head>
+<style>
+td { -webkit-mask-image : url(red_transparent.gif); }
+</style>
+</head>
+<body>
+AA000A00AAA00<table><tr><td>
+<script>
+    if (window.internals) {
+        layoutTestController.dumpAsText();
+        internals.paintControlTints(document);
+    }
+</script>
+Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=68133">68133</a>: Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled<br>
+This test has PASSED (no crash).
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/webkit-mask-crash-td.html b/tests/tests/webkitsecurity/assets/webkit-mask-crash-td.html
new file mode 100644
index 0000000..cfbee61
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/webkit-mask-crash-td.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<head>
+<style>
+.f {
+    -webkit-mask:-webkit-gradient(linear, left top, left bottom, from(#E7E7E7), to(#CFCFCF));
+}
+</style>
+</head>
+<body>
+<table>
+<tr class="f">
+<td>
+<script>
+    if (window.internals) {
+        layoutTestController.dumpAsText();
+        internals.paintControlTints(document);
+    }
+</script>
+Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=68133">68133</a>: Crash in RenderBox::paintMaskImages when GraphicsContext's painting is disabled<br>
+This test has PASSED (no crash).
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/webkit-transform-crash.html b/tests/tests/webkitsecurity/assets/webkit-transform-crash.html
new file mode 100644
index 0000000..a810a94
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/webkit-transform-crash.html
@@ -0,0 +1,11 @@
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8">
+<!-- This should not crash (null renderer) -->
+<script>
+  document.createElementNS("http://www.w3.org/2000/svg","g").getTransformToElement();
+  if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+</head><body>
+PASS
+</body></html>
diff --git a/tests/tests/webkitsecurity/assets/win-boundary-crash.html-disabled b/tests/tests/webkitsecurity/assets/win-boundary-crash.html-disabled
new file mode 100644
index 0000000..78f4254
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/win-boundary-crash.html-disabled
@@ -0,0 +1,14 @@
+<html>
+<head>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+</script>
+</head>
+<body>
+<p>Test for <i><a href="http://bugs.webkit.org/show_bug.cgi?id=14516">http://bugs.webkit.org/show_bug.cgi?id=14516</a>
+crash loading multipart/x-mixed-replace data on windows safari</i></p>
+<p>If WebKit does not crash when loading this img, then it passed.</p>
+<img src="resources/multipart-nodashes.php" />
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/window-close-crash.html b/tests/tests/webkitsecurity/assets/window-close-crash.html
new file mode 100644
index 0000000..9b4bcd0
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/window-close-crash.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<script src="script-tests/window-close-crash.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/window-close-crash.js b/tests/tests/webkitsecurity/assets/window-close-crash.js
new file mode 100644
index 0000000..cc5f690
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/window-close-crash.js
@@ -0,0 +1,34 @@
+description("Tests the assertion that the GeolocationClient should not be updating<br>" +
+            "when the GeolocationController is destroyed.<br>" +
+            "See https://bugs.webkit.org/show_bug.cgi?id=52216");
+
+var otherWindow;
+
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.setCanOpenWindows();
+    layoutTestController.setCloseRemainingWindowsWhenComplete(true);
+} else
+    testFailed('This test can not be run without the LayoutTestController');
+
+function gotPosition(p)
+{
+    testPassed("Received Geoposition.");
+    otherWindow.close();
+    window.setTimeout(waitForWindowToClose, 0);
+}
+
+function waitForWindowToClose()
+{
+    if (!otherWindow.closed) {
+        window.setTimeout(waitForWindowToClose, 0);
+        return;
+    }
+    testPassed("Success - no crash!");
+    finishJSTest();
+}
+
+debug("Main page opening resources/window-close-popup.html");
+otherWindow = window.open("resources/window-close-popup.html");
+
+window.jsTestIsAsync = true;
diff --git a/tests/tests/webkitsecurity/assets/window-closed-crash.html b/tests/tests/webkitsecurity/assets/window-closed-crash.html
new file mode 100644
index 0000000..9849498
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/window-closed-crash.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script type="text/javascript">
+        function log(msg)
+        {
+            document.getElementById('console').appendChild(document.createTextNode(msg + '\n'));
+        }
+    </script>
+</head>
+<body>
+    <p>This tests that window.closed on a closed window, or window without a frame, does not crash the browser. See rdar://problem/5329841</p>
+    <pre id="console"></pre>
+    <iframe id="anIframe"></iframe>
+    <script>
+        if (window.layoutTestController)
+            layoutTestController.dumpAsText();
+
+        var win = window.frames[0];
+        document.body.removeChild(document.getElementById('anIframe'));
+
+        var c = win.closed;
+        log("Passed!");
+    </script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/window-collection-length-no-crash.html b/tests/tests/webkitsecurity/assets/window-collection-length-no-crash.html
new file mode 100644
index 0000000..81c3ed2
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/window-collection-length-no-crash.html
@@ -0,0 +1,32 @@
+<html>
+<head></head>
+<body>
+<p id="description"></p>
+<br>
+<iframe id="subframe"></iframe>
+<br>
+This tests that window.frames.length does not crash the browser after the
+frame navigates away from the current page. You should see "SUCCESS" below
+once the test completes.
+<br>
+<div id="status">Test in progress...</div>
+
+<script>
+if (window.layoutTestController) {
+    window.layoutTestController.dumpAsText();
+    window.layoutTestController.waitUntilDone();
+}
+
+var myFrames = subframe.frames;
+
+function done() {
+    var foo = myFrames.length;
+    document.getElementById("status").innerText = "SUCCESS";
+    if (window.layoutTestController)
+        window.layoutTestController.notifyDone();
+}
+
+subframe.document.location = "resources/notify-parent-done.html";
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/window-custom-prototype-crash.html b/tests/tests/webkitsecurity/assets/window-custom-prototype-crash.html
new file mode 100644
index 0000000..5bd1f01
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/window-custom-prototype-crash.html
@@ -0,0 +1,10 @@
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    var newPrototype = new Object();
+    newPrototype.myNewPrototypeFunction = function() { return "myNewPrototypeFunction"; }
+    window.__proto__ = newPrototype;
+    window.myNewPrototypeFunction();
+</script>
+If this did not crash the test has succeeded.
diff --git a/tests/tests/webkitsecurity/assets/window-domurl-crash.html b/tests/tests/webkitsecurity/assets/window-domurl-crash.html
new file mode 100644
index 0000000..7d5c04c
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/window-domurl-crash.html
@@ -0,0 +1,60 @@
+<html>

+<head>

+<script>

+var blob = (new WebKitBlobBuilder).getBlob();

+var url = null;

+var count = 0;

+

+if (!window.gc)

+{

+    window.gc = function()

+    {

+        if (window.GCController)

+            return GCController.collect();

+        for (var i = 0; i < 10000; i++)

+            var s = new String("abc");

+    }

+}

+

+function load()

+{

+    if (window.layoutTestController)

+    {

+        layoutTestController.dumpAsText();

+        layoutTestController.setCanOpenWindows();

+        layoutTestController.setCloseRemainingWindowsWhenComplete(true);

+        layoutTestController.waitUntilDone();

+    }

+    win = window.open();

+    if (win.webkitURL)

+    {

+        url = win.webkitURL;

+        win.location = "nothing";

+        setTimeout(crash, 0);

+        return;

+    }

+    document.body.innerHTML = "PASS";

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+

+function crash()

+{

+    gc();

+    url.createObjectURL(blob);

+    if (count++ < 5)

+    {

+        setTimeout(crash, 0);

+        return;

+    }

+    document.body.innerHTML = "PASS";

+    if (window.layoutTestController)

+        layoutTestController.notifyDone();

+}

+</script>

+</head>

+<body onload="load()">

+RUNNING...

+</body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/window-event-override-no-crash.html b/tests/tests/webkitsecurity/assets/window-event-override-no-crash.html
new file mode 100644
index 0000000..05a93e8
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/window-event-override-no-crash.html
@@ -0,0 +1,14 @@
+<html>
+<body>
+<script>
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+window.event = new Object;
+var iframe = document.createElement("iframe");
+document.body.appendChild(iframe);
+iframe.src = "resources/blank.html";
+</script>
+This test ensures that window.event can be set to a meaningless object (and immediately be used internally) without causing a crash.
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/word-break-next-linebox-not-dirty-crash-main.html b/tests/tests/webkitsecurity/assets/word-break-next-linebox-not-dirty-crash-main.html
new file mode 100644
index 0000000..fc9ddb3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/word-break-next-linebox-not-dirty-crash-main.html
@@ -0,0 +1,12 @@
+<html>

+Test passes if it does not crash.

+<script>

+    if (window.layoutTestController)

+    {

+        layoutTestController.dumpAsText();

+        layoutTestController.waitUntilDone();

+    }

+</script>

+<iframe width="100" src="resources/word-break-next-linebox-not-dirty-crash.html"></iframe>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/word-break-next-linebox-not-dirty-crash.html b/tests/tests/webkitsecurity/assets/word-break-next-linebox-not-dirty-crash.html
new file mode 100644
index 0000000..3be0dcf
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/word-break-next-linebox-not-dirty-crash.html
@@ -0,0 +1,44 @@
+<html>

+<body onload="runTest();">

+<audio>a</audio>a

+<center></center>

+aaaaaaaaaaaaaaaaaaa

+<wbr id="wbr"/>

+<span>aaaaaaaaaaaaa</span>

+<script>

+function reference(domNode)

+{

+    this.domNode = domNode;

+}

+function walk(a, currentPrefix, index, domNode)

+{

+    if (domNode == null)

+        return;

+    newPrefix = currentPrefix + "_" + index;

+    walk(a, currentPrefix, index + 1, domNode.nextSibling);

+    walk(a, newPrefix, 0, domNode.firstChild);

+    a[newPrefix] = new reference(domNode);

+}

+function clearAllNodes()

+{

+    var a = new Array();

+    walk(a, "", 0, document.body);

+    for (key in a)

+    {

+        document.body.offsetTop;

+        a[key].domNode.parentNode.removeChild(a[key].domNode);

+    }

+}

+function runTest() {

+  var font = document.createElement('font');

+  document.getElementById('wbr').appendChild(font);

+  document.body.offsetTop;

+  clearAllNodes();

+  

+  if (window.layoutTestController)

+      layoutTestController.notifyDone();

+}

+</script>

+</body>

+</html>

+

diff --git a/tests/tests/webkitsecurity/assets/worker-crash-with-invalid-location.html b/tests/tests/webkitsecurity/assets/worker-crash-with-invalid-location.html
new file mode 100644
index 0000000..8fd90df
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/worker-crash-with-invalid-location.html
@@ -0,0 +1,32 @@
+<html>
+<body>
+<p>Test worker fetch of blocked url. Should print a "PASS" statement.</p>
+<div id=result></div>
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+function log(message)
+{
+    document.getElementById("result").innerHTML += message + "<br>";
+}
+
+try {
+    // DumpRenderTree allows a request to this url, but then blocks it
+    // during the "willSendRequest" callback (which caused a crash).
+    // In a browser, this will throw a security exception.
+    new Worker("http://example.com/worker.js");
+} catch (error) {
+}
+
+try {
+    // Ditto.
+    new SharedWorker("http://example.com/worker.js");
+} catch (error) {
+}
+
+log("PASS");
+
+</script>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/worker-finish-crash.html b/tests/tests/webkitsecurity/assets/worker-finish-crash.html
new file mode 100644
index 0000000..ab7b024
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/worker-finish-crash.html
@@ -0,0 +1,18 @@
+<body>
+<p>Test to ensure that finishing a Worker won't re-enter. We pass if we don't crash.</p>
+<script>
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+var worker = new Worker("does-not-exist.js");
+worker.onerror = function() {
+    window.stop();
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+</script>
+</body>
diff --git a/tests/tests/webkitsecurity/assets/x-frame-options-detached-document-crash.html b/tests/tests/webkitsecurity/assets/x-frame-options-detached-document-crash.html
new file mode 100644
index 0000000..4849aeb
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/x-frame-options-detached-document-crash.html
@@ -0,0 +1,13 @@
+This checks that writing an X-Frame-Options meta tag to a detached document does not crash.
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+</script>
+<iframe id=foo></iframe>
+<script>
+  var fooFrame = document.getElementById('foo');
+  var fooDoc = fooFrame.contentWindow.document;
+  fooFrame.parentNode.removeChild(fooFrame);
+
+  fooDoc.write('<meta http-equiv="X-Frame-Options" content="deny"/>');
+</script>
diff --git a/tests/tests/webkitsecurity/assets/xml-parser-error-message-crash.svg b/tests/tests/webkitsecurity/assets/xml-parser-error-message-crash.svg
new file mode 100644
index 0000000..467710e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/xml-parser-error-message-crash.svg
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg">

+<script>

+if (window.layoutTestController)

+    layoutTestController.dumpAsText();

+

+function runTest()

+{

+    document.firstChild.innerHTML = "PASS";

+}

+

+document.addEventListener("DOMNodeInsertedIntoDocument", runTest, true);

+</script>

+

diff --git a/tests/tests/webkitsecurity/assets/xmlhttprequest-post-crash.html b/tests/tests/webkitsecurity/assets/xmlhttprequest-post-crash.html
new file mode 100644
index 0000000..7200ad3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/xmlhttprequest-post-crash.html
@@ -0,0 +1,29 @@
+<html>
+<head>
+<script type="text/javascript">
+
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+var xhr = new XMLHttpRequest();
+
+xhr.onreadystatechange = function() {
+    if (xhr.readyState == 4) {
+        document.getElementById("page").textContent = "PASS";
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+}
+
+xhr.open("POST", "resources/1251.html", true);
+xhr.send(null);
+</script>
+</head>
+<body>
+<p> Test case for <a href="http://bugs.webkit.org/show_bug.cgi?id=16906">bug 16906</a>: [CURL] Crash below ResourceHandleManager::setupPOST when job->request().httpBody() is NULL </p>
+<p> This page should not crash and you should see PASS</p>
+<div id="page"/>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/xmltokenizer-do-not-crash.pl b/tests/tests/webkitsecurity/assets/xmltokenizer-do-not-crash.pl
new file mode 100755
index 0000000..0319422
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/xmltokenizer-do-not-crash.pl
@@ -0,0 +1,25 @@
+#!/usr/bin/perl -w
+
+# flush the buffers after each print
+select (STDOUT);
+$| = 1;
+
+print "Content-Type: text/xml\r\n";
+print "Expires: Thu, 01 Dec 2003 16:00:00 GMT\r\n";
+print "Cache-Control: no-store, no-cache, must-revalidate\r\n";
+print "Pragma: no-cache\r\n";
+print "\r\n";
+
+print "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">\n";
+print "<html xmlns=\"http://www.w3.org/1999/xhtml\" xml:lang=\"pl\">\n";
+print "<head>\n";
+print "<script>\n";
+print "if (window.layoutTestController) layoutTestController.dumpAsText();\n";
+print "</script>";
+print "</head>\n";
+print "<body>\n";
+print "<pre id='msg'></pre>\n";
+print "<script type='text/javascript' src='resources/script-slow1.pl'></script>\n";
+sleep 1;
+print "<script type='text/javascript' src='resources/script-slow2.pl'></script>\n";
+print "</body></html>\n";
diff --git a/tests/tests/webkitsecurity/assets/xpath-detached-iframe-resolver-crash.html b/tests/tests/webkitsecurity/assets/xpath-detached-iframe-resolver-crash.html
new file mode 100644
index 0000000..c3c387a
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/xpath-detached-iframe-resolver-crash.html
@@ -0,0 +1,40 @@
+<html>
+<head>
+<script src="../js/resources/js-test-pre.js"></script>
+<script>
+    if (window.layoutTestController) {
+        layoutTestController.waitUntilDone();
+        layoutTestController.dumpAsText();
+    }
+
+    var dummyResolverCalled = false;
+    var foundNode;
+    function dummyResolver() {
+        dummyResolverCalled = true;
+        return "http://www.w3.org/1999/xhtml";
+    }
+
+    function test() {
+        var iframe = document.createElement("iframe");
+        document.body.appendChild(iframe);
+        var doc = iframe.contentWindow.document;
+        doc.open();
+        doc.write("<html><body><div></div></body></html>");
+        doc.close();
+        document.body.removeChild(iframe);
+        foundNode = doc.evaluate("//dummyns:div", doc, dummyResolver, XPathResult.FIRST_ORDERED_NODE_TYPE, null).singleNodeValue;
+
+        testPassed("Did not crash.");
+        shouldBeTrue("dummyResolverCalled");
+        shouldBe("foundNode.toString()", "\"[object HTMLDivElement]\"");
+
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+</script>
+</head>
+<body onload="test()">
+<p>Ensure that using XPath namespace resolver with a detached iframe doesn't crash.</p>
+<div id="console"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/xpath-result-eventlistener-crash.html b/tests/tests/webkitsecurity/assets/xpath-result-eventlistener-crash.html
new file mode 100644
index 0000000..8ce3336
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/xpath-result-eventlistener-crash.html
@@ -0,0 +1,56 @@
+<html>
+<body>
+<div id="div"></div>
+<p> Test for bug <a href="https://bugs.webkit.org/show_bug.cgi?id=34231">34231</a>: Nodes in XPath result snapshots should keep JS wrappers alive.</p>
+<p>This page tests for proper invalidation of a node's event listeners. If the test passes, you'll see a PASS message below.</p>
+<pre id="console">FAILED: Test did not run.</pre>
+<script>
+function $(id)
+{
+    return document.getElementById(id);
+}
+
+function log(s)
+{
+    $('console').innerHTML = s + '\n';
+}
+
+function allocate() {
+    for (var i = 0; i < 3000; ++i)
+        String(i);
+}
+
+(function () {
+    if (window.layoutTestController)
+        layoutTestController.dumpAsText();
+
+    // Fill the heap with event listeners...
+    var a = []
+    for (var i = 0; i < 5000; ++i)
+        a[a.length] = function() { };
+
+    // ...followed by a DOM node wrapper
+    var div = $("div");
+
+    // Add the listeners to the DOM node.
+    for (var i = 0; i < a.length; ++i)
+        div.addEventListener("click", a[i], false);
+
+    // Eliminate JS references to the div and its listeners, but keep a reference to the div in an XPath query.
+    var query = document.evaluate("//div", document.documentElement, null, XPathResult.UNORDERED_NODE_SNAPSHOT_TYPE, null);
+    div.parentNode.removeChild(div);
+    div = null
+    a = null;
+
+    // Potentially overwrite listeners with strings, but don't overwrite div.
+    allocate();
+
+    // Fire listeners and see if we crash.
+    var event = document.createEvent('MouseEvent');
+    event.initEvent('click', true, true);
+    query.snapshotItem(0).dispatchEvent(event);
+
+    log("PASS: You didn't crash.");
+})();
+</script>
+</body></html>
diff --git a/tests/tests/webkitsecurity/assets/xslt-transform-to-fragment-crash.html b/tests/tests/webkitsecurity/assets/xslt-transform-to-fragment-crash.html
new file mode 100644
index 0000000..6f0dae3
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/xslt-transform-to-fragment-crash.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+Test passes if it does not crash.
+<script>
+if (window.layoutTestController)
+    layoutTestController.dumpAsText();
+
+var style = '\
+    <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> \
+      <xsl:variable name="test"></xsl:variable> \
+      <xsl:variable name="test"></xsl:variable> \
+    </xsl:stylesheet>';
+var xslp = new XSLTProcessor();
+var foo = new DOMParser().parseFromString(style, "text/xml");
+xslp.importStylesheet(foo);
+xslp.transformToFragment(foo, document);
+xslp.transformToFragment(foo, document);
+</script>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/xss-auditor-doesnt-crash-on-post-submit.html b/tests/tests/webkitsecurity/assets/xss-auditor-doesnt-crash-on-post-submit.html
new file mode 100644
index 0000000..09c734e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/xss-auditor-doesnt-crash-on-post-submit.html
@@ -0,0 +1,32 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script src="../js/resources/js-test-pre.js"></script>
+    <script>
+    function test() {
+        if (document.location.hash !== '#submitted') {
+            if (window.layoutTestController) {
+                layoutTestController.dumpAsText();
+                layoutTestController.setXSSAuditorEnabled(true)
+                layoutTestController.waitUntilDone();
+            }
+
+            var form = document.getElementById('form');
+            // Shouldn't trigger any assertions.
+            form.submit();
+        } else {
+            testPassed('No assertions raised.');
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+        }
+    }
+    </script>
+</head>
+<body onload="test()">
+    This tests that no assertions are thrown when POST submitting a form.
+    <form method="post" id="form" action="#submitted">
+        <input type="text">
+    </form>
+    <div id="console"></div>
+</body>
+</html>
diff --git a/tests/tests/webkitsecurity/assets/zero-colspan-crash.html b/tests/tests/webkitsecurity/assets/zero-colspan-crash.html
new file mode 100644
index 0000000..04a596e
--- /dev/null
+++ b/tests/tests/webkitsecurity/assets/zero-colspan-crash.html
@@ -0,0 +1,34 @@
+<html>
+  <head>
+    <style type="text/css">
+        table
+        {
+            table-layout: fixed;
+            width: 1px;
+        }
+    </style>
+    <script>
+        if (window.layoutTestController) {
+            layoutTestController.dumpAsText();
+            layoutTestController.waitUntilDone();
+        }
+    </script>
+  </head>
+  <body onload="finish()">
+    This test is to ensure that we do not crash while rendering a fixed table layout.
+    <div id="result"><span style='color: red;'>FAIL:</span> Did not complete test</div>
+    <table>
+      <td width="1"></td>
+      <td colspan="65536"></td>
+    </table>
+    <script>
+        function finish()
+        {
+            if (window.layoutTestController)
+                layoutTestController.notifyDone();
+            document.getElementById("result").innerHTML = "<span style='color: green;'>PASS:</span> Did not crash.";
+        }
+    </script>
+  </body>
+</html>
+
diff --git a/tests/tests/webkitsecurity/generate/WebViewBaseTest b/tests/tests/webkitsecurity/generate/WebViewBaseTest
new file mode 100644
index 0000000..9ff6bf6
--- /dev/null
+++ b/tests/tests/webkitsecurity/generate/WebViewBaseTest
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class %s extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "%s";
+    private static final String TEST_PATH = "%s";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public %s() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/generate/generate_webview_crash_tests.py b/tests/tests/webkitsecurity/generate/generate_webview_crash_tests.py
new file mode 100755
index 0000000..6d0de23
--- /dev/null
+++ b/tests/tests/webkitsecurity/generate/generate_webview_crash_tests.py
@@ -0,0 +1,261 @@
+#! /usr/bin/env python
+
+"""
+generate_webview_crash_tests.py
+
+generate_webview_crash_tests.py <path_to_tests>
+
+Specializes WebViewSecurityBaseTest.java with the appropriate values.
+
+This script exists as an ugly hack around the lack of real parameterized testing
+support. Its basic flow is:
+
+  1. Get the path to a directory containing the tests you want.
+  2. Copy those files to ../assets/
+  3. Filter those tests so that we only load the .html files (test roots).
+  4. For each of those, generate a test from WebViewBaseTest.java
+  5. Place the generated tests under src/android/webkitsecurity/cts
+
+The process of generating the tests is very simple:
+
+  1. From each test root generate a Java-style name
+  2. Replace the class name and constructor name with the Java name
+  3. From the Java-style name generate a logtag
+  4. Replace the logtag with the generated logtag value
+  5. Replace the base path with the on-device path to the test root
+  6. TODO: remove the comment at the top of the base file.
+
+"""
+
+import re
+import sys
+import string
+import shutil
+import os.path
+
+BASE_FILE = "WebViewBaseTest"
+HOST_ASSETS_PATH = os.path.join("..", "assets")
+HOST_SOURCE_PATH = os.path.join("..", "src", "android", "webkitsecurity", "cts")
+DEVICE_ASSETS_PATH = ""
+
+
+def print_help():
+  """Prints the docstring, which is also our help text"""
+  print(sys.modules[__name__].__doc__)
+
+
+def get_arguments():
+  """Processes the only argument, ensuring it is sane before returning"""
+
+  # if we don't get the correct number of arguments
+  if len(sys.argv) != 2:
+    print("Sorry, but we need tests to run! Please see the help text below.\n")
+    print_help()
+    exit(1)
+
+  # get the argument
+  argument = os.path.realpath(sys.argv[1])
+
+  # if the given argument isn't a valid directory
+  if not os.path.isdir(argument):
+    print("Given path is not a directory. Please see the help text below.\n")
+    print_help()
+    exit(1)
+
+  # TODO: if the directory is empty or contains no .html files, error out.
+
+  # go home
+  return argument
+
+def is_crashing_test(path):
+  """Checks for the string 'crash' in the file name"""
+  if not path.endswith('expected.txt'):
+    if 'crash' in path.lower():
+      if 'svn' not in path.lower():
+        return True
+  return False
+
+def get_test_paths(directory):
+  """Returns a list of canonical pathnames to the files in the directory"""
+
+  canonical_test_paths = []
+
+  for top, dirs, files in os.walk(directory):
+    for fname in files:
+      name = os.path.join(top, fname)
+      if is_crashing_test(name):
+        canonical_test_paths.append(os.path.join(directory, name))
+
+  # make sure there are some
+  if not canonical_test_paths:
+    print("No test files found! Please specify some and try again.\n")
+    print_help()
+    exit(1)
+
+  # otherwise, head home
+  return canonical_test_paths
+
+
+def copy_assets(test_files):
+  """Copies each of the given test files to the host asset directory"""
+  for path in test_files:
+    shutil.copy(path, HOST_ASSETS_PATH)
+
+
+def get_test_roots(test_files):
+  """Filters out non-HTML files from the list, returning only entry points"""
+
+  # get all the test roots
+  test_roots = [t for t in test_files if t.endswith('.html')]
+
+  # if there aren't any, die
+  if not test_roots:
+    print("No test roots found! Please specify some tests.\n")
+    print_help()
+    exit(1)
+
+  # otherwise, go home
+  return test_roots
+
+
+def read_base_test(base_file):
+  """Reads in the base test file"""
+  with open(base_file) as f:
+    contents = f.read()
+  return contents
+
+
+def get_asset_path(test):
+  """Get the path to the test file on the device"""
+  return DEVICE_ASSETS_PATH + os.path.basename(test)
+
+
+def get_java_name(test):
+  """Returns a Java-style name based on the path of the test.
+
+  This is actually a surprisingly ugly thing to do. The Java convention is:
+
+    * Must start with an uppercase letter
+    * Must not contain the $ or whitespace
+    * Should be CamelCased
+    * Should not contain any other punctuation
+
+  To which we add the following requirements:
+
+    * Must start with 'Webkit'
+    * Must end with 'Test'
+    * Should not contain any other numerals
+    * Should not conflict with any other test
+    * Should not duplicate any words
+
+  Unfortunately, the names of the tests we're given are all across the board,
+  which makes this code a bit of a mess. Our basic process is to:
+
+    1. Gather the basename of the test
+    2. Strip its extension
+    3. Replace all numeric characters (9) with literal counterparts (Nine)
+    4. Stripping split on any undesired character
+    5. Capitalize the fragments
+    6. Verify that the first fragment is not "Webkit"
+    7. Verify that the last fragment is not "Test"
+    8. Join them
+
+  I'm sure there are remaining issues here, but this should do for now.
+  """
+
+  basename = os.path.basename(test)
+
+  # note that this is fragile, but we're being conservative here
+  name = basename.split('.')[0]
+
+  # build the numeral-number table
+  nums = {'0' : "Zero",
+          '1' : "One",
+          '2' : "Two",
+          '3' : "Three",
+          '4' : "Four",
+          '5' : "Five",
+          '6' : "Six",
+          '7' : "Seven",
+          '8' : "Eight",
+          '9' : "Nine"}
+
+  # do our replacement
+  for k, v in nums.items():
+    name = name.replace(k, v)
+
+  # do the stripping split to obtain our fragments
+  undesired_chars = '[' + string.whitespace + string.punctuation + ']'
+  fragments = re.split(undesired_chars, name)
+
+  # capitalize each fragment
+  fragments = [f.capitalize() for f in fragments]
+
+  # check the first and last fragments
+  if fragments[0] != 'Webkit':
+    fragments.insert(0, 'Webkit')
+
+  if fragments[-1] != 'Test':
+    fragments.append('Test')
+
+  # join the results
+  return ''.join(fragments)
+
+
+def get_device_path(test):
+  """Gets the path to the asset as it will be seen from the device"""
+  return DEVICE_ASSETS_PATH + os.path.basename(test)
+
+
+def get_host_test_path(java_name):
+  """Returns the path that the generated test should be stored at"""
+  return os.path.join(HOST_SOURCE_PATH, java_name + '.java')
+
+
+def write_test(test_contents, new_test_host_path):
+  """Writes the given contents at the given path"""
+  with open(new_test_host_path, 'w') as f:
+    f.write(test_contents)
+
+
+if __name__ == "__main__":
+
+  # TODO: check our location
+  # check_sanity()
+
+  # get our aguments
+  directory = get_arguments()
+
+  # turn that into a list of test pathnames
+  test_paths = get_test_paths(directory)
+
+  # copy those paths over to the assets dir
+  copy_assets(test_paths)
+
+  # filter for the .html files
+  test_roots = get_test_roots(test_paths)
+
+  # read the base test in
+  base_test = read_base_test(BASE_FILE)
+
+  # the test roots are the entry points for the tests we care about
+  # let's iterate over them and build the accompanying test files.
+  for test in test_roots:
+
+    # get the values for substitution
+    asset_path = get_asset_path(test)
+    java_name = get_java_name(test)
+
+    # get the on-device path to the test
+    device_test_path = get_device_path(test)
+
+    # do the actual substitution
+    new_test = base_test % (java_name, java_name, device_test_path, java_name)
+
+    # get the destination to write to
+    new_test_host_path = get_host_test_path(java_name)
+
+    # write the test
+    write_test(new_test, new_test_host_path)
+
+  # and we're done!
diff --git a/tests/tests/webkitsecurity/generate/postprocess.py b/tests/tests/webkitsecurity/generate/postprocess.py
new file mode 100644
index 0000000..d245a8b
--- /dev/null
+++ b/tests/tests/webkitsecurity/generate/postprocess.py
@@ -0,0 +1,188 @@
+#! /usr/bin/env python
+
+"""
+webkit_security_postprocessor.py
+
+This script postprocesses the result of a cts-tradefed run of webkit security tests to match the
+failing tests to the appropriate CL in upstream WebKit.
+"""
+
+import os
+import commands
+import multiprocessing
+from xml.etree import ElementTree
+
+class Test:
+
+  java_name = ""
+  webkit_name = ""
+  local_path = ""
+  cls = None
+  test_case = ""
+
+  def __init__(self, java_name):
+    self.java_name = java_name
+    self.cls = []
+
+  def __str__(self):
+    data = self.java_name + '\n'
+    underline = "=" * (len(data) - 1) + "\n"
+    data += underline + '\n'
+    data += "\t" + "to reproduce" + "\n"
+    data += "\t" + "------------" + "\n"
+    data += "\t" + "cts-tradefed run cts --class android.webkitsecurity.cts." + self.java_name + "\n"
+    data += "\n"
+    data += "\t" + "test case" + "\n"
+    data += "\t" + "---------" + "\n"
+    for line in self.test_case.splitlines():
+      data += "\t" + line + "\n"
+    data += "\n"
+    data += "\t" + "revisions" + "\n"
+    data += "\t" + "---------" + "\n"
+    for cl in self.cls:
+      name = "[" + str(cl) + "]"
+      link = "http://trac.webkit.org/changeset/" + str(cl)[1:]
+      data += "\t" + name + "(" + link + ")" + '\n'
+    return data
+
+# get the location of the xml output file
+test_results_directory = "/usr/local/google/android/out/host/linux-x86/cts/android-cts/repository/results"
+
+
+# get the location of the android webkitsecurity tests
+source_dir = "/usr/local/google/android/"
+android_tests_dir = source_dir + "cts/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/"
+
+# get the location of the webkit layout tests
+webkit_tests_dir = "/usr/local/google/webkit/LayoutTests"
+
+def get_test_results():
+  # look in the test results directory
+  test_results = []
+  for root, dirs, fnames in os.walk(test_results_directory):
+    for fname in fnames:
+      if fname == 'testResult.xml':
+        full_path = os.path.abspath(os.path.join(root, fname))
+        test_results.append(full_path)
+
+  # special cases
+  if not test_results:
+    raise Exception("No results found")
+  elif len(test_results) == 1:
+    return test_results[0]
+  else:
+    # find the timestamp of each file
+    newest = None
+    newest_fname = None
+    for fname in test_results:
+      timestamp_start = fname.index('20')
+      timestamp_end = fname.index('/', start)
+      timestamp = time.strptime(fname[timestamp_start:timestamp_end], "%Y.%m.%d_%H.%M.%S")
+      if newest == None or timestamp > newest:
+        newest = timestamp
+        newest_fname = fname
+    return newest_fname
+
+def get_all_java_tests():
+  element_tree = ElementTree.parse(get_test_results())
+  for elem in element_tree.getiterator():
+    if elem.tag == 'TestCase':
+      java_name = elem.attrib['name']
+      if java_name.startswith('Webkit') and java_name.endswith('Test'):
+        for subelem in elem:
+          if subelem.tag == 'Test':
+            if subelem.attrib['result'] == 'fail':
+              yield Test(java_name)
+
+def extract_webkit_name_from_test(test):
+  sig = "    private static final String TEST_PATH = \""
+  for line in test:
+    if line.startswith(sig):
+      return line[len(sig):].strip()[:-2]
+
+def get_all_web_tests(java_tests, android_test_dir):
+  # for each java test
+  for test in java_tests:
+    test_name = os.path.join(android_test_dir, test.java_name) + '.java'
+    with open(test_name) as f:
+      # get the webkit test name
+      webkit_test_name = extract_webkit_name_from_test(f)
+      # postprocess it
+      test.webkit_name = webkit_test_name.split('/')[-1]
+      yield test
+
+def find_local_files(tests, webkit_tests_dir):
+  # convert the test names to a dictionary
+  tests = dict((n.webkit_name, n) for n in tests)
+  # for each test under LayoutTests/
+  for root, dirs, files in os.walk(webkit_tests_dir):
+    if '.svn' in root:
+      continue
+    for fname in files:
+      if fname in tests:
+        tests[fname].local_path = os.path.abspath(os.path.join(root, fname))
+        with open(tests[fname].local_path) as f:
+          tests[fname].test_case = f.read()
+  # return the tests
+  return tests.values()
+
+def get_test_cls(test):
+  cwd = os.getcwd()
+  os.chdir(webkit_tests_dir)
+  while True:
+    cmd = "svn log -q %s" % test.local_path
+    status, output = commands.getstatusoutput(cmd)
+    if not status:
+      break
+  # parse the results, saving only the commit numbers
+  for line in output.splitlines():
+    if line.startswith('r'):
+      cl = line.split()[0].strip()
+      test.cls.append(cl)
+  os.chdir(cwd)
+  return test
+
+def get_all_test_cls(tests):
+  pool = multiprocessing.Pool(processes=12)
+  return pool.map(get_test_cls, tests)
+
+def output(tests, bugreport):
+  for test in tests:
+    print str(test)
+  print
+  print
+  print bugreport
+
+def get_crashes():
+  status, output = commands.getstatusoutput("adb bugreport")
+  # TODO reintroduce crash parsing
+  # - this was removed due to questions about symbol resolution, but could be reintroduced if
+  # - this script as a whole knew anything about branches.
+  # - Alternatively, if this would fail meaningfully it could also be reintroduced
+  return output
+
+def decode_crashes(logcat):
+  with open('/tmp/crashdump.txt', 'w') as f:
+    f.write(logcat)
+  cwd = os.getcwd()
+  os.chdir('/usr/local/google/android') # TODO add branch setting
+  status, output = commands.getstatusoutput("./vendor/google/tools/stack /tmp/crashdump.txt")
+  return output
+
+
+def post_bug(report):
+  # TODO add auto bugging
+  pass
+
+if __name__ == "__main__":
+  java_tests = list(get_all_java_tests())
+  webkit_tests = list(get_all_web_tests(java_tests, android_tests_dir))
+  local_tests = find_local_files(webkit_tests, webkit_tests_dir)
+  tests = get_all_test_cls(local_tests)
+  crashes = get_crashes()
+  traces = decode_crashes(crashes)
+  output(tests, traces)
+  
+
+  
+
diff --git a/tests/tests/webkitsecurity/res/layout/webview_layout.xml b/tests/tests/webkitsecurity/res/layout/webview_layout.xml
new file mode 100644
index 0000000..7a0ed0d
--- /dev/null
+++ b/tests/tests/webkitsecurity/res/layout/webview_layout.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+ * Copyright (C) 2009 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ -->
+<LinearLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    android:orientation="vertical"
+    android:layout_width="match_parent"
+    android:layout_height="wrap_content">
+
+    <WebView android:id="@+id/web_page"
+        android:layout_width="wrap_content"
+        android:layout_height="wrap_content" />
+</LinearLayout>
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebViewStubActivity.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebViewStubActivity.java
new file mode 100644
index 0000000..c971e8c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebViewStubActivity.java
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import android.app.Activity;
+import android.os.Bundle;
+import android.webkit.WebView;
+
+import com.android.cts.webkitsecurity.R;
+
+public class WebViewStubActivity extends Activity {
+    private WebView mWebView;
+
+    @Override
+    public void onCreate(Bundle savedInstanceState) {
+        super.onCreate(savedInstanceState);
+        setContentView(R.layout.webview_layout);
+        mWebView = (WebView) findViewById(R.id.web_page);
+    }
+
+    public WebView getWebView() {
+        return mWebView;
+    }
+
+    @Override
+    public void onDestroy() {
+        mWebView.destroy();
+        super.onDestroy();
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAbortCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAbortCrashTest.java
new file mode 100644
index 0000000..76ceabd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAbortCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAbortCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAbortCrashTest";
+    private static final String TEST_PATH = "abort-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAbortCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAbsolutePositionForeignObjectChildCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAbsolutePositionForeignObjectChildCrashTest.java
new file mode 100644
index 0000000..233a0d7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAbsolutePositionForeignObjectChildCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAbsolutePositionForeignObjectChildCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAbsolutePositionForeignObjectChildCrashTest";
+    private static final String TEST_PATH = "absolute-position-foreign-object-child-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAbsolutePositionForeignObjectChildCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAdoptNodeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAdoptNodeCrashTest.java
new file mode 100644
index 0000000..2e2441c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAdoptNodeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAdoptNodeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAdoptNodeCrashTest";
+    private static final String TEST_PATH = "adopt-node-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAdoptNodeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAfterDoesntCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAfterDoesntCrashTest.java
new file mode 100644
index 0000000..f2e4228
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAfterDoesntCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAfterDoesntCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAfterDoesntCrashTest";
+    private static final String TEST_PATH = "after-doesnt-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAfterDoesntCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAfterWithFirstLetterFloatCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAfterWithFirstLetterFloatCrashTest.java
new file mode 100644
index 0000000..83c5ee2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAfterWithFirstLetterFloatCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAfterWithFirstLetterFloatCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAfterWithFirstLetterFloatCrashTest";
+    private static final String TEST_PATH = "after-with-first-letter-float-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAfterWithFirstLetterFloatCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnchorLinkedAnonymousBlockCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnchorLinkedAnonymousBlockCrashTest.java
new file mode 100644
index 0000000..10a0776
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnchorLinkedAnonymousBlockCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAnchorLinkedAnonymousBlockCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAnchorLinkedAnonymousBlockCrashTest";
+    private static final String TEST_PATH = "anchor-linked-anonymous-block-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAnchorLinkedAnonymousBlockCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnimatedBackgroundImageCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnimatedBackgroundImageCrashTest.java
new file mode 100644
index 0000000..f34d8a7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnimatedBackgroundImageCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAnimatedBackgroundImageCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAnimatedBackgroundImageCrashTest";
+    private static final String TEST_PATH = "animated-background-image-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAnimatedBackgroundImageCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnimationOnInlineCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnimationOnInlineCrashTest.java
new file mode 100644
index 0000000..759d911
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnimationOnInlineCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAnimationOnInlineCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAnimationOnInlineCrashTest";
+    private static final String TEST_PATH = "animation-on-inline-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAnimationOnInlineCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousBeforeChildParentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousBeforeChildParentCrashTest.java
new file mode 100644
index 0000000..47d69fb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousBeforeChildParentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAnonymousBeforeChildParentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAnonymousBeforeChildParentCrashTest";
+    private static final String TEST_PATH = "anonymous-before-child-parent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAnonymousBeforeChildParentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousBlockCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousBlockCrashTest.java
new file mode 100644
index 0000000..205cc42
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousBlockCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAnonymousBlockCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAnonymousBlockCrashTest";
+    private static final String TEST_PATH = "anonymous-block-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAnonymousBlockCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousBlockMergeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousBlockMergeCrashTest.java
new file mode 100644
index 0000000..905ed8e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousBlockMergeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAnonymousBlockMergeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAnonymousBlockMergeCrashTest";
+    private static final String TEST_PATH = "anonymous-block-merge-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAnonymousBlockMergeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousRenderBlockInContinuationCausesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousRenderBlockInContinuationCausesCrashTest.java
new file mode 100644
index 0000000..7515383
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousRenderBlockInContinuationCausesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAnonymousRenderBlockInContinuationCausesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAnonymousRenderBlockInContinuationCausesCrashTest";
+    private static final String TEST_PATH = "anonymous-render-block-in-continuation-causes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAnonymousRenderBlockInContinuationCausesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousSplitBlockCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousSplitBlockCrashTest.java
new file mode 100644
index 0000000..5f25444
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAnonymousSplitBlockCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAnonymousSplitBlockCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAnonymousSplitBlockCrashTest";
+    private static final String TEST_PATH = "anonymous-split-block-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAnonymousSplitBlockCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitApplyStyleTextDecorationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitApplyStyleTextDecorationCrashTest.java
new file mode 100644
index 0000000..69cc46b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitApplyStyleTextDecorationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitApplyStyleTextDecorationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitApplyStyleTextDecorationCrashTest";
+    private static final String TEST_PATH = "apply-style-text-decoration-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitApplyStyleTextDecorationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitApplyblockelementVisiblepositionforindexCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitApplyblockelementVisiblepositionforindexCrashTest.java
new file mode 100644
index 0000000..5a6ac20
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitApplyblockelementVisiblepositionforindexCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitApplyblockelementVisiblepositionforindexCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitApplyblockelementVisiblepositionforindexCrashTest";
+    private static final String TEST_PATH = "applyblockelement-visiblepositionforindex-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitApplyblockelementVisiblepositionforindexCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArcCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArcCrashTest.java
new file mode 100644
index 0000000..414f81a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArcCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitArcCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitArcCrashTest";
+    private static final String TEST_PATH = "arc-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitArcCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAreaIslinkFocusNullPtrCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAreaIslinkFocusNullPtrCrashTest.java
new file mode 100644
index 0000000..36295f5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAreaIslinkFocusNullPtrCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAreaIslinkFocusNullPtrCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAreaIslinkFocusNullPtrCrashTest";
+    private static final String TEST_PATH = "area-islink-focus-null-ptr-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAreaIslinkFocusNullPtrCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAriaActivedescendantCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAriaActivedescendantCrashTest.java
new file mode 100644
index 0000000..159b522
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAriaActivedescendantCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAriaActivedescendantCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAriaActivedescendantCrashTest";
+    private static final String TEST_PATH = "aria-activedescendant-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAriaActivedescendantCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAriaOptionsAndMenuitemsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAriaOptionsAndMenuitemsCrashTest.java
new file mode 100644
index 0000000..b5700a4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAriaOptionsAndMenuitemsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAriaOptionsAndMenuitemsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAriaOptionsAndMenuitemsCrashTest";
+    private static final String TEST_PATH = "aria-options-and-menuitems-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAriaOptionsAndMenuitemsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArrayBufferCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArrayBufferCrashTest.java
new file mode 100644
index 0000000..a15f78c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArrayBufferCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitArrayBufferCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitArrayBufferCrashTest";
+    private static final String TEST_PATH = "array-buffer-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitArrayBufferCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArrayBufferViewCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArrayBufferViewCrashTest.java
new file mode 100644
index 0000000..3a92a03
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArrayBufferViewCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitArrayBufferViewCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitArrayBufferViewCrashTest";
+    private static final String TEST_PATH = "array-buffer-view-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitArrayBufferViewCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArrayBufferViewCrashWhenReassignedTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArrayBufferViewCrashWhenReassignedTest.java
new file mode 100644
index 0000000..6e24be6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitArrayBufferViewCrashWhenReassignedTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitArrayBufferViewCrashWhenReassignedTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitArrayBufferViewCrashWhenReassignedTest";
+    private static final String TEST_PATH = "array-buffer-view-crash-when-reassigned.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitArrayBufferViewCrashWhenReassignedTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAsteriskCounterUpdateAfterLayoutCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAsteriskCounterUpdateAfterLayoutCrashTest.java
new file mode 100644
index 0000000..609feb7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAsteriskCounterUpdateAfterLayoutCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAsteriskCounterUpdateAfterLayoutCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAsteriskCounterUpdateAfterLayoutCrashTest";
+    private static final String TEST_PATH = "asterisk-counter-update-after-layout-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAsteriskCounterUpdateAfterLayoutCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAvlCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAvlCrashTest.java
new file mode 100644
index 0000000..0f3c27d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitAvlCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitAvlCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitAvlCrashTest";
+    private static final String TEST_PATH = "avl-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitAvlCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackcolorCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackcolorCrashTest.java
new file mode 100644
index 0000000..3e5e025
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackcolorCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBackcolorCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBackcolorCrashTest";
+    private static final String TEST_PATH = "backcolor-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBackcolorCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackgroundFillZeroAreaCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackgroundFillZeroAreaCrashTest.java
new file mode 100644
index 0000000..34f3293
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackgroundFillZeroAreaCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBackgroundFillZeroAreaCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBackgroundFillZeroAreaCrashTest";
+    private static final String TEST_PATH = "background-fill-zero-area-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBackgroundFillZeroAreaCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackgroundNorepeatCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackgroundNorepeatCrashTest.java
new file mode 100644
index 0000000..ebe4243
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackgroundNorepeatCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBackgroundNorepeatCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBackgroundNorepeatCrashTest";
+    private static final String TEST_PATH = "background-norepeat-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBackgroundNorepeatCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackwardTextiteratorFirstLetterCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackwardTextiteratorFirstLetterCrashTest.java
new file mode 100644
index 0000000..9833724
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBackwardTextiteratorFirstLetterCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBackwardTextiteratorFirstLetterCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBackwardTextiteratorFirstLetterCrashTest";
+    private static final String TEST_PATH = "backward-textiterator-first-letter-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBackwardTextiteratorFirstLetterCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBadHandshakeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBadHandshakeCrashTest.java
new file mode 100644
index 0000000..b92b2d1
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBadHandshakeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBadHandshakeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBadHandshakeCrashTest";
+    private static final String TEST_PATH = "bad-handshake-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBadHandshakeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBadTransitionShorthandCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBadTransitionShorthandCrashTest.java
new file mode 100644
index 0000000..cb040b9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBadTransitionShorthandCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBadTransitionShorthandCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBadTransitionShorthandCrashTest";
+    private static final String TEST_PATH = "bad-transition-shorthand-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBadTransitionShorthandCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBasevalAnimvalCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBasevalAnimvalCrashTest.java
new file mode 100644
index 0000000..2bf4d52
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBasevalAnimvalCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBasevalAnimvalCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBasevalAnimvalCrashTest";
+    private static final String TEST_PATH = "baseVal-animVal-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBasevalAnimvalCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBasevalAnimvalListCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBasevalAnimvalListCrashTest.java
new file mode 100644
index 0000000..99383f9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBasevalAnimvalListCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBasevalAnimvalListCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBasevalAnimvalListCrashTest";
+    private static final String TEST_PATH = "baseVal-animVal-list-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBasevalAnimvalListCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeBlockDoesntCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeBlockDoesntCrashTest.java
new file mode 100644
index 0000000..0bd326a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeBlockDoesntCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBeforeBlockDoesntCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBeforeBlockDoesntCrashTest";
+    private static final String TEST_PATH = "before-block-doesnt-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBeforeBlockDoesntCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeChildNonTableSectionAddTableCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeChildNonTableSectionAddTableCrashTest.java
new file mode 100644
index 0000000..87c02ac
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeChildNonTableSectionAddTableCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBeforeChildNonTableSectionAddTableCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBeforeChildNonTableSectionAddTableCrashTest";
+    private static final String TEST_PATH = "before-child-non-table-section-add-table-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBeforeChildNonTableSectionAddTableCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeContentWithListMarkerInAnonBlockCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeContentWithListMarkerInAnonBlockCrashTest.java
new file mode 100644
index 0000000..283fa61
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeContentWithListMarkerInAnonBlockCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBeforeContentWithListMarkerInAnonBlockCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBeforeContentWithListMarkerInAnonBlockCrashTest";
+    private static final String TEST_PATH = "before-content-with-list-marker-in-anon-block-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBeforeContentWithListMarkerInAnonBlockCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeDoesntCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeDoesntCrashTest.java
new file mode 100644
index 0000000..821cb65
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeDoesntCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBeforeDoesntCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBeforeDoesntCrashTest";
+    private static final String TEST_PATH = "before-doesnt-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBeforeDoesntCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeTableDoesntCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeTableDoesntCrashTest.java
new file mode 100644
index 0000000..67aac9f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBeforeTableDoesntCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBeforeTableDoesntCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBeforeTableDoesntCrashTest";
+    private static final String TEST_PATH = "before-table-doesnt-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBeforeTableDoesntCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBidiNeutralInMixedDirectionRunCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBidiNeutralInMixedDirectionRunCrashTest.java
new file mode 100644
index 0000000..16737fb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBidiNeutralInMixedDirectionRunCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBidiNeutralInMixedDirectionRunCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBidiNeutralInMixedDirectionRunCrashTest";
+    private static final String TEST_PATH = "bidi-neutral-in-mixed-direction-run-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBidiNeutralInMixedDirectionRunCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBindingsArrayApplyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBindingsArrayApplyCrashTest.java
new file mode 100644
index 0000000..94bed07
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBindingsArrayApplyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBindingsArrayApplyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBindingsArrayApplyCrashTest";
+    private static final String TEST_PATH = "bindings-array-apply-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBindingsArrayApplyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlobBuilderCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlobBuilderCrashTest.java
new file mode 100644
index 0000000..f6445aa
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlobBuilderCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBlobBuilderCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBlobBuilderCrashTest";
+    private static final String TEST_PATH = "blob-builder-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBlobBuilderCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockNotRemovedFromParentLineboxesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockNotRemovedFromParentLineboxesCrashTest.java
new file mode 100644
index 0000000..bbd0f38
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockNotRemovedFromParentLineboxesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBlockNotRemovedFromParentLineboxesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBlockNotRemovedFromParentLineboxesCrashTest";
+    private static final String TEST_PATH = "block-not-removed-from-parent-lineboxes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBlockNotRemovedFromParentLineboxesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockRemoveChildDeleteLineBoxCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockRemoveChildDeleteLineBoxCrashTest.java
new file mode 100644
index 0000000..7bb6083
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockRemoveChildDeleteLineBoxCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBlockRemoveChildDeleteLineBoxCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBlockRemoveChildDeleteLineBoxCrashTest";
+    private static final String TEST_PATH = "block-remove-child-delete-line-box-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBlockRemoveChildDeleteLineBoxCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockStyleProgressCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockStyleProgressCrashTest.java
new file mode 100644
index 0000000..ae3e97c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockStyleProgressCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBlockStyleProgressCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBlockStyleProgressCrashTest";
+    private static final String TEST_PATH = "block-style-progress-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBlockStyleProgressCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockquoteCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockquoteCrashTest.java
new file mode 100644
index 0000000..d4e7a87
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBlockquoteCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBlockquoteCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBlockquoteCrashTest";
+    private static final String TEST_PATH = "blockquote-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBlockquoteCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBodyCloneLinkDeclParentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBodyCloneLinkDeclParentCrashTest.java
new file mode 100644
index 0000000..9985fcb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBodyCloneLinkDeclParentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBodyCloneLinkDeclParentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBodyCloneLinkDeclParentCrashTest";
+    private static final String TEST_PATH = "body-clone-link-decl-parent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBodyCloneLinkDeclParentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBodyRemovalCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBodyRemovalCrashTest.java
new file mode 100644
index 0000000..0f0a570
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBodyRemovalCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBodyRemovalCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBodyRemovalCrashTest";
+    private static final String TEST_PATH = "body-removal-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBodyRemovalCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBorderImageCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBorderImageCrashTest.java
new file mode 100644
index 0000000..88c931a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBorderImageCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBorderImageCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBorderImageCrashTest";
+    private static final String TEST_PATH = "border-image-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBorderImageCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBorderImageNullImageCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBorderImageNullImageCrashTest.java
new file mode 100644
index 0000000..97ffe4a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitBorderImageNullImageCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitBorderImageNullImageCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitBorderImageNullImageCrashTest";
+    private static final String TEST_PATH = "border-image-null-image-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitBorderImageNullImageCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCallApplyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCallApplyCrashTest.java
new file mode 100644
index 0000000..79fa367
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCallApplyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCallApplyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCallApplyCrashTest";
+    private static final String TEST_PATH = "call-apply-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCallApplyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasFontExUnitsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasFontExUnitsCrashTest.java
new file mode 100644
index 0000000..7c836e4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasFontExUnitsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCanvasFontExUnitsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCanvasFontExUnitsCrashTest";
+    private static final String TEST_PATH = "canvas-font-ex-units-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCanvasFontExUnitsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasGetimagedataLargeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasGetimagedataLargeCrashTest.java
new file mode 100644
index 0000000..8587f7b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasGetimagedataLargeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCanvasGetimagedataLargeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCanvasGetimagedataLargeCrashTest";
+    private static final String TEST_PATH = "canvas-getImageData-large-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCanvasGetimagedataLargeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasTodataurlCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasTodataurlCrashTest.java
new file mode 100644
index 0000000..f5793d9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasTodataurlCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCanvasTodataurlCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCanvasTodataurlCrashTest";
+    private static final String TEST_PATH = "canvas-toDataURL-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCanvasTodataurlCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasTodataurlJpegCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasTodataurlJpegCrashTest.java
new file mode 100644
index 0000000..6f872f7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCanvasTodataurlJpegCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCanvasTodataurlJpegCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCanvasTodataurlJpegCrashTest";
+    private static final String TEST_PATH = "canvas-toDataURL-jpeg-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCanvasTodataurlJpegCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCellInRowBeforeMisnestedTextCrashCssTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCellInRowBeforeMisnestedTextCrashCssTest.java
new file mode 100644
index 0000000..ad8af7c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCellInRowBeforeMisnestedTextCrashCssTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCellInRowBeforeMisnestedTextCrashCssTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCellInRowBeforeMisnestedTextCrashCssTest";
+    private static final String TEST_PATH = "cell-in-row-before-misnested-text-crash-css.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCellInRowBeforeMisnestedTextCrashCssTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangeFormElementDocumentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangeFormElementDocumentCrashTest.java
new file mode 100644
index 0000000..68a2eb4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangeFormElementDocumentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitChangeFormElementDocumentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitChangeFormElementDocumentCrashTest";
+    private static final String TEST_PATH = "change-form-element-document-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitChangeFormElementDocumentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangeVersionNoCrashOnPreflightFailureTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangeVersionNoCrashOnPreflightFailureTest.java
new file mode 100644
index 0000000..0403bfa
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangeVersionNoCrashOnPreflightFailureTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitChangeVersionNoCrashOnPreflightFailureTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitChangeVersionNoCrashOnPreflightFailureTest";
+    private static final String TEST_PATH = "change-version-no-crash-on-preflight-failure.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitChangeVersionNoCrashOnPreflightFailureTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangeWidgetAndClickCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangeWidgetAndClickCrashTest.java
new file mode 100644
index 0000000..6ecbd74
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangeWidgetAndClickCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitChangeWidgetAndClickCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitChangeWidgetAndClickCrashTest";
+    private static final String TEST_PATH = "change-widget-and-click-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitChangeWidgetAndClickCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangingAttrbutesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangingAttrbutesCrashTest.java
new file mode 100644
index 0000000..78cb426
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChangingAttrbutesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitChangingAttrbutesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitChangingAttrbutesCrashTest";
+    private static final String TEST_PATH = "changing-attrbutes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitChangingAttrbutesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCharacterDataMutationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCharacterDataMutationCrashTest.java
new file mode 100644
index 0000000..778c97d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCharacterDataMutationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCharacterDataMutationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCharacterDataMutationCrashTest";
+    private static final String TEST_PATH = "character-data-mutation-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCharacterDataMutationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCheckboxSelectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCheckboxSelectionCrashTest.java
new file mode 100644
index 0000000..64d2b7d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCheckboxSelectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCheckboxSelectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCheckboxSelectionCrashTest";
+    private static final String TEST_PATH = "checkbox-selection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCheckboxSelectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChildNotRemovedFromParentLineboxesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChildNotRemovedFromParentLineboxesCrashTest.java
new file mode 100644
index 0000000..30b96a2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChildNotRemovedFromParentLineboxesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitChildNotRemovedFromParentLineboxesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitChildNotRemovedFromParentLineboxesCrashTest";
+    private static final String TEST_PATH = "child-not-removed-from-parent-lineboxes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitChildNotRemovedFromParentLineboxesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChromiumLinuxFallbackCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChromiumLinuxFallbackCrashTest.java
new file mode 100644
index 0000000..5a5dfbf
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitChromiumLinuxFallbackCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitChromiumLinuxFallbackCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitChromiumLinuxFallbackCrashTest";
+    private static final String TEST_PATH = "chromium-linux-fallback-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitChromiumLinuxFallbackCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitClearWatchInvalidIdCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitClearWatchInvalidIdCrashTest.java
new file mode 100644
index 0000000..181920f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitClearWatchInvalidIdCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitClearWatchInvalidIdCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitClearWatchInvalidIdCrashTest";
+    private static final String TEST_PATH = "clear-watch-invalid-id-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitClearWatchInvalidIdCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitClickSizeZeroNoCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitClickSizeZeroNoCrashTest.java
new file mode 100644
index 0000000..a71db65
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitClickSizeZeroNoCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitClickSizeZeroNoCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitClickSizeZeroNoCrashTest";
+    private static final String TEST_PATH = "click-size-zero-no-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitClickSizeZeroNoCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloneAnonymousBlockNonInlineChildCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloneAnonymousBlockNonInlineChildCrashTest.java
new file mode 100644
index 0000000..9fffc22
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloneAnonymousBlockNonInlineChildCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCloneAnonymousBlockNonInlineChildCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCloneAnonymousBlockNonInlineChildCrashTest";
+    private static final String TEST_PATH = "clone-anonymous-block-non-inline-child-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCloneAnonymousBlockNonInlineChildCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloneBeforeAfterContentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloneBeforeAfterContentCrashTest.java
new file mode 100644
index 0000000..f06d590
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloneBeforeAfterContentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCloneBeforeAfterContentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCloneBeforeAfterContentCrashTest";
+    private static final String TEST_PATH = "clone-before-after-content-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCloneBeforeAfterContentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloneBlockChildrenInlineMismatchCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloneBlockChildrenInlineMismatchCrashTest.java
new file mode 100644
index 0000000..cf60266
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloneBlockChildrenInlineMismatchCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCloneBlockChildrenInlineMismatchCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCloneBlockChildrenInlineMismatchCrashTest";
+    private static final String TEST_PATH = "clone-block-children-inline-mismatch-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCloneBlockChildrenInlineMismatchCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitClonenodeAfterDeleteruleCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitClonenodeAfterDeleteruleCrashTest.java
new file mode 100644
index 0000000..6e73aca
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitClonenodeAfterDeleteruleCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitClonenodeAfterDeleteruleCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitClonenodeAfterDeleteruleCrashTest";
+    private static final String TEST_PATH = "cloneNode-after-deleteRule-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitClonenodeAfterDeleteruleCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloseInOnmessageCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloseInOnmessageCrashTest.java
new file mode 100644
index 0000000..46f287d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCloseInOnmessageCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCloseInOnmessageCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCloseInOnmessageCrashTest";
+    private static final String TEST_PATH = "close-in-onmessage-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCloseInOnmessageCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitColumnSpanParentContinuationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitColumnSpanParentContinuationCrashTest.java
new file mode 100644
index 0000000..15a66f4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitColumnSpanParentContinuationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitColumnSpanParentContinuationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitColumnSpanParentContinuationCrashTest";
+    private static final String TEST_PATH = "column-span-parent-continuation-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitColumnSpanParentContinuationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCombiningCharacterSequenceFallbackCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCombiningCharacterSequenceFallbackCrashTest.java
new file mode 100644
index 0000000..8cdb4ed
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCombiningCharacterSequenceFallbackCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCombiningCharacterSequenceFallbackCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCombiningCharacterSequenceFallbackCrashTest";
+    private static final String TEST_PATH = "combining-character-sequence-fallback-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCombiningCharacterSequenceFallbackCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitConsoleLongEvalCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitConsoleLongEvalCrashTest.java
new file mode 100644
index 0000000..0e5f503
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitConsoleLongEvalCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitConsoleLongEvalCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitConsoleLongEvalCrashTest";
+    private static final String TEST_PATH = "console-long-eval-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitConsoleLongEvalCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitConstructorAsFunctionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitConstructorAsFunctionCrashTest.java
new file mode 100644
index 0000000..06d151d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitConstructorAsFunctionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitConstructorAsFunctionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitConstructorAsFunctionCrashTest";
+    private static final String TEST_PATH = "constructor-as-function-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitConstructorAsFunctionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContainerTransformCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContainerTransformCrashTest.java
new file mode 100644
index 0000000..cb5fb5b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContainerTransformCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitContainerTransformCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitContainerTransformCrashTest";
+    private static final String TEST_PATH = "container-transform-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitContainerTransformCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContentHeightZeroCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContentHeightZeroCrashTest.java
new file mode 100644
index 0000000..19877ef
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContentHeightZeroCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitContentHeightZeroCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitContentHeightZeroCrashTest";
+    private static final String TEST_PATH = "content-height-zero-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitContentHeightZeroCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContextDestroyedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContextDestroyedCrashTest.java
new file mode 100644
index 0000000..7f4e005
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContextDestroyedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitContextDestroyedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitContextDestroyedCrashTest";
+    private static final String TEST_PATH = "context-destroyed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitContextDestroyedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContinuationcrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContinuationcrashTest.java
new file mode 100644
index 0000000..bdcf7c4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitContinuationcrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitContinuationcrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitContinuationcrashTest";
+    private static final String TEST_PATH = "continuationCrash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitContinuationcrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyCrashTest.java
new file mode 100644
index 0000000..44ac8c0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCopyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCopyCrashTest";
+    private static final String TEST_PATH = "copy-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCopyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyCrashWithExtraneousAttributeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyCrashWithExtraneousAttributeTest.java
new file mode 100644
index 0000000..1765794
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyCrashWithExtraneousAttributeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCopyCrashWithExtraneousAttributeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCopyCrashWithExtraneousAttributeTest";
+    private static final String TEST_PATH = "copy-crash-with-extraneous-attribute.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCopyCrashWithExtraneousAttributeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyStandaloneImageCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyStandaloneImageCrashTest.java
new file mode 100644
index 0000000..852474c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyStandaloneImageCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCopyStandaloneImageCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCopyStandaloneImageCrashTest";
+    private static final String TEST_PATH = "copy-standalone-image-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCopyStandaloneImageCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyWithoutCommonBlockCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyWithoutCommonBlockCrashTest.java
new file mode 100644
index 0000000..17c4194
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCopyWithoutCommonBlockCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCopyWithoutCommonBlockCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCopyWithoutCommonBlockCrashTest";
+    private static final String TEST_PATH = "copy-without-common-block-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCopyWithoutCommonBlockCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterAfterStyleCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterAfterStyleCrashTest.java
new file mode 100644
index 0000000..eabbd60
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterAfterStyleCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCounterAfterStyleCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCounterAfterStyleCrashTest";
+    private static final String TEST_PATH = "counter-after-style-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCounterAfterStyleCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterBeforeSelectorCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterBeforeSelectorCrashTest.java
new file mode 100644
index 0000000..9b456f8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterBeforeSelectorCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCounterBeforeSelectorCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCounterBeforeSelectorCrashTest";
+    private static final String TEST_PATH = "counter-before-selector-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCounterBeforeSelectorCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterCrashFrameSrcTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterCrashFrameSrcTest.java
new file mode 100644
index 0000000..c9c2a46
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterCrashFrameSrcTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCounterCrashFrameSrcTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCounterCrashFrameSrcTest";
+    private static final String TEST_PATH = "counter-crash-frame-src.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCounterCrashFrameSrcTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterCrashTest.java
new file mode 100644
index 0000000..a53a52c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCounterCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCounterCrashTest";
+    private static final String TEST_PATH = "counter-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCounterCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterReparentTableChildrenCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterReparentTableChildrenCrashTest.java
new file mode 100644
index 0000000..7a64928
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterReparentTableChildrenCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCounterReparentTableChildrenCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCounterReparentTableChildrenCrashTest";
+    private static final String TEST_PATH = "counter-reparent-table-children-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCounterReparentTableChildrenCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterTraverseObjectCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterTraverseObjectCrashTest.java
new file mode 100644
index 0000000..eabb27f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCounterTraverseObjectCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCounterTraverseObjectCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCounterTraverseObjectCrashTest";
+    private static final String TEST_PATH = "counter-traverse-object-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCounterTraverseObjectCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashAccessingClipboarddataTypesTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashAccessingClipboarddataTypesTest.java
new file mode 100644
index 0000000..1e001b7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashAccessingClipboarddataTypesTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashAccessingClipboarddataTypesTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashAccessingClipboarddataTypesTest";
+    private static final String TEST_PATH = "crash-accessing-clipboardData-types.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashAccessingClipboarddataTypesTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashAnonymousTableComputelogicalwidthTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashAnonymousTableComputelogicalwidthTest.java
new file mode 100644
index 0000000..b569734
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashAnonymousTableComputelogicalwidthTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashAnonymousTableComputelogicalwidthTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashAnonymousTableComputelogicalwidthTest";
+    private static final String TEST_PATH = "crash-anonymous-table-computeLogicalWidth.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashAnonymousTableComputelogicalwidthTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashAnonymousTableLayoutTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashAnonymousTableLayoutTest.java
new file mode 100644
index 0000000..3e97ec6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashAnonymousTableLayoutTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashAnonymousTableLayoutTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashAnonymousTableLayoutTest";
+    private static final String TEST_PATH = "crash-anonymous-table-layout.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashAnonymousTableLayoutTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashBeforeborderDirtySectionTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashBeforeborderDirtySectionTest.java
new file mode 100644
index 0000000..4b2411a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashBeforeborderDirtySectionTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashBeforeborderDirtySectionTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashBeforeborderDirtySectionTest";
+    private static final String TEST_PATH = "crash-beforeBorder-dirty-section.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashBeforeborderDirtySectionTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashBreakingBlockquoteWithListTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashBreakingBlockquoteWithListTest.java
new file mode 100644
index 0000000..82e3686
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashBreakingBlockquoteWithListTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashBreakingBlockquoteWithListTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashBreakingBlockquoteWithListTest";
+    private static final String TEST_PATH = "crash-breaking-blockquote-with-list.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashBreakingBlockquoteWithListTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashButtonInputAutofocusTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashButtonInputAutofocusTest.java
new file mode 100644
index 0000000..362d6fb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashButtonInputAutofocusTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashButtonInputAutofocusTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashButtonInputAutofocusTest";
+    private static final String TEST_PATH = "crash-button-input-autofocus.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashButtonInputAutofocusTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashButtonKeygenTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashButtonKeygenTest.java
new file mode 100644
index 0000000..78374c8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashButtonKeygenTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashButtonKeygenTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashButtonKeygenTest";
+    private static final String TEST_PATH = "crash-button-keygen.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashButtonKeygenTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashButtonRelayoutTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashButtonRelayoutTest.java
new file mode 100644
index 0000000..e3e85c2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashButtonRelayoutTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashButtonRelayoutTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashButtonRelayoutTest";
+    private static final String TEST_PATH = "crash-button-relayout.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashButtonRelayoutTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashClosingPageWithMediaAsPluginFallbackTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashClosingPageWithMediaAsPluginFallbackTest.java
new file mode 100644
index 0000000..685b09a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashClosingPageWithMediaAsPluginFallbackTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashClosingPageWithMediaAsPluginFallbackTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashClosingPageWithMediaAsPluginFallbackTest";
+    private static final String TEST_PATH = "crash-closing-page-with-media-as-plugin-fallback.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashClosingPageWithMediaAsPluginFallbackTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashCopyingBackforwardlistTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashCopyingBackforwardlistTest.java
new file mode 100644
index 0000000..4f66b1e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashCopyingBackforwardlistTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashCopyingBackforwardlistTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashCopyingBackforwardlistTest";
+    private static final String TEST_PATH = "crash-copying-backforwardlist.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashCopyingBackforwardlistTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashDeterminingAriaRoleWhenLabelPresentTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashDeterminingAriaRoleWhenLabelPresentTest.java
new file mode 100644
index 0000000..47a1178
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashDeterminingAriaRoleWhenLabelPresentTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashDeterminingAriaRoleWhenLabelPresentTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashDeterminingAriaRoleWhenLabelPresentTest";
+    private static final String TEST_PATH = "crash-determining-aria-role-when-label-present.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashDeterminingAriaRoleWhenLabelPresentTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashDisplayLocalDirectoryTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashDisplayLocalDirectoryTest.java
new file mode 100644
index 0000000..83a7b77
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashDisplayLocalDirectoryTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashDisplayLocalDirectoryTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashDisplayLocalDirectoryTest";
+    private static final String TEST_PATH = "crash-display-local-directory.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashDisplayLocalDirectoryTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashEmptySectionCalcborderTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashEmptySectionCalcborderTest.java
new file mode 100644
index 0000000..f8cf7ca
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashEmptySectionCalcborderTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashEmptySectionCalcborderTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashEmptySectionCalcborderTest";
+    private static final String TEST_PATH = "crash-empty-section-calcBorder.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashEmptySectionCalcborderTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashEmptySectionFixedLayoutCalcarrayTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashEmptySectionFixedLayoutCalcarrayTest.java
new file mode 100644
index 0000000..81b2321
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashEmptySectionFixedLayoutCalcarrayTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashEmptySectionFixedLayoutCalcarrayTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashEmptySectionFixedLayoutCalcarrayTest";
+    private static final String TEST_PATH = "crash-empty-section-fixed-layout-calcArray.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashEmptySectionFixedLayoutCalcarrayTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashFilterChangeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashFilterChangeTest.java
new file mode 100644
index 0000000..60fc71b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashFilterChangeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashFilterChangeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashFilterChangeTest";
+    private static final String TEST_PATH = "crash-filter-change.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashFilterChangeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashFlexboxNoLayoutChildTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashFlexboxNoLayoutChildTest.java
new file mode 100644
index 0000000..98fd6f2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashFlexboxNoLayoutChildTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashFlexboxNoLayoutChildTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashFlexboxNoLayoutChildTest";
+    private static final String TEST_PATH = "crash-flexbox-no-layout-child.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashFlexboxNoLayoutChildTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashFramesetCssContentPropertyTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashFramesetCssContentPropertyTest.java
new file mode 100644
index 0000000..5b7de0c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashFramesetCssContentPropertyTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashFramesetCssContentPropertyTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashFramesetCssContentPropertyTest";
+    private static final String TEST_PATH = "crash-frameset-CSS-content-property.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashFramesetCssContentPropertyTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedCounterTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedCounterTest.java
new file mode 100644
index 0000000..50677ac
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedCounterTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashGeneratedCounterTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashGeneratedCounterTest";
+    private static final String TEST_PATH = "crash-generated-counter.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashGeneratedCounterTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedImageTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedImageTest.java
new file mode 100644
index 0000000..f036e3c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedImageTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashGeneratedImageTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashGeneratedImageTest";
+    private static final String TEST_PATH = "crash-generated-image.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashGeneratedImageTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedQuoteTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedQuoteTest.java
new file mode 100644
index 0000000..7275058
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedQuoteTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashGeneratedQuoteTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashGeneratedQuoteTest";
+    private static final String TEST_PATH = "crash-generated-quote.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashGeneratedQuoteTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedTextTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedTextTest.java
new file mode 100644
index 0000000..988a256
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashGeneratedTextTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashGeneratedTextTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashGeneratedTextTest";
+    private static final String TEST_PATH = "crash-generated-text.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashGeneratedTextTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashHtmlparserCreateheadTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashHtmlparserCreateheadTest.java
new file mode 100644
index 0000000..b4de2cc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashHtmlparserCreateheadTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashHtmlparserCreateheadTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashHtmlparserCreateheadTest";
+    private static final String TEST_PATH = "crash-HTMLParser-createHead.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashHtmlparserCreateheadTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashHugeLayerTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashHugeLayerTest.java
new file mode 100644
index 0000000..ad91eb7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashHugeLayerTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashHugeLayerTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashHugeLayerTest";
+    private static final String TEST_PATH = "crash-huge-layer.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashHugeLayerTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashHwSwSwitchTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashHwSwSwitchTest.java
new file mode 100644
index 0000000..8992ce2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashHwSwSwitchTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashHwSwSwitchTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashHwSwSwitchTest";
+    private static final String TEST_PATH = "crash-hw-sw-switch.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashHwSwSwitchTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashInElementForTextMarkerTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashInElementForTextMarkerTest.java
new file mode 100644
index 0000000..c7c2d6f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashInElementForTextMarkerTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashInElementForTextMarkerTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashInElementForTextMarkerTest";
+    private static final String TEST_PATH = "crash-in-element-for-text-marker.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashInElementForTextMarkerTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashIndentingListItemTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashIndentingListItemTest.java
new file mode 100644
index 0000000..47be35a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashIndentingListItemTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashIndentingListItemTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashIndentingListItemTest";
+    private static final String TEST_PATH = "crash-indenting-list-item.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashIndentingListItemTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashInlineContainerClientTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashInlineContainerClientTest.java
new file mode 100644
index 0000000..2ffc6e8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashInlineContainerClientTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashInlineContainerClientTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashInlineContainerClientTest";
+    private static final String TEST_PATH = "crash-inline-container-client.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashInlineContainerClientTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashInvalidTextMarkerNodeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashInvalidTextMarkerNodeTest.java
new file mode 100644
index 0000000..f828cc5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashInvalidTextMarkerNodeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashInvalidTextMarkerNodeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashInvalidTextMarkerNodeTest";
+    private static final String TEST_PATH = "crash-invalid-text-marker-node.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashInvalidTextMarkerNodeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashLineBreakAfterOutdentTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashLineBreakAfterOutdentTest.java
new file mode 100644
index 0000000..3a4a1da
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashLineBreakAfterOutdentTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashLineBreakAfterOutdentTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashLineBreakAfterOutdentTest";
+    private static final String TEST_PATH = "crash-line-break-after-outdent.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashLineBreakAfterOutdentTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashMultipleFamilyFontfaceTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashMultipleFamilyFontfaceTest.java
new file mode 100644
index 0000000..ea17683
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashMultipleFamilyFontfaceTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashMultipleFamilyFontfaceTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashMultipleFamilyFontfaceTest";
+    private static final String TEST_PATH = "crash-multiple-family-fontface.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashMultipleFamilyFontfaceTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnAbsolutePositioningTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnAbsolutePositioningTest.java
new file mode 100644
index 0000000..bb336f4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnAbsolutePositioningTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnAbsolutePositioningTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnAbsolutePositioningTest";
+    private static final String TEST_PATH = "crash-on-absolute-positioning.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnAbsolutePositioningTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnClearSelectionTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnClearSelectionTest.java
new file mode 100644
index 0000000..5ec365d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnClearSelectionTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnClearSelectionTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnClearSelectionTest";
+    private static final String TEST_PATH = "crash-on-clear-selection.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnClearSelectionTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnCustomCursorWhenLoadingTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnCustomCursorWhenLoadingTest.java
new file mode 100644
index 0000000..35e4b4d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnCustomCursorWhenLoadingTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnCustomCursorWhenLoadingTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnCustomCursorWhenLoadingTest";
+    private static final String TEST_PATH = "crash-on-custom-cursor-when-loading.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnCustomCursorWhenLoadingTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnDegenerateGradientTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnDegenerateGradientTest.java
new file mode 100644
index 0000000..4cc3160
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnDegenerateGradientTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnDegenerateGradientTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnDegenerateGradientTest";
+    private static final String TEST_PATH = "crash-on-degenerate-gradient.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnDegenerateGradientTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnDragWithMutationEventsTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnDragWithMutationEventsTest.java
new file mode 100644
index 0000000..2670ba2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnDragWithMutationEventsTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnDragWithMutationEventsTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnDragWithMutationEventsTest";
+    private static final String TEST_PATH = "crash-on-drag-with-mutation-events.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnDragWithMutationEventsTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnEnterInContenteditableListTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnEnterInContenteditableListTest.java
new file mode 100644
index 0000000..4227e06
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnEnterInContenteditableListTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnEnterInContenteditableListTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnEnterInContenteditableListTest";
+    private static final String TEST_PATH = "crash-on-enter-in-contentEditable-list.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnEnterInContenteditableListTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnMutateDuringDropTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnMutateDuringDropTest.java
new file mode 100644
index 0000000..ae15b54
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnMutateDuringDropTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnMutateDuringDropTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnMutateDuringDropTest";
+    private static final String TEST_PATH = "crash-on-mutate-during-drop.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnMutateDuringDropTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnOnepxBorderTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnOnepxBorderTest.java
new file mode 100644
index 0000000..ca5e375
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnOnepxBorderTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnOnepxBorderTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnOnepxBorderTest";
+    private static final String TEST_PATH = "crash-on-1px-border.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnOnepxBorderTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnRemoveTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnRemoveTest.java
new file mode 100644
index 0000000..93fbb66
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnRemoveTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnRemoveTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnRemoveTest";
+    private static final String TEST_PATH = "crash-on-remove.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnRemoveTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnTrTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnTrTest.java
new file mode 100644
index 0000000..c50bba2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnTrTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnTrTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnTrTest";
+    private static final String TEST_PATH = "crash-on-tr.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnTrTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnZeroRadiusTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnZeroRadiusTest.java
new file mode 100644
index 0000000..65974ad
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOnZeroRadiusTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOnZeroRadiusTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOnZeroRadiusTest";
+    private static final String TEST_PATH = "crash-on-zero-radius.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOnZeroRadiusTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOneTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOneTest.java
new file mode 100644
index 0000000..acf4447
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashOneTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashOneTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashOneTest";
+    private static final String TEST_PATH = "crash-1.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashOneTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashRemovedIframeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashRemovedIframeTest.java
new file mode 100644
index 0000000..dd85b11
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashRemovedIframeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashRemovedIframeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashRemovedIframeTest";
+    private static final String TEST_PATH = "crash-removed-iframe.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashRemovedIframeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashReparentTiledLayerTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashReparentTiledLayerTest.java
new file mode 100644
index 0000000..e4c51d0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashReparentTiledLayerTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashReparentTiledLayerTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashReparentTiledLayerTest";
+    private static final String TEST_PATH = "crash-reparent-tiled-layer.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashReparentTiledLayerTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashReplacedDisplayBlockTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashReplacedDisplayBlockTest.java
new file mode 100644
index 0000000..d0b914a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashReplacedDisplayBlockTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashReplacedDisplayBlockTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashReplacedDisplayBlockTest";
+    private static final String TEST_PATH = "crash-replaced-display-block.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashReplacedDisplayBlockTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashReplacingLocationBeforeLoadTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashReplacingLocationBeforeLoadTest.java
new file mode 100644
index 0000000..855d001
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashReplacingLocationBeforeLoadTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashReplacingLocationBeforeLoadTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashReplacingLocationBeforeLoadTest";
+    private static final String TEST_PATH = "crash-replacing-location-before-load.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashReplacingLocationBeforeLoadTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashRestoringPluginPageFromPageCacheTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashRestoringPluginPageFromPageCacheTest.java
new file mode 100644
index 0000000..2878c77
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashRestoringPluginPageFromPageCacheTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashRestoringPluginPageFromPageCacheTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashRestoringPluginPageFromPageCacheTest";
+    private static final String TEST_PATH = "crash-restoring-plugin-page-from-page-cache.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashRestoringPluginPageFromPageCacheTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSectionLogicalHeightChangedNeedscellrecalcTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSectionLogicalHeightChangedNeedscellrecalcTest.java
new file mode 100644
index 0000000..0f26a42
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSectionLogicalHeightChangedNeedscellrecalcTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashSectionLogicalHeightChangedNeedscellrecalcTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashSectionLogicalHeightChangedNeedscellrecalcTest";
+    private static final String TEST_PATH = "crash-section-logical-height-changed-needsCellRecalc.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashSectionLogicalHeightChangedNeedscellrecalcTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSetFontTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSetFontTest.java
new file mode 100644
index 0000000..c774d3b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSetFontTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashSetFontTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashSetFontTest";
+    private static final String TEST_PATH = "crash-set-font.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashSetFontTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSplitcolumnTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSplitcolumnTest.java
new file mode 100644
index 0000000..e54bfa5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSplitcolumnTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashSplitcolumnTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashSplitcolumnTest";
+    private static final String TEST_PATH = "crash-splitColumn.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashSplitcolumnTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSplitcolumnThreeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSplitcolumnThreeTest.java
new file mode 100644
index 0000000..29a77bd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSplitcolumnThreeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashSplitcolumnThreeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashSplitcolumnThreeTest";
+    private static final String TEST_PATH = "crash-splitColumn-3.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashSplitcolumnThreeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSplitcolumnTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSplitcolumnTwoTest.java
new file mode 100644
index 0000000..ae91b94
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSplitcolumnTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashSplitcolumnTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashSplitcolumnTwoTest";
+    private static final String TEST_PATH = "crash-splitColumn-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashSplitcolumnTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashStyleFirstLetterTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashStyleFirstLetterTest.java
new file mode 100644
index 0000000..7c3c76c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashStyleFirstLetterTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashStyleFirstLetterTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashStyleFirstLetterTest";
+    private static final String TEST_PATH = "crash-style-first-letter.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashStyleFirstLetterTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSvgDocumentTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSvgDocumentTest.java
new file mode 100644
index 0000000..7c4d60c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashSvgDocumentTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashSvgDocumentTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashSvgDocumentTest";
+    private static final String TEST_PATH = "crash-svg-document.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashSvgDocumentTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashTableCellChangeHeightTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashTableCellChangeHeightTest.java
new file mode 100644
index 0000000..bd4dfb6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashTableCellChangeHeightTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashTableCellChangeHeightTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashTableCellChangeHeightTest";
+    private static final String TEST_PATH = "crash-table-cell-change-height.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashTableCellChangeHeightTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashTextpathAttributesTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashTextpathAttributesTest.java
new file mode 100644
index 0000000..45e399b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashTextpathAttributesTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashTextpathAttributesTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashTextpathAttributesTest";
+    private static final String TEST_PATH = "crash-textPath-attributes.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashTextpathAttributesTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashTwoTest.java
new file mode 100644
index 0000000..17f8513
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashTwoTest";
+    private static final String TEST_PATH = "crash-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWhenNavigatingAwayThenBackTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWhenNavigatingAwayThenBackTest.java
new file mode 100644
index 0000000..1af8781
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWhenNavigatingAwayThenBackTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashWhenNavigatingAwayThenBackTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashWhenNavigatingAwayThenBackTest";
+    private static final String TEST_PATH = "crash-when-navigating-away-then-back.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashWhenNavigatingAwayThenBackTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWhenReparentSiblingTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWhenReparentSiblingTest.java
new file mode 100644
index 0000000..f841fa2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWhenReparentSiblingTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashWhenReparentSiblingTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashWhenReparentSiblingTest";
+    private static final String TEST_PATH = "crash-when-reparent-sibling.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashWhenReparentSiblingTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWhileLoadingTagWithPauseTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWhileLoadingTagWithPauseTest.java
new file mode 100644
index 0000000..492126c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWhileLoadingTagWithPauseTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashWhileLoadingTagWithPauseTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashWhileLoadingTagWithPauseTest";
+    private static final String TEST_PATH = "crash-while-loading-tag-with-pause.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashWhileLoadingTagWithPauseTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWithNoelementSelectboxTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWithNoelementSelectboxTest.java
new file mode 100644
index 0000000..183ad1d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashWithNoelementSelectboxTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashWithNoelementSelectboxTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashWithNoelementSelectboxTest";
+    private static final String TEST_PATH = "crash-with-noelement-selectbox.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashWithNoelementSelectboxTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashingATagInMapTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashingATagInMapTest.java
new file mode 100644
index 0000000..87166a3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrashingATagInMapTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrashingATagInMapTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrashingATagInMapTest";
+    private static final String TEST_PATH = "crashing-a-tag-in-map.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrashingATagInMapTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCreateBlobUrlCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCreateBlobUrlCrashTest.java
new file mode 100644
index 0000000..721247c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCreateBlobUrlCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCreateBlobUrlCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCreateBlobUrlCrashTest";
+    private static final String TEST_PATH = "create-blob-url-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCreateBlobUrlCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCreateDocumentCrashOnAttachEventTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCreateDocumentCrashOnAttachEventTest.java
new file mode 100644
index 0000000..68daaa7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCreateDocumentCrashOnAttachEventTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCreateDocumentCrashOnAttachEventTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCreateDocumentCrashOnAttachEventTest";
+    private static final String TEST_PATH = "create-document-crash-on-attach-event.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCreateDocumentCrashOnAttachEventTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCreatePatternDoesNotCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCreatePatternDoesNotCrashTest.java
new file mode 100644
index 0000000..dcd3110
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCreatePatternDoesNotCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCreatePatternDoesNotCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCreatePatternDoesNotCrashTest";
+    private static final String TEST_PATH = "create-pattern-does-not-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCreatePatternDoesNotCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrossOriginStylesheetCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrossOriginStylesheetCrashTest.java
new file mode 100644
index 0000000..f7ba5d6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCrossOriginStylesheetCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCrossOriginStylesheetCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCrossOriginStylesheetCrashTest";
+    private static final String TEST_PATH = "cross-origin-stylesheet-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCrossOriginStylesheetCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssContentAndWebkitMaskBoxImageCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssContentAndWebkitMaskBoxImageCrashTest.java
new file mode 100644
index 0000000..870e614
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssContentAndWebkitMaskBoxImageCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCssContentAndWebkitMaskBoxImageCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCssContentAndWebkitMaskBoxImageCrashTest";
+    private static final String TEST_PATH = "css-content-and-webkit-mask-box-image-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCssContentAndWebkitMaskBoxImageCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssFontfaceRuleCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssFontfaceRuleCrashTest.java
new file mode 100644
index 0000000..cc8537e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssFontfaceRuleCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCssFontfaceRuleCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCssFontfaceRuleCrashTest";
+    private static final String TEST_PATH = "css-fontface-rule-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCssFontfaceRuleCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssInlineStyleDeclarationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssInlineStyleDeclarationCrashTest.java
new file mode 100644
index 0000000..c898196
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssInlineStyleDeclarationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCssInlineStyleDeclarationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCssInlineStyleDeclarationCrashTest";
+    private static final String TEST_PATH = "css-inline-style-declaration-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCssInlineStyleDeclarationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssKeyframeStyleCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssKeyframeStyleCrashTest.java
new file mode 100644
index 0000000..479a6d0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssKeyframeStyleCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCssKeyframeStyleCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCssKeyframeStyleCrashTest";
+    private static final String TEST_PATH = "css-keyframe-style-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCssKeyframeStyleCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCsstargetCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCsstargetCrashTest.java
new file mode 100644
index 0000000..dcfc174
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCsstargetCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCsstargetCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCsstargetCrashTest";
+    private static final String TEST_PATH = "cssTarget-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCsstargetCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssthreeRadialGradientCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssthreeRadialGradientCrashTest.java
new file mode 100644
index 0000000..a892dce
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCssthreeRadialGradientCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCssthreeRadialGradientCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCssthreeRadialGradientCrashTest";
+    private static final String TEST_PATH = "css3-radial-gradient-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCssthreeRadialGradientCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCustomFontDataCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCustomFontDataCrashTest.java
new file mode 100644
index 0000000..8704fcc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCustomFontDataCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCustomFontDataCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCustomFontDataCrashTest";
+    private static final String TEST_PATH = "custom-font-data-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCustomFontDataCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCustomFontDataCrashtwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCustomFontDataCrashtwoTest.java
new file mode 100644
index 0000000..d6b0161
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitCustomFontDataCrashtwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitCustomFontDataCrashtwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitCustomFontDataCrashtwoTest";
+    private static final String TEST_PATH = "custom-font-data-crash2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitCustomFontDataCrashtwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDanglingFormElementCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDanglingFormElementCrashTest.java
new file mode 100644
index 0000000..d7f3066
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDanglingFormElementCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDanglingFormElementCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDanglingFormElementCrashTest";
+    private static final String TEST_PATH = "dangling-form-element-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDanglingFormElementCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDashboardRegionsAttrCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDashboardRegionsAttrCrashTest.java
new file mode 100644
index 0000000..297e355
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDashboardRegionsAttrCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDashboardRegionsAttrCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDashboardRegionsAttrCrashTest";
+    private static final String TEST_PATH = "dashboard-regions-attr-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDashboardRegionsAttrCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDataViewCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDataViewCrashTest.java
new file mode 100644
index 0000000..0f82651
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDataViewCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDataViewCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDataViewCrashTest";
+    private static final String TEST_PATH = "data-view-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDataViewCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDebuggerActivationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDebuggerActivationCrashTest.java
new file mode 100644
index 0000000..fdddfd0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDebuggerActivationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDebuggerActivationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDebuggerActivationCrashTest";
+    private static final String TEST_PATH = "debugger-activation-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDebuggerActivationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDebuggerActivationCrashtwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDebuggerActivationCrashtwoTest.java
new file mode 100644
index 0000000..0ba53a5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDebuggerActivationCrashtwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDebuggerActivationCrashtwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDebuggerActivationCrashtwoTest";
+    private static final String TEST_PATH = "debugger-activation-crash2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDebuggerActivationCrashtwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDelayedStyleMutationEventCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDelayedStyleMutationEventCrashTest.java
new file mode 100644
index 0000000..b0af789
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDelayedStyleMutationEventCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDelayedStyleMutationEventCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDelayedStyleMutationEventCrashTest";
+    private static final String TEST_PATH = "delayed-style-mutation-event-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDelayedStyleMutationEventCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDeleteInsignificantTextCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDeleteInsignificantTextCrashTest.java
new file mode 100644
index 0000000..e83ccd9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDeleteInsignificantTextCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDeleteInsignificantTextCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDeleteInsignificantTextCrashTest";
+    private static final String TEST_PATH = "delete-insignificant-text-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDeleteInsignificantTextCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDestroyCellWithSelectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDestroyCellWithSelectionCrashTest.java
new file mode 100644
index 0000000..4b9ea13
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDestroyCellWithSelectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDestroyCellWithSelectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDestroyCellWithSelectionCrashTest";
+    private static final String TEST_PATH = "destroy-cell-with-selection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDestroyCellWithSelectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDestroyCounterCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDestroyCounterCrashTest.java
new file mode 100644
index 0000000..fb966b2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDestroyCounterCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDestroyCounterCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDestroyCounterCrashTest";
+    private static final String TEST_PATH = "destroy-counter-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDestroyCounterCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDestroySelectedRadioButtonCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDestroySelectedRadioButtonCrashTest.java
new file mode 100644
index 0000000..dc85502
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDestroySelectedRadioButtonCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDestroySelectedRadioButtonCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDestroySelectedRadioButtonCrashTest";
+    private static final String TEST_PATH = "destroy-selected-radio-button-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDestroySelectedRadioButtonCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetachedObjectNotificationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetachedObjectNotificationCrashTest.java
new file mode 100644
index 0000000..292d9a4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetachedObjectNotificationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDetachedObjectNotificationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDetachedObjectNotificationCrashTest";
+    private static final String TEST_PATH = "detached-object-notification-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDetachedObjectNotificationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetachedOutermostSvgCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetachedOutermostSvgCrashTest.java
new file mode 100644
index 0000000..0358147
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetachedOutermostSvgCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDetachedOutermostSvgCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDetachedOutermostSvgCrashTest";
+    private static final String TEST_PATH = "detached-outermost-svg-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDetachedOutermostSvgCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetailsChildrenMergeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetailsChildrenMergeCrashTest.java
new file mode 100644
index 0000000..c9a06e2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetailsChildrenMergeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDetailsChildrenMergeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDetailsChildrenMergeCrashTest";
+    private static final String TEST_PATH = "details-children-merge-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDetailsChildrenMergeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetailsElementRenderInlineCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetailsElementRenderInlineCrashTest.java
new file mode 100644
index 0000000..2e415fe
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDetailsElementRenderInlineCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDetailsElementRenderInlineCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDetailsElementRenderInlineCrashTest";
+    private static final String TEST_PATH = "details-element-render-inline-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDetailsElementRenderInlineCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDeviceOrientationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDeviceOrientationCrashTest.java
new file mode 100644
index 0000000..19d6792
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDeviceOrientationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDeviceOrientationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDeviceOrientationCrashTest";
+    private static final String TEST_PATH = "device-orientation-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDeviceOrientationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDirtyInlineTextboxCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDirtyInlineTextboxCrashTest.java
new file mode 100644
index 0000000..ebf7c55
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDirtyInlineTextboxCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDirtyInlineTextboxCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDirtyInlineTextboxCrashTest";
+    private static final String TEST_PATH = "dirty-inline-textbox-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDirtyInlineTextboxCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDispatcheventCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDispatcheventCrashTest.java
new file mode 100644
index 0000000..8a0cac1
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDispatcheventCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDispatcheventCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDispatcheventCrashTest";
+    private static final String TEST_PATH = "dispatchEvent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDispatcheventCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDisplayNoneInlineStyleChangeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDisplayNoneInlineStyleChangeCrashTest.java
new file mode 100644
index 0000000..7bd5cf9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDisplayNoneInlineStyleChangeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDisplayNoneInlineStyleChangeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDisplayNoneInlineStyleChangeCrashTest";
+    private static final String TEST_PATH = "display-none-inline-style-change-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDisplayNoneInlineStyleChangeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDivWithinAnchorsCausesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDivWithinAnchorsCausesCrashTest.java
new file mode 100644
index 0000000..a511eef
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDivWithinAnchorsCausesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDivWithinAnchorsCausesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDivWithinAnchorsCausesCrashTest";
+    private static final String TEST_PATH = "div-within-anchors-causes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDivWithinAnchorsCausesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoctypeEventListenerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoctypeEventListenerCrashTest.java
new file mode 100644
index 0000000..2b60dcd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoctypeEventListenerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDoctypeEventListenerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDoctypeEventListenerCrashTest";
+    private static final String TEST_PATH = "doctype-event-listener-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDoctypeEventListenerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDocumentDeactivationCallbackCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDocumentDeactivationCallbackCrashTest.java
new file mode 100644
index 0000000..165f0cd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDocumentDeactivationCallbackCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDocumentDeactivationCallbackCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDocumentDeactivationCallbackCrashTest";
+    private static final String TEST_PATH = "document-deactivation-callback-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDocumentDeactivationCallbackCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDomstringReplaceCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDomstringReplaceCrashTest.java
new file mode 100644
index 0000000..cccf529
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDomstringReplaceCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDomstringReplaceCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDomstringReplaceCrashTest";
+    private static final String TEST_PATH = "domstring-replace-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDomstringReplaceCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDomurlScriptExecutionContextCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDomurlScriptExecutionContextCrashTest.java
new file mode 100644
index 0000000..0681835
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDomurlScriptExecutionContextCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDomurlScriptExecutionContextCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDomurlScriptExecutionContextCrashTest";
+    private static final String TEST_PATH = "domurl-script-execution-context-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDomurlScriptExecutionContextCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDontCrashWithNullGifFramesTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDontCrashWithNullGifFramesTest.java
new file mode 100644
index 0000000..2b17ed7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDontCrashWithNullGifFramesTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDontCrashWithNullGifFramesTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDontCrashWithNullGifFramesTest";
+    private static final String TEST_PATH = "dont-crash-with-null-gif-frames.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDontCrashWithNullGifFramesTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleMergeAnonymousBlockCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleMergeAnonymousBlockCrashTest.java
new file mode 100644
index 0000000..66f7b40
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleMergeAnonymousBlockCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDoubleMergeAnonymousBlockCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDoubleMergeAnonymousBlockCrashTest";
+    private static final String TEST_PATH = "double-merge-anonymous-block-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDoubleMergeAnonymousBlockCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleclickCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleclickCrashTest.java
new file mode 100644
index 0000000..479bd8c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleclickCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDoubleclickCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDoubleclickCrashTest";
+    private static final String TEST_PATH = "doubleclick-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDoubleclickCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleclickWhitespaceCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleclickWhitespaceCrashTest.java
new file mode 100644
index 0000000..9c33baa
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleclickWhitespaceCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDoubleclickWhitespaceCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDoubleclickWhitespaceCrashTest";
+    private static final String TEST_PATH = "doubleclick-whitespace-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDoubleclickWhitespaceCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleclickWhitespaceImgCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleclickWhitespaceImgCrashTest.java
new file mode 100644
index 0000000..7752407
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDoubleclickWhitespaceImgCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDoubleclickWhitespaceImgCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDoubleclickWhitespaceImgCrashTest";
+    private static final String TEST_PATH = "doubleclick-whitespace-img-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDoubleclickWhitespaceImgCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragAndDropDatatransferTypesNocrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragAndDropDatatransferTypesNocrashTest.java
new file mode 100644
index 0000000..2982578
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragAndDropDatatransferTypesNocrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDragAndDropDatatransferTypesNocrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDragAndDropDatatransferTypesNocrashTest";
+    private static final String TEST_PATH = "drag-and-drop-dataTransfer-types-nocrash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDragAndDropDatatransferTypesNocrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragDropIframeRefreshCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragDropIframeRefreshCrashTest.java
new file mode 100644
index 0000000..1d20049
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragDropIframeRefreshCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDragDropIframeRefreshCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDragDropIframeRefreshCrashTest";
+    private static final String TEST_PATH = "drag-drop-iframe-refresh-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDragDropIframeRefreshCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragFileCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragFileCrashTest.java
new file mode 100644
index 0000000..f9945c1
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragFileCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDragFileCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDragFileCrashTest";
+    private static final String TEST_PATH = "drag-file-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDragFileCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragOverIframeInvalidSourceCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragOverIframeInvalidSourceCrashTest.java
new file mode 100644
index 0000000..018a283
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDragOverIframeInvalidSourceCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDragOverIframeInvalidSourceCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDragOverIframeInvalidSourceCrashTest";
+    private static final String TEST_PATH = "drag-over-iframe-invalid-source-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDragOverIframeInvalidSourceCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDuplicateHtmlElementCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDuplicateHtmlElementCrashTest.java
new file mode 100644
index 0000000..78a806b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDuplicateHtmlElementCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDuplicateHtmlElementCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDuplicateHtmlElementCrashTest";
+    private static final String TEST_PATH = "duplicate-html-element-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDuplicateHtmlElementCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDuplicateParamCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDuplicateParamCrashTest.java
new file mode 100644
index 0000000..9eb7838
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDuplicateParamCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDuplicateParamCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDuplicateParamCrashTest";
+    private static final String TEST_PATH = "duplicate-param-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDuplicateParamCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDuplicateParamGcCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDuplicateParamGcCrashTest.java
new file mode 100644
index 0000000..0c991ea
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDuplicateParamGcCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDuplicateParamGcCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDuplicateParamGcCrashTest";
+    private static final String TEST_PATH = "duplicate-param-gc-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDuplicateParamGcCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDynamicMarkerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDynamicMarkerCrashTest.java
new file mode 100644
index 0000000..9ec83d0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitDynamicMarkerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitDynamicMarkerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitDynamicMarkerCrashTest";
+    private static final String TEST_PATH = "dynamic-marker-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitDynamicMarkerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEditableNonEditableCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEditableNonEditableCrashTest.java
new file mode 100644
index 0000000..8ce6c0b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEditableNonEditableCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEditableNonEditableCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEditableNonEditableCrashTest";
+    private static final String TEST_PATH = "editable-non-editable-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEditableNonEditableCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEditingCommandWhileExecutingTypingCommandCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEditingCommandWhileExecutingTypingCommandCrashTest.java
new file mode 100644
index 0000000..1d60ab4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEditingCommandWhileExecutingTypingCommandCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEditingCommandWhileExecutingTypingCommandCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEditingCommandWhileExecutingTypingCommandCrashTest";
+    private static final String TEST_PATH = "editing-command-while-executing-typing-command-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEditingCommandWhileExecutingTypingCommandCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmbedBidiStyleInIsolateCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmbedBidiStyleInIsolateCrashTest.java
new file mode 100644
index 0000000..175f9e4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmbedBidiStyleInIsolateCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmbedBidiStyleInIsolateCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmbedBidiStyleInIsolateCrashTest";
+    private static final String TEST_PATH = "embed-bidi-style-in-isolate-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmbedBidiStyleInIsolateCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmbedcrasherTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmbedcrasherTest.java
new file mode 100644
index 0000000..faff7b2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmbedcrasherTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmbedcrasherTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmbedcrasherTest";
+    private static final String TEST_PATH = "embedCrasher.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmbedcrasherTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyAnonymousBlockRemoveCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyAnonymousBlockRemoveCrashTest.java
new file mode 100644
index 0000000..b21bc03
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyAnonymousBlockRemoveCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptyAnonymousBlockRemoveCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptyAnonymousBlockRemoveCrashTest";
+    private static final String TEST_PATH = "empty-anonymous-block-remove-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptyAnonymousBlockRemoveCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyBdiCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyBdiCrashTest.java
new file mode 100644
index 0000000..727b2aa
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyBdiCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptyBdiCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptyBdiCrashTest";
+    private static final String TEST_PATH = "empty-bdi-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptyBdiCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyContentWithFloatCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyContentWithFloatCrashTest.java
new file mode 100644
index 0000000..bb70477
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyContentWithFloatCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptyContentWithFloatCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptyContentWithFloatCrashTest";
+    private static final String TEST_PATH = "empty-content-with-float-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptyContentWithFloatCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyFirstLineCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyFirstLineCrashTest.java
new file mode 100644
index 0000000..a440e1a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyFirstLineCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptyFirstLineCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptyFirstLineCrashTest";
+    private static final String TEST_PATH = "empty-first-line-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptyFirstLineCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyMsubsupCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyMsubsupCrashTest.java
new file mode 100644
index 0000000..7586024
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyMsubsupCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptyMsubsupCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptyMsubsupCrashTest";
+    private static final String TEST_PATH = "empty-msubsup-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptyMsubsupCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyRenderSurfaceCrasherTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyRenderSurfaceCrasherTest.java
new file mode 100644
index 0000000..c2edde6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyRenderSurfaceCrasherTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptyRenderSurfaceCrasherTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptyRenderSurfaceCrasherTest";
+    private static final String TEST_PATH = "empty-render-surface-crasher.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptyRenderSurfaceCrasherTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyRowCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyRowCrashTest.java
new file mode 100644
index 0000000..92d67ce
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyRowCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptyRowCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptyRowCrashTest";
+    private static final String TEST_PATH = "empty-row-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptyRowCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptySectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptySectionCrashTest.java
new file mode 100644
index 0000000..7087783
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptySectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptySectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptySectionCrashTest";
+    private static final String TEST_PATH = "empty-section-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptySectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyTransformPreservethreedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyTransformPreservethreedCrashTest.java
new file mode 100644
index 0000000..142da4b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyTransformPreservethreedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptyTransformPreservethreedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptyTransformPreservethreedCrashTest";
+    private static final String TEST_PATH = "webkit-empty-transform-preserve3d-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptyTransformPreservethreedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyWebkitMaskCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyWebkitMaskCrashTest.java
new file mode 100644
index 0000000..ea189dc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyWebkitMaskCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptyWebkitMaskCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptyWebkitMaskCrashTest";
+    private static final String TEST_PATH = "empty-webkit-mask-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptyWebkitMaskCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyWorkerNocrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyWorkerNocrashTest.java
new file mode 100644
index 0000000..d19237c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEmptyWorkerNocrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEmptyWorkerNocrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEmptyWorkerNocrashTest";
+    private static final String TEST_PATH = "empty-worker-nocrash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEmptyWorkerNocrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEndOfBufferCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEndOfBufferCrashTest.java
new file mode 100644
index 0000000..9f5374c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEndOfBufferCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEndOfBufferCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEndOfBufferCrashTest";
+    private static final String TEST_PATH = "end-of-buffer-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEndOfBufferCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEvalCacheCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEvalCacheCrashTest.java
new file mode 100644
index 0000000..b8d81a7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEvalCacheCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEvalCacheCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEvalCacheCrashTest";
+    private static final String TEST_PATH = "eval-cache-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEvalCacheCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEventListenerMapRehashCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEventListenerMapRehashCrashTest.java
new file mode 100644
index 0000000..7887ef0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEventListenerMapRehashCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEventListenerMapRehashCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEventListenerMapRehashCrashTest";
+    private static final String TEST_PATH = "event-listener-map-rehash-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEventListenerMapRehashCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEventsourceReconnectDuringNavigateCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEventsourceReconnectDuringNavigateCrashTest.java
new file mode 100644
index 0000000..eb46e53
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitEventsourceReconnectDuringNavigateCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitEventsourceReconnectDuringNavigateCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitEventsourceReconnectDuringNavigateCrashTest";
+    private static final String TEST_PATH = "eventsource-reconnect-during-navigate-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitEventsourceReconnectDuringNavigateCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionCodegenCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionCodegenCrashTest.java
new file mode 100644
index 0000000..05a0fa6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionCodegenCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitExceptionCodegenCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitExceptionCodegenCrashTest";
+    private static final String TEST_PATH = "exception-codegen-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitExceptionCodegenCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameInlineScriptCrashIframeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameInlineScriptCrashIframeTest.java
new file mode 100644
index 0000000..3388e0b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameInlineScriptCrashIframeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitExceptionNoFrameInlineScriptCrashIframeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitExceptionNoFrameInlineScriptCrashIframeTest";
+    private static final String TEST_PATH = "exception-no-frame-inline-script-crash-iframe.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitExceptionNoFrameInlineScriptCrashIframeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameInlineScriptCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameInlineScriptCrashTest.java
new file mode 100644
index 0000000..33b23a5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameInlineScriptCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitExceptionNoFrameInlineScriptCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitExceptionNoFrameInlineScriptCrashTest";
+    private static final String TEST_PATH = "exception-no-frame-inline-script-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitExceptionNoFrameInlineScriptCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameTimeoutCrashIframeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameTimeoutCrashIframeTest.java
new file mode 100644
index 0000000..95f7272
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameTimeoutCrashIframeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitExceptionNoFrameTimeoutCrashIframeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitExceptionNoFrameTimeoutCrashIframeTest";
+    private static final String TEST_PATH = "exception-no-frame-timeout-crash-iframe.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitExceptionNoFrameTimeoutCrashIframeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameTimeoutCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameTimeoutCrashTest.java
new file mode 100644
index 0000000..b93411a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExceptionNoFrameTimeoutCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitExceptionNoFrameTimeoutCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitExceptionNoFrameTimeoutCrashTest";
+    private static final String TEST_PATH = "exception-no-frame-timeout-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitExceptionNoFrameTimeoutCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExistentEventsourceStatusErrorIframeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExistentEventsourceStatusErrorIframeCrashTest.java
new file mode 100644
index 0000000..0d4d938
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExistentEventsourceStatusErrorIframeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitExistentEventsourceStatusErrorIframeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitExistentEventsourceStatusErrorIframeCrashTest";
+    private static final String TEST_PATH = "existent-eventsource-status-error-iframe-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitExistentEventsourceStatusErrorIframeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExtendByLineAnonymousContentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExtendByLineAnonymousContentCrashTest.java
new file mode 100644
index 0000000..f1ecaac
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExtendByLineAnonymousContentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitExtendByLineAnonymousContentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitExtendByLineAnonymousContentCrashTest";
+    private static final String TEST_PATH = "extend-by-line-anonymous-content-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitExtendByLineAnonymousContentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExtendOverFileInputByDragCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExtendOverFileInputByDragCrashTest.java
new file mode 100644
index 0000000..b32a517
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitExtendOverFileInputByDragCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitExtendOverFileInputByDragCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitExtendOverFileInputByDragCrashTest";
+    private static final String TEST_PATH = "extend-over-file-input-by-drag-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitExtendOverFileInputByDragCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFencedWhitespaceSeparatorsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFencedWhitespaceSeparatorsCrashTest.java
new file mode 100644
index 0000000..70be644
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFencedWhitespaceSeparatorsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFencedWhitespaceSeparatorsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFencedWhitespaceSeparatorsCrashTest";
+    private static final String TEST_PATH = "fenced-whitespace-separators-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFencedWhitespaceSeparatorsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFileReaderDirectoryCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFileReaderDirectoryCrashTest.java
new file mode 100644
index 0000000..970a3d5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFileReaderDirectoryCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFileReaderDirectoryCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFileReaderDirectoryCrashTest";
+    private static final String TEST_PATH = "file-reader-directory-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFileReaderDirectoryCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFilesystemNoCallbackNullPtrCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFilesystemNoCallbackNullPtrCrashTest.java
new file mode 100644
index 0000000..da07606
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFilesystemNoCallbackNullPtrCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFilesystemNoCallbackNullPtrCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFilesystemNoCallbackNullPtrCrashTest";
+    private static final String TEST_PATH = "filesystem-no-callback-null-ptr-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFilesystemNoCallbackNullPtrCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFillLayerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFillLayerCrashTest.java
new file mode 100644
index 0000000..dc32889
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFillLayerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFillLayerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFillLayerCrashTest";
+    private static final String TEST_PATH = "fill-layer-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFillLayerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFilterEmptyElementCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFilterEmptyElementCrashTest.java
new file mode 100644
index 0000000..5944a68
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFilterEmptyElementCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFilterEmptyElementCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFilterEmptyElementCrashTest";
+    private static final String TEST_PATH = "filter-empty-element-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFilterEmptyElementCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFindLayoutCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFindLayoutCrashTest.java
new file mode 100644
index 0000000..0a14dec
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFindLayoutCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFindLayoutCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFindLayoutCrashTest";
+    private static final String TEST_PATH = "find-layout-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFindLayoutCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterAnonymousBlockCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterAnonymousBlockCrashTest.java
new file mode 100644
index 0000000..1cae293
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterAnonymousBlockCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFirstLetterAnonymousBlockCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFirstLetterAnonymousBlockCrashTest";
+    private static final String TEST_PATH = "first-letter-anonymous-block-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFirstLetterAnonymousBlockCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterBlockFormControlsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterBlockFormControlsCrashTest.java
new file mode 100644
index 0000000..3415a8b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterBlockFormControlsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFirstLetterBlockFormControlsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFirstLetterBlockFormControlsCrashTest";
+    private static final String TEST_PATH = "first-letter-block-form-controls-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFirstLetterBlockFormControlsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterInlineFlowSplitCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterInlineFlowSplitCrashTest.java
new file mode 100644
index 0000000..2661e63
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterInlineFlowSplitCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFirstLetterInlineFlowSplitCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFirstLetterInlineFlowSplitCrashTest";
+    private static final String TEST_PATH = "first-letter-inline-flow-split-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFirstLetterInlineFlowSplitCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterInlineFlowSplitTableCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterInlineFlowSplitTableCrashTest.java
new file mode 100644
index 0000000..d205888
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterInlineFlowSplitTableCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFirstLetterInlineFlowSplitTableCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFirstLetterInlineFlowSplitTableCrashTest";
+    private static final String TEST_PATH = "first-letter-inline-flow-split-table-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFirstLetterInlineFlowSplitTableCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterRtlCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterRtlCrashTest.java
new file mode 100644
index 0000000..9f637e6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterRtlCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFirstLetterRtlCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFirstLetterRtlCrashTest";
+    private static final String TEST_PATH = "first-letter-rtl-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFirstLetterRtlCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterTextFragmentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterTextFragmentCrashTest.java
new file mode 100644
index 0000000..907b488
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterTextFragmentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFirstLetterTextFragmentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFirstLetterTextFragmentCrashTest";
+    private static final String TEST_PATH = "first-letter-text-fragment-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFirstLetterTextFragmentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterTextTransformCausesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterTextTransformCausesCrashTest.java
new file mode 100644
index 0000000..6a662eb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstLetterTextTransformCausesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFirstLetterTextTransformCausesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFirstLetterTextTransformCausesCrashTest";
+    private static final String TEST_PATH = "first-letter-text-transform-causes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFirstLetterTextTransformCausesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstletterTablecellCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstletterTablecellCrashTest.java
new file mode 100644
index 0000000..93c0e65
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstletterTablecellCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFirstletterTablecellCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFirstletterTablecellCrashTest";
+    private static final String TEST_PATH = "firstletter-tablecell-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFirstletterTablecellCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstlineFixedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstlineFixedCrashTest.java
new file mode 100644
index 0000000..1234da9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstlineFixedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFirstlineFixedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFirstlineFixedCrashTest";
+    private static final String TEST_PATH = "firstline-fixed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFirstlineFixedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstrectCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstrectCrashTest.java
new file mode 100644
index 0000000..609d3ed
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFirstrectCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFirstrectCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFirstrectCrashTest";
+    private static final String TEST_PATH = "firstRect-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFirstrectCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFiveseventwofivezerofiveeightCrashScenarioOneTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFiveseventwofivezerofiveeightCrashScenarioOneTest.java
new file mode 100644
index 0000000..f7b84f2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFiveseventwofivezerofiveeightCrashScenarioOneTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFiveseventwofivezerofiveeightCrashScenarioOneTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFiveseventwofivezerofiveeightCrashScenarioOneTest";
+    private static final String TEST_PATH = "5725058-crash-scenario-1.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFiveseventwofivezerofiveeightCrashScenarioOneTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFiveseventwofivezerofiveeightCrashScenarioThreeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFiveseventwofivezerofiveeightCrashScenarioThreeTest.java
new file mode 100644
index 0000000..cb3c294
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFiveseventwofivezerofiveeightCrashScenarioThreeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFiveseventwofivezerofiveeightCrashScenarioThreeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFiveseventwofivezerofiveeightCrashScenarioThreeTest";
+    private static final String TEST_PATH = "5725058-crash-scenario-3.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFiveseventwofivezerofiveeightCrashScenarioThreeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFiveseventwofivezerofiveeightCrashScenarioTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFiveseventwofivezerofiveeightCrashScenarioTwoTest.java
new file mode 100644
index 0000000..9d64f55
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFiveseventwofivezerofiveeightCrashScenarioTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFiveseventwofivezerofiveeightCrashScenarioTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFiveseventwofivezerofiveeightCrashScenarioTwoTest";
+    private static final String TEST_PATH = "5725058-crash-scenario-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFiveseventwofivezerofiveeightCrashScenarioTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFixRangeFromRootEditableCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFixRangeFromRootEditableCrashTest.java
new file mode 100644
index 0000000..4a023e8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFixRangeFromRootEditableCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFixRangeFromRootEditableCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFixRangeFromRootEditableCrashTest";
+    private static final String TEST_PATH = "fix-range-from-root-editable-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFixRangeFromRootEditableCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFixedTableLayoutLargeColspanCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFixedTableLayoutLargeColspanCrashTest.java
new file mode 100644
index 0000000..07291c0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFixedTableLayoutLargeColspanCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFixedTableLayoutLargeColspanCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFixedTableLayoutLargeColspanCrashTest";
+    private static final String TEST_PATH = "fixed-table-layout-large-colspan-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFixedTableLayoutLargeColspanCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFlexboxInRegionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFlexboxInRegionCrashTest.java
new file mode 100644
index 0000000..cf550c5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFlexboxInRegionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFlexboxInRegionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFlexboxInRegionCrashTest";
+    private static final String TEST_PATH = "flexbox-in-region-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFlexboxInRegionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatNotRemovedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatNotRemovedCrashTest.java
new file mode 100644
index 0000000..717c6e9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatNotRemovedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFloatNotRemovedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFloatNotRemovedCrashTest";
+    private static final String TEST_PATH = "float-not-removed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFloatNotRemovedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatNotRemovedFromNextSiblingCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatNotRemovedFromNextSiblingCrashTest.java
new file mode 100644
index 0000000..5f530db
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatNotRemovedFromNextSiblingCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFloatNotRemovedFromNextSiblingCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFloatNotRemovedFromNextSiblingCrashTest";
+    private static final String TEST_PATH = "float-not-removed-from-next-sibling-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFloatNotRemovedFromNextSiblingCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatOriginatingLineDeletedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatOriginatingLineDeletedCrashTest.java
new file mode 100644
index 0000000..65e2ef5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatOriginatingLineDeletedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFloatOriginatingLineDeletedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFloatOriginatingLineDeletedCrashTest";
+    private static final String TEST_PATH = "float-originating-line-deleted-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFloatOriginatingLineDeletedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatingBeforeContentWithListMarkerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatingBeforeContentWithListMarkerCrashTest.java
new file mode 100644
index 0000000..259ee2d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatingBeforeContentWithListMarkerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFloatingBeforeContentWithListMarkerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFloatingBeforeContentWithListMarkerCrashTest";
+    private static final String TEST_PATH = "floating-before-content-with-list-marker-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFloatingBeforeContentWithListMarkerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatsNotClearedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatsNotClearedCrashTest.java
new file mode 100644
index 0000000..bd120dc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFloatsNotClearedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFloatsNotClearedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFloatsNotClearedCrashTest";
+    private static final String TEST_PATH = "floats-not-cleared-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFloatsNotClearedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusChangeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusChangeCrashTest.java
new file mode 100644
index 0000000..4f9c414
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusChangeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFocusChangeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFocusChangeCrashTest";
+    private static final String TEST_PATH = "focus-change-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFocusChangeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusChangeCrashtwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusChangeCrashtwoTest.java
new file mode 100644
index 0000000..58ba32f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusChangeCrashtwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFocusChangeCrashtwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFocusChangeCrashtwoTest";
+    private static final String TEST_PATH = "focus-change-crash2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFocusChangeCrashtwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusControllerCrashChangeEventTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusControllerCrashChangeEventTest.java
new file mode 100644
index 0000000..8d75dbb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusControllerCrashChangeEventTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFocusControllerCrashChangeEventTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFocusControllerCrashChangeEventTest";
+    private static final String TEST_PATH = "focus-controller-crash-change-event.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFocusControllerCrashChangeEventTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusCrashTest.java
new file mode 100644
index 0000000..adf6d10
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFocusCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFocusCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFocusCrashTest";
+    private static final String TEST_PATH = "focus-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFocusCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFontmetricBorderRadiusNullCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFontmetricBorderRadiusNullCrashTest.java
new file mode 100644
index 0000000..084d170
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFontmetricBorderRadiusNullCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFontmetricBorderRadiusNullCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFontmetricBorderRadiusNullCrashTest";
+    private static final String TEST_PATH = "fontMetric-border-radius-null-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFontmetricBorderRadiusNullCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFontmetricWebkitBorderEndWidthNullCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFontmetricWebkitBorderEndWidthNullCrashTest.java
new file mode 100644
index 0000000..1277a92
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFontmetricWebkitBorderEndWidthNullCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFontmetricWebkitBorderEndWidthNullCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFontmetricWebkitBorderEndWidthNullCrashTest";
+    private static final String TEST_PATH = "fontMetric-webkit-border-end-width-null-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFontmetricWebkitBorderEndWidthNullCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFontsizeUnitRemsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFontsizeUnitRemsCrashTest.java
new file mode 100644
index 0000000..b22bc10
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFontsizeUnitRemsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFontsizeUnitRemsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFontsizeUnitRemsCrashTest";
+    private static final String TEST_PATH = "fontsize-unit-rems-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFontsizeUnitRemsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitForeignContentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitForeignContentCrashTest.java
new file mode 100644
index 0000000..e4f8d61
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitForeignContentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitForeignContentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitForeignContentCrashTest";
+    private static final String TEST_PATH = "foreign-content-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitForeignContentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormAssociatedElementCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormAssociatedElementCrashTest.java
new file mode 100644
index 0000000..8c13909
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormAssociatedElementCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFormAssociatedElementCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFormAssociatedElementCrashTest";
+    private static final String TEST_PATH = "form-associated-element-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFormAssociatedElementCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormAssociatedElementCrashthreeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormAssociatedElementCrashthreeTest.java
new file mode 100644
index 0000000..15552fb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormAssociatedElementCrashthreeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFormAssociatedElementCrashthreeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFormAssociatedElementCrashthreeTest";
+    private static final String TEST_PATH = "form-associated-element-crash3.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFormAssociatedElementCrashthreeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormAssociatedElementCrashtwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormAssociatedElementCrashtwoTest.java
new file mode 100644
index 0000000..5a24b91
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormAssociatedElementCrashtwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFormAssociatedElementCrashtwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFormAssociatedElementCrashtwoTest";
+    private static final String TEST_PATH = "form-associated-element-crash2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFormAssociatedElementCrashtwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormIframeTargetBeforeLoadCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormIframeTargetBeforeLoadCrashTest.java
new file mode 100644
index 0000000..5b11ac5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormIframeTargetBeforeLoadCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFormIframeTargetBeforeLoadCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFormIframeTargetBeforeLoadCrashTest";
+    private static final String TEST_PATH = "form-iframe-target-before-load-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFormIframeTargetBeforeLoadCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormIframeTargetBeforeLoadCrashtwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormIframeTargetBeforeLoadCrashtwoTest.java
new file mode 100644
index 0000000..4899efd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormIframeTargetBeforeLoadCrashtwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFormIframeTargetBeforeLoadCrashtwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFormIframeTargetBeforeLoadCrashtwoTest";
+    private static final String TEST_PATH = "form-iframe-target-before-load-crash2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFormIframeTargetBeforeLoadCrashtwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormInRowBeforeMisnestedTextCrashCssTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormInRowBeforeMisnestedTextCrashCssTest.java
new file mode 100644
index 0000000..e7b2f09
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormInRowBeforeMisnestedTextCrashCssTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFormInRowBeforeMisnestedTextCrashCssTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFormInRowBeforeMisnestedTextCrashCssTest";
+    private static final String TEST_PATH = "form-in-row-before-misnested-text-crash-css.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFormInRowBeforeMisnestedTextCrashCssTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormInTableBeforeMisnestedTextCrashCssTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormInTableBeforeMisnestedTextCrashCssTest.java
new file mode 100644
index 0000000..03ac324
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormInTableBeforeMisnestedTextCrashCssTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFormInTableBeforeMisnestedTextCrashCssTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFormInTableBeforeMisnestedTextCrashCssTest";
+    private static final String TEST_PATH = "form-in-table-before-misnested-text-crash-css.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFormInTableBeforeMisnestedTextCrashCssTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormInTbodyBeforeMisnestedTextCrashCssTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormInTbodyBeforeMisnestedTextCrashCssTest.java
new file mode 100644
index 0000000..44f3375
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFormInTbodyBeforeMisnestedTextCrashCssTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFormInTbodyBeforeMisnestedTextCrashCssTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFormInTbodyBeforeMisnestedTextCrashCssTest";
+    private static final String TEST_PATH = "form-in-tbody-before-misnested-text-crash-css.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFormInTbodyBeforeMisnestedTextCrashCssTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFouronefourfivefivethreefivecrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFouronefourfivefivethreefivecrashTest.java
new file mode 100644
index 0000000..35bee22
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFouronefourfivefivethreefivecrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFouronefourfivefivethreefivecrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFouronefourfivefivethreefivecrashTest";
+    private static final String TEST_PATH = "4145535Crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFouronefourfivefivethreefivecrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameContentwindowCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameContentwindowCrashTest.java
new file mode 100644
index 0000000..e62707b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameContentwindowCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFrameContentwindowCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFrameContentwindowCrashTest";
+    private static final String TEST_PATH = "frame-contentWindow-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFrameContentwindowCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameCrashWithPageCacheTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameCrashWithPageCacheTest.java
new file mode 100644
index 0000000..04bf65b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameCrashWithPageCacheTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFrameCrashWithPageCacheTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFrameCrashWithPageCacheTest";
+    private static final String TEST_PATH = "frame-crash-with-page-cache.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFrameCrashWithPageCacheTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadAbortCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadAbortCrashTest.java
new file mode 100644
index 0000000..35cf8fb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadAbortCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFrameUnloadAbortCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFrameUnloadAbortCrashTest";
+    private static final String TEST_PATH = "frame-unload-abort-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFrameUnloadAbortCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashOneTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashOneTest.java
new file mode 100644
index 0000000..6ae74b7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashOneTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFrameUnloadCrashOneTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFrameUnloadCrashOneTest";
+    private static final String TEST_PATH = "frame-unload-crash-1.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFrameUnloadCrashOneTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashTest.java
new file mode 100644
index 0000000..e7ec308
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFrameUnloadCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFrameUnloadCrashTest";
+    private static final String TEST_PATH = "frame-unload-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFrameUnloadCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashThreeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashThreeTest.java
new file mode 100644
index 0000000..829ffea
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashThreeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFrameUnloadCrashThreeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFrameUnloadCrashThreeTest";
+    private static final String TEST_PATH = "frame-unload-crash-3.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFrameUnloadCrashThreeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashTwoTest.java
new file mode 100644
index 0000000..7dcd607
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFrameUnloadCrashTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFrameUnloadCrashTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFrameUnloadCrashTwoTest";
+    private static final String TEST_PATH = "frame-unload-crash-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFrameUnloadCrashTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFramelessMediaElementCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFramelessMediaElementCrashTest.java
new file mode 100644
index 0000000..8da2fbf
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitFramelessMediaElementCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitFramelessMediaElementCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitFramelessMediaElementCrashTest";
+    private static final String TEST_PATH = "frameless-media-element-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitFramelessMediaElementCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedBeforeCounterDoesntCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedBeforeCounterDoesntCrashTest.java
new file mode 100644
index 0000000..556d2db
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedBeforeCounterDoesntCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitGeneratedBeforeCounterDoesntCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitGeneratedBeforeCounterDoesntCrashTest";
+    private static final String TEST_PATH = "generated-before-counter-doesnt-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitGeneratedBeforeCounterDoesntCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedChildSplitFlowCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedChildSplitFlowCrashTest.java
new file mode 100644
index 0000000..97a9812
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedChildSplitFlowCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitGeneratedChildSplitFlowCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitGeneratedChildSplitFlowCrashTest";
+    private static final String TEST_PATH = "generated-child-split-flow-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitGeneratedChildSplitFlowCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedContentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedContentCrashTest.java
new file mode 100644
index 0000000..b9618af
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedContentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitGeneratedContentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitGeneratedContentCrashTest";
+    private static final String TEST_PATH = "generated-content-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitGeneratedContentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedLayerScrollbarCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedLayerScrollbarCrashTest.java
new file mode 100644
index 0000000..17ad7d2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGeneratedLayerScrollbarCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitGeneratedLayerScrollbarCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitGeneratedLayerScrollbarCrashTest";
+    private static final String TEST_PATH = "generated-layer-scrollbar-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitGeneratedLayerScrollbarCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGetUrlWithIframeTargetNoCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGetUrlWithIframeTargetNoCrashTest.java
new file mode 100644
index 0000000..3cb858e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGetUrlWithIframeTargetNoCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitGetUrlWithIframeTargetNoCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitGetUrlWithIframeTargetNoCrashTest";
+    private static final String TEST_PATH = "get-url-with-iframe-target-no-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitGetUrlWithIframeTargetNoCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGetmatchedcssrulesNullCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGetmatchedcssrulesNullCrashTest.java
new file mode 100644
index 0000000..eb5fb99
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGetmatchedcssrulesNullCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitGetmatchedcssrulesNullCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitGetmatchedcssrulesNullCrashTest";
+    private static final String TEST_PATH = "getMatchedCSSRules-null-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitGetmatchedcssrulesNullCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGiantStylesheetCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGiantStylesheetCrashTest.java
new file mode 100644
index 0000000..faf98bc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGiantStylesheetCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitGiantStylesheetCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitGiantStylesheetCrashTest";
+    private static final String TEST_PATH = "giant-stylesheet-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitGiantStylesheetCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGlyphrefRendererCreateCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGlyphrefRendererCreateCrashTest.java
new file mode 100644
index 0000000..e8762a3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGlyphrefRendererCreateCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitGlyphrefRendererCreateCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitGlyphrefRendererCreateCrashTest";
+    private static final String TEST_PATH = "glyphref-renderer-create-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitGlyphrefRendererCreateCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGradientOnPseudoelementCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGradientOnPseudoelementCrashTest.java
new file mode 100644
index 0000000..a53f2de
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitGradientOnPseudoelementCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitGradientOnPseudoelementCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitGradientOnPseudoelementCrashTest";
+    private static final String TEST_PATH = "gradient-on-pseudoelement-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitGradientOnPseudoelementCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHasfocusFramelessCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHasfocusFramelessCrashTest.java
new file mode 100644
index 0000000..af8b407
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHasfocusFramelessCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitHasfocusFramelessCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitHasfocusFramelessCrashTest";
+    private static final String TEST_PATH = "hasFocus-frameless-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitHasfocusFramelessCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHiddenIframeScrollbarCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHiddenIframeScrollbarCrashTest.java
new file mode 100644
index 0000000..01cd96d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHiddenIframeScrollbarCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitHiddenIframeScrollbarCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitHiddenIframeScrollbarCrashTest";
+    private static final String TEST_PATH = "hidden-iframe-scrollbar-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitHiddenIframeScrollbarCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHiddenIframeScrollbarCrashtwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHiddenIframeScrollbarCrashtwoTest.java
new file mode 100644
index 0000000..1bfb239
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHiddenIframeScrollbarCrashtwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitHiddenIframeScrollbarCrashtwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitHiddenIframeScrollbarCrashtwoTest";
+    private static final String TEST_PATH = "hidden-iframe-scrollbar-crash2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitHiddenIframeScrollbarCrashtwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHorizontalBoxFloatCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHorizontalBoxFloatCrashTest.java
new file mode 100644
index 0000000..8b7b90a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHorizontalBoxFloatCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitHorizontalBoxFloatCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitHorizontalBoxFloatCrashTest";
+    private static final String TEST_PATH = "horizontal-box-float-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitHorizontalBoxFloatCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHoverStyleRecalcCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHoverStyleRecalcCrashTest.java
new file mode 100644
index 0000000..e3ac923
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHoverStyleRecalcCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitHoverStyleRecalcCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitHoverStyleRecalcCrashTest";
+    private static final String TEST_PATH = "hover-style-recalc-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitHoverStyleRecalcCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHoverTimerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHoverTimerCrashTest.java
new file mode 100644
index 0000000..03be216
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHoverTimerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitHoverTimerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitHoverTimerCrashTest";
+    private static final String TEST_PATH = "hover-timer-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitHoverTimerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHugeColumnGapCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHugeColumnGapCrashTest.java
new file mode 100644
index 0000000..01446ea
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitHugeColumnGapCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitHugeColumnGapCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitHugeColumnGapCrashTest";
+    private static final String TEST_PATH = "huge-column-gap-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitHugeColumnGapCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIdAttributeWithNamespaceCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIdAttributeWithNamespaceCrashTest.java
new file mode 100644
index 0000000..cba3879
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIdAttributeWithNamespaceCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIdAttributeWithNamespaceCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIdAttributeWithNamespaceCrashTest";
+    private static final String TEST_PATH = "id-attribute-with-namespace-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIdAttributeWithNamespaceCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIdentCrashesTopnodeIsTextTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIdentCrashesTopnodeIsTextTest.java
new file mode 100644
index 0000000..2fafc13
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIdentCrashesTopnodeIsTextTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIdentCrashesTopnodeIsTextTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIdentCrashesTopnodeIsTextTest";
+    private static final String TEST_PATH = "ident-crashes-topnode-is-text.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIdentCrashesTopnodeIsTextTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeContentwindowCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeContentwindowCrashTest.java
new file mode 100644
index 0000000..175e4dd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeContentwindowCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIframeContentwindowCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIframeContentwindowCrashTest";
+    private static final String TEST_PATH = "iframe-contentWindow-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIframeContentwindowCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeFlatteningCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeFlatteningCrashTest.java
new file mode 100644
index 0000000..55f5524
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeFlatteningCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIframeFlatteningCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIframeFlatteningCrashTest";
+    private static final String TEST_PATH = "iframe-flattening-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIframeFlatteningCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeFlatteningSelectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeFlatteningSelectionCrashTest.java
new file mode 100644
index 0000000..a989563
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeFlatteningSelectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIframeFlatteningSelectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIframeFlatteningSelectionCrashTest";
+    private static final String TEST_PATH = "iframe-flattening-selection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIframeFlatteningSelectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeInvalidSourceCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeInvalidSourceCrashTest.java
new file mode 100644
index 0000000..4c474f2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeInvalidSourceCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIframeInvalidSourceCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIframeInvalidSourceCrashTest";
+    private static final String TEST_PATH = "iframe-invalid-source-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIframeInvalidSourceCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadCrashMacTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadCrashMacTest.java
new file mode 100644
index 0000000..dcad0d6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadCrashMacTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIframeOnloadCrashMacTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIframeOnloadCrashMacTest";
+    private static final String TEST_PATH = "iframe-onload-crash-mac.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIframeOnloadCrashMacTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadCrashUnixTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadCrashUnixTest.java
new file mode 100644
index 0000000..7d73115
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadCrashUnixTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIframeOnloadCrashUnixTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIframeOnloadCrashUnixTest";
+    private static final String TEST_PATH = "iframe-onload-crash-unix.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIframeOnloadCrashUnixTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadCrashWinTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadCrashWinTest.java
new file mode 100644
index 0000000..a7d17dc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadCrashWinTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIframeOnloadCrashWinTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIframeOnloadCrashWinTest";
+    private static final String TEST_PATH = "iframe-onload-crash-win.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIframeOnloadCrashWinTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadRemoveSelfNoCrashChildTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadRemoveSelfNoCrashChildTest.java
new file mode 100644
index 0000000..12f183a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadRemoveSelfNoCrashChildTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIframeOnloadRemoveSelfNoCrashChildTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIframeOnloadRemoveSelfNoCrashChildTest";
+    private static final String TEST_PATH = "iframe-onload-remove-self-no-crash-child.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIframeOnloadRemoveSelfNoCrashChildTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadRemoveSelfNoCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadRemoveSelfNoCrashTest.java
new file mode 100644
index 0000000..5197e59
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframeOnloadRemoveSelfNoCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIframeOnloadRemoveSelfNoCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIframeOnloadRemoveSelfNoCrashTest";
+    private static final String TEST_PATH = "iframe-onload-remove-self-no-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIframeOnloadRemoveSelfNoCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframePluginLoadRemoveDocumentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframePluginLoadRemoveDocumentCrashTest.java
new file mode 100644
index 0000000..8db23c3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIframePluginLoadRemoveDocumentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIframePluginLoadRemoveDocumentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIframePluginLoadRemoveDocumentCrashTest";
+    private static final String TEST_PATH = "iframe-plugin-load-remove-document-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIframePluginLoadRemoveDocumentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIgnoredResultNullComparisonCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIgnoredResultNullComparisonCrashTest.java
new file mode 100644
index 0000000..dc6f2ea
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIgnoredResultNullComparisonCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIgnoredResultNullComparisonCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIgnoredResultNullComparisonCrashTest";
+    private static final String TEST_PATH = "ignored-result-null-comparison-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIgnoredResultNullComparisonCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIgnoredResultRefCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIgnoredResultRefCrashTest.java
new file mode 100644
index 0000000..164ae85
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIgnoredResultRefCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIgnoredResultRefCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIgnoredResultRefCrashTest";
+    private static final String TEST_PATH = "ignored-result-ref-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIgnoredResultRefCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImageEmptyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImageEmptyCrashTest.java
new file mode 100644
index 0000000..c827d5a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImageEmptyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitImageEmptyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitImageEmptyCrashTest";
+    private static final String TEST_PATH = "image-empty-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitImageEmptyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImageMapTitleCausesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImageMapTitleCausesCrashTest.java
new file mode 100644
index 0000000..ce80783
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImageMapTitleCausesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitImageMapTitleCausesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitImageMapTitleCausesCrashTest";
+    private static final String TEST_PATH = "image-map-title-causes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitImageMapTitleCausesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImageMapUpdateParentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImageMapUpdateParentCrashTest.java
new file mode 100644
index 0000000..9463122
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImageMapUpdateParentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitImageMapUpdateParentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitImageMapUpdateParentCrashTest";
+    private static final String TEST_PATH = "image-map-update-parent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitImageMapUpdateParentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImagemapNorenderCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImagemapNorenderCrashTest.java
new file mode 100644
index 0000000..82b2c37
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImagemapNorenderCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitImagemapNorenderCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitImagemapNorenderCrashTest";
+    private static final String TEST_PATH = "imagemap-norender-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitImagemapNorenderCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImbricatedFlowThreadsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImbricatedFlowThreadsCrashTest.java
new file mode 100644
index 0000000..2bde5d2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImbricatedFlowThreadsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitImbricatedFlowThreadsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitImbricatedFlowThreadsCrashTest";
+    private static final String TEST_PATH = "imbricated-flow-threads-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitImbricatedFlowThreadsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImplicitHeadInFragmentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImplicitHeadInFragmentCrashTest.java
new file mode 100644
index 0000000..5b9e89e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImplicitHeadInFragmentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitImplicitHeadInFragmentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitImplicitHeadInFragmentCrashTest";
+    private static final String TEST_PATH = "implicit-head-in-fragment-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitImplicitHeadInFragmentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImportCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImportCrashTest.java
new file mode 100644
index 0000000..2e1b323
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitImportCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitImportCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitImportCrashTest";
+    private static final String TEST_PATH = "import-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitImportCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIndentNodeToSplitToCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIndentNodeToSplitToCrashTest.java
new file mode 100644
index 0000000..d1b1e1c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIndentNodeToSplitToCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIndentNodeToSplitToCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIndentNodeToSplitToCrashTest";
+    private static final String TEST_PATH = "indent-node-to-split-to-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIndentNodeToSplitToCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIndexValidationCrashWithBufferSubDataTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIndexValidationCrashWithBufferSubDataTest.java
new file mode 100644
index 0000000..ac26ff5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitIndexValidationCrashWithBufferSubDataTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitIndexValidationCrashWithBufferSubDataTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitIndexValidationCrashWithBufferSubDataTest";
+    private static final String TEST_PATH = "index-validation-crash-with-buffer-sub-data.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitIndexValidationCrashWithBufferSubDataTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInitkeyboardeventCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInitkeyboardeventCrashTest.java
new file mode 100644
index 0000000..e1d4203
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInitkeyboardeventCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInitkeyboardeventCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInitkeyboardeventCrashTest";
+    private static final String TEST_PATH = "initkeyboardevent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInitkeyboardeventCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBodyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBodyCrashTest.java
new file mode 100644
index 0000000..cd942cc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBodyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineBodyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineBodyCrashTest";
+    private static final String TEST_PATH = "inline-body-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineBodyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBodyWithScrollbarCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBodyWithScrollbarCrashTest.java
new file mode 100644
index 0000000..330f598
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBodyWithScrollbarCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineBodyWithScrollbarCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineBodyWithScrollbarCrashTest";
+    private static final String TEST_PATH = "inline-body-with-scrollbar-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineBodyWithScrollbarCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBoxAdjustPositionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBoxAdjustPositionCrashTest.java
new file mode 100644
index 0000000..906ab1e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBoxAdjustPositionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineBoxAdjustPositionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineBoxAdjustPositionCrashTest";
+    private static final String TEST_PATH = "inline-box-adjust-position-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineBoxAdjustPositionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBoxAdjustPositionCrashtwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBoxAdjustPositionCrashtwoTest.java
new file mode 100644
index 0000000..adc541f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBoxAdjustPositionCrashtwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineBoxAdjustPositionCrashtwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineBoxAdjustPositionCrashtwoTest";
+    private static final String TEST_PATH = "inline-box-adjust-position-crash2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineBoxAdjustPositionCrashtwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBoxWrapperCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBoxWrapperCrashTest.java
new file mode 100644
index 0000000..00d9bde
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineBoxWrapperCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineBoxWrapperCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineBoxWrapperCrashTest";
+    private static final String TEST_PATH = "inline-box-wrapper-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineBoxWrapperCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineChildHeightWidthCalcCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineChildHeightWidthCalcCrashTest.java
new file mode 100644
index 0000000..17f0dc5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineChildHeightWidthCalcCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineChildHeightWidthCalcCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineChildHeightWidthCalcCrashTest";
+    private static final String TEST_PATH = "inline-child-height-width-calc-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineChildHeightWidthCalcCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineChildrenCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineChildrenCrashTest.java
new file mode 100644
index 0000000..b0648f4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineChildrenCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineChildrenCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineChildrenCrashTest";
+    private static final String TEST_PATH = "inline-children-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineChildrenCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineCrashTest.java
new file mode 100644
index 0000000..5946570
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineCrashTest";
+    private static final String TEST_PATH = "inline-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineDestroyDirtyLinesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineDestroyDirtyLinesCrashTest.java
new file mode 100644
index 0000000..4605712
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineDestroyDirtyLinesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineDestroyDirtyLinesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineDestroyDirtyLinesCrashTest";
+    private static final String TEST_PATH = "inline-destroy-dirty-lines-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineDestroyDirtyLinesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineMarqueeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineMarqueeCrashTest.java
new file mode 100644
index 0000000..9fcafed
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineMarqueeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineMarqueeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineMarqueeCrashTest";
+    private static final String TEST_PATH = "inline-marquee-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineMarqueeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineSplittingWithAfterFloatCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineSplittingWithAfterFloatCrashTest.java
new file mode 100644
index 0000000..77c9e15
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineSplittingWithAfterFloatCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineSplittingWithAfterFloatCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineSplittingWithAfterFloatCrashTest";
+    private static final String TEST_PATH = "inline-splitting-with-after-float-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineSplittingWithAfterFloatCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineToBlockCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineToBlockCrashTest.java
new file mode 100644
index 0000000..1b923a3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInlineToBlockCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInlineToBlockCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInlineToBlockCrashTest";
+    private static final String TEST_PATH = "inline-to-block-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInlineToBlockCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInnerhtmlSelectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInnerhtmlSelectionCrashTest.java
new file mode 100644
index 0000000..4d3d241
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInnerhtmlSelectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInnerhtmlSelectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInnerhtmlSelectionCrashTest";
+    private static final String TEST_PATH = "innerHTML-selection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInnerhtmlSelectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputBoxTextFragmentCombineTextCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputBoxTextFragmentCombineTextCrashTest.java
new file mode 100644
index 0000000..d9df61d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputBoxTextFragmentCombineTextCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInputBoxTextFragmentCombineTextCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInputBoxTextFragmentCombineTextCrashTest";
+    private static final String TEST_PATH = "input-box-text-fragment-combine-text-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInputBoxTextFragmentCombineTextCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputElementAttachCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputElementAttachCrashTest.java
new file mode 100644
index 0000000..fbcff91
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputElementAttachCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInputElementAttachCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInputElementAttachCrashTest";
+    private static final String TEST_PATH = "input-element-attach-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInputElementAttachCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputElementPageCacheCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputElementPageCacheCrashTest.java
new file mode 100644
index 0000000..5597bab
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputElementPageCacheCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInputElementPageCacheCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInputElementPageCacheCrashTest";
+    private static final String TEST_PATH = "input-element-page-cache-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInputElementPageCacheCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputNumberCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputNumberCrashTest.java
new file mode 100644
index 0000000..278c3c6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputNumberCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInputNumberCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInputNumberCrashTest";
+    private static final String TEST_PATH = "input-number-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInputNumberCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputNumberSpinbuttonCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputNumberSpinbuttonCrashTest.java
new file mode 100644
index 0000000..5a2ebfd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputNumberSpinbuttonCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInputNumberSpinbuttonCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInputNumberSpinbuttonCrashTest";
+    private static final String TEST_PATH = "input-number-spinbutton-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInputNumberSpinbuttonCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputSearchTableColumnCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputSearchTableColumnCrashTest.java
new file mode 100644
index 0000000..7903e94
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInputSearchTableColumnCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInputSearchTableColumnCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInputSearchTableColumnCrashTest";
+    private static final String TEST_PATH = "input-search-table-column-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInputSearchTableColumnCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertImagesInPreXCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertImagesInPreXCrashTest.java
new file mode 100644
index 0000000..1757c6b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertImagesInPreXCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInsertImagesInPreXCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInsertImagesInPreXCrashTest";
+    private static final String TEST_PATH = "insert-images-in-pre-x-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInsertImagesInPreXCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertTextCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertTextCrashTest.java
new file mode 100644
index 0000000..cfce93d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertTextCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInsertTextCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInsertTextCrashTest";
+    private static final String TEST_PATH = "insert-text-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInsertTextCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertTextIntoEmptyFramesetCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertTextIntoEmptyFramesetCrashTest.java
new file mode 100644
index 0000000..57149ee
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertTextIntoEmptyFramesetCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInsertTextIntoEmptyFramesetCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInsertTextIntoEmptyFramesetCrashTest";
+    private static final String TEST_PATH = "insert-text-into-empty-frameset-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInsertTextIntoEmptyFramesetCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertadjacenthtmlDocumentfragmentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertadjacenthtmlDocumentfragmentCrashTest.java
new file mode 100644
index 0000000..f889ea1
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertadjacenthtmlDocumentfragmentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInsertadjacenthtmlDocumentfragmentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInsertadjacenthtmlDocumentfragmentCrashTest";
+    private static final String TEST_PATH = "insertAdjacentHTML-DocumentFragment-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInsertadjacenthtmlDocumentfragmentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInserthtmlMutationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInserthtmlMutationCrashTest.java
new file mode 100644
index 0000000..08ee09e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInserthtmlMutationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInserthtmlMutationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInserthtmlMutationCrashTest";
+    private static final String TEST_PATH = "insertHTML-mutation-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInserthtmlMutationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertionPointLineNumberOnPasswordCrashesTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertionPointLineNumberOnPasswordCrashesTest.java
new file mode 100644
index 0000000..6ea68d4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertionPointLineNumberOnPasswordCrashesTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInsertionPointLineNumberOnPasswordCrashesTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInsertionPointLineNumberOnPasswordCrashesTest";
+    private static final String TEST_PATH = "insertion-point-line-number-on-password-crashes.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInsertionPointLineNumberOnPasswordCrashesTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertnodeEmptyFragmentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertnodeEmptyFragmentCrashTest.java
new file mode 100644
index 0000000..6bf0fb1
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInsertnodeEmptyFragmentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInsertnodeEmptyFragmentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInsertnodeEmptyFragmentCrashTest";
+    private static final String TEST_PATH = "insertNode-empty-fragment-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInsertnodeEmptyFragmentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInteractiveValidationCrashByStyleOverrideTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInteractiveValidationCrashByStyleOverrideTest.java
new file mode 100644
index 0000000..65799ff
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInteractiveValidationCrashByStyleOverrideTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInteractiveValidationCrashByStyleOverrideTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInteractiveValidationCrashByStyleOverrideTest";
+    private static final String TEST_PATH = "interactive-validation-crash-by-style-override.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInteractiveValidationCrashByStyleOverrideTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInteractiveValidationSelectCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInteractiveValidationSelectCrashTest.java
new file mode 100644
index 0000000..0926556
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInteractiveValidationSelectCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInteractiveValidationSelectCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInteractiveValidationSelectCrashTest";
+    private static final String TEST_PATH = "interactive-validation-select-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInteractiveValidationSelectCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidCharsetOnScriptCrashesLoaderTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidCharsetOnScriptCrashesLoaderTest.java
new file mode 100644
index 0000000..39fa4ef
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidCharsetOnScriptCrashesLoaderTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInvalidCharsetOnScriptCrashesLoaderTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInvalidCharsetOnScriptCrashesLoaderTest";
+    private static final String TEST_PATH = "invalid-charset-on-script-crashes-loader.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInvalidCharsetOnScriptCrashesLoaderTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidCursorPropertyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidCursorPropertyCrashTest.java
new file mode 100644
index 0000000..d9f12ff
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidCursorPropertyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInvalidCursorPropertyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInvalidCursorPropertyCrashTest";
+    private static final String TEST_PATH = "invalid-cursor-property-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInvalidCursorPropertyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidFontFamilyInFontFaceCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidFontFamilyInFontFaceCrashTest.java
new file mode 100644
index 0000000..01c010a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidFontFamilyInFontFaceCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInvalidFontFamilyInFontFaceCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInvalidFontFamilyInFontFaceCrashTest";
+    private static final String TEST_PATH = "invalid-font-family-in-font-face-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInvalidFontFamilyInFontFaceCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidMediaUrlCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidMediaUrlCrashTest.java
new file mode 100644
index 0000000..999f118
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidMediaUrlCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInvalidMediaUrlCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInvalidMediaUrlCrashTest";
+    private static final String TEST_PATH = "invalid-media-url-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInvalidMediaUrlCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidSetFontCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidSetFontCrashTest.java
new file mode 100644
index 0000000..155127c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitInvalidSetFontCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitInvalidSetFontCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitInvalidSetFontCrashTest";
+    private static final String TEST_PATH = "invalid-set-font-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitInvalidSetFontCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlAsFramesrcCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlAsFramesrcCrashTest.java
new file mode 100644
index 0000000..758b6e6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlAsFramesrcCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitJavascriptUrlAsFramesrcCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitJavascriptUrlAsFramesrcCrashTest";
+    private static final String TEST_PATH = "javascript-url-as-framesrc-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitJavascriptUrlAsFramesrcCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlCrashFunctionIframeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlCrashFunctionIframeTest.java
new file mode 100644
index 0000000..9b26e88
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlCrashFunctionIframeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitJavascriptUrlCrashFunctionIframeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitJavascriptUrlCrashFunctionIframeTest";
+    private static final String TEST_PATH = "javascript-url-crash-function-iframe.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitJavascriptUrlCrashFunctionIframeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlCrashFunctionTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlCrashFunctionTest.java
new file mode 100644
index 0000000..015eb9c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlCrashFunctionTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitJavascriptUrlCrashFunctionTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitJavascriptUrlCrashFunctionTest";
+    private static final String TEST_PATH = "javascript-url-crash-function.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitJavascriptUrlCrashFunctionTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlIframeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlIframeCrashTest.java
new file mode 100644
index 0000000..ec972c3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJavascriptUrlIframeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitJavascriptUrlIframeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitJavascriptUrlIframeCrashTest";
+    private static final String TEST_PATH = "javascript-url-iframe-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitJavascriptUrlIframeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJqueryAnimationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJqueryAnimationCrashTest.java
new file mode 100644
index 0000000..cf6b6c1
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitJqueryAnimationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitJqueryAnimationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitJqueryAnimationCrashTest";
+    private static final String TEST_PATH = "jQuery-animation-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitJqueryAnimationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKeyboardeventMousedownCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKeyboardeventMousedownCrashTest.java
new file mode 100644
index 0000000..c554aa1
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKeyboardeventMousedownCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitKeyboardeventMousedownCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitKeyboardeventMousedownCrashTest";
+    private static final String TEST_PATH = "keyboardevent-mousedown-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitKeyboardeventMousedownCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKeyeventIframeRemovedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKeyeventIframeRemovedCrashTest.java
new file mode 100644
index 0000000..218bded
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKeyeventIframeRemovedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitKeyeventIframeRemovedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitKeyeventIframeRemovedCrashTest";
+    private static final String TEST_PATH = "keyevent-iframe-removed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitKeyeventIframeRemovedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKeyframesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKeyframesCrashTest.java
new file mode 100644
index 0000000..70dbde8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKeyframesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitKeyframesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitKeyframesCrashTest";
+    private static final String TEST_PATH = "webkit-keyframes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitKeyframesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKhmerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKhmerCrashTest.java
new file mode 100644
index 0000000..e69d5e2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitKhmerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitKhmerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitKhmerCrashTest";
+    private static final String TEST_PATH = "khmer-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitKhmerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLargeListOfRulesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLargeListOfRulesCrashTest.java
new file mode 100644
index 0000000..a8cee4b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLargeListOfRulesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitLargeListOfRulesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitLargeListOfRulesCrashTest";
+    private static final String TEST_PATH = "large-list-of-rules-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitLargeListOfRulesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLargeRowspanCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLargeRowspanCrashTest.java
new file mode 100644
index 0000000..2c472fb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLargeRowspanCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitLargeRowspanCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitLargeRowspanCrashTest";
+    private static final String TEST_PATH = "large-rowspan-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitLargeRowspanCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLargeSizeImageCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLargeSizeImageCrashTest.java
new file mode 100644
index 0000000..7ce9001
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLargeSizeImageCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitLargeSizeImageCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitLargeSizeImageCrashTest";
+    private static final String TEST_PATH = "large-size-image-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitLargeSizeImageCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLayerHitTestCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLayerHitTestCrashTest.java
new file mode 100644
index 0000000..621255e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLayerHitTestCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitLayerHitTestCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitLayerHitTestCrashTest";
+    private static final String TEST_PATH = "layer-hit-test-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitLayerHitTestCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLayerzordercrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLayerzordercrashTest.java
new file mode 100644
index 0000000..cdc0f2d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLayerzordercrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitLayerzordercrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitLayerzordercrashTest";
+    private static final String TEST_PATH = "layerZOrderCrash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitLayerzordercrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLayouthorizontalboxCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLayouthorizontalboxCrashTest.java
new file mode 100644
index 0000000..8f3c3d3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLayouthorizontalboxCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitLayouthorizontalboxCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitLayouthorizontalboxCrashTest";
+    private static final String TEST_PATH = "layoutHorizontalBox-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitLayouthorizontalboxCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLiStyleAlphaHugeValueCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLiStyleAlphaHugeValueCrashTest.java
new file mode 100644
index 0000000..60d8615
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLiStyleAlphaHugeValueCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitLiStyleAlphaHugeValueCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitLiStyleAlphaHugeValueCrashTest";
+    private static final String TEST_PATH = "li-style-alpha-huge-value-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitLiStyleAlphaHugeValueCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLineClampCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLineClampCrashTest.java
new file mode 100644
index 0000000..560386f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLineClampCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitLineClampCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitLineClampCrashTest";
+    private static final String TEST_PATH = "line-clamp-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitLineClampCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitListItemPseudoNocrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitListItemPseudoNocrashTest.java
new file mode 100644
index 0000000..5cfea94
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitListItemPseudoNocrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitListItemPseudoNocrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitListItemPseudoNocrashTest";
+    private static final String TEST_PATH = "list-item-pseudo-nocrash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitListItemPseudoNocrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitListStyleNoneCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitListStyleNoneCrashTest.java
new file mode 100644
index 0000000..b0ca5d4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitListStyleNoneCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitListStyleNoneCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitListStyleNoneCrashTest";
+    private static final String TEST_PATH = "list-style-none-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitListStyleNoneCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitListWrappingImageCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitListWrappingImageCrashTest.java
new file mode 100644
index 0000000..8223b8d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitListWrappingImageCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitListWrappingImageCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitListWrappingImageCrashTest";
+    private static final String TEST_PATH = "list-wrapping-image-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitListWrappingImageCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLoadDeferResumeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLoadDeferResumeCrashTest.java
new file mode 100644
index 0000000..2e1f1a7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLoadDeferResumeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitLoadDeferResumeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitLoadDeferResumeCrashTest";
+    private static final String TEST_PATH = "load-defer-resume-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitLoadDeferResumeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLocationNewWindowNoCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLocationNewWindowNoCrashTest.java
new file mode 100644
index 0000000..375d410
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitLocationNewWindowNoCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitLocationNewWindowNoCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitLocationNewWindowNoCrashTest";
+    private static final String TEST_PATH = "location-new-window-no-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitLocationNewWindowNoCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMainresourceNullMimetypeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMainresourceNullMimetypeCrashTest.java
new file mode 100644
index 0000000..d0c99c3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMainresourceNullMimetypeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMainresourceNullMimetypeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMainresourceNullMimetypeCrashTest";
+    private static final String TEST_PATH = "mainresource-null-mimetype-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMainresourceNullMimetypeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMarqueeAnonymousNodeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMarqueeAnonymousNodeCrashTest.java
new file mode 100644
index 0000000..3273459
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMarqueeAnonymousNodeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMarqueeAnonymousNodeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMarqueeAnonymousNodeCrashTest";
+    private static final String TEST_PATH = "webkit-marquee-anonymous-node-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMarqueeAnonymousNodeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashFieldsetLegendTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashFieldsetLegendTest.java
new file mode 100644
index 0000000..449c595
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashFieldsetLegendTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMaskCrashFieldsetLegendTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMaskCrashFieldsetLegendTest";
+    private static final String TEST_PATH = "webkit-mask-crash-fieldset-legend.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMaskCrashFieldsetLegendTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashFigureTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashFigureTest.java
new file mode 100644
index 0000000..fc5d094
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashFigureTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMaskCrashFigureTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMaskCrashFigureTest";
+    private static final String TEST_PATH = "webkit-mask-crash-figure.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMaskCrashFigureTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashTableTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashTableTest.java
new file mode 100644
index 0000000..5eb7344
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashTableTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMaskCrashTableTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMaskCrashTableTest";
+    private static final String TEST_PATH = "webkit-mask-crash-table.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMaskCrashTableTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashTdTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashTdTest.java
new file mode 100644
index 0000000..66e7a11
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashTdTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMaskCrashTdTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMaskCrashTdTest";
+    private static final String TEST_PATH = "webkit-mask-crash-td.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMaskCrashTdTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashTdTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashTdTwoTest.java
new file mode 100644
index 0000000..b544b42
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskCrashTdTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMaskCrashTdTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMaskCrashTdTwoTest";
+    private static final String TEST_PATH = "webkit-mask-crash-td-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMaskCrashTdTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskMissingImageCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskMissingImageCrashTest.java
new file mode 100644
index 0000000..654981f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMaskMissingImageCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMaskMissingImageCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMaskMissingImageCrashTest";
+    private static final String TEST_PATH = "mask-missing-image-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMaskMissingImageCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMathOptionsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMathOptionsCrashTest.java
new file mode 100644
index 0000000..3bed40d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMathOptionsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMathOptionsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMathOptionsCrashTest";
+    private static final String TEST_PATH = "math-options-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMathOptionsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMatrixAsFunctionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMatrixAsFunctionCrashTest.java
new file mode 100644
index 0000000..35a4f90
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMatrixAsFunctionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMatrixAsFunctionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMatrixAsFunctionCrashTest";
+    private static final String TEST_PATH = "matrix-as-function-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMatrixAsFunctionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMediaControlsCloneCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMediaControlsCloneCrashTest.java
new file mode 100644
index 0000000..6011756
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMediaControlsCloneCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMediaControlsCloneCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMediaControlsCloneCrashTest";
+    private static final String TEST_PATH = "media-controls-clone-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMediaControlsCloneCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMediaQueryEvaluatorCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMediaQueryEvaluatorCrashTest.java
new file mode 100644
index 0000000..c702b3a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMediaQueryEvaluatorCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMediaQueryEvaluatorCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMediaQueryEvaluatorCrashTest";
+    private static final String TEST_PATH = "media-query-evaluator-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMediaQueryEvaluatorCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMediaSvgCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMediaSvgCrashTest.java
new file mode 100644
index 0000000..9b00f02
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMediaSvgCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMediaSvgCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMediaSvgCrashTest";
+    private static final String TEST_PATH = "media-svg-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMediaSvgCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMenulistPopupCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMenulistPopupCrashTest.java
new file mode 100644
index 0000000..77e0ae3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMenulistPopupCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMenulistPopupCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMenulistPopupCrashTest";
+    private static final String TEST_PATH = "menulist-popup-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMenulistPopupCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMergeAnonymousBlockRemoveChildCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMergeAnonymousBlockRemoveChildCrashTest.java
new file mode 100644
index 0000000..e47dfd8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMergeAnonymousBlockRemoveChildCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMergeAnonymousBlockRemoveChildCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMergeAnonymousBlockRemoveChildCrashTest";
+    private static final String TEST_PATH = "merge-anonymous-block-remove-child-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMergeAnonymousBlockRemoveChildCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMergeAnonymousBlockRemoveChildCrashtwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMergeAnonymousBlockRemoveChildCrashtwoTest.java
new file mode 100644
index 0000000..fa0e7ca
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMergeAnonymousBlockRemoveChildCrashtwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMergeAnonymousBlockRemoveChildCrashtwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMergeAnonymousBlockRemoveChildCrashtwoTest";
+    private static final String TEST_PATH = "merge-anonymous-block-remove-child-crash2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMergeAnonymousBlockRemoveChildCrashtwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMeterElementCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMeterElementCrashTest.java
new file mode 100644
index 0000000..5aca046
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMeterElementCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMeterElementCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMeterElementCrashTest";
+    private static final String TEST_PATH = "meter-element-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMeterElementCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMeterElementWithChildCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMeterElementWithChildCrashTest.java
new file mode 100644
index 0000000..fc341b3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMeterElementWithChildCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMeterElementWithChildCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMeterElementWithChildCrashTest";
+    private static final String TEST_PATH = "meter-element-with-child-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMeterElementWithChildCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitModCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitModCrashTest.java
new file mode 100644
index 0000000..33f5784
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitModCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitModCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitModCrashTest";
+    private static final String TEST_PATH = "mod-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitModCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMouseMovedRemoveFrameCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMouseMovedRemoveFrameCrashTest.java
new file mode 100644
index 0000000..8b8739f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMouseMovedRemoveFrameCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMouseMovedRemoveFrameCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMouseMovedRemoveFrameCrashTest";
+    private static final String TEST_PATH = "mouse-moved-remove-frame-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMouseMovedRemoveFrameCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestFourTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestFourTest.java
new file mode 100644
index 0000000..45ab5ea
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestFourTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMoveByWordVisuallyCrashTestFourTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMoveByWordVisuallyCrashTestFourTest";
+    private static final String TEST_PATH = "move-by-word-visually-crash-test-4.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMoveByWordVisuallyCrashTestFourTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestOneTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestOneTest.java
new file mode 100644
index 0000000..b94f27b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestOneTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMoveByWordVisuallyCrashTestOneTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMoveByWordVisuallyCrashTestOneTest";
+    private static final String TEST_PATH = "move-by-word-visually-crash-test-1.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMoveByWordVisuallyCrashTestOneTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestTextareaTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestTextareaTest.java
new file mode 100644
index 0000000..8bab4e0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestTextareaTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMoveByWordVisuallyCrashTestTextareaTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMoveByWordVisuallyCrashTestTextareaTest";
+    private static final String TEST_PATH = "move-by-word-visually-crash-test-textarea.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMoveByWordVisuallyCrashTestTextareaTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestThreeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestThreeTest.java
new file mode 100644
index 0000000..35b4ba2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestThreeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMoveByWordVisuallyCrashTestThreeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMoveByWordVisuallyCrashTestThreeTest";
+    private static final String TEST_PATH = "move-by-word-visually-crash-test-3.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMoveByWordVisuallyCrashTestThreeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestTwoTest.java
new file mode 100644
index 0000000..53e9b29
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMoveByWordVisuallyCrashTestTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMoveByWordVisuallyCrashTestTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMoveByWordVisuallyCrashTestTwoTest";
+    private static final String TEST_PATH = "move-by-word-visually-crash-test-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMoveByWordVisuallyCrashTestTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMsubAnonymousChildRenderCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMsubAnonymousChildRenderCrashTest.java
new file mode 100644
index 0000000..a90c0c5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMsubAnonymousChildRenderCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMsubAnonymousChildRenderCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMsubAnonymousChildRenderCrashTest";
+    private static final String TEST_PATH = "msub-anonymous-child-render-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMsubAnonymousChildRenderCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultilineAndObjectInsideIsolateCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultilineAndObjectInsideIsolateCrashTest.java
new file mode 100644
index 0000000..9d6df86
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultilineAndObjectInsideIsolateCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMultilineAndObjectInsideIsolateCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMultilineAndObjectInsideIsolateCrashTest";
+    private static final String TEST_PATH = "multiline-and-object-inside-isolate-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMultilineAndObjectInsideIsolateCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfiveExpectedTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfiveExpectedTest.java
new file mode 100644
index 0000000..782123d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfiveExpectedTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMultipleCaptionsCrashfiveExpectedTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMultipleCaptionsCrashfiveExpectedTest";
+    private static final String TEST_PATH = "multiple-captions-crash5-expected.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMultipleCaptionsCrashfiveExpectedTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfiveTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfiveTest.java
new file mode 100644
index 0000000..06183c8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfiveTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMultipleCaptionsCrashfiveTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMultipleCaptionsCrashfiveTest";
+    private static final String TEST_PATH = "multiple-captions-crash5.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMultipleCaptionsCrashfiveTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfourExpectedTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfourExpectedTest.java
new file mode 100644
index 0000000..f2de349
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfourExpectedTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMultipleCaptionsCrashfourExpectedTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMultipleCaptionsCrashfourExpectedTest";
+    private static final String TEST_PATH = "multiple-captions-crash4-expected.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMultipleCaptionsCrashfourExpectedTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfourTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfourTest.java
new file mode 100644
index 0000000..49bef5c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashfourTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMultipleCaptionsCrashfourTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMultipleCaptionsCrashfourTest";
+    private static final String TEST_PATH = "multiple-captions-crash4.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMultipleCaptionsCrashfourTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashthreeExpectedTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashthreeExpectedTest.java
new file mode 100644
index 0000000..80471ab
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashthreeExpectedTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMultipleCaptionsCrashthreeExpectedTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMultipleCaptionsCrashthreeExpectedTest";
+    private static final String TEST_PATH = "multiple-captions-crash3-expected.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMultipleCaptionsCrashthreeExpectedTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashthreeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashthreeTest.java
new file mode 100644
index 0000000..bdb00b4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCaptionsCrashthreeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMultipleCaptionsCrashthreeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMultipleCaptionsCrashthreeTest";
+    private static final String TEST_PATH = "multiple-captions-crash3.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMultipleCaptionsCrashthreeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCursorsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCursorsCrashTest.java
new file mode 100644
index 0000000..cb91080
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMultipleCursorsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMultipleCursorsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMultipleCursorsCrashTest";
+    private static final String TEST_PATH = "multiple-cursors-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMultipleCursorsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMutationCallbackNonElementCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMutationCallbackNonElementCrashTest.java
new file mode 100644
index 0000000..4aeb4c2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitMutationCallbackNonElementCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitMutationCallbackNonElementCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitMutationCallbackNonElementCrashTest";
+    private static final String TEST_PATH = "mutation-callback-non-element-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitMutationCallbackNonElementCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNamednodemapSetnameditemCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNamednodemapSetnameditemCrashTest.java
new file mode 100644
index 0000000..1792c0c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNamednodemapSetnameditemCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNamednodemapSetnameditemCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNamednodemapSetnameditemCrashTest";
+    private static final String TEST_PATH = "NamedNodeMap-setNamedItem-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNamednodemapSetnameditemCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigationRedirectScheduleCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigationRedirectScheduleCrashTest.java
new file mode 100644
index 0000000..eacf310
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigationRedirectScheduleCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNavigationRedirectScheduleCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNavigationRedirectScheduleCrashTest";
+    private static final String TEST_PATH = "navigation-redirect-schedule-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNavigationRedirectScheduleCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigatorCookieenabledNoCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigatorCookieenabledNoCrashTest.java
new file mode 100644
index 0000000..96dc4ad
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigatorCookieenabledNoCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNavigatorCookieenabledNoCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNavigatorCookieenabledNoCrashTest";
+    private static final String TEST_PATH = "navigator-cookieEnabled-no-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNavigatorCookieenabledNoCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigatorDetachedNoCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigatorDetachedNoCrashTest.java
new file mode 100644
index 0000000..54f52a3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigatorDetachedNoCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNavigatorDetachedNoCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNavigatorDetachedNoCrashTest";
+    private static final String TEST_PATH = "navigator-detached-no-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNavigatorDetachedNoCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigatorPluginsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigatorPluginsCrashTest.java
new file mode 100644
index 0000000..2c1d010
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNavigatorPluginsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNavigatorPluginsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNavigatorPluginsCrashTest";
+    private static final String TEST_PATH = "navigator-plugins-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNavigatorPluginsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNegativeRemainingLengthCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNegativeRemainingLengthCrashTest.java
new file mode 100644
index 0000000..24b5007
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNegativeRemainingLengthCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNegativeRemainingLengthCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNegativeRemainingLengthCrashTest";
+    private static final String TEST_PATH = "negative-remaining-length-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNegativeRemainingLengthCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedBidiIsolateCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedBidiIsolateCrashTest.java
new file mode 100644
index 0000000..6904e6b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedBidiIsolateCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNestedBidiIsolateCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNestedBidiIsolateCrashTest";
+    private static final String TEST_PATH = "nested-bidi-isolate-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNestedBidiIsolateCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedEventRemoveNodeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedEventRemoveNodeCrashTest.java
new file mode 100644
index 0000000..152e93c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedEventRemoveNodeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNestedEventRemoveNodeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNestedEventRemoveNodeCrashTest";
+    private static final String TEST_PATH = "nested-event-remove-node-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNestedEventRemoveNodeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedFirstLetterWithFloatCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedFirstLetterWithFloatCrashTest.java
new file mode 100644
index 0000000..9bec43b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedFirstLetterWithFloatCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNestedFirstLetterWithFloatCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNestedFirstLetterWithFloatCrashTest";
+    private static final String TEST_PATH = "nested-first-letter-with-float-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNestedFirstLetterWithFloatCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedFragmentParserCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedFragmentParserCrashTest.java
new file mode 100644
index 0000000..cd1b5ca
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedFragmentParserCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNestedFragmentParserCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNestedFragmentParserCrashTest";
+    private static final String TEST_PATH = "nested-fragment-parser-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNestedFragmentParserCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedLayoutCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedLayoutCrashTest.java
new file mode 100644
index 0000000..f3116cd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedLayoutCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNestedLayoutCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNestedLayoutCrashTest";
+    private static final String TEST_PATH = "nested-layout-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNestedLayoutCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedTablesWithBeforeAfterContentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedTablesWithBeforeAfterContentCrashTest.java
new file mode 100644
index 0000000..71ba026
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNestedTablesWithBeforeAfterContentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNestedTablesWithBeforeAfterContentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNestedTablesWithBeforeAfterContentCrashTest";
+    private static final String TEST_PATH = "nested-tables-with-before-after-content-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNestedTablesWithBeforeAfterContentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNoOverhangingFloatCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNoOverhangingFloatCrashTest.java
new file mode 100644
index 0000000..14008a2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNoOverhangingFloatCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNoOverhangingFloatCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNoOverhangingFloatCrashTest";
+    private static final String TEST_PATH = "no-overhanging-float-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNoOverhangingFloatCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeFilterDetachedIframeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeFilterDetachedIframeCrashTest.java
new file mode 100644
index 0000000..bc1b386
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeFilterDetachedIframeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNodeFilterDetachedIframeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNodeFilterDetachedIframeCrashTest";
+    private static final String TEST_PATH = "node-filter-detached-iframe-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNodeFilterDetachedIframeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeIteratorDocumentMovedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeIteratorDocumentMovedCrashTest.java
new file mode 100644
index 0000000..a30ef03
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeIteratorDocumentMovedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNodeIteratorDocumentMovedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNodeIteratorDocumentMovedCrashTest";
+    private static final String TEST_PATH = "node-iterator-document-moved-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNodeIteratorDocumentMovedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeIteratorReferenceNodeMovedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeIteratorReferenceNodeMovedCrashTest.java
new file mode 100644
index 0000000..b64ba44
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeIteratorReferenceNodeMovedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNodeIteratorReferenceNodeMovedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNodeIteratorReferenceNodeMovedCrashTest";
+    private static final String TEST_PATH = "node-iterator-reference-node-moved-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNodeIteratorReferenceNodeMovedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeMoveToNewDocumentCrashMainTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeMoveToNewDocumentCrashMainTest.java
new file mode 100644
index 0000000..7356473
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNodeMoveToNewDocumentCrashMainTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNodeMoveToNewDocumentCrashMainTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNodeMoveToNewDocumentCrashMainTest";
+    private static final String TEST_PATH = "node-move-to-new-document-crash-main.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNodeMoveToNewDocumentCrashMainTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNonExistentEventsourceStatusErrorIframeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNonExistentEventsourceStatusErrorIframeCrashTest.java
new file mode 100644
index 0000000..97388cf
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNonExistentEventsourceStatusErrorIframeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNonExistentEventsourceStatusErrorIframeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNonExistentEventsourceStatusErrorIframeCrashTest";
+    private static final String TEST_PATH = "non-existent-eventsource-status-error-iframe-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNonExistentEventsourceStatusErrorIframeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNonNativeImageCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNonNativeImageCrashTest.java
new file mode 100644
index 0000000..e760461
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNonNativeImageCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNonNativeImageCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNonNativeImageCrashTest";
+    private static final String TEST_PATH = "non-native-image-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNonNativeImageCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNonStyledElementIdCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNonStyledElementIdCrashTest.java
new file mode 100644
index 0000000..8606161
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNonStyledElementIdCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNonStyledElementIdCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNonStyledElementIdCrashTest";
+    private static final String TEST_PATH = "non-styled-element-id-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNonStyledElementIdCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNormalizeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNormalizeCrashTest.java
new file mode 100644
index 0000000..a16aa74
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNormalizeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNormalizeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNormalizeCrashTest";
+    private static final String TEST_PATH = "normalize-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNormalizeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNotificationsDocumentCloseCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNotificationsDocumentCloseCrashTest.java
new file mode 100644
index 0000000..00dc78f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNotificationsDocumentCloseCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNotificationsDocumentCloseCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNotificationsDocumentCloseCrashTest";
+    private static final String TEST_PATH = "notifications-document-close-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNotificationsDocumentCloseCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNotificationsWindowCloseCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNotificationsWindowCloseCrashTest.java
new file mode 100644
index 0000000..0baeac7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNotificationsWindowCloseCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNotificationsWindowCloseCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNotificationsWindowCloseCrashTest";
+    private static final String TEST_PATH = "notifications-window-close-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNotificationsWindowCloseCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullChardataCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullChardataCrashTest.java
new file mode 100644
index 0000000..58a8093
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullChardataCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNullChardataCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNullChardataCrashTest";
+    private static final String TEST_PATH = "null-chardata-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNullChardataCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationAssignCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationAssignCrashTest.java
new file mode 100644
index 0000000..468d43b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationAssignCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNullDocumentLocationAssignCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNullDocumentLocationAssignCrashTest";
+    private static final String TEST_PATH = "null-document-location-assign-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNullDocumentLocationAssignCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationHrefPutCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationHrefPutCrashTest.java
new file mode 100644
index 0000000..ae66cf9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationHrefPutCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNullDocumentLocationHrefPutCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNullDocumentLocationHrefPutCrashTest";
+    private static final String TEST_PATH = "null-document-location-href-put-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNullDocumentLocationHrefPutCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationPutCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationPutCrashTest.java
new file mode 100644
index 0000000..d486681
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationPutCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNullDocumentLocationPutCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNullDocumentLocationPutCrashTest";
+    private static final String TEST_PATH = "null-document-location-put-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNullDocumentLocationPutCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationReplaceCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationReplaceCrashTest.java
new file mode 100644
index 0000000..3fca730
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentLocationReplaceCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNullDocumentLocationReplaceCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNullDocumentLocationReplaceCrashTest";
+    private static final String TEST_PATH = "null-document-location-replace-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNullDocumentLocationReplaceCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentWindowOpenCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentWindowOpenCrashTest.java
new file mode 100644
index 0000000..4894a6d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullDocumentWindowOpenCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNullDocumentWindowOpenCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNullDocumentWindowOpenCrashTest";
+    private static final String TEST_PATH = "null-document-window-open-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNullDocumentWindowOpenCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullPageShowModalDialogCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullPageShowModalDialogCrashTest.java
new file mode 100644
index 0000000..64d7e62
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNullPageShowModalDialogCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNullPageShowModalDialogCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNullPageShowModalDialogCrashTest";
+    private static final String TEST_PATH = "null-page-show-modal-dialog-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNullPageShowModalDialogCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNumberParsingCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNumberParsingCrashTest.java
new file mode 100644
index 0000000..c81d74c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNumberParsingCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNumberParsingCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNumberParsingCrashTest";
+    private static final String TEST_PATH = "number-parsing-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNumberParsingCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNumberParsingCrashTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNumberParsingCrashTwoTest.java
new file mode 100644
index 0000000..5bb08e0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitNumberParsingCrashTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitNumberParsingCrashTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitNumberParsingCrashTwoTest";
+    private static final String TEST_PATH = "number-parsing-crash-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitNumberParsingCrashTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOneLetterTransformCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOneLetterTransformCrashTest.java
new file mode 100644
index 0000000..986325f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOneLetterTransformCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOneLetterTransformCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOneLetterTransformCrashTest";
+    private static final String TEST_PATH = "one-letter-transform-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOneLetterTransformCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnloadRemoveIframeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnloadRemoveIframeCrashTest.java
new file mode 100644
index 0000000..41836a4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnloadRemoveIframeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOnloadRemoveIframeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOnloadRemoveIframeCrashTest";
+    private static final String TEST_PATH = "onload-remove-iframe-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOnloadRemoveIframeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnloadRemoveIframeCrashTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnloadRemoveIframeCrashTwoTest.java
new file mode 100644
index 0000000..765df99
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnloadRemoveIframeCrashTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOnloadRemoveIframeCrashTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOnloadRemoveIframeCrashTwoTest";
+    private static final String TEST_PATH = "onload-remove-iframe-crash-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOnloadRemoveIframeCrashTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnloadframecrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnloadframecrashTest.java
new file mode 100644
index 0000000..ba9ffe4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnloadframecrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOnloadframecrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOnloadframecrashTest";
+    private static final String TEST_PATH = "onloadFrameCrash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOnloadframecrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnunloadFormSubmitCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnunloadFormSubmitCrashTest.java
new file mode 100644
index 0000000..80ee44a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnunloadFormSubmitCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOnunloadFormSubmitCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOnunloadFormSubmitCrashTest";
+    private static final String TEST_PATH = "onunload-form-submit-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOnunloadFormSubmitCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnunloadFormSubmitCrashTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnunloadFormSubmitCrashTwoTest.java
new file mode 100644
index 0000000..b88ba90
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOnunloadFormSubmitCrashTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOnunloadFormSubmitCrashTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOnunloadFormSubmitCrashTwoTest";
+    private static final String TEST_PATH = "onunload-form-submit-crash-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOnunloadFormSubmitCrashTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeFourTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeFourTest.java
new file mode 100644
index 0000000..dded483
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeFourTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeFourTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeFourTest";
+    private static final String TEST_PATH = "orphaned-selection-crash-bug32823-4.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeFourTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeOneTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeOneTest.java
new file mode 100644
index 0000000..0b7eff8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeOneTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeOneTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeOneTest";
+    private static final String TEST_PATH = "orphaned-selection-crash-bug32823-1.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeOneTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeThreeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeThreeTest.java
new file mode 100644
index 0000000..b24f729
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeThreeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeThreeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeThreeTest";
+    private static final String TEST_PATH = "orphaned-selection-crash-bug32823-3.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeThreeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeTwoTest.java
new file mode 100644
index 0000000..2e06610
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeTwoTest";
+    private static final String TEST_PATH = "orphaned-selection-crash-bug32823-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOrphanedSelectionCrashBugthreetwoeighttwothreeTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedUnitsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedUnitsCrashTest.java
new file mode 100644
index 0000000..892345a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOrphanedUnitsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOrphanedUnitsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOrphanedUnitsCrashTest";
+    private static final String TEST_PATH = "orphaned_units_crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOrphanedUnitsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowCustomScrollbarCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowCustomScrollbarCrashTest.java
new file mode 100644
index 0000000..063ad65
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowCustomScrollbarCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOverflowCustomScrollbarCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOverflowCustomScrollbarCrashTest";
+    private static final String TEST_PATH = "overflow-custom-scrollbar-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOverflowCustomScrollbarCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowHeightFloatNotRemovedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowHeightFloatNotRemovedCrashTest.java
new file mode 100644
index 0000000..774f784
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowHeightFloatNotRemovedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOverflowHeightFloatNotRemovedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOverflowHeightFloatNotRemovedCrashTest";
+    private static final String TEST_PATH = "overflow-height-float-not-removed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOverflowHeightFloatNotRemovedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowHeightFloatNotRemovedCrashthreeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowHeightFloatNotRemovedCrashthreeTest.java
new file mode 100644
index 0000000..172afd9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowHeightFloatNotRemovedCrashthreeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOverflowHeightFloatNotRemovedCrashthreeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOverflowHeightFloatNotRemovedCrashthreeTest";
+    private static final String TEST_PATH = "overflow-height-float-not-removed-crash3.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOverflowHeightFloatNotRemovedCrashthreeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowHeightFloatNotRemovedCrashtwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowHeightFloatNotRemovedCrashtwoTest.java
new file mode 100644
index 0000000..9ef79ea
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverflowHeightFloatNotRemovedCrashtwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOverflowHeightFloatNotRemovedCrashtwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOverflowHeightFloatNotRemovedCrashtwoTest";
+    private static final String TEST_PATH = "overflow-height-float-not-removed-crash2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOverflowHeightFloatNotRemovedCrashtwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverhangingFloatLegendCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverhangingFloatLegendCrashTest.java
new file mode 100644
index 0000000..39faa93
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverhangingFloatLegendCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOverhangingFloatLegendCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOverhangingFloatLegendCrashTest";
+    private static final String TEST_PATH = "overhanging-float-legend-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOverhangingFloatLegendCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverhangingFloatsNotRemovedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverhangingFloatsNotRemovedCrashTest.java
new file mode 100644
index 0000000..5f480fd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverhangingFloatsNotRemovedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOverhangingFloatsNotRemovedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOverhangingFloatsNotRemovedCrashTest";
+    private static final String TEST_PATH = "overhanging-floats-not-removed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOverhangingFloatsNotRemovedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverrideTransitionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverrideTransitionCrashTest.java
new file mode 100644
index 0000000..d7c6cf5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitOverrideTransitionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitOverrideTransitionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitOverrideTransitionCrashTest";
+    private static final String TEST_PATH = "override-transition-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitOverrideTransitionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPageCacheCrashOnDataUrlsTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPageCacheCrashOnDataUrlsTest.java
new file mode 100644
index 0000000..fab31eb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPageCacheCrashOnDataUrlsTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPageCacheCrashOnDataUrlsTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPageCacheCrashOnDataUrlsTest";
+    private static final String TEST_PATH = "page-cache-crash-on-data-urls.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPageCacheCrashOnDataUrlsTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPaginatedLayerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPaginatedLayerCrashTest.java
new file mode 100644
index 0000000..329aa9f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPaginatedLayerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPaginatedLayerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPaginatedLayerCrashTest";
+    private static final String TEST_PATH = "paginated-layer-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPaginatedLayerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParentBoxNotBoxCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParentBoxNotBoxCrashTest.java
new file mode 100644
index 0000000..a63aae6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParentBoxNotBoxCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitParentBoxNotBoxCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitParentBoxNotBoxCrashTest";
+    private static final String TEST_PATH = "parent-box-not-box-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitParentBoxNotBoxCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParentViewLayoutCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParentViewLayoutCrashTest.java
new file mode 100644
index 0000000..1ec56cf
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParentViewLayoutCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitParentViewLayoutCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitParentViewLayoutCrashTest";
+    private static final String TEST_PATH = "parent-view-layout-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitParentViewLayoutCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParseColorIntOrPercentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParseColorIntOrPercentCrashTest.java
new file mode 100644
index 0000000..cff94f9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParseColorIntOrPercentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitParseColorIntOrPercentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitParseColorIntOrPercentCrashTest";
+    private static final String TEST_PATH = "parse-color-int-or-percent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitParseColorIntOrPercentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParseTimingFunctionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParseTimingFunctionCrashTest.java
new file mode 100644
index 0000000..7908775
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitParseTimingFunctionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitParseTimingFunctionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitParseTimingFunctionCrashTest";
+    private static final String TEST_PATH = "parse-timing-function-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitParseTimingFunctionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPathGetpresentationattributeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPathGetpresentationattributeCrashTest.java
new file mode 100644
index 0000000..5ca6c89
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPathGetpresentationattributeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPathGetpresentationattributeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPathGetpresentationattributeCrashTest";
+    private static final String TEST_PATH = "path-getPresentationAttribute-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPathGetpresentationattributeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPauseCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPauseCrashTest.java
new file mode 100644
index 0000000..b055e68
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPauseCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPauseCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPauseCrashTest";
+    private static final String TEST_PATH = "pause-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPauseCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPendingImagesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPendingImagesCrashTest.java
new file mode 100644
index 0000000..8027a9f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPendingImagesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPendingImagesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPendingImagesCrashTest";
+    private static final String TEST_PATH = "pending-images-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPendingImagesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPendingReflectionMaskCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPendingReflectionMaskCrashTest.java
new file mode 100644
index 0000000..75b47aa
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPendingReflectionMaskCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPendingReflectionMaskCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPendingReflectionMaskCrashTest";
+    private static final String TEST_PATH = "pending-reflection-mask-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPendingReflectionMaskCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPercentHeightDescendantNotRemovedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPercentHeightDescendantNotRemovedCrashTest.java
new file mode 100644
index 0000000..12cefe3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPercentHeightDescendantNotRemovedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPercentHeightDescendantNotRemovedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPercentHeightDescendantNotRemovedCrashTest";
+    private static final String TEST_PATH = "percent-height-descendant-not-removed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPercentHeightDescendantNotRemovedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPlaceholderCrashWithScrollbarCornerTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPlaceholderCrashWithScrollbarCornerTest.java
new file mode 100644
index 0000000..e56cfcd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPlaceholderCrashWithScrollbarCornerTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPlaceholderCrashWithScrollbarCornerTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPlaceholderCrashWithScrollbarCornerTest";
+    private static final String TEST_PATH = "placeholder-crash-with-scrollbar-corner.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPlaceholderCrashWithScrollbarCornerTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPngExtraRowCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPngExtraRowCrashTest.java
new file mode 100644
index 0000000..2fc204f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPngExtraRowCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPngExtraRowCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPngExtraRowCrashTest";
+    private static final String TEST_PATH = "png-extra-row-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPngExtraRowCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPolylinePointsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPolylinePointsCrashTest.java
new file mode 100644
index 0000000..ca31fda
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPolylinePointsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPolylinePointsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPolylinePointsCrashTest";
+    private static final String TEST_PATH = "polyline-points-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPolylinePointsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionAbsoluteToFixedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionAbsoluteToFixedCrashTest.java
new file mode 100644
index 0000000..561b59c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionAbsoluteToFixedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPositionAbsoluteToFixedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPositionAbsoluteToFixedCrashTest";
+    private static final String TEST_PATH = "position-absolute-to-fixed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPositionAbsoluteToFixedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedBackgroundHitTestCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedBackgroundHitTestCrashTest.java
new file mode 100644
index 0000000..77c3224
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedBackgroundHitTestCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPositionedBackgroundHitTestCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPositionedBackgroundHitTestCrashTest";
+    private static final String TEST_PATH = "positioned-background-hit-test-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPositionedBackgroundHitTestCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedChildNotRemovedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedChildNotRemovedCrashTest.java
new file mode 100644
index 0000000..8f052ee
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedChildNotRemovedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPositionedChildNotRemovedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPositionedChildNotRemovedCrashTest";
+    private static final String TEST_PATH = "positioned-child-not-removed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPositionedChildNotRemovedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedCountCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedCountCrashTest.java
new file mode 100644
index 0000000..329f665
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedCountCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPositionedCountCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPositionedCountCrashTest";
+    private static final String TEST_PATH = "positioned-count-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPositionedCountCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedDivWithFloatingAfterContentCrashFrameoneTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedDivWithFloatingAfterContentCrashFrameoneTest.java
new file mode 100644
index 0000000..0be7f08
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedDivWithFloatingAfterContentCrashFrameoneTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPositionedDivWithFloatingAfterContentCrashFrameoneTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPositionedDivWithFloatingAfterContentCrashFrameoneTest";
+    private static final String TEST_PATH = "positioned-div-with-floating-after-content-crash-frame1.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPositionedDivWithFloatingAfterContentCrashFrameoneTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedDivWithFloatingAfterContentCrashFrametwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedDivWithFloatingAfterContentCrashFrametwoTest.java
new file mode 100644
index 0000000..53260d3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedDivWithFloatingAfterContentCrashFrametwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPositionedDivWithFloatingAfterContentCrashFrametwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPositionedDivWithFloatingAfterContentCrashFrametwoTest";
+    private static final String TEST_PATH = "positioned-div-with-floating-after-content-crash-frame2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPositionedDivWithFloatingAfterContentCrashFrametwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedDivWithFloatingAfterContentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedDivWithFloatingAfterContentCrashTest.java
new file mode 100644
index 0000000..7bc6b70
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedDivWithFloatingAfterContentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPositionedDivWithFloatingAfterContentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPositionedDivWithFloatingAfterContentCrashTest";
+    private static final String TEST_PATH = "positioned-div-with-floating-after-content-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPositionedDivWithFloatingAfterContentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedGeneratedContentUnderRunInCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedGeneratedContentUnderRunInCrashTest.java
new file mode 100644
index 0000000..106d3bb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedGeneratedContentUnderRunInCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPositionedGeneratedContentUnderRunInCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPositionedGeneratedContentUnderRunInCrashTest";
+    private static final String TEST_PATH = "positioned-generated-content-under-run-in-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPositionedGeneratedContentUnderRunInCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedInRelativePositionInlineCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedInRelativePositionInlineCrashTest.java
new file mode 100644
index 0000000..1ee36fa
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPositionedInRelativePositionInlineCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPositionedInRelativePositionInlineCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPositionedInRelativePositionInlineCrashTest";
+    private static final String TEST_PATH = "positioned-in-relative-position-inline-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPositionedInRelativePositionInlineCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPrintCloseCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPrintCloseCrashTest.java
new file mode 100644
index 0000000..e9bce4c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitPrintCloseCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitPrintCloseCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitPrintCloseCrashTest";
+    private static final String TEST_PATH = "print-close-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitPrintCloseCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitProcessEndTagForInbodyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitProcessEndTagForInbodyCrashTest.java
new file mode 100644
index 0000000..8177941
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitProcessEndTagForInbodyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitProcessEndTagForInbodyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitProcessEndTagForInbodyCrashTest";
+    private static final String TEST_PATH = "process-end-tag-for-inbody-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitProcessEndTagForInbodyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitProgressElementWithChildCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitProgressElementWithChildCrashTest.java
new file mode 100644
index 0000000..f3e2203
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitProgressElementWithChildCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitProgressElementWithChildCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitProgressElementWithChildCrashTest";
+    private static final String TEST_PATH = "progress-element-with-child-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitProgressElementWithChildCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitProgressElementWithStyleCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitProgressElementWithStyleCrashTest.java
new file mode 100644
index 0000000..835713f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitProgressElementWithStyleCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitProgressElementWithStyleCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitProgressElementWithStyleCrashTest";
+    private static final String TEST_PATH = "progress-element-with-style-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitProgressElementWithStyleCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeDeleteContentsEventFireCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeDeleteContentsEventFireCrashTest.java
new file mode 100644
index 0000000..f444b54
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeDeleteContentsEventFireCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRangeDeleteContentsEventFireCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRangeDeleteContentsEventFireCrashTest";
+    private static final String TEST_PATH = "range-delete-contents-event-fire-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRangeDeleteContentsEventFireCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeExtractContentsEventFireCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeExtractContentsEventFireCrashTest.java
new file mode 100644
index 0000000..cf503ff
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeExtractContentsEventFireCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRangeExtractContentsEventFireCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRangeExtractContentsEventFireCrashTest";
+    private static final String TEST_PATH = "range-extract-contents-event-fire-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRangeExtractContentsEventFireCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeExtractContentsEventFireCrashtwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeExtractContentsEventFireCrashtwoTest.java
new file mode 100644
index 0000000..7b59cde
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeExtractContentsEventFireCrashtwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRangeExtractContentsEventFireCrashtwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRangeExtractContentsEventFireCrashtwoTest";
+    private static final String TEST_PATH = "range-extract-contents-event-fire-crash2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRangeExtractContentsEventFireCrashtwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeInsertnodeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeInsertnodeCrashTest.java
new file mode 100644
index 0000000..da1db02
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeInsertnodeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRangeInsertnodeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRangeInsertnodeCrashTest";
+    private static final String TEST_PATH = "Range-insertNode-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRangeInsertnodeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeSelectionAcrossDocumentsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeSelectionAcrossDocumentsCrashTest.java
new file mode 100644
index 0000000..39076fb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRangeSelectionAcrossDocumentsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRangeSelectionAcrossDocumentsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRangeSelectionAcrossDocumentsCrashTest";
+    private static final String TEST_PATH = "range-selection-across-documents-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRangeSelectionAcrossDocumentsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReEnterAndCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReEnterAndCrashTest.java
new file mode 100644
index 0000000..92042b9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReEnterAndCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitReEnterAndCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitReEnterAndCrashTest";
+    private static final String TEST_PATH = "re-enter-and-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitReEnterAndCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRecalcSectionFirstBodyCrashMainTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRecalcSectionFirstBodyCrashMainTest.java
new file mode 100644
index 0000000..f32d04f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRecalcSectionFirstBodyCrashMainTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRecalcSectionFirstBodyCrashMainTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRecalcSectionFirstBodyCrashMainTest";
+    private static final String TEST_PATH = "recalc-section-first-body-crash-main.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRecalcSectionFirstBodyCrashMainTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRecalcSectionFirstBodyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRecalcSectionFirstBodyCrashTest.java
new file mode 100644
index 0000000..0ec1f8d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRecalcSectionFirstBodyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRecalcSectionFirstBodyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRecalcSectionFirstBodyCrashTest";
+    private static final String TEST_PATH = "recalc-section-first-body-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRecalcSectionFirstBodyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRecursiveBeforeUnloadCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRecursiveBeforeUnloadCrashTest.java
new file mode 100644
index 0000000..7924844
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRecursiveBeforeUnloadCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRecursiveBeforeUnloadCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRecursiveBeforeUnloadCrashTest";
+    private static final String TEST_PATH = "recursive-before-unload-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRecursiveBeforeUnloadCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRedirectWithNoLocationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRedirectWithNoLocationCrashTest.java
new file mode 100644
index 0000000..c1d87fa
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRedirectWithNoLocationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRedirectWithNoLocationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRedirectWithNoLocationCrashTest";
+    private static final String TEST_PATH = "redirect-with-no-location-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRedirectWithNoLocationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReflectedImgCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReflectedImgCrashTest.java
new file mode 100644
index 0000000..5093d19
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReflectedImgCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitReflectedImgCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitReflectedImgCrashTest";
+    private static final String TEST_PATH = "reflected-img-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitReflectedImgCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegexpCharclassCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegexpCharclassCrashTest.java
new file mode 100644
index 0000000..b92d8bd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegexpCharclassCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRegexpCharclassCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRegexpCharclassCrashTest";
+    private static final String TEST_PATH = "regexp-charclass-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRegexpCharclassCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegexpCompileCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegexpCompileCrashTest.java
new file mode 100644
index 0000000..f3c53d5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegexpCompileCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRegexpCompileCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRegexpCompileCrashTest";
+    private static final String TEST_PATH = "regexp-compile-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRegexpCompileCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegexpExtendedCharactersCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegexpExtendedCharactersCrashTest.java
new file mode 100644
index 0000000..3bdb2c1
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegexpExtendedCharactersCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRegexpExtendedCharactersCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRegexpExtendedCharactersCrashTest";
+    private static final String TEST_PATH = "regexp-extended-characters-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRegexpExtendedCharactersCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegionRangeForBoxCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegionRangeForBoxCrashTest.java
new file mode 100644
index 0000000..b06eb8c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRegionRangeForBoxCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRegionRangeForBoxCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRegionRangeForBoxCrashTest";
+    private static final String TEST_PATH = "region-range-for-box-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRegionRangeForBoxCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRelativePositionReplacedInTableDisplayCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRelativePositionReplacedInTableDisplayCrashTest.java
new file mode 100644
index 0000000..eb8da7e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRelativePositionReplacedInTableDisplayCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRelativePositionReplacedInTableDisplayCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRelativePositionReplacedInTableDisplayCrashTest";
+    private static final String TEST_PATH = "relative-position-replaced-in-table-display-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRelativePositionReplacedInTableDisplayCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRelativePositionedRtlCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRelativePositionedRtlCrashTest.java
new file mode 100644
index 0000000..2013e8c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRelativePositionedRtlCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRelativePositionedRtlCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRelativePositionedRtlCrashTest";
+    private static final String TEST_PATH = "relative-positioned-rtl-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRelativePositionedRtlCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRelayoutNestedPositionedElementsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRelayoutNestedPositionedElementsCrashTest.java
new file mode 100644
index 0000000..896ccba
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRelayoutNestedPositionedElementsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRelayoutNestedPositionedElementsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRelayoutNestedPositionedElementsCrashTest";
+    private static final String TEST_PATH = "relayout-nested-positioned-elements-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRelayoutNestedPositionedElementsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReloadCrashIframeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReloadCrashIframeTest.java
new file mode 100644
index 0000000..c96340a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReloadCrashIframeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitReloadCrashIframeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitReloadCrashIframeTest";
+    private static final String TEST_PATH = "reload-crash-iframe.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitReloadCrashIframeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReloadCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReloadCrashTest.java
new file mode 100644
index 0000000..eb45eb7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReloadCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitReloadCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitReloadCrashTest";
+    private static final String TEST_PATH = "reload-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitReloadCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovalBeforeAttachCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovalBeforeAttachCrashTest.java
new file mode 100644
index 0000000..fef83e2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovalBeforeAttachCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemovalBeforeAttachCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemovalBeforeAttachCrashTest";
+    private static final String TEST_PATH = "removal-before-attach-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemovalBeforeAttachCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovalOfMulticolSpanCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovalOfMulticolSpanCrashTest.java
new file mode 100644
index 0000000..8b08ab3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovalOfMulticolSpanCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemovalOfMulticolSpanCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemovalOfMulticolSpanCrashTest";
+    private static final String TEST_PATH = "removal-of-multicol-span-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemovalOfMulticolSpanCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveAllChildrenCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveAllChildrenCrashTest.java
new file mode 100644
index 0000000..ea1ed02
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveAllChildrenCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveAllChildrenCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveAllChildrenCrashTest";
+    private static final String TEST_PATH = "remove-all-children-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveAllChildrenCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveDivFromFlexibleBoxWithFloatingAfterContentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveDivFromFlexibleBoxWithFloatingAfterContentCrashTest.java
new file mode 100644
index 0000000..f7c7170
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveDivFromFlexibleBoxWithFloatingAfterContentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveDivFromFlexibleBoxWithFloatingAfterContentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveDivFromFlexibleBoxWithFloatingAfterContentCrashTest";
+    private static final String TEST_PATH = "remove-div-from-flexible-box-with-floating-after-content-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveDivFromFlexibleBoxWithFloatingAfterContentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveElementFromWithinFocusHandlerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveElementFromWithinFocusHandlerCrashTest.java
new file mode 100644
index 0000000..fc16e06
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveElementFromWithinFocusHandlerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveElementFromWithinFocusHandlerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveElementFromWithinFocusHandlerCrashTest";
+    private static final String TEST_PATH = "remove-element-from-within-focus-handler-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveElementFromWithinFocusHandlerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveFormatNonHtmlElementCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveFormatNonHtmlElementCrashTest.java
new file mode 100644
index 0000000..5eb4aa9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveFormatNonHtmlElementCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveFormatNonHtmlElementCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveFormatNonHtmlElementCrashTest";
+    private static final String TEST_PATH = "remove-format-non-html-element-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveFormatNonHtmlElementCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveFrameWithScrollbarsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveFrameWithScrollbarsCrashTest.java
new file mode 100644
index 0000000..30aff96
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveFrameWithScrollbarsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveFrameWithScrollbarsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveFrameWithScrollbarsCrashTest";
+    private static final String TEST_PATH = "remove-frame-with-scrollbars-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveFrameWithScrollbarsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveIframeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveIframeCrashTest.java
new file mode 100644
index 0000000..b4959c1
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveIframeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveIframeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveIframeCrashTest";
+    private static final String TEST_PATH = "remove-iframe-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveIframeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveListmarkerFromAnonblockWithContinuationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveListmarkerFromAnonblockWithContinuationCrashTest.java
new file mode 100644
index 0000000..72f6702
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveListmarkerFromAnonblockWithContinuationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveListmarkerFromAnonblockWithContinuationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveListmarkerFromAnonblockWithContinuationCrashTest";
+    private static final String TEST_PATH = "remove-listmarker-from-anonblock-with-continuation-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveListmarkerFromAnonblockWithContinuationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveNamedAttributeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveNamedAttributeCrashTest.java
new file mode 100644
index 0000000..63845b1
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveNamedAttributeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveNamedAttributeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveNamedAttributeCrashTest";
+    private static final String TEST_PATH = "remove-named-attribute-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveNamedAttributeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveReflectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveReflectionCrashTest.java
new file mode 100644
index 0000000..d8f6154
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveReflectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveReflectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveReflectionCrashTest";
+    private static final String TEST_PATH = "remove-reflection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveReflectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveRemoteContextInErrorCallbackCrashInnerTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveRemoteContextInErrorCallbackCrashInnerTest.java
new file mode 100644
index 0000000..e6ac3a4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveRemoteContextInErrorCallbackCrashInnerTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveRemoteContextInErrorCallbackCrashInnerTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveRemoteContextInErrorCallbackCrashInnerTest";
+    private static final String TEST_PATH = "remove-remote-context-in-error-callback-crash-inner.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveRemoteContextInErrorCallbackCrashInnerTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveRemoteContextInErrorCallbackCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveRemoteContextInErrorCallbackCrashTest.java
new file mode 100644
index 0000000..bae7796
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveRemoteContextInErrorCallbackCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveRemoteContextInErrorCallbackCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveRemoteContextInErrorCallbackCrashTest";
+    private static final String TEST_PATH = "remove-remote-context-in-error-callback-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveRemoteContextInErrorCallbackCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveShadowHostCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveShadowHostCrashTest.java
new file mode 100644
index 0000000..e4ff8e5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveShadowHostCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveShadowHostCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveShadowHostCrashTest";
+    private static final String TEST_PATH = "remove-shadow-host-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveShadowHostCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveTimeoutCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveTimeoutCrashTest.java
new file mode 100644
index 0000000..fa66778
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemoveTimeoutCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemoveTimeoutCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemoveTimeoutCrashTest";
+    private static final String TEST_PATH = "remove-timeout-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemoveTimeoutCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedAnonymousBlockChildCausesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedAnonymousBlockChildCausesCrashTest.java
new file mode 100644
index 0000000..ab2d381
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedAnonymousBlockChildCausesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemovedAnonymousBlockChildCausesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemovedAnonymousBlockChildCausesCrashTest";
+    private static final String TEST_PATH = "removed-anonymous-block-child-causes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemovedAnonymousBlockChildCausesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedContinuationElementCausesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedContinuationElementCausesCrashTest.java
new file mode 100644
index 0000000..71d8fd3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedContinuationElementCausesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemovedContinuationElementCausesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemovedContinuationElementCausesCrashTest";
+    private static final String TEST_PATH = "removed-continuation-element-causes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemovedContinuationElementCausesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedMediaRuleDeletedParentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedMediaRuleDeletedParentCrashTest.java
new file mode 100644
index 0000000..9f54c45
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedMediaRuleDeletedParentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemovedMediaRuleDeletedParentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemovedMediaRuleDeletedParentCrashTest";
+    private static final String TEST_PATH = "removed-media-rule-deleted-parent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemovedMediaRuleDeletedParentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedStylesheetRuleDeletedParentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedStylesheetRuleDeletedParentCrashTest.java
new file mode 100644
index 0000000..e89fd60
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovedStylesheetRuleDeletedParentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemovedStylesheetRuleDeletedParentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemovedStylesheetRuleDeletedParentCrashTest";
+    private static final String TEST_PATH = "removed-stylesheet-rule-deleted-parent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemovedStylesheetRuleDeletedParentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovingInsideRelpositionedInlineCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovingInsideRelpositionedInlineCrashTest.java
new file mode 100644
index 0000000..7594378
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovingInsideRelpositionedInlineCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemovingInsideRelpositionedInlineCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemovingInsideRelpositionedInlineCrashTest";
+    private static final String TEST_PATH = "removing-inside-relpositioned-inline-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemovingInsideRelpositionedInlineCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovingTextareaAfterEditCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovingTextareaAfterEditCrashTest.java
new file mode 100644
index 0000000..84e52fa
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRemovingTextareaAfterEditCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRemovingTextareaAfterEditCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRemovingTextareaAfterEditCrashTest";
+    private static final String TEST_PATH = "removing-textarea-after-edit-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRemovingTextareaAfterEditCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRenderTextCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRenderTextCrashTest.java
new file mode 100644
index 0000000..461f536
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRenderTextCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRenderTextCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRenderTextCrashTest";
+    private static final String TEST_PATH = "render-text-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRenderTextCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRenderTreeReorgCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRenderTreeReorgCrashTest.java
new file mode 100644
index 0000000..1fe9fe0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRenderTreeReorgCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRenderTreeReorgCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRenderTreeReorgCrashTest";
+    private static final String TEST_PATH = "render-tree-reorg-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRenderTreeReorgCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRendererDestructionByInvalidateselectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRendererDestructionByInvalidateselectionCrashTest.java
new file mode 100644
index 0000000..35115c2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRendererDestructionByInvalidateselectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRendererDestructionByInvalidateselectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRendererDestructionByInvalidateselectionCrashTest";
+    private static final String TEST_PATH = "renderer-destruction-by-invalidateSelection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRendererDestructionByInvalidateselectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRendererPositionedAssertCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRendererPositionedAssertCrashTest.java
new file mode 100644
index 0000000..3afcb67
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRendererPositionedAssertCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRendererPositionedAssertCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRendererPositionedAssertCrashTest";
+    private static final String TEST_PATH = "renderer-positioned-assert-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRendererPositionedAssertCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRepaintDisplayNoneCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRepaintDisplayNoneCrashTest.java
new file mode 100644
index 0000000..ed3d2bc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRepaintDisplayNoneCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRepaintDisplayNoneCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRepaintDisplayNoneCrashTest";
+    private static final String TEST_PATH = "repaint-display-none-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRepaintDisplayNoneCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReparentTableChildrenWithCountersCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReparentTableChildrenWithCountersCrashTest.java
new file mode 100644
index 0000000..1c6b2fc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReparentTableChildrenWithCountersCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitReparentTableChildrenWithCountersCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitReparentTableChildrenWithCountersCrashTest";
+    private static final String TEST_PATH = "reparent-table-children-with-counters-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitReparentTableChildrenWithCountersCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReplaceSelectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReplaceSelectionCrashTest.java
new file mode 100644
index 0000000..78f52d0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReplaceSelectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitReplaceSelectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitReplaceSelectionCrashTest";
+    private static final String TEST_PATH = "replace-selection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitReplaceSelectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReplaceTextInNodePreservingMarkersCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReplaceTextInNodePreservingMarkersCrashTest.java
new file mode 100644
index 0000000..26eb9b9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReplaceTextInNodePreservingMarkersCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitReplaceTextInNodePreservingMarkersCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitReplaceTextInNodePreservingMarkersCrashTest";
+    private static final String TEST_PATH = "replace-text-in-node-preserving-markers-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitReplaceTextInNodePreservingMarkersCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReplacementFragmentRemoveUnrenderedNodeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReplacementFragmentRemoveUnrenderedNodeCrashTest.java
new file mode 100644
index 0000000..12011b0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitReplacementFragmentRemoveUnrenderedNodeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitReplacementFragmentRemoveUnrenderedNodeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitReplacementFragmentRemoveUnrenderedNodeCrashTest";
+    private static final String TEST_PATH = "replacement-fragment-remove-unrendered-node-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitReplacementFragmentRemoveUnrenderedNodeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitResizeLayerDeletionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitResizeLayerDeletionCrashTest.java
new file mode 100644
index 0000000..47d30c7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitResizeLayerDeletionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitResizeLayerDeletionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitResizeLayerDeletionCrashTest";
+    private static final String TEST_PATH = "resize-layer-deletion-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitResizeLayerDeletionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRootInlineboxSelectedChildrenCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRootInlineboxSelectedChildrenCrashTest.java
new file mode 100644
index 0000000..c0f2a4b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRootInlineboxSelectedChildrenCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRootInlineboxSelectedChildrenCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRootInlineboxSelectedChildrenCrashTest";
+    private static final String TEST_PATH = "root-inlinebox-selected-children-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRootInlineboxSelectedChildrenCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRootObjectPrematureDeleteCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRootObjectPrematureDeleteCrashTest.java
new file mode 100644
index 0000000..882f16b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRootObjectPrematureDeleteCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRootObjectPrematureDeleteCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRootObjectPrematureDeleteCrashTest";
+    private static final String TEST_PATH = "root-object-premature-delete-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRootObjectPrematureDeleteCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRowInTbodyBeforeMisnestedTextCrashCssTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRowInTbodyBeforeMisnestedTextCrashCssTest.java
new file mode 100644
index 0000000..c051a18
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRowInTbodyBeforeMisnestedTextCrashCssTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRowInTbodyBeforeMisnestedTextCrashCssTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRowInTbodyBeforeMisnestedTextCrashCssTest";
+    private static final String TEST_PATH = "row-in-tbody-before-misnested-text-crash-css.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRowInTbodyBeforeMisnestedTextCrashCssTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRtlFirstLetterTextIteratorCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRtlFirstLetterTextIteratorCrashTest.java
new file mode 100644
index 0000000..711850a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRtlFirstLetterTextIteratorCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRtlFirstLetterTextIteratorCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRtlFirstLetterTextIteratorCrashTest";
+    private static final String TEST_PATH = "rtl-first-letter-text-iterator-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRtlFirstLetterTextIteratorCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRtlNthChildFirstLetterCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRtlNthChildFirstLetterCrashTest.java
new file mode 100644
index 0000000..788693f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRtlNthChildFirstLetterCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRtlNthChildFirstLetterCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRtlNthChildFirstLetterCrashTest";
+    private static final String TEST_PATH = "rtl-nth-child-first-letter-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRtlNthChildFirstLetterCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRtlSelectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRtlSelectionCrashTest.java
new file mode 100644
index 0000000..17ac4c7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRtlSelectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRtlSelectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRtlSelectionCrashTest";
+    private static final String TEST_PATH = "rtl-selection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRtlSelectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRubyBaseMergeBlockChildrenCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRubyBaseMergeBlockChildrenCrashTest.java
new file mode 100644
index 0000000..ca2c76e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRubyBaseMergeBlockChildrenCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRubyBaseMergeBlockChildrenCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRubyBaseMergeBlockChildrenCrashTest";
+    private static final String TEST_PATH = "ruby-base-merge-block-children-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRubyBaseMergeBlockChildrenCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRubyOverhangCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRubyOverhangCrashTest.java
new file mode 100644
index 0000000..c67e699
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRubyOverhangCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRubyOverhangCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRubyOverhangCrashTest";
+    private static final String TEST_PATH = "ruby-overhang-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRubyOverhangCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRunInCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRunInCrashTest.java
new file mode 100644
index 0000000..75355b2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRunInCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRunInCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRunInCrashTest";
+    private static final String TEST_PATH = "run-in-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRunInCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRuninContinuationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRuninContinuationCrashTest.java
new file mode 100644
index 0000000..cbcab26
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRuninContinuationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRuninContinuationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRuninContinuationCrashTest";
+    private static final String TEST_PATH = "runin-continuation-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRuninContinuationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRuninReparentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRuninReparentCrashTest.java
new file mode 100644
index 0000000..edf72b4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitRuninReparentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitRuninReparentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitRuninReparentCrashTest";
+    private static final String TEST_PATH = "runin-reparent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitRuninReparentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSandboxedPluginCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSandboxedPluginCrashTest.java
new file mode 100644
index 0000000..a128278
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSandboxedPluginCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSandboxedPluginCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSandboxedPluginCrashTest";
+    private static final String TEST_PATH = "sandboxed-plugin-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSandboxedPluginCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSavedStateAdoptnodeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSavedStateAdoptnodeCrashTest.java
new file mode 100644
index 0000000..3322b59
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSavedStateAdoptnodeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSavedStateAdoptnodeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSavedStateAdoptnodeCrashTest";
+    private static final String TEST_PATH = "saved-state-adoptNode-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSavedStateAdoptnodeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScriptElementWithoutFrameCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScriptElementWithoutFrameCrashTest.java
new file mode 100644
index 0000000..bd2dfa2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScriptElementWithoutFrameCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitScriptElementWithoutFrameCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitScriptElementWithoutFrameCrashTest";
+    private static final String TEST_PATH = "script-element-without-frame-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitScriptElementWithoutFrameCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollableIframeRemoveCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollableIframeRemoveCrashTest.java
new file mode 100644
index 0000000..1d690df
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollableIframeRemoveCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitScrollableIframeRemoveCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitScrollableIframeRemoveCrashTest";
+    private static final String TEST_PATH = "scrollable-iframe-remove-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitScrollableIframeRemoveCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollbarCrashOnRefreshTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollbarCrashOnRefreshTest.java
new file mode 100644
index 0000000..78b2d80
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollbarCrashOnRefreshTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitScrollbarCrashOnRefreshTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitScrollbarCrashOnRefreshTest";
+    private static final String TEST_PATH = "scrollbar-crash-on-refresh.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitScrollbarCrashOnRefreshTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollbarGradientCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollbarGradientCrashTest.java
new file mode 100644
index 0000000..d22fde0
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollbarGradientCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitScrollbarGradientCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitScrollbarGradientCrashTest";
+    private static final String TEST_PATH = "scrollbar-gradient-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitScrollbarGradientCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollbarPartCreatedWithNoParentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollbarPartCreatedWithNoParentCrashTest.java
new file mode 100644
index 0000000..ed1ba86
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitScrollbarPartCreatedWithNoParentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitScrollbarPartCreatedWithNoParentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitScrollbarPartCreatedWithNoParentCrashTest";
+    private static final String TEST_PATH = "scrollbar-part-created-with-no-parent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitScrollbarPartCreatedWithNoParentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSearchFieldCrashInDesignmodeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSearchFieldCrashInDesignmodeTest.java
new file mode 100644
index 0000000..478f014
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSearchFieldCrashInDesignmodeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSearchFieldCrashInDesignmodeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSearchFieldCrashInDesignmodeTest";
+    private static final String TEST_PATH = "search-field-crash-in-designmode.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSearchFieldCrashInDesignmodeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSearchPopupCrasherTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSearchPopupCrasherTest.java
new file mode 100644
index 0000000..8101351
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSearchPopupCrasherTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSearchPopupCrasherTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSearchPopupCrasherTest";
+    private static final String TEST_PATH = "search-popup-crasher.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSearchPopupCrasherTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSearchShadowHostCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSearchShadowHostCrashTest.java
new file mode 100644
index 0000000..84605c9
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSearchShadowHostCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSearchShadowHostCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSearchShadowHostCrashTest";
+    private static final String TEST_PATH = "search-shadow-host-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSearchShadowHostCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSectionInTableBeforeMisnestedTextCrashCssTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSectionInTableBeforeMisnestedTextCrashCssTest.java
new file mode 100644
index 0000000..929e960
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSectionInTableBeforeMisnestedTextCrashCssTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSectionInTableBeforeMisnestedTextCrashCssTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSectionInTableBeforeMisnestedTextCrashCssTest";
+    private static final String TEST_PATH = "section-in-table-before-misnested-text-crash-css.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSectionInTableBeforeMisnestedTextCrashCssTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectCrashZerozerooneTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectCrashZerozerooneTest.java
new file mode 100644
index 0000000..d858ffe
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectCrashZerozerooneTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSelectCrashZerozerooneTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSelectCrashZerozerooneTest";
+    private static final String TEST_PATH = "select-crash-001.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSelectCrashZerozerooneTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectCrashZerozerotwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectCrashZerozerotwoTest.java
new file mode 100644
index 0000000..e1840ca
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectCrashZerozerotwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSelectCrashZerozerotwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSelectCrashZerozerotwoTest";
+    private static final String TEST_PATH = "select-crash-002.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSelectCrashZerozerotwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectInRegionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectInRegionCrashTest.java
new file mode 100644
index 0000000..e830367
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectInRegionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSelectInRegionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSelectInRegionCrashTest";
+    private static final String TEST_PATH = "select-in-region-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSelectInRegionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectOnchangeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectOnchangeCrashTest.java
new file mode 100644
index 0000000..4e7adaa
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectOnchangeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSelectOnchangeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSelectOnchangeCrashTest";
+    private static final String TEST_PATH = "select-onchange-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSelectOnchangeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectOptionAccesskeyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectOptionAccesskeyCrashTest.java
new file mode 100644
index 0000000..e056570
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectOptionAccesskeyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSelectOptionAccesskeyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSelectOptionAccesskeyCrashTest";
+    private static final String TEST_PATH = "select-option-accesskey-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSelectOptionAccesskeyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectStartRemoveRootCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectStartRemoveRootCrashTest.java
new file mode 100644
index 0000000..4564798
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectStartRemoveRootCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSelectStartRemoveRootCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSelectStartRemoveRootCrashTest";
+    private static final String TEST_PATH = "select-start-remove-root-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSelectStartRemoveRootCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectedTabCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectedTabCrashTest.java
new file mode 100644
index 0000000..762ea6c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectedTabCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSelectedTabCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSelectedTabCrashTest";
+    private static final String TEST_PATH = "selected-tab-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSelectedTabCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectionGapClipOutTigerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectionGapClipOutTigerCrashTest.java
new file mode 100644
index 0000000..edf6bc4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectionGapClipOutTigerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSelectionGapClipOutTigerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSelectionGapClipOutTigerCrashTest";
+    private static final String TEST_PATH = "selection-gap-clip-out-tiger-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSelectionGapClipOutTigerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectionModifyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectionModifyCrashTest.java
new file mode 100644
index 0000000..78dde73
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectionModifyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSelectionModifyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSelectionModifyCrashTest";
+    private static final String TEST_PATH = "selection-modify-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSelectionModifyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectionPluginClearCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectionPluginClearCrashTest.java
new file mode 100644
index 0000000..9d716a4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSelectionPluginClearCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSelectionPluginClearCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSelectionPluginClearCrashTest";
+    private static final String TEST_PATH = "selection-plugin-clear-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSelectionPluginClearCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSetBoxStyleInRegionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSetBoxStyleInRegionCrashTest.java
new file mode 100644
index 0000000..e144b61
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSetBoxStyleInRegionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSetBoxStyleInRegionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSetBoxStyleInRegionCrashTest";
+    private static final String TEST_PATH = "set-box-style-in-region-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSetBoxStyleInRegionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSetTypeToNullCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSetTypeToNullCrashTest.java
new file mode 100644
index 0000000..5def9dc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSetTypeToNullCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSetTypeToNullCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSetTypeToNullCrashTest";
+    private static final String TEST_PATH = "set-type-to-null-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSetTypeToNullCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitShorthandMismatchedListCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitShorthandMismatchedListCrashTest.java
new file mode 100644
index 0000000..e337c6a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitShorthandMismatchedListCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitShorthandMismatchedListCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitShorthandMismatchedListCrashTest";
+    private static final String TEST_PATH = "shorthand-mismatched-list-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitShorthandMismatchedListCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSliderCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSliderCrashTest.java
new file mode 100644
index 0000000..4755e9d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSliderCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSliderCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSliderCrashTest";
+    private static final String TEST_PATH = "slider-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSliderCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSmallCapsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSmallCapsCrashTest.java
new file mode 100644
index 0000000..fa596d2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSmallCapsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSmallCapsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSmallCapsCrashTest";
+    private static final String TEST_PATH = "small-caps-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSmallCapsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSmilElementNotRemovedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSmilElementNotRemovedCrashTest.java
new file mode 100644
index 0000000..7b0cc7b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSmilElementNotRemovedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSmilElementNotRemovedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSmilElementNotRemovedCrashTest";
+    private static final String TEST_PATH = "smil-element-not-removed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSmilElementNotRemovedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSortNoJitCodeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSortNoJitCodeCrashTest.java
new file mode 100644
index 0000000..8c57f55
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSortNoJitCodeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSortNoJitCodeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSortNoJitCodeCrashTest";
+    private static final String TEST_PATH = "sort-no-jit-code-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSortNoJitCodeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSpellcheckApiCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSpellcheckApiCrashTest.java
new file mode 100644
index 0000000..bff6972
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSpellcheckApiCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSpellcheckApiCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSpellcheckApiCrashTest";
+    private static final String TEST_PATH = "spellcheck-api-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSpellcheckApiCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSpellcheckInputSearchCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSpellcheckInputSearchCrashTest.java
new file mode 100644
index 0000000..f665e64
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSpellcheckInputSearchCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSpellcheckInputSearchCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSpellcheckInputSearchCrashTest";
+    private static final String TEST_PATH = "spellcheck-input-search-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSpellcheckInputSearchCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSplitFlowAnonymousWrapperCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSplitFlowAnonymousWrapperCrashTest.java
new file mode 100644
index 0000000..3214654
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSplitFlowAnonymousWrapperCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSplitFlowAnonymousWrapperCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSplitFlowAnonymousWrapperCrashTest";
+    private static final String TEST_PATH = "split-flow-anonymous-wrapper-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSplitFlowAnonymousWrapperCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSplitInlineWrongPostBlockCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSplitInlineWrongPostBlockCrashTest.java
new file mode 100644
index 0000000..9a126fa
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSplitInlineWrongPostBlockCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSplitInlineWrongPostBlockCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSplitInlineWrongPostBlockCrashTest";
+    private static final String TEST_PATH = "split-inline-wrong-post-block-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSplitInlineWrongPostBlockCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStaleGridCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStaleGridCrashTest.java
new file mode 100644
index 0000000..125443b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStaleGridCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStaleGridCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStaleGridCrashTest";
+    private static final String TEST_PATH = "stale-grid-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStaleGridCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStaleStyleSelectorCrashOneTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStaleStyleSelectorCrashOneTest.java
new file mode 100644
index 0000000..1ec944c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStaleStyleSelectorCrashOneTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStaleStyleSelectorCrashOneTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStaleStyleSelectorCrashOneTest";
+    private static final String TEST_PATH = "stale-style-selector-crash-1.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStaleStyleSelectorCrashOneTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStaleStyleSelectorCrashTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStaleStyleSelectorCrashTwoTest.java
new file mode 100644
index 0000000..ff4998d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStaleStyleSelectorCrashTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStaleStyleSelectorCrashTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStaleStyleSelectorCrashTwoTest";
+    private static final String TEST_PATH = "stale-style-selector-crash-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStaleStyleSelectorCrashTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStateApiOnDetachedFrameCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStateApiOnDetachedFrameCrashTest.java
new file mode 100644
index 0000000..23c5ae2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStateApiOnDetachedFrameCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStateApiOnDetachedFrameCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStateApiOnDetachedFrameCrashTest";
+    private static final String TEST_PATH = "state-api-on-detached-frame-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStateApiOnDetachedFrameCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStatementListRegisterCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStatementListRegisterCrashTest.java
new file mode 100644
index 0000000..2adc247
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStatementListRegisterCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStatementListRegisterCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStatementListRegisterCrashTest";
+    private static final String TEST_PATH = "statement-list-register-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStatementListRegisterCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStopCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStopCrashTest.java
new file mode 100644
index 0000000..0cd2ff3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStopCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStopCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStopCrashTest";
+    private static final String TEST_PATH = "stop-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStopCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStringReplaceExceptionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStringReplaceExceptionCrashTest.java
new file mode 100644
index 0000000..664c266
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStringReplaceExceptionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStringReplaceExceptionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStringReplaceExceptionCrashTest";
+    private static final String TEST_PATH = "string-replace-exception-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStringReplaceExceptionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStyleAccessDuringImagechangedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStyleAccessDuringImagechangedCrashTest.java
new file mode 100644
index 0000000..578d0e6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStyleAccessDuringImagechangedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStyleAccessDuringImagechangedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStyleAccessDuringImagechangedCrashTest";
+    private static final String TEST_PATH = "style-access-during-imageChanged-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStyleAccessDuringImagechangedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStyledCloneInlineStyleDeclParentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStyledCloneInlineStyleDeclParentCrashTest.java
new file mode 100644
index 0000000..1e38880
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStyledCloneInlineStyleDeclParentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStyledCloneInlineStyleDeclParentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStyledCloneInlineStyleDeclParentCrashTest";
+    private static final String TEST_PATH = "styled-clone-inline-style-decl-parent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStyledCloneInlineStyleDeclParentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStyledNotInDocumentCloneInlineStyleDeclParentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStyledNotInDocumentCloneInlineStyleDeclParentCrashTest.java
new file mode 100644
index 0000000..9a86ebe
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStyledNotInDocumentCloneInlineStyleDeclParentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStyledNotInDocumentCloneInlineStyleDeclParentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStyledNotInDocumentCloneInlineStyleDeclParentCrashTest";
+    private static final String TEST_PATH = "styled-not-in-document-clone-inline-style-decl-parent-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStyledNotInDocumentCloneInlineStyleDeclParentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStylesheetCandidateNodeCrashMainTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStylesheetCandidateNodeCrashMainTest.java
new file mode 100644
index 0000000..d8d9f67
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitStylesheetCandidateNodeCrashMainTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitStylesheetCandidateNodeCrashMainTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitStylesheetCandidateNodeCrashMainTest";
+    private static final String TEST_PATH = "stylesheet-candidate-node-crash-main.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitStylesheetCandidateNodeCrashMainTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSubframeLoadCrashMainTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSubframeLoadCrashMainTest.java
new file mode 100644
index 0000000..e0179de
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSubframeLoadCrashMainTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSubframeLoadCrashMainTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSubframeLoadCrashMainTest";
+    private static final String TEST_PATH = "subframe-load-crash-main.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSubframeLoadCrashMainTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSubresourceLoadFailedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSubresourceLoadFailedCrashTest.java
new file mode 100644
index 0000000..4a22d43
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSubresourceLoadFailedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSubresourceLoadFailedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSubresourceLoadFailedCrashTest";
+    private static final String TEST_PATH = "subresource-load-failed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSubresourceLoadFailedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgBackgroundCrashOnRefreshTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgBackgroundCrashOnRefreshTest.java
new file mode 100644
index 0000000..5713120
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgBackgroundCrashOnRefreshTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSvgBackgroundCrashOnRefreshTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSvgBackgroundCrashOnRefreshTest";
+    private static final String TEST_PATH = "svg-background-crash-on-refresh.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSvgBackgroundCrashOnRefreshTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgEllipseRenderCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgEllipseRenderCrashTest.java
new file mode 100644
index 0000000..33255e4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgEllipseRenderCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSvgEllipseRenderCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSvgEllipseRenderCrashTest";
+    private static final String TEST_PATH = "svg-ellipse-render-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSvgEllipseRenderCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgRtlTextCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgRtlTextCrashTest.java
new file mode 100644
index 0000000..6d87f14
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgRtlTextCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSvgRtlTextCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSvgRtlTextCrashTest";
+    private static final String TEST_PATH = "svg-rtl-text-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSvgRtlTextCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvglengthAnimationRetargetCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvglengthAnimationRetargetCrashTest.java
new file mode 100644
index 0000000..67abfde
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvglengthAnimationRetargetCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSvglengthAnimationRetargetCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSvglengthAnimationRetargetCrashTest";
+    private static final String TEST_PATH = "svglength-animation-retarget-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSvglengthAnimationRetargetCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgpolygonelementBasevalListRemovalCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgpolygonelementBasevalListRemovalCrashTest.java
new file mode 100644
index 0000000..3ba9718
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgpolygonelementBasevalListRemovalCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSvgpolygonelementBasevalListRemovalCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSvgpolygonelementBasevalListRemovalCrashTest";
+    private static final String TEST_PATH = "SVGPolygonElement-baseVal-list-removal-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSvgpolygonelementBasevalListRemovalCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgstyledelementPendingresourceCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgstyledelementPendingresourceCrashTest.java
new file mode 100644
index 0000000..515e479
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSvgstyledelementPendingresourceCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSvgstyledelementPendingresourceCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSvgstyledelementPendingresourceCrashTest";
+    private static final String TEST_PATH = "SVGStyledElement-pendingResource-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSvgstyledelementPendingresourceCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSwitchMultipleListItemsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSwitchMultipleListItemsCrashTest.java
new file mode 100644
index 0000000..c896b26
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitSwitchMultipleListItemsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitSwitchMultipleListItemsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitSwitchMultipleListItemsCrashTest";
+    private static final String TEST_PATH = "switch-multiple-list-items-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitSwitchMultipleListItemsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTabCrashWithImageMapTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTabCrashWithImageMapTest.java
new file mode 100644
index 0000000..4791efb
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTabCrashWithImageMapTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTabCrashWithImageMapTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTabCrashWithImageMapTest";
+    private static final String TEST_PATH = "tab-crash-with-image-map.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTabCrashWithImageMapTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableAnonymousBlockDestroyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableAnonymousBlockDestroyCrashTest.java
new file mode 100644
index 0000000..27950d8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableAnonymousBlockDestroyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableAnonymousBlockDestroyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableAnonymousBlockDestroyCrashTest";
+    private static final String TEST_PATH = "table-anonymous-block-destroy-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableAnonymousBlockDestroyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableCaptionsChildVisibleCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableCaptionsChildVisibleCrashTest.java
new file mode 100644
index 0000000..7a11fa2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableCaptionsChildVisibleCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableCaptionsChildVisibleCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableCaptionsChildVisibleCrashTest";
+    private static final String TEST_PATH = "table-captions-child-visible-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableCaptionsChildVisibleCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableColumnsBlocksCalcCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableColumnsBlocksCalcCrashTest.java
new file mode 100644
index 0000000..846829b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableColumnsBlocksCalcCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableColumnsBlocksCalcCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableColumnsBlocksCalcCrashTest";
+    private static final String TEST_PATH = "table-columns-blocks-calc-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableColumnsBlocksCalcCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableContinuationOutlinePaintCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableContinuationOutlinePaintCrashTest.java
new file mode 100644
index 0000000..685e94b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableContinuationOutlinePaintCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableContinuationOutlinePaintCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableContinuationOutlinePaintCrashTest";
+    private static final String TEST_PATH = "table-continuation-outline-paint-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableContinuationOutlinePaintCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableModificationCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableModificationCrashTest.java
new file mode 100644
index 0000000..69f076b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableModificationCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableModificationCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableModificationCrashTest";
+    private static final String TEST_PATH = "table-modification-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableModificationCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableMultiColumnCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableMultiColumnCrashTest.java
new file mode 100644
index 0000000..1d9fa20
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableMultiColumnCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableMultiColumnCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableMultiColumnCrashTest";
+    private static final String TEST_PATH = "table-multi-column-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableMultiColumnCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableResidualStyleCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableResidualStyleCrashTest.java
new file mode 100644
index 0000000..8830f63
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableResidualStyleCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableResidualStyleCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableResidualStyleCrashTest";
+    private static final String TEST_PATH = "table-residual-style-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableResidualStyleCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableRowAfterNoCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableRowAfterNoCrashTest.java
new file mode 100644
index 0000000..597799f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableRowAfterNoCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableRowAfterNoCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableRowAfterNoCrashTest";
+    private static final String TEST_PATH = "table-row-after-no-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableRowAfterNoCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableRowCompositingRepaintCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableRowCompositingRepaintCrashTest.java
new file mode 100644
index 0000000..913226c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableRowCompositingRepaintCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableRowCompositingRepaintCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableRowCompositingRepaintCrashTest";
+    private static final String TEST_PATH = "table-row-compositing-repaint-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableRowCompositingRepaintCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableSectionNodeAtPointCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableSectionNodeAtPointCrashTest.java
new file mode 100644
index 0000000..cd1fcca
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableSectionNodeAtPointCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableSectionNodeAtPointCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableSectionNodeAtPointCrashTest";
+    private static final String TEST_PATH = "table-section-node-at-point-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableSectionNodeAtPointCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableWithEmptyTheadCausesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableWithEmptyTheadCausesCrashTest.java
new file mode 100644
index 0000000..d4c13b6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTableWithEmptyTheadCausesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTableWithEmptyTheadCausesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTableWithEmptyTheadCausesCrashTest";
+    private static final String TEST_PATH = "table-with-empty-thead-causes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTableWithEmptyTheadCausesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTeardownCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTeardownCrashTest.java
new file mode 100644
index 0000000..6efe700
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTeardownCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTeardownCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTeardownCrashTest";
+    private static final String TEST_PATH = "teardown-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTeardownCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTemporarySpanCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTemporarySpanCrashTest.java
new file mode 100644
index 0000000..c6ac8cd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTemporarySpanCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTemporarySpanCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTemporarySpanCrashTest";
+    private static final String TEST_PATH = "temporary-span-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTemporarySpanCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextBeforeTableColCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextBeforeTableColCrashTest.java
new file mode 100644
index 0000000..2883d7a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextBeforeTableColCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextBeforeTableColCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextBeforeTableColCrashTest";
+    private static final String TEST_PATH = "text-before-table-col-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextBeforeTableColCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextContentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextContentCrashTest.java
new file mode 100644
index 0000000..1845e7e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextContentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextContentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextContentCrashTest";
+    private static final String TEST_PATH = "text-content-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextContentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextContentCrashTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextContentCrashTwoTest.java
new file mode 100644
index 0000000..3d8223f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextContentCrashTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextContentCrashTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextContentCrashTwoTest";
+    private static final String TEST_PATH = "text-content-crash-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextContentCrashTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextControlCrashOnSelectTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextControlCrashOnSelectTest.java
new file mode 100644
index 0000000..4188c1e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextControlCrashOnSelectTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextControlCrashOnSelectTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextControlCrashOnSelectTest";
+    private static final String TEST_PATH = "text-control-crash-on-select.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextControlCrashOnSelectTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextControlSelectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextControlSelectionCrashTest.java
new file mode 100644
index 0000000..ef06a1c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextControlSelectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextControlSelectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextControlSelectionCrashTest";
+    private static final String TEST_PATH = "text-control-selection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextControlSelectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextFieldSetvalueCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextFieldSetvalueCrashTest.java
new file mode 100644
index 0000000..11edf76
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextFieldSetvalueCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextFieldSetvalueCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextFieldSetvalueCrashTest";
+    private static final String TEST_PATH = "text-field-setvalue-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextFieldSetvalueCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextNodeAppendDataRemoveCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextNodeAppendDataRemoveCrashTest.java
new file mode 100644
index 0000000..7293131
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextNodeAppendDataRemoveCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextNodeAppendDataRemoveCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextNodeAppendDataRemoveCrashTest";
+    private static final String TEST_PATH = "text-node-append-data-remove-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextNodeAppendDataRemoveCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextSetValueCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextSetValueCrashTest.java
new file mode 100644
index 0000000..2bff5d4
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextSetValueCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextSetValueCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextSetValueCrashTest";
+    private static final String TEST_PATH = "text-set-value-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextSetValueCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextStyleRecalcCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextStyleRecalcCrashTest.java
new file mode 100644
index 0000000..ae61428
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextStyleRecalcCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextStyleRecalcCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextStyleRecalcCrashTest";
+    private static final String TEST_PATH = "text-style-recalc-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextStyleRecalcCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextareaCheckvalidityCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextareaCheckvalidityCrashTest.java
new file mode 100644
index 0000000..1a6a87e
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextareaCheckvalidityCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextareaCheckvalidityCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextareaCheckvalidityCrashTest";
+    private static final String TEST_PATH = "textarea-checkValidity-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextareaCheckvalidityCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextareaNodeRemovedFromDocumentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextareaNodeRemovedFromDocumentCrashTest.java
new file mode 100644
index 0000000..a92c566
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextareaNodeRemovedFromDocumentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextareaNodeRemovedFromDocumentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextareaNodeRemovedFromDocumentCrashTest";
+    private static final String TEST_PATH = "textarea-node-removed-from-document-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextareaNodeRemovedFromDocumentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextareaSubmitCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextareaSubmitCrashTest.java
new file mode 100644
index 0000000..9687408
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextareaSubmitCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextareaSubmitCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextareaSubmitCrashTest";
+    private static final String TEST_PATH = "textarea-submit-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextareaSubmitCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextboxNotRemovedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextboxNotRemovedCrashTest.java
new file mode 100644
index 0000000..9039607
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextboxNotRemovedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextboxNotRemovedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextboxNotRemovedCrashTest";
+    private static final String TEST_PATH = "textbox-not-removed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextboxNotRemovedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextboxRoleOnContenteditableCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextboxRoleOnContenteditableCrashTest.java
new file mode 100644
index 0000000..4b84702
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTextboxRoleOnContenteditableCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTextboxRoleOnContenteditableCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTextboxRoleOnContenteditableCrashTest";
+    private static final String TEST_PATH = "textbox-role-on-contenteditable-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTextboxRoleOnContenteditableCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitThumbsliderCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitThumbsliderCrashTest.java
new file mode 100644
index 0000000..5331a23
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitThumbsliderCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitThumbsliderCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitThumbsliderCrashTest";
+    private static final String TEST_PATH = "thumbslider-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitThumbsliderCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitToggleReflectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitToggleReflectionCrashTest.java
new file mode 100644
index 0000000..b3d71ae
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitToggleReflectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitToggleReflectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitToggleReflectionCrashTest";
+    private static final String TEST_PATH = "toggle-reflection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitToggleReflectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTouchStaleNodeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTouchStaleNodeCrashTest.java
new file mode 100644
index 0000000..41925a6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTouchStaleNodeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTouchStaleNodeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTouchStaleNodeCrashTest";
+    private static final String TEST_PATH = "touch-stale-node-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTouchStaleNodeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTrackTextTrackDestructorCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTrackTextTrackDestructorCrashTest.java
new file mode 100644
index 0000000..6ea111c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTrackTextTrackDestructorCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTrackTextTrackDestructorCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTrackTextTrackDestructorCrashTest";
+    private static final String TEST_PATH = "track-text-track-destructor-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTrackTextTrackDestructorCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransactionCallbackExceptionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransactionCallbackExceptionCrashTest.java
new file mode 100644
index 0000000..927eb7f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransactionCallbackExceptionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTransactionCallbackExceptionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTransactionCallbackExceptionCrashTest";
+    private static final String TEST_PATH = "transaction-callback-exception-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTransactionCallbackExceptionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransactionCrashOnAbortTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransactionCrashOnAbortTest.java
new file mode 100644
index 0000000..8232bb8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransactionCrashOnAbortTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTransactionCrashOnAbortTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTransactionCrashOnAbortTest";
+    private static final String TEST_PATH = "transaction-crash-on-abort.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTransactionCrashOnAbortTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransformCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransformCrashTest.java
new file mode 100644
index 0000000..0ebd609
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransformCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTransformCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTransformCrashTest";
+    private static final String TEST_PATH = "webkit-transform-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTransformCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransitionCacheDictionaryCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransitionCacheDictionaryCrashTest.java
new file mode 100644
index 0000000..329bafc
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransitionCacheDictionaryCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTransitionCacheDictionaryCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTransitionCacheDictionaryCrashTest";
+    private static final String TEST_PATH = "transition-cache-dictionary-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTransitionCacheDictionaryCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransitionDurationClearedInTransitionendCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransitionDurationClearedInTransitionendCrashTest.java
new file mode 100644
index 0000000..5b7248f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTransitionDurationClearedInTransitionendCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTransitionDurationClearedInTransitionendCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTransitionDurationClearedInTransitionendCrashTest";
+    private static final String TEST_PATH = "transition-duration-cleared-in-transitionend-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTransitionDurationClearedInTransitionendCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTreeScopeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTreeScopeCrashTest.java
new file mode 100644
index 0000000..06a9d23
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTreeScopeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTreeScopeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTreeScopeCrashTest";
+    private static final String TEST_PATH = "tree-scope-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTreeScopeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTrefCloneCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTrefCloneCrashTest.java
new file mode 100644
index 0000000..c561644
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTrefCloneCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTrefCloneCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTrefCloneCrashTest";
+    private static final String TEST_PATH = "tref-clone-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTrefCloneCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTryCatchCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTryCatchCrashTest.java
new file mode 100644
index 0000000..9d2f4a3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTryCatchCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTryCatchCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTryCatchCrashTest";
+    private static final String TEST_PATH = "try-catch-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTryCatchCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTwodTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTwodTest.java
new file mode 100644
index 0000000..4f3a503
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTwodTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTwodTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTwodTest";
+    private static final String TEST_PATH = "2d.text-custom-font-load-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTwodTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTypeofCodegenCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTypeofCodegenCrashTest.java
new file mode 100644
index 0000000..bf5bb5c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitTypeofCodegenCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitTypeofCodegenCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitTypeofCodegenCrashTest";
+    private static final String TEST_PATH = "typeof-codegen-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitTypeofCodegenCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUndefinedPropertyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUndefinedPropertyCrashTest.java
new file mode 100644
index 0000000..2f82622
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUndefinedPropertyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUndefinedPropertyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUndefinedPropertyCrashTest";
+    private static final String TEST_PATH = "undefined-property-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUndefinedPropertyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUndoCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUndoCrashTest.java
new file mode 100644
index 0000000..0b2742d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUndoCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUndoCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUndoCrashTest";
+    private static final String TEST_PATH = "undo-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUndoCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUnexpectedConstantCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUnexpectedConstantCrashTest.java
new file mode 100644
index 0000000..e755b5c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUnexpectedConstantCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUnexpectedConstantCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUnexpectedConstantCrashTest";
+    private static final String TEST_PATH = "unexpected-constant-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUnexpectedConstantCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUniscribeItemBoundaryCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUniscribeItemBoundaryCrashTest.java
new file mode 100644
index 0000000..8be3808
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUniscribeItemBoundaryCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUniscribeItemBoundaryCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUniscribeItemBoundaryCrashTest";
+    private static final String TEST_PATH = "uniscribe-item-boundary-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUniscribeItemBoundaryCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUnsupportedAttributeDoesNotCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUnsupportedAttributeDoesNotCrashTest.java
new file mode 100644
index 0000000..65e7985
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUnsupportedAttributeDoesNotCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUnsupportedAttributeDoesNotCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUnsupportedAttributeDoesNotCrashTest";
+    private static final String TEST_PATH = "unsupported-attribute-does-not-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUnsupportedAttributeDoesNotCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateAlwaysCreateLineBoxesFullLayoutCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateAlwaysCreateLineBoxesFullLayoutCrashTest.java
new file mode 100644
index 0000000..32cad4b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateAlwaysCreateLineBoxesFullLayoutCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUpdateAlwaysCreateLineBoxesFullLayoutCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUpdateAlwaysCreateLineBoxesFullLayoutCrashTest";
+    private static final String TEST_PATH = "update-always-create-line-boxes-full-layout-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUpdateAlwaysCreateLineBoxesFullLayoutCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateFromElementDuringEditingCrashOneTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateFromElementDuringEditingCrashOneTest.java
new file mode 100644
index 0000000..e3cff1a
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateFromElementDuringEditingCrashOneTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUpdateFromElementDuringEditingCrashOneTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUpdateFromElementDuringEditingCrashOneTest";
+    private static final String TEST_PATH = "update-from-element-during-editing-crash-1.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUpdateFromElementDuringEditingCrashOneTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateFromElementDuringEditingCrashTwoTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateFromElementDuringEditingCrashTwoTest.java
new file mode 100644
index 0000000..6b0df8f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateFromElementDuringEditingCrashTwoTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUpdateFromElementDuringEditingCrashTwoTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUpdateFromElementDuringEditingCrashTwoTest";
+    private static final String TEST_PATH = "update-from-element-during-editing-crash-2.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUpdateFromElementDuringEditingCrashTwoTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateMidpointsForTrailingBoxesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateMidpointsForTrailingBoxesCrashTest.java
new file mode 100644
index 0000000..a695e07
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateMidpointsForTrailingBoxesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUpdateMidpointsForTrailingBoxesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUpdateMidpointsForTrailingBoxesCrashTest";
+    private static final String TEST_PATH = "update-midpoints-for-trailing-boxes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUpdateMidpointsForTrailingBoxesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateWidgetsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateWidgetsCrashTest.java
new file mode 100644
index 0000000..cdfe0e8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdateWidgetsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUpdateWidgetsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUpdateWidgetsCrashTest";
+    private static final String TEST_PATH = "update-widgets-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUpdateWidgetsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdatingAttributeInTableCausesCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdatingAttributeInTableCausesCrashTest.java
new file mode 100644
index 0000000..2dfde3f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdatingAttributeInTableCausesCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUpdatingAttributeInTableCausesCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUpdatingAttributeInTableCausesCrashTest";
+    private static final String TEST_PATH = "updating-attribute-in-table-causes-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUpdatingAttributeInTableCausesCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdatingAttributeInTableRowCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdatingAttributeInTableRowCrashTest.java
new file mode 100644
index 0000000..d456b55
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUpdatingAttributeInTableRowCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUpdatingAttributeInTableRowCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUpdatingAttributeInTableRowCrashTest";
+    private static final String TEST_PATH = "updating-attribute-in-table-row-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUpdatingAttributeInTableRowCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUseStyleRecalcScriptExecuteCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUseStyleRecalcScriptExecuteCrashTest.java
new file mode 100644
index 0000000..d24dcf3
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUseStyleRecalcScriptExecuteCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUseStyleRecalcScriptExecuteCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUseStyleRecalcScriptExecuteCrashTest";
+    private static final String TEST_PATH = "use-style-recalc-script-execute-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUseStyleRecalcScriptExecuteCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUserStylesheetCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUserStylesheetCrashTest.java
new file mode 100644
index 0000000..603ae9d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitUserStylesheetCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitUserStylesheetCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitUserStylesheetCrashTest";
+    private static final String TEST_PATH = "user-stylesheet-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitUserStylesheetCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitValueListOutOfBoundsCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitValueListOutOfBoundsCrashTest.java
new file mode 100644
index 0000000..6dceea7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitValueListOutOfBoundsCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitValueListOutOfBoundsCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitValueListOutOfBoundsCrashTest";
+    private static final String TEST_PATH = "value-list-out-of-bounds-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitValueListOutOfBoundsCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitValueWithoutSelectionCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitValueWithoutSelectionCrashTest.java
new file mode 100644
index 0000000..e1b7be8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitValueWithoutSelectionCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitValueWithoutSelectionCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitValueWithoutSelectionCrashTest";
+    private static final String TEST_PATH = "value-without-selection-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitValueWithoutSelectionCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVarShadowsArgCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVarShadowsArgCrashTest.java
new file mode 100644
index 0000000..dc2cedd
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVarShadowsArgCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitVarShadowsArgCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitVarShadowsArgCrashTest";
+    private static final String TEST_PATH = "var-shadows-arg-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitVarShadowsArgCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVarShadowsArgGcCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVarShadowsArgGcCrashTest.java
new file mode 100644
index 0000000..d2955a5
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVarShadowsArgGcCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitVarShadowsArgGcCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitVarShadowsArgGcCrashTest";
+    private static final String TEST_PATH = "var-shadows-arg-gc-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitVarShadowsArgGcCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVideoDisplayNoneCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVideoDisplayNoneCrashTest.java
new file mode 100644
index 0000000..78d1c3d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVideoDisplayNoneCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitVideoDisplayNoneCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitVideoDisplayNoneCrashTest";
+    private static final String TEST_PATH = "video-display-none-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitVideoDisplayNoneCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVideoElementOtherNamespaceCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVideoElementOtherNamespaceCrashTest.java
new file mode 100644
index 0000000..9fe2346
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVideoElementOtherNamespaceCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitVideoElementOtherNamespaceCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitVideoElementOtherNamespaceCrashTest";
+    private static final String TEST_PATH = "video-element-other-namespace-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitVideoElementOtherNamespaceCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVideoLayerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVideoLayerCrashTest.java
new file mode 100644
index 0000000..320cba2
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVideoLayerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitVideoLayerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitVideoLayerCrashTest";
+    private static final String TEST_PATH = "video-layer-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitVideoLayerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVisiblePositionCrashForTextNodeTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVisiblePositionCrashForTextNodeTest.java
new file mode 100644
index 0000000..9ef8967
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVisiblePositionCrashForTextNodeTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitVisiblePositionCrashForTextNodeTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitVisiblePositionCrashForTextNodeTest";
+    private static final String TEST_PATH = "visible-position-crash-for-text-node.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitVisiblePositionCrashForTextNodeTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVkernElementCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVkernElementCrashTest.java
new file mode 100644
index 0000000..34b6d41
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitVkernElementCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitVkernElementCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitVkernElementCrashTest";
+    private static final String TEST_PATH = "vkern-element-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitVkernElementCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWbrInMrootCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWbrInMrootCrashTest.java
new file mode 100644
index 0000000..080249b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWbrInMrootCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWbrInMrootCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWbrInMrootCrashTest";
+    private static final String TEST_PATH = "wbr-in-mroot-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWbrInMrootCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWbrInPreCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWbrInPreCrashTest.java
new file mode 100644
index 0000000..a3fd927
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWbrInPreCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWbrInPreCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWbrInPreCrashTest";
+    private static final String TEST_PATH = "wbr-in-pre-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWbrInPreCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowCloseCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowCloseCrashTest.java
new file mode 100644
index 0000000..3571677
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowCloseCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWindowCloseCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWindowCloseCrashTest";
+    private static final String TEST_PATH = "window-close-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWindowCloseCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowClosedCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowClosedCrashTest.java
new file mode 100644
index 0000000..d1365d8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowClosedCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWindowClosedCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWindowClosedCrashTest";
+    private static final String TEST_PATH = "window-closed-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWindowClosedCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowCollectionLengthNoCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowCollectionLengthNoCrashTest.java
new file mode 100644
index 0000000..cabf71d
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowCollectionLengthNoCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWindowCollectionLengthNoCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWindowCollectionLengthNoCrashTest";
+    private static final String TEST_PATH = "window-collection-length-no-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWindowCollectionLengthNoCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowCustomPrototypeCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowCustomPrototypeCrashTest.java
new file mode 100644
index 0000000..40d2721
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowCustomPrototypeCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWindowCustomPrototypeCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWindowCustomPrototypeCrashTest";
+    private static final String TEST_PATH = "window-custom-prototype-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWindowCustomPrototypeCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowDomurlCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowDomurlCrashTest.java
new file mode 100644
index 0000000..cf29d15
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowDomurlCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWindowDomurlCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWindowDomurlCrashTest";
+    private static final String TEST_PATH = "window-domurl-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWindowDomurlCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowEventOverrideNoCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowEventOverrideNoCrashTest.java
new file mode 100644
index 0000000..506d608
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWindowEventOverrideNoCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWindowEventOverrideNoCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWindowEventOverrideNoCrashTest";
+    private static final String TEST_PATH = "window-event-override-no-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWindowEventOverrideNoCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWordBreakNextLineboxNotDirtyCrashMainTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWordBreakNextLineboxNotDirtyCrashMainTest.java
new file mode 100644
index 0000000..d030d50
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWordBreakNextLineboxNotDirtyCrashMainTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWordBreakNextLineboxNotDirtyCrashMainTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWordBreakNextLineboxNotDirtyCrashMainTest";
+    private static final String TEST_PATH = "word-break-next-linebox-not-dirty-crash-main.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWordBreakNextLineboxNotDirtyCrashMainTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWordBreakNextLineboxNotDirtyCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWordBreakNextLineboxNotDirtyCrashTest.java
new file mode 100644
index 0000000..f977554
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWordBreakNextLineboxNotDirtyCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWordBreakNextLineboxNotDirtyCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWordBreakNextLineboxNotDirtyCrashTest";
+    private static final String TEST_PATH = "word-break-next-linebox-not-dirty-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWordBreakNextLineboxNotDirtyCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWorkerCrashWithInvalidLocationTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWorkerCrashWithInvalidLocationTest.java
new file mode 100644
index 0000000..9e84ae6
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWorkerCrashWithInvalidLocationTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWorkerCrashWithInvalidLocationTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWorkerCrashWithInvalidLocationTest";
+    private static final String TEST_PATH = "worker-crash-with-invalid-location.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWorkerCrashWithInvalidLocationTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWorkerFinishCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWorkerFinishCrashTest.java
new file mode 100644
index 0000000..b0dea7b
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitWorkerFinishCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitWorkerFinishCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitWorkerFinishCrashTest";
+    private static final String TEST_PATH = "worker-finish-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitWorkerFinishCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXFrameOptionsDetachedDocumentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXFrameOptionsDetachedDocumentCrashTest.java
new file mode 100644
index 0000000..587e50f
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXFrameOptionsDetachedDocumentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitXFrameOptionsDetachedDocumentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitXFrameOptionsDetachedDocumentCrashTest";
+    private static final String TEST_PATH = "x-frame-options-detached-document-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitXFrameOptionsDetachedDocumentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXmlhttprequestPostCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXmlhttprequestPostCrashTest.java
new file mode 100644
index 0000000..96cbfe7
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXmlhttprequestPostCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitXmlhttprequestPostCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitXmlhttprequestPostCrashTest";
+    private static final String TEST_PATH = "xmlhttprequest-post-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitXmlhttprequestPostCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXpathDetachedIframeResolverCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXpathDetachedIframeResolverCrashTest.java
new file mode 100644
index 0000000..6efd234
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXpathDetachedIframeResolverCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitXpathDetachedIframeResolverCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitXpathDetachedIframeResolverCrashTest";
+    private static final String TEST_PATH = "xpath-detached-iframe-resolver-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitXpathDetachedIframeResolverCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXpathResultEventlistenerCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXpathResultEventlistenerCrashTest.java
new file mode 100644
index 0000000..62b387c
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXpathResultEventlistenerCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitXpathResultEventlistenerCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitXpathResultEventlistenerCrashTest";
+    private static final String TEST_PATH = "xpath-result-eventlistener-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitXpathResultEventlistenerCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXsltTransformToFragmentCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXsltTransformToFragmentCrashTest.java
new file mode 100644
index 0000000..a3bb8ec
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXsltTransformToFragmentCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitXsltTransformToFragmentCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitXsltTransformToFragmentCrashTest";
+    private static final String TEST_PATH = "xslt-transform-to-fragment-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitXsltTransformToFragmentCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXssAuditorDoesntCrashOnPostSubmitTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXssAuditorDoesntCrashOnPostSubmitTest.java
new file mode 100644
index 0000000..8400537
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitXssAuditorDoesntCrashOnPostSubmitTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitXssAuditorDoesntCrashOnPostSubmitTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitXssAuditorDoesntCrashOnPostSubmitTest";
+    private static final String TEST_PATH = "xss-auditor-doesnt-crash-on-post-submit.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitXssAuditorDoesntCrashOnPostSubmitTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}
diff --git a/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitZeroColspanCrashTest.java b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitZeroColspanCrashTest.java
new file mode 100644
index 0000000..02c86a8
--- /dev/null
+++ b/tests/tests/webkitsecurity/src/android/webkitsecurity/cts/WebkitZeroColspanCrashTest.java
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2012 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.webkitsecurity.cts;
+
+import java.util.Date;
+
+import android.net.Uri;
+import android.util.Log;
+
+import junit.framework.Assert;
+
+import java.io.File;
+import java.io.FileInputStream;
+
+import android.webkit.WebView;
+import android.webkit.WebSettings;
+import android.webkit.MimeTypeMap;
+
+import android.cts.util.PollingCheck;
+
+import android.content.Context;
+import android.content.res.AssetManager;
+
+import android.test.UiThreadTest;
+import android.test.ActivityInstrumentationTestCase2;
+
+import android.webkitsecurity.cts.WebViewStubActivity;
+
+/*
+ * This file acts as a template for the generation of other webkit tests.
+ * 
+ * The contents of the assets/webkitsecuritytests directory will be scanned
+ * for html files, and for each one found a new class will be generated based
+ * on this template.
+ *
+ * The specific things that have to be done to this template are:
+ *
+ *     1. Change the name to Webkit + javify(testname) + Test
+ *     2. Change the private TEST_PATH value to the test's name
+ *     3. Change the logtag to shellify(testname)
+ *     4. Change the constructor name to <classname>
+ *     5. Save this as <classname>.java
+ *     6. TODO: Remove this comment
+ *
+ */
+
+public class WebkitZeroColspanCrashTest extends ActivityInstrumentationTestCase2<WebViewStubActivity> {
+    private static final String LOGTAG = "WebkitZeroColspanCrashTest";
+    private static final String TEST_PATH = "zero-colspan-crash.html";
+    private static final int INITIAL_PROGRESS = 100;
+    private static long TEST_TIMEOUT = 20000L;
+    private static long TIME_FOR_LAYOUT = 1000L;
+
+    private WebView mWebView;
+    private boolean mIsUiThreadDone;
+
+    public WebkitZeroColspanCrashTest() {
+        super("android.webkitsecurity.cts", WebViewStubActivity.class);
+    }
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+        mWebView = getActivity().getWebView();
+    }
+
+    @Override
+    protected void tearDown() throws Exception {
+        super.tearDown();
+    }
+
+    @UiThreadTest
+    public void testWebkitCrashes() throws Exception {
+
+        // set up the webview
+        mWebView = new WebView(getActivity());
+        getActivity().setContentView(mWebView);
+
+        // We need to be able to run JS for most of these tests
+        WebSettings settings = mWebView.getSettings();
+        settings.setJavaScriptEnabled(true);
+        settings.setJavaScriptCanOpenWindowsAutomatically(true);
+
+        // Get the url for the test
+        Log.d(LOGTAG, TEST_PATH);
+        String url = "file:///android_asset/" + TEST_PATH;
+
+        Log.d(LOGTAG, url.toString());
+
+        // Run the test
+        assertLoadUrlSuccessfully(url);
+    }
+
+    private void assertLoadUrlSuccessfully(String url) {
+        mWebView.loadUrl(url);
+        waitForLoadComplete();
+    }
+
+    private void waitForLoadComplete() {
+        new PollingCheck(TEST_TIMEOUT) {
+            @Override
+            protected boolean check() {
+                return mWebView.getProgress() == 100;
+            }
+        }.run();
+        try {
+            Thread.sleep(TIME_FOR_LAYOUT);
+        } catch (InterruptedException e) {
+            Log.w(LOGTAG, "waitForLoadComplete() interrupted while sleeping for layout delay.");
+        }
+    }
+}