diff --git a/mozilla/layout/reftests/bugs/363370-1-ref.html b/mozilla/layout/reftests/bugs/363370-1-ref.html
new file mode 100644
index 00000000000..f1497a92002
--- /dev/null
+++ b/mozilla/layout/reftests/bugs/363370-1-ref.html
@@ -0,0 +1,11 @@
+<html><head>
+<title>Testcase bug 363370 - [reflow branch] Crash [@ nsTArray_base::ShiftData] with testcase that appends table cells</title>
+</head>
+<body>
+
+<table border>
+<thead id="b"><tr><td rowspan="3">td</td></tr><tr><td>td</td></tr></thead>
+<tbody colspan="1" id="f"><tr></tr><tr><td>td</td></tr></tbody></table>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/mozilla/layout/reftests/bugs/363370-1.html b/mozilla/layout/reftests/bugs/363370-1.html
new file mode 100644
index 00000000000..b7fad24db13
--- /dev/null
+++ b/mozilla/layout/reftests/bugs/363370-1.html
@@ -0,0 +1,32 @@
+<html><head>
+<title>Testcase bug 363370 - [reflow branch] Crash [@ nsTArray_base::ShiftData] with testcase that appends table cells</title>
+</head>
+<body>
+
+<table border>
+<thead id="b"><tr><td rowspan="3">td</td></tr></thead>
+<tbody colspan="1" id="f"><tr></tr></tbody></table>
+
+<script>
+function doe()  {
+
+
+var x=document.createElement('td');
+var text = document.createTextNode("td");
+x.appendChild(text);
+
+document.getElementById('b').appendChild(x);
+
+
+var y=document.createElement('td');
+var t2 = document.createTextNode("td");
+ y.appendChild(t2);
+
+
+document.getElementById('f').appendChild(y);
+
+}
+setTimeout(doe, 200);
+</script>
+</body>
+</html>
\ No newline at end of file
diff --git a/mozilla/layout/reftests/bugs/364318-1-ref.xhtml b/mozilla/layout/reftests/bugs/364318-1-ref.xhtml
new file mode 100644
index 00000000000..03fe53c0f1e
--- /dev/null
+++ b/mozilla/layout/reftests/bugs/364318-1-ref.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <title>rowspan transition</title>
+</head>
+<body>
+<table><thead ><tr><td>td</td><td id="target" rowspan="2">x</td></tr><tr ><td rowspan="2">x</td></tr></thead></table>
+</body>
+
+</html>
diff --git a/mozilla/layout/reftests/bugs/364318-1.xhtml b/mozilla/layout/reftests/bugs/364318-1.xhtml
new file mode 100644
index 00000000000..1bd8293a0ca
--- /dev/null
+++ b/mozilla/layout/reftests/bugs/364318-1.xhtml
@@ -0,0 +1,9 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <title>rowspan transition</title>
+</head>
+<body onload="document.getElementById('target').setAttribute('rowspan',2);">
+<table><thead ><tr><td>td</td><td id="target" rowspan="0">x</td></tr><tr ><td rowspan="2">x</td></tr></thead></table>
+</body>
+
+</html>
diff --git a/mozilla/layout/reftests/bugs/368651-1-ref.html b/mozilla/layout/reftests/bugs/368651-1-ref.html
new file mode 100644
index 00000000000..d34cbea6096
--- /dev/null
+++ b/mozilla/layout/reftests/bugs/368651-1-ref.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+
+</head>
+
+<body>
+
+<table border>
+  <tbody id="tbody">
+    <tr>
+      <td rowspan="0">a</td>
+    </tr>
+    <tr>
+    </tr>
+    <tr>
+      <td>b</td>
+    </tr>
+  </tbody>
+</table>
+
+
+</body>
+</html>
diff --git a/mozilla/layout/reftests/bugs/368651-1.html b/mozilla/layout/reftests/bugs/368651-1.html
new file mode 100644
index 00000000000..40ee8bbfe72
--- /dev/null
+++ b/mozilla/layout/reftests/bugs/368651-1.html
@@ -0,0 +1,35 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+
+<head>
+<script>
+function boom()
+{
+  var td = document.createElementNS("http://www.w3.org/1999/xhtml", "td");
+  td.appendChild(document.createTextNode("b"));
+  document.getElementById("tbody").appendChild(td);
+}
+</script>
+</head>
+
+<body>
+
+<table border>
+  <tbody id="tbody">
+    <tr>
+      <td rowspan="0">a</td>
+    </tr>
+    <tr>
+    </tr>
+  </tbody>
+</table>
+
+<script>
+  // Flush layout
+  document.body.offsetWidth;
+
+  boom();
+</script>
+
+</body>
+</html>
diff --git a/mozilla/layout/reftests/bugs/369975-1.html b/mozilla/layout/reftests/bugs/369975-1.html
new file mode 100644
index 00000000000..f4f0b41e1f2
--- /dev/null
+++ b/mozilla/layout/reftests/bugs/369975-1.html
@@ -0,0 +1,21 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <title>Assert: Must have usable originating data here + crash</title>
+</head>
+
+<body>
+
+<table border>
+ <tbody>
+  <tr ><td rowspan="2">1</td></tr>
+  <tr><td rowspan="2">2</td></tr>
+  <tr ><td rowspan="3" colspan="2">3</td></tr>
+  <tr></tr>
+</tbody>
+<tbody>
+  <tr><td rowspan="3">4</td></tr>
+  <tr><td>5</td></tr>
+</tbody>
+</table>
+</body>
+</html>
diff --git a/mozilla/layout/reftests/bugs/reftest.list b/mozilla/layout/reftests/bugs/reftest.list
index 347a383cdc4..bf09b3c2399 100644
--- a/mozilla/layout/reftests/bugs/reftest.list
+++ b/mozilla/layout/reftests/bugs/reftest.list
@@ -171,11 +171,13 @@ fails-if(MOZ_WIDGET_TOOLKIT=="cocoa") == 359903-1.html 359903-1-ref.html # bug 3
 == 362594-2c.html 362594-2-standards-ref.html
 == 362901-1.html 362901-1-ref.html
 == 363329-1.html 363329-1-ref.html
-== 363329-2.html 363329-2-ref.html
+== 363329-2.html 363329-2-ref.html
+== 363370-1.html 363370-1-ref.html
 == 363637-1.html 363637-1-ref.html
 == 363874.html 363874-ref.html
 == 363874-max-width.html 363874-max-width-ref.html
-== 364066-1.html 364066-1-ref.html
+== 364066-1.html 364066-1-ref.html
+== 364318-1.xhtml 364318-1-ref.xhtml
 == 364079-1.html 364079-1-ref.html
 == 364861-1.html 364861-1-ref.html
 == 364862-1.html 364862-1-ref.html
@@ -216,8 +218,10 @@ fails == 368020-4.html 368020-4-ref.html # bug 368085
 # == 368247-1.html 368247-1-ref.html
 == 368247-2.html 368247-2-ref.html
 fails == 368504-1.html 368504-1-ref.html # bug 368504
-== 368622-1.html 368622-1-ref.html
-== 368622-1.html 368622-1-ref.html
+== 368622-1.html 368622-1-ref.html
+== 368622-1.html 368622-1-ref.html
+== 368651-1.html 368651-1-ref.html
+== 369975-1.html 369975-1.html
 == 369882.xul 369882-ref.xul
 == 370422-1.html 370422-1-ref.html
 == 370586-1.xhtml 370586-1-ref.xhtml
