diff --git a/mozilla/layout/base/crashtests/321058-1.xul b/mozilla/layout/base/crashtests/321058-1.xul
new file mode 100644
index 00000000000..1df88d19a2c
--- /dev/null
+++ b/mozilla/layout/base/crashtests/321058-1.xul
@@ -0,0 +1,4 @@
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <popupgroup>
+  </popupgroup>
+</window>
diff --git a/mozilla/layout/base/crashtests/321058-2.xul b/mozilla/layout/base/crashtests/321058-2.xul
new file mode 100644
index 00000000000..a3bbb411093
--- /dev/null
+++ b/mozilla/layout/base/crashtests/321058-2.xul
@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+
+<?xml-stylesheet href="chrome://global/skin/" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" class="reftest-wait" onload="setTimeout(boom, 30);">
+        
+<script><![CDATA[
+        
+function boom()
+{
+  var XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+
+  var popupgroup = document.createElementNS(XUL_NS, 'popupgroup');
+  document.documentElement.appendChild(popupgroup);
+  document.documentElement.removeChild(popupgroup);
+
+  var tooltip = document.createElementNS(XUL_NS, 'tooltip');
+  document.documentElement.appendChild(tooltip);
+  
+  document.documentElement.removeAttribute("class");
+}
+
+]]></script>
+
+</window>
diff --git a/mozilla/layout/base/crashtests/400185-1.xul b/mozilla/layout/base/crashtests/400185-1.xul
new file mode 100644
index 00000000000..1ca9442402a
--- /dev/null
+++ b/mozilla/layout/base/crashtests/400185-1.xul
@@ -0,0 +1,21 @@
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" onload="setTimeout(doe, 30);" class="reftest-wait">
+<popupgroup id="a"/>
+<listcols>
+<nativescrollbar id="c">
+<treecols/>
+</nativescrollbar>
+</listcols>
+
+<script>
+function doe() {
+  document.documentElement.id = "true";
+  document.documentElement.removeChild(document.getElementById('a')); 
+  var ne = document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'popupgroup'); 
+  document.documentElement.appendChild(ne); 
+  document.getElementById('c').appendChild(document.createElementNS("http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul", 'treecols'));
+  document.documentElement.removeChild(ne);
+  document.documentElement.removeAttribute("class");
+}
+</script>
+</window>
diff --git a/mozilla/layout/base/crashtests/crashtests.list b/mozilla/layout/base/crashtests/crashtests.list
index 964f47de56b..c8259f53b38 100644
--- a/mozilla/layout/base/crashtests/crashtests.list
+++ b/mozilla/layout/base/crashtests/crashtests.list
@@ -8,6 +8,8 @@ load 310267-1.xml
 load 310638-1.svg
 load 310638-2.html
 load 313086-1.xml
+load 321058-1.xul
+load 321058-2.xul
 load 322436-1.html
 load 325967-1.html
 load 325984-1.xhtml
@@ -79,6 +81,7 @@ load 399676-1.xhtml
 load 399687-1.html
 load 399940-1.xhtml
 load 399946-1.xhtml
+load 400185-1.xul
 load 400445-1.xhtml
 load 400904-1.xhtml
 load 401589-1.xul